Security Legislation Amendment (Critical Infrastructure) Act 2021 (Cth)

Security Legislation Amendment (Critical Infrastructure) Act 2021

No. 124, 2021

An Act to amend legislation relating to critical infrastructure, and for other purposes

Contents

Security Legislation Amendment (Critical Infrastructure) Act 2021

No. 124, 2021

An Act to amend legislation relating to critical infrastructure, and for other purposes

[Assented to 2 December 2021]

The Parliament of Australia enacts:

1Short title

This Act is the Security Legislation Amendment (Critical Infrastructure) Act 2021.

2Commencement

(1)
Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table	The day this Act receives the Royal Assent.	2 December 2021
2. Schedule 1, Parts 1 and 2	The day after this Act receives the Royal Assent.	3 December 2021
3. Schedule 1, Part 3	The later of: (a) immediately after the commencement of the provisions covered by table item 2; and (b) the commencement of the Federal Circuit and Family Court of Australia Act 2021. However, the provisions do not commence at all if the event mentioned in paragraph (b) does not occur.	3 December 2021 (paragraph (a) applies)
4. Schedule 1, Part 4	The later of: (a) immediately after the commencement of the provisions covered by table item 2; and (b) the commencement of the National Emergency Declaration Act 2020. However, the provisions do not commence at all if the event mentioned in paragraph (b) does not occur.	3 December 2021 (paragraph (a) applies)
5. Schedule 2	The day after this Act receives the Royal Assent.	3 December 2021

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.
(2)
Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Schedule 1—Security of critical infrastructure

Part 1General amendments

Administrative Decisions (Judicial Review) Act 1977

Before paragraph (da) of Schedule 1

Insert:
(dae)
decisions under Part 3A of the Security of Critical Infrastructure Act 2018;

Security of Critical Infrastructure Act 2018

Section 3

Omit “to national security”.

At the end of section 3

Add:
; and (e)
providing a regime for the Commonwealth to respond to serious cyber security incidents.

Section 4

Repeal the section, substitute:

4Simplified outline of this Act

This Act creates a framework for managing risks relating to critical infrastructure.
The framework consists of the following:
(a)
the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public);
(c)
requiring notification of cyber security incidents;
(e)
requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset;
(f)
allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security;
(g)
allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents;
(h)
setting up a regime for the Commonwealth to respond to serious cyber security incidents;
(i)
allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.
Certain information obtained or generated under, or relating to the operation of, this Act is protected information. There are restrictions on when a person may make a record of, use or disclose protected information.
Civil penalty provisions of this Act may be enforced using civil penalty orders, injunctions or infringement notices, and enforceable undertakings may be accepted in relation to compliance with civil penalty provisions. The Regulatory Powers Act is applied for these purposes. Certain provisions of this Act are subject to monitoring and investigation under the Regulatory Powers Act. Certain provisions of this Act may be enforced by imposing a criminal penalty.
The Minister may privately declare an asset to be a critical infrastructure asset.
The Secretary must give the Minister reports, for presentation to the Parliament, on the operation of this Act.

Section 5

Insert:
access, in relation to a computer program, means the execution of the computer program.
access to computer data means:
(a)
in a case where the computer data is held in a computer—the display of the data by the computer or any other output of the data from the computer; or
(b)
in a case where the computer data is held in a computer—the copying or moving of the data to:
(i)
any other location in the computer; or
(ii)
another computer; or
(iii)
a data storage device; or
(c)
in a case where the computer data is held in a data storage device—the copying or moving of the data to:
(i)
a computer; or
(ii)
another data storage device.
aircraft operator has the same meaning as in the Aviation Transport Security Act 2004.
airport has the same meaning as in the Aviation Transport Security Act 2004.
airport operator has the same meaning as in the Aviation Transport Security Act 2004.
air service has the same meaning as in the Aviation Transport Security Act 2004.
approved staff member of the authorised agency has the meaning given by section 35BJ.
ASD means the Australian Signals Directorate.
asset includes:
(a)
a system; and
(b)
a network; and
(c)
a facility; and
(d)
a computer; and
(e)
a computer device; and
(f)
a computer program; and
(g)
computer data; and
(h)
premises; and
(i)
any other thing.
associated entity has the same meaning as in the Corporations Act 2001.
associated transmission facility means:
(a)
an antenna; or
(b)
a combiner; or
(c)
a feeder system; or
(d)
an apparatus; or
(e)
an item of equipment; or
(f)
a structure; or
(g)
a line; or
(h)
an electricity cable or wire;
that is associated with a radiocommunications transmitter.
AusCheck scheme has the same meaning as in the AusCheck Act 2007.
Australia, when used in a geographical sense, includes the external Territories.
Australian CS facility licence has the same meaning as in Chapter 7 of the Corporations Act 2001.
Australian derivative trade repository licence has the same meaning as in Chapter 7 of the Corporations Act 2001.
Australian market licence has the same meaning as in Chapter 7 of the Corporations Act 2001.
authorised agency means ASD.
authorised deposit‑taking institution has the same meaning as in the Banking Act 1959.
background check has the same meaning as in the AusCheck Act 2007.
banking business has the same meaning as in the Banking Act 1959.
benchmark administrator licence has the same meaning as in the Corporations Act 2001.
broadcasting re‑transmission asset means:
(a)
a radiocommunications transmitter; or
(b)
a broadcasting transmission tower; or
(c)
an associated transmission facility;
that is used in connection with the transmission of a service to which, as a result of section 212 of the Broadcasting Services Act 1992, the regulatory regime established by that Act does not apply.
broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
broadcasting transmission asset means:
(a)
a radiocommunications transmitter; or
(b)
a broadcasting transmission tower; or
(c)
an associated transmission facility;
that is used, or is capable of being used, in connection with the transmission of:
(d)
a national broadcasting service; or
(e)
a commercial radio broadcasting service; or
(f)
a commercial television broadcasting service.
broadcasting transmission tower has the same meaning as in Schedule 4 to the Broadcasting Services Act 1992.
business critical data means:
(a)
personal information (within the meaning of the Privacy Act 1988) that relates to at least 20,000 individuals; or
(b)
information relating to any research and development in relation to a critical infrastructure asset; or
(c)
information relating to any systems needed to operate a critical infrastructure asset; or
(d)
information needed to operate a critical infrastructure asset; or
(e)
information relating to risk management and business continuity (however described) in relation to a critical infrastructure asset.
carriage service has the same meaning as in the Telecommunications Act 1997.
carriage service provider has the same meaning as in the Telecommunications Act 1997.
carrier has the same meaning as in the Telecommunications Act 1997.
chief executive of the authorised agency means the Director‑General of ASD.
clearing and settlement facility has the same meaning as in Chapter 7 of the Corporations Act 2001.
commercial radio broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
commercial television broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
communications sector means the sector of the Australian economy that involves:
(a)
supplying a carriage service; or
(b)
providing a broadcasting service; or
(c)
owning or operating assets that are used in connection with the supply of a carriage service; or
(d)
owning or operating assets that are used in connection with the transmission of a broadcasting service; or
(e)
administering an Australian domain name system.
computer means all or part of:
(a)
one or more computers; or
(b)
one or more computer systems; or
(c)
one or more computer networks; or
(d)
any combination of the above.
computer data means data held in:
(a)
a computer; or
(b)
a data storage device.
computer device means a device connected to a computer.
connected includes connection otherwise than by means of physical contact, for example, a connection by means of radiocommunication.
constable has the same meaning as in the Crimes Act 1914.
credit facility has the meaning given by regulations made for the purposes of paragraph 12BAA(7)(k) of the Australian Securities and Investments Commission Act 2001.
credit facility business means a business that offers, or provides services in relation to, a credit facility.
critical aviation asset means:
(a)
an asset that:
(i)
is used in connection with the provision of an air service; and
(ii)
is owned or operated by an aircraft operator; or
(b)
an asset that:
(i)
is used in connection with the provision of an air service; and
(ii)
is owned or operated by a regulated air cargo agent; or
(c)
an asset that is used by an airport operator in connection with the operation of an airport.
Note: The rules may prescribe that a specified critical aviation asset is not a critical infrastructure asset (see section 9).
critical banking asset has the meaning given by section 12G.
Note: The rules may prescribe that a specified critical banking asset is not a critical infrastructure asset (see section 9).
critical broadcasting asset has the meaning given by section 12E.
Note: The rules may prescribe that a specified critical broadcasting asset is not a critical infrastructure asset (see section 9).
critical data storage or processing asset has the meaning given by section 12F.
Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9).
critical defence capability includes:
(a)
materiel; and
(b)
technology; and
(c)
a platform; and
(d)
a network; and
(e)
a system; and
(f)
a service;
that is required in connection with:
(g)
the defence of Australia; or
(h)
national security.
critical defence industry asset means an asset that:
(a)
is being, or will be, supplied by an entity to the Defence Department, or the Australian Defence Force, under a contract; and
(b)
consists of, or enables, a critical defence capability.
Note: The rules may prescribe that a specified critical defence industry asset is not a critical infrastructure asset (see section 9).
critical domain name system has the meaning given by section 12KA.
Note: The rules may prescribe that a specified critical domain name system is not a critical infrastructure asset (see section 9).
critical education asset means a university that is owned or operated by an entity that is registered in the Australian university category of the National Register of Higher Education Providers.
Note: The rules may prescribe that a specified critical education asset is not a critical infrastructure asset (see section 9).
critical energy market operatorasset means an asset that:
(a)
is owned or operated by:
(i)
Australian Energy Market Operator Limited (ACN 072 010 327); or
(ii)
Power and Water Corporation; or
(iii)
Regional Power Corporation; or
(iv)
Electricity Networks Corporation; and
(b)
is used in connection with the operation of an energy market or system; and
(c)
is critical to ensuring the security and reliability of an energy market;
but does not include:
(d)
a critical electricity asset; or
(e)
a critical gas asset; or
(f)
a critical liquid fuel asset.
Note: The rules may prescribe that a specified critical energy market operator asset is not a critical infrastructure asset (see section 9).
critical financial market infrastructure asset has the meaning given by section 12D.
Note: The rules may prescribe that a specified critical financial market infrastructure asset is not a critical infrastructure asset (see section 9).
critical food and grocery asset has the meaning given by section 12K.
Note: The rules may prescribe that a specified critical food and grocery asset is not a critical infrastructure asset (see section 9).
critical freight infrastructure asset has the meaning given by section 12B.
Note: The rules may prescribe that a specified critical freight infrastructure asset is not a critical infrastructure asset (see section 9).
critical freight services asset has the meaning given by section 12C.
Note: The rules may prescribe that a specified critical freight services asset is not a critical infrastructure asset (see section 9).
critical hospital means a hospital that has a general intensive care unit.
Note: The rules may prescribe that a specified critical hospital is not a critical infrastructure asset (see section 9).
critical infrastructure sector has the meaning given by section 8D.
critical infrastructure sector asset has the meaning given by subsection 8E(1).
critical insurance asset has the meaning given by section 12H.
Note: The rules may prescribe that a specified critical insurance asset is not a critical infrastructure asset (see section 9).
critical liquid fuel asset has the meaning given by section 12A.
Note: The rules may prescribe that a specified critical liquid fuel asset is not a critical infrastructure asset (see section 9).
critical public transport asset means a public transport network or system that:
(a)
is managed by a single entity; and
(b)
is capable of handling at least 5 million passenger journeys per month;
but does not include a critical aviation asset.
Note: The rules may prescribe that a specified critical public transport asset is not a critical infrastructure asset (see section 9).
critical superannuation asset has the meaning given by section 12J.
Note: The rules may prescribe that a specified critical superannuation asset is not a critical infrastructure asset (see section 9).
critical telecommunications asset means:
(a)
a telecommunications network that is:
(i)
owned or operated by a carrier; and
(ii)
used to supply a carriage service; or
(b)
a telecommunications network, or any other asset, that is:
(i)
owned or operated by a carriage service provider; and
(ii)
used in connection with the supply of a carriage service.
Note: The rules may prescribe that a specified critical telecommunications asset is not a critical infrastructure asset (see section 9).
cyber security incident has the meaning given by section 12M.
data includes information in any form.
data storage means data storage that involves information technology, and includes data back‑up.
data storage device means a thing (for example, a disk or file server) containing (whether temporarily or permanently), or designed to contain (whether temporarily or permanently), data for use by a computer.
data storage or processing provider means an entity that provides a data storage or processing service.
data storage or processing sector means the sector of the Australian economy that involves providing data storage or processing services.
data storage or processing service means:
(a)
a service that enables end‑users to store or back‑up data; or
(b)
a data processing service.
Defence Department means the Department of State that deals with defence and that is administered by the Defence Minister.
defence industry sector means the sector of the Australian economy that involves the provision of critical defence capabilities.
Defence Minister means the Minister administering section 1 of the Defence Act 1903.
derivative trade repository has the same meaning as in Chapter 7 of the Corporations Act 2001.
Electricity Networks Corporation means the Electricity Networks Corporation established by section 4 of the Electricity Corporations Act 2005 (WA).
electronic communication means a communication of information in any form by means of guided or unguided electromagnetic energy.
energy sector means the sector of the Australian economy that involves:
(a)
the production, transmission, distribution or supply of electricity; or
(b)
the production, processing, transmission, distribution or supply of gas; or
(c)
the production, processing, transmission, distribution or supply of liquid fuel.
engage in conduct means:
(a)
do an act or thing; or
(b)
omit to perform an act or thing.
financial benchmark has the same meaning as in Part 7.5B of the Corporations Act 2001.
financial market has the same meaning as in Chapter 7 of the Corporations Act 2001.
financial services and markets sector means the sector of the Australian economy that involves:
(a)
carrying on banking business; or
(b)
operating a superannuation fund; or
(c)
carrying on insurance business; or
(d)
carrying on life insurance business; or
(e)
carrying on health insurance business; or
(f)
operating a financial market; or
(g)
operating a clearing and settlement facility;
(h)
operating a derivative trade repository; or
(i)
administering a financial benchmark; or
(j)
operating a payment system; or
(k)
carrying on financial services business; or
(l)
carrying on credit facility business.
financial services business has the same meaning as in Chapter 7 of the Corporations Act 2001.
food means food for human consumption.
food and grocery sector means the sector of the Australian economy that involves:
(a)
manufacturing; or
(b)
processing; or
(c)
packaging; or
(d)
distributing; or
(e)
supplying;
food or groceries on a commercial basis.
gas means a substance that:
(a)
is in a gaseous state at standard temperature and pressure; and
(b)
consists of naturally occurring hydrocarbons, or a naturally occurring mixture of hydrocarbons and non‑hydrocarbons, the principal constituent of which is methane; and
(c)
is suitable for consumption.
general intensive care unit means an area within a hospital that:
(a)
is equipped and staffed so that it is capable of providing to a patient:
(i)
mechanical ventilation for a period of several days; and
(ii)
invasive cardiovascular monitoring; and
(b)
is supported by:
(i)
during normal working hours—at least one specialist, or consultant physician, in the specialty of intensive care, who is immediately available, and exclusively rostered, to that area; and
(ii)
at all times—at least one medical practitioner who is present in the hospital and immediately available to that area; and
(iii)
at least 18 hours each day—at least one nurse; and
(c)
has admission and discharge policies in operation.

government business enterprise has the same meaning as in the Public Governance, Performance and Accountability Act 2013.
health care includes:
(a)
services provided by individuals who practise in any of the following professions or occupations:
(i)
dental (including the profession of a dentist, dental therapist, dental hygienist, dental prosthetist and oral health therapist);
(ii)
medical;
(iii)
medical radiation practice;
(iv)
nursing;
(v)
midwifery;
(vi)
occupational therapy;
(vii)
optometry;
(viii)
pharmacy;
(ix)
physiotherapy;
(x)
podiatry;
(xi)
psychology;
(xii)
a profession or occupation specified in the rules; and
(b)
treatment and maintenance as a patient at a hospital.
health care and medical sector means the sector of the Australian economy that involves:
(a)
the provision of health care; or
(b)
the production, distribution or supply of medical supplies.
health insurance business has the same meaning as in the Private Health Insurance Act 2007.
higher education and research sector means the sector of the Australian economy that involves:
(a)
being a higher education provider; or
(b)
undertaking a program of research that:
(i)
is supported financially (in whole or in part) by the Commonwealth; or
(ii)
is relevant to a critical infrastructure sector (other than the higher education and research sector).
higher education provider has the same meaning as in the Tertiary Education Quality and Standards Agency Act 2011.
hospital has the same meaning as in the Private Health Insurance Act 2007.
IGIS official means:
(a)
the Inspector‑General of Intelligence and Security; or
(b)
any other person covered by subsection 32(1) of the Inspector‑General of Intelligence and Security Act 1986.
impairment of electronic communication to or from a computer includes:
(a)
the prevention of any such communication; and
(b)
the impairment of any such communication on an electronic link or network used by the computer;
but does not include a mere interception of any such communication.
inland waters means waters within Australia other than waters of the sea.
insurance business has the same meaning as in the Insurance Act 1973.
internet carriage service means a listed carriage service that enables end‑users to access the internet.
life insurance business has the same meaning as in the Life Insurance Act 1995.
liquid fuel has the same meaning as in the Liquid Fuel Emergency Act 1984.
listed carriage service has the same meaning as in the Telecommunications Act 1997.
local hospital network has the same meaning as in the National Health Reform Act 2011.
managed service provider, in relation to an asset, means an entity that:
(a)
manages:
(i)
the asset; or
(ii)
a part of the asset; or
(b)
manages an aspect of:
(i)
the asset; or
(ii)
a part of the asset; or
(c)
manages an aspect of the operation of:
(i)
the asset; or
(ii)
a part of the asset.
medical supplies includes:
(a)
goods for therapeutic use; and
(b)
things specified in the rules.
Ministerial authorisation means an authorisation under section 35AB.
modification:
(a)
in respect of computer data—means:
(i)
the alteration or removal of the data; or
(ii)
an addition to the data; or
(b)
in respect of a computer program—means:
(i)
the alteration or removal of the program; or
(ii)
an addition to the program.
national broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
National Register of Higher Education Providers means the register established and maintained under section 198 of the Tertiary Education Quality and Standards Agency Act 2011.
notification provision means:
(a)
subsection 35AE(3); or
(b)
subsection 35AE(4); or
(c)
subsection 35AE(5); or
(d)
subsection 35AE(6); or
(e)
subsection 35AE(7); or
(f)
subsection 35AE(8); or
(g)
subsection 35AH(5); or
(h)
subsection 35AH(6); or
(i)
subsection 35AH(7); or
(j)
subsection 35AY(3); or
(k)
subsection 35AY(4); or
(l)
subsection 35AY(5); or
(m)
subsection 35AY(6); or
(n)
subsection 35AY(7); or
(o)
subsection 35AY(8); or
(p)
subsection 51(3); or
(q)
subsection 52(4).
Ombudsman official means:
(a)
the Ombudsman; or
(b)
a Deputy Commonwealth Ombudsman; or
(c)
a person who is a member of the staff referred to in subsection 31(1) of the Ombudsman Act 1976.
8
Section 5 (paragraph (b) of the definition of operator)
Repeal the paragraph, substitute:
(b)
for a critical infrastructure asset other than a critical port—an entity that operates the asset or part of the asset.

Section 5

Insert:
payment system has the same meaning as in the Payment Systems (Regulation) Act 1998.

Section 5

Insert:
Power and Water Corporation means the Power and Water Corporation established by section 4 of the Power and Water Corporation Act 1987 (NT).
11
Section 5 (after paragraph (b) of the definition of protected information)
Insert:
(bb)
records or is the fact that the Minister has:
(i)
given a Ministerial authorisation; or
(ii)
revoked a Ministerial authorisation; or
(be)
is, or is included in, a report under section 30BC or 30BD; or
(bi)
is, or is included in, a report prepared in compliance with:
(i)
a system information periodic reporting notice; or
(ii)
a system information event‑based reporting notice; or
(bj)
records or is the fact that the Secretary has:
(i)
given a direction under section 35AK; or
(ii)
revoked such a direction; or
(bk)
records or is the fact that the Secretary has:
(i)
given a direction under section 35AQ; or
(ii)
revoked such a direction; or
(bl)
records or is the fact that the Secretary has:
(i)
given a request under section 35AX; or
(ii)
revoked such a request; or
12
Section 5 (paragraph (c) of the definition of protected information)
Omit “or (b)”, substitute “, (b), (ba), (bb), (bc), (bd), (be), (bf), (bg), (bh), (bi), (bj), (bk) or (bl)”.

Section 5

Insert:
radiocommunications transmitter has the same meaning as in the Radiocommunications Act 1992.
regional centre means a city, or a town that has a population of 10,000 or more people.
Regional Power Corporation means the Regional Power Corporation established by section 4 of the Electricity Corporations Act 2005 (WA).
registrable superannuation entity has the same meaning as in the Superannuation Industry (Supervision) Act 1993.
regulated air cargo agent has the same meaning as in the Aviation Transport Security Act 2004.
related body corporate has the same meaning as in the Corporations Act 2001.
relevant Commonwealth regulator means:
(a)
a Department that is specified in the rules; or
(b)
a body that is:
(i)
established by a law of the Commonwealth; and
(ii)
specified in the rules.
relevant entity, in relation to an asset, means an entity that:
(a)
is the responsible entity for the asset; or
(b)
is a direct interest holder in relation to the asset; or
(c)
is an operator of the asset; or
(d)
is a managed service provider for the asset.
relevant impact has the meaning given by section 8G.

Section 5 (definition of relevant industry)

Repeal the definition.

Section 5 (definition of responsible entity)

Repeal the definition, substitute:
responsible entity, for an asset, has the meaning given by section 12L.
16
Section 5 (paragraph (a) of the definition of security)
Omit “sections 10 and 12”, substitute “the definition of critical energy market operatorasset and sections 10, 12, 12A, 12D, 12G, 12H, 12J, 12M and 12N”.
17
Section 5 (paragraph (b) of the definition of security)
Omit “sections 10 and 12”, substitute “the definition of critical energy market operatorasset and sections 10, 12, 12A, 12D, 12G, 12H, 12J, 12M and 12N”.

Section 5

Insert:
significant financial benchmark has the same meaning as in the Corporations Act 2001.
space technology sector means the sector of the Australian economy that involves the commercial provision of space‑related services.
Note: The following are examples of space‑related services:
(a) position, navigation and timing services in relation to space objects;
(b) space situational awareness services;
(c) space weather monitoring and forecasting;
(d) communications, tracking, telemetry and control in relation to space objects;
(e) remote sensing earth observations from space;
(f) facilitating access to space.
staff member, in relation to the authorised agency, means a staff member of ASD (within the meaning of the Intelligence Services Act 2001).
technical assistance notice has the same meaning as in Part 15 of the Telecommunications Act 1997.
technical assistance request has the same meaning as in Part 15 of the Telecommunications Act 1997.
technical capability notice has the same meaning as in Part 15 of the Telecommunications Act 1997.
telecommunications network has the same meaning as in the Telecommunications Act 1997.
therapeutic use has the same meaning as in the Therapeutic Goods Act 1989.
transport sector means the sector of the Australian economy that involves:
(a)
owning or operating assets that are used in connection with the transport of goods or passengers on a commercial basis; or
(b)
the transport of goods or passengers on a commercial basis.
unauthorised access, modification or impairment has the meaning given by section 12N.
water and sewerage sector means the sector of the Australian economy that involves:
(a)
operating water or sewerage systems or networks; or
(b)
manufacturing or supplying goods, or providing services, for use in connection with the operation of water or sewerage systems or networks.

Section 5 (definition of water utility)

After “water services”, insert “or sewerage services, or both”.

At the end of section 6

Add:
Interest and control information provided by the Commonwealth
(5)
If the first entity:
(a)
is the Governor‑General, the Prime Minister or a Minister; and
(b)
is a direct interest holder in relation to an asset because of paragraph 8(1)(b);
the first entity is not required to provide any interest and control information.
Note: The expression Minister is defined in section 2B of the Acts Interpretation Act 1901.
(6)
However, subsection (5) does not affect the obligation of the Commonwealth to provide interest and control information in relation to the asset if the Commonwealth is also a direct interest holder in relation to the asset because of paragraph 8(1)(a) or (b).

After section 8C

Insert:

8DMeaning of critical infrastructure sector

Each of the following sectors of the Australian economy is a critical infrastructure sector:
(a)
the communications sector;
(b)
the data storage or processing sector;
(c)
the financial services and markets sector;
(d)
the water and sewerage sector;
(e)
the energy sector;
(f)
the health care and medical sector;
(g)
the higher education and research sector;
(h)
the food and grocery sector;
(i)
the transport sector;
(j)
the space technology sector;
(k)
the defence industry sector.

8EMeaning of critical infrastructure sector asset

(1)
An asset is a critical infrastructure sector asset if it is an asset that relates to a critical infrastructure sector.
Deeming—when asset relates to a sector
(2)
For the purposes of this Act, each of the following assets is taken to relate to the communications sector:
(a)
a critical telecommunications asset;
(b)
a critical broadcasting asset;
(c)
a critical domain name system.
(3)
For the purposes of this Act, a critical data storage or processing asset is taken to relate to the data storage or processing sector.
(4)
For the purposes of this Act, each of the following assets is taken to relate to the financial services and markets sector:
(a)
a critical banking asset;
(b)
a critical superannuation asset;
(c)
a critical insurance asset;
(d)
a critical financial market infrastructure asset.
(5)
For the purposes of this Act, a critical water asset is taken to relate to the water and sewerage sector.
(6)
For the purposes of this Act, each of the following assets is taken to relate to the energy sector:
(a)
a critical electricity asset;
(b)
a critical gas asset;
(c)
a critical energy market operator asset;
(d)
a critical liquid fuel asset.
(7)
For the purposes of this Act, a critical hospital is taken to relate to the health care and medical sector.
(8)
For the purposes of this Act, a critical education asset is taken to relate to the higher education and research sector.
(9)
For the purposes of this Act, a critical food and grocery asset is taken to relate to the food and grocery sector.
(10)
For the purposes of this Act, each of the following assets is taken to relate to the transport sector:
(a)
a critical port;
(b)
a critical freight infrastructure asset;
(c)
a critical freight services asset;
(d)
a critical public transport asset;
(e)
a critical aviation asset.
(11)
For the purposes of this Act, a critical defence industry asset is taken to relate to the defence industry sector.

8FCritical infrastructure sector for a critical infrastructure asset

For the purposes of this Act, the critical infrastructure sector for a critical infrastructure asset is the critical infrastructure sector to which the asset relates.

8GMeaning of relevant impact

(1)
Each of the following is a relevant impact of a hazard on a critical infrastructure asset:
(a)
the impact (whether direct or indirect) of the hazard on the availability of the asset;
(b)
the impact (whether direct or indirect) of the hazard on the integrity of the asset;
(c)
the impact (whether direct or indirect) of the hazard on the reliability of the asset;
(d)
the impact (whether direct or indirect) of the hazard on the confidentiality of:
(i)
information about the asset; or
(ii)
if information is stored in the asset—the information; or
(iii)
if the asset is computer data—the computer data.
(2)
Each of the following is a relevant impact of a cyber security incident on a critical infrastructure asset:
(a)
the impact (whether direct or indirect) of the incident on the availability of the asset;
(b)
the impact (whether direct or indirect) of the incident on the integrity of the asset;
(c)
the impact (whether direct or indirect) of the incident on the reliability of the asset;
(d)
the impact (whether direct or indirect) of the incident on the confidentiality of:
(i)
information about the asset; or
(ii)
if information is stored in the asset—the information; or
(iii)
if the asset is computer data—the computer data.

Paragraphs 9(1)(a), (b), (c) and (d)

Repeal the paragraphs, substitute:
(a)
a critical telecommunications asset; or
(b)
a critical broadcasting asset; or
(c)
a critical domain name system; or
(d)
a critical data storage or processing asset; or
(da)
a critical banking asset; or
(db)
a critical superannuation asset; or
(dc)
a critical insurance asset; or
(dd)
a critical financial market infrastructure asset; or
(de)
a critical water asset; or
(df)
a critical electricity asset; or
(dg)
a critical gas asset; or
(dh)
a critical energy market operator asset; or
(di)
a critical liquid fuel asset; or
(dj)
a critical hospital; or
(dk)
a critical education asset; or
(dl)
a critical food and grocery asset; or
(dm)
a critical port; or
(dn)
a critical freight infrastructure asset; or
(do)
a critical freight services asset; or
(dp)
a critical public transport asset; or
(dq)
a critical aviation asset; or
(dr)
a critical defence industry asset; or

At the end of subsection 9(1)

Add:
Note: For prescription by class, see subsection 13(3) of the Legislation Act 2003.

Paragraphs 9(2)(a), (b), (c) and (d)

Repeal the paragraphs, substitute:
(a)
a critical telecommunications asset; or
(b)
a critical broadcasting asset; or
(c)
a critical domain name system; or
(d)
a critical data storage or processing asset; or
(e)
a critical banking asset; or
(f)
a critical superannuation asset; or
(g)
a critical insurance asset; or
(h)
a critical financial market infrastructure asset; or
(i)
a critical water asset; or
(j)
a critical electricity asset; or
(k)
a critical gas asset; or
(l)
a critical energy market operator asset; or
(m)
a critical liquid fuel asset; or
(n)
a critical hospital; or
(o)
a critical education asset; or
(p)
a critical food and grocery asset; or
(q)
a critical port; or
(r)
a critical freight infrastructure asset; or
(s)
a critical freight services asset; or
(t)
a critical public transport asset; or
(u)
a critical aviation asset; or
(v)
a critical defence industry asset;

At the end of subsection 9(2)

Add:
Note: For prescription by class, see subsection 13(3) of the Legislation Act 2003.

After subsection 9(2)

Insert:
(2A)
If an asset is owned by:
(a)
the Commonwealth; or
(b)
a body corporate established by a law of the Commonwealth (other than a government business enterprise);
the asset is not a critical infrastructure asset unless:
(c)
the asset is declared under section 51 to be a critical infrastructure asset; or
(d)
the asset is prescribed by the rules for the purposes of paragraph (1)(f).
(2B)
An asset is not a critical infrastructure asset if, or to the extent to which, the asset is located outside Australia.

Paragraph 9(3)(b)

Repeal the paragraph, substitute:
(b)
the asset relates to a critical infrastructure sector.

Subparagraph 9(4)(a)(i)

Before “located”, insert “wholly or partly”.

Subparagraph 9(4)(a)(ii)

Omit “industry for the asset”, substitute “critical infrastructure sector”.

Paragraph 10(1)(a)

After “customers”, insert “or any other number of customers prescribed by the rules”.

Paragraph 12(1)(b)

Repeal the paragraph, substitute:
(b)
a gas storage facility that has a maximum daily withdrawal capacity of at least 75 terajoules per day or any other maximum daily withdrawal capacity prescribed by the rules;

After section 12

Insert:

12AMeaning of critical liquid fuel asset

(1)
An asset is a critical liquid fuel asset if it is any of the following:
(a)
a liquid fuel refinery that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (2);
(b)
a liquid fuel pipeline that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (3);
(c)
a liquid fuel storage facility that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (4).
Note: The rules may prescribe that a specified critical liquid fuel asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of paragraph (1)(a), the rules may prescribe:
(a)
specified liquid fuel refineries that are critical to ensuring the security and reliability of a liquid fuel market; or
(b)
requirements for a liquid fuel refinery to be critical to ensuring the security and reliability of a liquid fuel market.
(3)
For the purposes of paragraph (1)(b), the rules may prescribe:
(a)
specified liquid fuel pipelines that are critical to ensuring the security and reliability of a liquid fuel market; or
(b)
requirements for a liquid fuel pipeline to be critical to ensuring the security and reliability of a liquid fuel market.
(4)
For the purposes of paragraph (1)(c), the rules may prescribe:
(a)
specified liquid fuel storage facilities that are critical to ensuring the security and reliability of a liquid fuel market; or
(b)
requirements for a liquid fuel storage facility to be critical to ensuring the security and reliability of a liquid fuel market.

12BMeaning of critical freight infrastructure asset

(1)
An asset is a critical freight infrastructure asset if it is any of the following:
(a)
a road network that, in accordance with subsection (2), functions as a critical corridor for the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres;
(b)
a rail network that, in accordance with subsection (3), functions as a critical corridor for the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres;
(c)
an intermodal transfer facility that, in accordance with subsection (4), is critical to the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres.
Note: The rules may prescribe that a specified critical freight infrastructure asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of paragraph (1)(a), the rules may prescribe:
(a)
specified road networks that function as a critical corridor for the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres; or
(b)
requirements for a road network to function as a critical corridor for the transportation of goods between:
(i)

2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres.
(3)
For the purposes of paragraph (1)(b), the rules may prescribe:
(a)
specified rail networks that function as a critical corridor for the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres; or
(b)
requirements for a rail network to function as a critical corridor for the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres.
(4)
For the purposes of paragraph (1)(c), the rules may prescribe:
(a)
specified intermodal transfer facilities that are critical to the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres; or
(b)
requirements for an intermodal transfer facility to be critical to the transportation of goods between:
(i)
2 States; or
(ii)
a State and a Territory; or
(iii)
2 Territories; or
(iv)
2 regional centres.
(5)
For the purposes of this section, road network includes a part of a road network.
(6)
For the purposes of this section, rail network includes a part of a rail network.

12CMeaning of critical freight services asset

(1)
An asset is a critical freight services asset if it is a network that is used by an entity carrying on a business that, in accordance with subsection (2), is critical to the transportation of goods by any or all of the following:
(a)
road;
(b)
rail;
(c)
inland waters;
(d)
sea.
Note: The rules may prescribe that a specified critical freight services asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of subsection (1), the rules may prescribe:
(a)
specified businesses that are critical to the transportation of goods by any or all of the following:
(i)
road;
(ii)
rail;
(iii)
inland waters;
(iv)
sea; or
(b)
requirements for a business to be critical to the transportation of goods by any or all of the following:
(i)
road;
(ii)
rail;
(iii)
inland waters;
(iv)
sea.

12DMeaning of critical financial market infrastructure asset

(1)
An asset is a critical financial market infrastructure asset if it is any of the following assets:
(a)
an asset that:
(i)
is owned or operated by an Australian body corporate that holds an Australian market licence; and
(ii)
is used in connection with the operation of a financial market that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector;
(b)
an asset that:
(i)
is owned or operated by an associated entity of an Australian body corporate that holds an Australian market licence; and
(ii)
is used in connection with the operation of a financial market that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector;
(c)
an asset that:
(i)
is owned or operated by an Australian body corporate that holds an Australian CS facility licence; and
(ii)
is used in connection with the operation of a clearing and settlement facility that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector;
(d)
an asset that:
(i)
is owned or operated by an associated entity of an Australian body corporate that holds an Australian CS facility licence; and
(ii)
is used in connection with the operation of a clearing and settlement facility that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector;
(e)
an asset that:
(i)
is owned or operated by an Australian body corporate that holds a benchmark administrator licence; and
(ii)
is used in connection with the administration of a significant financial benchmark that, in accordance with subsection (4), is critical to the security and reliability of the financial services and markets sector;
(f)
an asset that:
(i) is owned or operated by an associated entity of an Australian body corporate that holds a benchmark administrator licence; and
(ii)
is used in connection with the administration of a significant financial benchmark that, in accordance with subsection (4), is critical to the security and reliability of the financial services and markets sector;
(g)
an asset that:
(i)
is owned or operated by an Australian body corporate that holds an Australian derivative trade repository licence; and
(ii)
is used in connection with the operation of a derivative trade repository that, in accordance with subsection (5), is critical to the security and reliability of the financial services and markets sector;
(h)
an asset that:
(i) is owned or operated by an associated entity of an Australian body corporate that holds an Australian derivative trade repository licence; and
(ii)
is used in connection with the operation of a derivative trade repository that, in accordance with subsection (5), is critical to the security and reliability of the financial services and markets sector;
(i)
an asset that is used in connection with the operation of a payment system that, in accordance with subsection (6), is critical to the security and reliability of the financial services and markets sector.
Note: The rules may prescribe that a specified critical financial market infrastructure asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of paragraphs (1)(a) and (b), the rules may prescribe:
(a)
specified financial markets that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a financial market to be critical to the security and reliability of the financial services and markets sector.
(3)
For the purposes of paragraphs (1)(c) and (d), the rules may prescribe:
(a)
specified clearing and settlement facilities that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a clearing and settlement facility to be critical to the security and reliability of the financial services and markets sector.
(4)
For the purposes of paragraphs (1)(e) and (f), the rules may prescribe:
(a)
specified significant financial benchmarks that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a significant financial benchmark to be critical to the security and reliability of the financial services and markets sector.
(5)
For the purposes of paragraphs (1)(g) and (h), the rules may prescribe:
(a)
specified derivative trade repositories that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a derivative trade repository to be critical to the security and reliability of the financial services and markets sector.
(6)
For the purposes of paragraph (1)(i), the rules may prescribe:
(a)
specified payment systems that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a payment system to be critical to the security and reliability of the financial services and markets sector.
(7)
For the purposes of this section, Australian body corporate means a body corporate that is incorporated in Australia.

12EMeaning of critical broadcasting asset

(1)
One or more broadcasting transmission assets are a critical broadcasting asset if:
(a)
the broadcasting transmission assets are:
(i)
owned or operated by the same entity; and
(ii)
located on a site that, in accordance with subsection (2), is a critical transmission site; or
(b)
the broadcasting transmission assets are:
(i)
owned or operated by the same entity; and
(ii)
located on at least 50 different sites; and
(iii)
not broadcasting re‑transmission assets; or
(c)
the broadcasting transmission assets are owned or operated by an entity that, in accordance with subsection (3), is critical to the transmission of a broadcasting service.
Note: The rules may prescribe that a specified critical broadcasting asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of paragraph (1)(a), the rules may prescribe:
(a)
specified sites that are critical transmission sites; or
(b)
requirements for sites to be critical transmission sites.
(3)
For the purposes of paragraph (1)(c), the rules may prescribe:
(a)
specified entities that are critical to the transmission of a broadcasting service; or
(b)
requirements for an entity to be critical to the transmission of a broadcasting service.

12FMeaning of criticaldata storage or processing asset

(1)
An asset is a critical data storage or processing asset if:
(a)
it is owned or operated by an entity that is a data storage or processing provider; and
(b)
it is used wholly or primarily to provide a data storage or processing service that is provided by the entity on a commercial basis to an end‑user that is:
(i)
the Commonwealth; or
(ii)
a body corporate established by a law of the Commonwealth; or
(iii)
a State; or
(iv)
a body corporate established by a law of a State; or
(v)
a Territory; or
(vi)
a body corporate established by a law of a Territory; and
(c)
the entity knows that the asset is used as described in paragraph (b).
Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9).
(2)
An asset is a critical data storage or processing asset if:
(a)
it is owned or operated by an entity that is a data storage or processing provider; and
(b)
it is used wholly or primarily to provide a data storage or processing service that:
(i)
is provided by the entity on a commercial basis to an end‑user that is the responsible entity for a critical infrastructure asset; and
(ii)
relates to business critical data; and
(c)
the entity knows that the asset is used as described in paragraph (b).
Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9).
(3)
If:
(a)
an entity (the first entity) is the responsible entity for a critical infrastructure asset; and
(b)
the first entity becomes aware that a data storage or processing service:
(i)
is provided by another entity on a commercial basis to the first entity; and
(ii)
relates to business critical data;
the first entity must:
(c)
take reasonable steps to inform that other entity that the first entity has become aware that the data storage or processing service:
(i)
is provided by the other entity on a commercial basis to the first entity; and
(ii)
relates to business critical data; and
(d)
do so as soon as practicable after becoming so aware.
Civil penalty for contravention of this subsection: 50 penalty units.

12GMeaning of critical banking asset

(1) An asset is a critical banking asset if it is any of the following assets:
(a)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by an authorised deposit‑taking institution;
(ii)
the authorised deposit‑taking institution is an authorised deposit‑taking institution that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of banking business;
(b) an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by a body corporate that is a related body corporate of an authorised deposit‑taking institution;
(ii)
the body corporate is a body corporate that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of banking business.
Note: The rules may prescribe that a specified critical banking asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of subparagraph (1)(a)(ii), the rules may prescribe:
(a)
specified authorised deposit‑taking institutions that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for an authorised deposit‑taking institution to be critical to the security and reliability of the financial services and markets sector.
(3)
For the purposes of subparagraph (1)(b)(ii), the rules may prescribe:
(a)
specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.

12HMeaning of critical insurance asset

(1) An asset is a critical insurance asset if it is any of the following assets:
(a)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by an entity that carries on insurance business;
(ii)
the entity is an entity that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of insurance business;
(b)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by a body corporate that is a related body corporate of an entity that carries on insurance business;
(ii)
the body corporate is a body corporate that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of insurance business;
(c)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by an entity that carries on life insurance business;
(ii)
the entity is an entity that, in accordance with subsection (4), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of life insurance business;
(d)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by a body corporate that is a related body corporate of an entity that carries on life insurance business;
(ii)
the body corporate is a body corporate that, in accordance with subsection (5), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of life insurance business;
(e)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by an entity that carries on health insurance business;
(ii)
the entity is an entity that, in accordance with subsection (6), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of health insurance business;
(f)
an asset where the following conditions are satisfied:
(i)
the asset is owned or operated by a body corporate that is a related body corporate of an entity that carries on health insurance business;
(ii)
the body corporate is a body corporate that, in accordance with subsection (7), is critical to the security and reliability of the financial services and markets sector;
(iii)
the asset is used in connection with the carrying on of health insurance business.
Note: The rules may prescribe that a specified critical insurance asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of subparagraph (1)(a)(ii), the rules may prescribe:
(a)
specified entities that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for an entity to be critical to the security and reliability of the financial services and markets sector.
(3)
For the purposes of subparagraph (1)(b)(ii), the rules may prescribe:
(a)
specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.
(4)
For the purposes of subparagraph (1)(c)(ii), the rules may prescribe:
(a)
specified entities that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for an entity to be critical to the security and reliability of the financial services and markets sector.
(5)
For the purposes of subparagraph (1)(d)(ii), the rules may prescribe:
(a)
specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.
(6)
For the purposes of subparagraph (1)(e)(ii), the rules may prescribe:
(a)
specified entities that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for an entity to be critical to the security and reliability of the financial services and markets sector.
(7)
For the purposes of subparagraph (1)(f)(ii), the rules may prescribe:
(a)
specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.

12JMeaning of critical superannuation asset

(1)
An asset is a critical superannuation asset if:
(a)
it is owned or operated by a registrable superannuation entity that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; and
(b)
it is used in connection with the operation of a superannuation fund.
Note: The rules may prescribe that a specified critical superannuation asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of paragraph (1)(a), the rules may prescribe:
(a)
specified registrable superannuation entities that are critical to the security and reliability of the financial services and markets sector; or
(b)
requirements for a registrable superannuation entity to be critical to the security and reliability of the financial services and markets sector.

12KMeaning of critical food and grocery asset

(1)
An asset is a critical food and grocery asset if it is a network that:
(a)
is used for the distribution or supply of:
(i)
food; or
(ii)
groceries; and
(b)
is owned or operated by an entity that is:
(i)
a critical supermarket retailer, in accordance with subsection (2); or
(ii)
a critical food wholesaler, in accordance with subsection (3); or
(iii)
a critical grocery wholesaler, in accordance with subsection (4).
Note: The rules may prescribe that a specified critical food and grocery asset is not a critical infrastructure asset (see section 9).
(2)
For the purposes of subparagraph (1)(b)(i), the rules may prescribe:
(a)
specified entities that are critical supermarket retailers; or
(b)
requirements for an entity to be a critical supermarket retailer.
(3)
For the purposes of subparagraph (1)(b)(ii), the rules may prescribe:
(a)
specified entities that are critical food wholesalers; or
(b)
requirements for an entity to be a critical food wholesaler.
(4)
For the purposes of subparagraph (1)(b)(iii), the rules may prescribe:
(a)
specified entities that are critical grocery wholesalers; or
(b)
requirements for an entity to be a critical grocery wholesaler.

12KAMeaning of critical domain name system

(1)
An asset is a critical domain name system if it:
(a)
is managed by an entity that, in accordance with subsection (2), is critical to the administration of an Australian domain name system; and
(b)
is used in connection with the administration of an Australian domain name system.
Note: The rules may prescribe that a specified critical domain name system is not a critical infrastructure asset (see section 9).
(2)
For the purposes of paragraph (1)(a), the rules may prescribe:
(a)
specified entities that are critical to the administration of an Australian domain name system; or
(b)
requirements for an entity to be critical to the administration of an Australian domain name system.

12LMeaning of responsible entity

Critical telecommunications asset
(1)
The responsible entity for a critical telecommunications asset is:
(a)
whichever of the following is applicable:
(i)
if the critical telecommunications asset is owned or operated by a carrier—the carrier;

(6)
A person exercising powers or performing functions under a delegation under subsection (5) must comply with any directions of the relevant chief executive.
External Territories
(7)
Part 5 of the Regulatory Powers Act, as it applies in relation to the provisions mentioned in subsection (1), extends to every external Territory.

Paragraphs 51(1)(b) and (c)

Repeal the paragraphs, substitute:
(b)
the asset relates to a critical infrastructure sector; and
(c)
the Minister is satisfied that the asset is critical to:
(i)
the social or economic stability of Australia or its people; or
(ii)
the defence of Australia; or
(iii)
national security; and
(d)
there would be a risk to:
(i)
the social or economic stability of Australia or its people; or
(ii)
the defence of Australia; or
(iii)
national security;
if it were publically known that the asset is a critical infrastructure asset.

Subsection 51(1) (note 1)

Repeal the note.

Subsection 51(1) (note 2)

Omit “Note 2”, substitute “Note”.

After subsection 51(2)

Insert:
(2A)
The declaration may do any or all of the following:
(a)
determine that Part 2 applies to the asset;
(c)
determine that Part 2B applies to the asset.

Paragraph 51(3)(b)

Repeal the paragraph, substitute:
(b)
if the asset is a tangible asset located (wholly or partly) in a State, the Australian Capital Territory or the Northern Territory—the First Minister of the State, the Australian Capital Territory or the Northern Territory, as the case requires.

Subsection 51(4)

Repeal the subsection.

After section 51

Insert:

51AConsultation—declaration

(1)
Before making a declaration under section 51 that specifies an entity as the responsible entity for an asset, the Minister must give the entity a notice:
(a)
setting out the proposed declaration; and
(b)
inviting the entity to make submissions to the Minister about the proposed declaration within:
(i)
28 days after the notice is given; or
(ii)
if a shorter period is specified in the notice—that shorter period.
(2)
The Minister must consider any submissions received within:
(a)
the 28‑day period mentioned in subparagraph (1)(b)(i); or
(b)
if a shorter period is specified in the notice—that shorter period.
(3)
The Minister must not specify a shorter period in the notice unless the Minister is satisfied that the shorter period is necessary due to urgent circumstances.
(4)
The notice must set out the reasons for making the declaration, unless the Minister is satisfied that doing so would be prejudicial to security.

Subsection 52(5)

Repeal the subsection.

Subsection 59(1)

After “this Act”, insert “(other than Part 3A)”.
68
Division 4 of Part 7 (at the end of the heading)
Add “etc.”.

At the end of subsection 60(2)

Add:
; and (h)
the number of cyber security incidents reported during the financial year under section 30BC; and
(i)
the number of cyber security incidents reported during the financial year under 30BD; and
(n)
the number of Ministerial authorisations given under section 35AB during the financial year; and
(o)
the number of Ministerial authorisations given under paragraph 35AB(2)(a) or (b) during the financial year; and
(p)
the number of Ministerial authorisations given under paragraph 35AB(2)(c) or (d) during the financial year; and
(q)
the number of Ministerial authorisations given under paragraph 35AB(2)(e) or (f) during the financial year.

After section 60

Insert:

60AACompensation for acquisition of property

(1)
If the operation of this Act would result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution) from an entity otherwise than on just terms (within the meaning of that paragraph), the Commonwealth is liable to pay a reasonable amount of compensation to the entity.
(2)
If the Commonwealth and the entity do not agree on the amount of the compensation, the entity may institute proceedings in:
(a)
the Federal Court of Australia; or
(b)
the Supreme Court of a State or Territory;
for the recovery from the Commonwealth of such reasonable amount of compensation as the court determines.

60ABService of notices, directions and instruments by electronic means

Paragraphs 9(1)(d) and (2)(d) of the Electronic Transactions Act 1999 do not apply to a notice, direction or instrument under:
(a)
this Act; or
(b)
the rules; or
(c)
the Regulatory Powers Act, so far as that Act relates to this Act.
Note: Paragraphs 9(1)(d) and (2)(d) of the Electronic Transactions Act 1999 deal with the consent of the recipient of information to the information being given by way of electronic communication.

70A

After section 60A

Insert:

60BReview of this Act

The Parliamentary Joint Committee on Intelligence and Security may:
(a)
review the operation, effectiveness and implications of this Act; and
(b)
report the Committee’s comments and recommendations to each House of the Parliament;
so long as the Committee begins the review before the end of 3 years after the Security Legislation Amendment (Critical Infrastructure) Act 2021 receives the Royal Assent.

Part 2Application provisions

71
Application—subsections 9(3) and (4) of the Security of Critical Infrastructure Act 2018
The amendments of subsections 9(3) and (4) of the Security of Critical Infrastructure Act 2018 made by this Schedule apply in relation to rules made after the commencement of this item.
72
Application—section 51 of the Security of Critical Infrastructure Act 2018
The amendments of section 51 of the Security of Critical Infrastructure Act 2018 made by this Schedule apply in relation to a declaration made after the commencement of this item.

Part 3Amendments contingent on the commencement of the Federal Circuit and Family Court of Australia Act 2021

Security of Critical Infrastructure Act 2018

Paragraphs 49A(12)(b) and 49B(11)(b)

Omit “Federal Circuit Court of Australia”, substitute “Federal Circuit and Family Court of Australia (Division 2)”.

Part 4Amendments contingent on the commencement of the National Emergency Declaration Act 2020

National Emergency Declaration Act 2020

74
Section 10 (after paragraph (za) of the definition of national emergency law)
Insert:
(zaa)
section 35AB of the Security of Critical Infrastructure Act 2018;

Security of Critical Infrastructure Act 2018

After subsection 35AB(1)

Insert:
(1A)
This section also applies if the Minister is satisfied that:
(a)
a cyber security incident:
(i)
has occurred; or
(ii)
is occurring; or
(iii)
is imminent; and
(b)
the incident has had, is having, or is likely to have, a relevant impact on a critical infrastructure asset (the primary asset); and
(c)
the incident relates to an emergency specified in a national emergency declaration (within the meaning of the National Emergency Declaration Act 2020) that is in force; and
(d)
no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident.

Schedule 2—Australian Signals Directorate

Criminal Code Act 1995

Subsection 476.4(2) of the Criminal Code

Omit “section 476.5”, substitute “sections 476.5 and 476.6”.
2
Section 476.5 of the Criminal Code (at the end of the heading)
Add “—ASIS and AGO”.

Subsection 476.5(1) of the Criminal Code

Omit “ASIS, AGO or ASD”, substitute “ASIS or AGO”.
4
Subsection 476.5(3) of the Criminal Code (definition of ASD)
Repeal the definition.
5
Subsection 476.5(3) of the Criminal Code (paragraph (b) of the definition of staff member)
Repeal the paragraph.

At the end of Division 476 of the Criminal Code

Add:

476.6Liability for certain acts—ASD

(1)
A staff member or agent of ASD is not subject to any civil or criminal liability for engaging in conduct inside or outside Australia if:
(a)
the conduct is engaged in on the reasonable belief that it is likely to cause a computer‑related act, event, circumstance or result to take place outside Australia (whether or not it in fact takes place outside Australia); and
(b)
the conduct is engaged in in the proper performance of a function of ASD.
(2)
A person is not subject to any civil or criminal liability for engaging in conduct inside or outside Australia if:
(a)
the conduct is preparatory to, in support of, or otherwise directly connected with, overseas activities of ASD; and
(b)
the conduct:
(i)
taken together with a computer‑related act, event, circumstance or result that took place, or was intended to take place, outside Australia, could amount to an offence; but
(ii)
in the absence of that computer‑related act, event, circumstance or result, would not amount to an offence; and
(c)
the conduct is engaged in in the proper performance of a function of ASD.
(3)
Subsection (2) is not intended to permit any conduct in relation to premises, persons, computers, things, or carriage services in Australia, being:
(a)
conduct which ASIO could not engage in without a Minister authorising it by warrant issued under Division 2 of Part III of the Australian Security Intelligence Organisation Act 1979 or under Part 2‑2 of the Telecommunications (Interception and Access) Act 1979; or
(b)
conduct engaged in to obtain information that ASIO could not obtain other than in accordance with Division 3 of Part 4‑1 of the Telecommunications (Interception and Access) Act 1979.
(4)
Subsections (1) and (2) have effect despite anything in a law of the Commonwealth or of a State or Territory, whether passed or made before or after the commencement of this subsection, unless the law expressly provides otherwise.
(5)
Subsection (4) does not affect the operation of subsection (3).
Certificate
(6)
The Inspector‑General of Intelligence and Security may give a certificate in writing certifying any fact relevant to the question of whether conduct was engaged in in the proper performance of a function of ASD.
(7)
In any proceedings, a certificate given under subsection (6) is prima facie evidence of the facts certified.
Notice to Inspector‑General of Intelligence and Security
(8)
If:
(a)
a person engages in conduct referred to in subsection (1) or (2) in relation to ASD; and
(b)
the conduct causes material damage, material interference or material obstruction to a computer (within the meaning of section 22 of the Australian Security Intelligence Organisation Act 1979) in Australia; and
(c)
apart from this section, the person would commit an offence against this Part;
then the agency head (within the meaning of the Intelligence Services Act 2001) of ASD must, as soon as practicable, give a written notice to the Inspector‑General of Intelligence and Security that:
(d)
informs the Inspector‑General of Intelligence and Security of that fact; and
(e)
provides details about the conduct that caused the damage, interference or obstruction to the computer.
(9)
This section has effect in addition to, and does not limit, section 14 of the Intelligence Services Act 2001.
Definitions
(10)
In this section:
ASD means the Australian Signals Directorate.
civil or criminal liability means any civil or criminal liability (whether under this Part, under another law or otherwise).
computer‑related act, event, circumstance or result means an act, event, circumstance or result involving:
(a)
the reliability, security or operation of a computer; or
(b)
access to, or modification of, data held in a computer or on a data storage device; or
(c)
electronic communication to or from a computer; or
(d)
the reliability, security or operation of any data held in or on a computer, computer disk, credit card, or other data storage device; or
(e)
possession or control of data held in a computer or on a data storage device; or
(f)
producing, supplying or obtaining data held in a computer or on a data storage device.
staff member, in relation to ASD, means:
(a)
the Director‑General of ASD; or
(b)
a member of the staff of ASD (whether an employee of ASD, a consultant or contractor to ASD, or a person who is made available by another Commonwealth or State authority or other person to perform services for ASD).

Application of amendments

The amendments made by this Schedule apply in relation to conduct engaged in after the commencement of this Schedule.

[Minister’s second reading speech made in—

House of Representatives on 10 December 2020

Senate on 21 October 2021]

(182/20)