Security of Critical Infrastructure Act 2018

This section applies if the Minister is satisfied that:

an incident:

has occurred; or

is occurring; or

is imminent; and

the incident has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets (each of which is a primary asset); and

there is a material risk that the incident has seriously prejudiced, is seriously prejudicing, or is likely to seriously prejudice:

the social or economic stability of Australia or its people; or

the defence of Australia; or

national security; and

no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident.

This section also applies if the Minister is satisfied that:

an incident:

has occurred; or

is occurring; or

is imminent; and

the incident has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets (each of which is a primary asset); and

the incident relates to an emergency specified in a national emergency declaration (within the meaning of the National Emergency Declaration Act 2020) that is in force; and

no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident.

The Minister may, on application by the Secretary, do any or all of the following things:

authorise the Secretary to give directions under section 35AK, relating to the incident and one or more primary assets, to one or more relevant entities;

authorise the Secretary to give directions under section 35AK, relating to the incident and one or more specified critical infrastructure sector assets, to one or more relevant entities;

authorise the Secretary to give to one or more specified entities a specified direction under section 35AQ that relates to the incident and one or more specified primary assets;

authorise the Secretary to give to one or more specified entities a specified direction under section 35AQ that relates to the incident and one or more specified critical infrastructure sector assets;

authorise the Secretary to give one or more specified requests under section 35AX that relate to the incident and one or more specified primary assets;

authorise the Secretary to give one or more specified requests under section 35AX that relate to the incident and one or more specified critical infrastructure sector assets.

Section 35AK deals with information gathering directions.

Section 35AQ deals with action directions.

Section 35AX deals with intervention requests. The Minister must not give an authorisation under paragraph (2)(e) or (f) unless the Minister is satisfied that the incident is a cyber security incident: see subsection (10).

An authorisation under subsection (2) is to be known as a Ministerial authorisation.

Subsection 33(3AB) of the Acts Interpretation Act 1901 does not apply to subsection (2) of this section.

Subsection 33(3AB) of the Acts Interpretation Act 1901 deals with specification by class.

A Ministerial authorisation under paragraph (2)(a) or (b):

is generally applicable to the incident and the asset or assets concerned; and

is to be made without reference to any specific directions.

The Minister must not give a Ministerial authorisation under paragraph (2)(a) or (b) unless the Minister is satisfied that the directions that could be authorised by the Ministerial authorisation are likely to facilitate a practical and effective response to the incident.

The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) in relation to a specified entity unless the Minister is satisfied that:

the specified entity is unwilling or unable to take all reasonable steps to respond to the incident; and

the specified direction is reasonably necessary for the purposes of responding to the incident; and

the specified direction is a proportionate response to the incident; and

compliance with the specified direction is technically feasible.

Section 12P provides examples of responding to an incident (including a cyber security incident).

In determining whether the specified direction is a proportionate response to the incident, the Minister must have regard to:

the impact of the specified direction on:

the activities carried on by the specified entity; and

the functioning of the asset or assets concerned; and

the consequences of compliance with the specified direction; and

such other matters (if any) as the Minister considers relevant.

The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) in relation to a specified entity if the specified direction:

requires the specified entity to permit the authorised agency to do an act or thing that could be the subject of a request under section 35AX; or

requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident.

Without limiting paragraph (2)(c) or (d), a direction referred to in that paragraph may require a specified entity to disclose specified personal information (within the meaning of the Privacy Act 1988) held by the entity to another specified entity for a specified purpose.

However, the Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d), to the extent that it authorises the giving of a direction covered by subsection (9A), unless the Minister has obtained the agreement of the Minister administering the Privacy Act 1988.

The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) that relates to the incident and an asset unless the Minister is satisfied that:

the incident is a cyber security incident; and

giving a Ministerial authorisation under paragraph (2)(c) or (d) would not amount to a practical and effective response to the incident; and

if there is only one relevant entity for the asset—the relevant entity is unwilling or unable to take all reasonable steps to respond to the incident; and

if there are 2 or more relevant entities for the asset—those entities, when considered together, are unwilling or unable to take all reasonable steps to respond to the incident; and

the specified request is reasonably necessary for the purposes of responding to the incident; and

the specified request is a proportionate response to the incident; and

compliance with the specified request is technically feasible; and

each of the acts or things specified in the specified request is an act or thing of a kind covered by section 35AC.

Section 12P provides examples of responding to a cyber security incident.

In determining whether the specified request is a proportionate response to the incident, the Minister must have regard to:

the impact of compliance with the specified request on the functioning of the asset; and

the consequences of acts or things that would be done in compliance with the specified request; and

such other matters (if any) as the Minister considers relevant.

The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) if compliance with the specified request would involve the authorised agency taking offensive cyber action against a person who is directly or indirectly responsible for the incident.

The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) unless the Minister has obtained the agreement of:

the Prime Minister; and

the Defence Minister.

An agreement under subsection (13) may be given:

orally; or

in writing.

If an agreement under subsection (13) is given orally, the Prime Minister or the Defence Minister, as the case requires, must:

do both of the following:

make a written record of the agreement;

give a copy of the written record of the agreement to the Minister; and

do so within 48 hours after the agreement is given.

A Ministerial authorisation is not a legislative instrument.

This section does not, by implication, limit a power conferred by another provision of this Act.