Explanatory Statement

Issued by the Authority of the Minister for Foreign Affairs

Autonomous Sanctions Regulations 2011

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 1) Instrument 2024

Autonomous sanctions are measures not involving the use of armed force which the Australian Government imposes as a matter of foreign policy in response to situations of international concern. Such situations include significant cybercrime incidents and malicious cyber activity threatening Australians and Australian government entities. 

Autonomous thematic cyber sanctions (Cyber Sanctions) demonstrate Australia’s commitment to deterring and responding robustly to malicious and significant cyber incidents. The imposition of sanctions also signals to persons and entities, targeting Australia and other countries through malicious cyber activity, that they will be held responsible for their actions. Sanctions can have a serious deterrent effect on individual actors and entities, exposing their activities and imposing restrictions on their actions, particularly when imposed in collaboration with likeminded partners.

The Autonomous Sanctions Regulations 2011 (the Regulations) make provision for, among other things, the proscription of persons or entities for autonomous thematic sanctions in response to significant cyber incidents. Subregulation 6A(2) of the Regulations enables the Minister for Foreign Affairs (the Minister) to designate a person or entity for targeted financial sanctions and/or declare a person for the purposes of a travel ban, in a range of circumstances, including if the Minister is satisfied (pursuant to subregulation 6A(2)(a) and/or 6A(2)(b) of regulation 6A, ‘Significant Cyber Incident criteria’) that the person or entity has caused, assisted with causing, or been complicit in, a cyber incident or an attempted cyber incident that is significant or which, had it occurred, would have been significant.

In determining whether a cyber incident is ‘significant’, the Minister for Foreign Affairs may have regard to:

• whether the conduct of the person or entity was malicious;
• whether the cyber incident involved any of the following:
  • actions that destroyed, degraded or rendered unavailable an essential service or critical infrastructure;
  • actions that resulted in the loss of a person’s life, or caused serious risk of loss of a person’s life;
  • theft of intellectual property, trade secrets or confidential business information for the purposes of gaining a competitive advantage for an entity or a commercial sector;
  • interference with a political or governmental process, the exercise of a political right or duty, or the functions or operations of a parliament; or
• whether the attempted cyber incident, had it occurred, could reasonably be expected to have involved one or more of the matters mentioned above; and
• any other matters the Minister considers relevant.

The purpose of a designation is to subject the designated person or entity to targeted financial sanctions. There are two types of targeted financial sanctions under the Regulations:

• the designated person or entity becomes the object of the prohibition in regulation 14 (which prohibits directly or indirectly making an asset available to, or for the benefit of, a designated person or entity, other than as authorised by a permit granted under regulation 18); and/or
• an asset owned or controlled by a designated person or entity is a “controlled asset”, subject to the prohibition in regulation 15 (which prohibits a person who holds that asset from either using or dealing with that asset, or allowing it to be used or dealt with, or facilitating the use of or dealing with it, other than as authorised by a permit granted under regulation 18).

The purpose of a declaration is to prevent a person from travelling to, entering or remaining in Australia.

Designated and declared persons, and designated entities, in relation to Significant Cyber Incidents are listed in the Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022 (the 2022 List).

Section 10(4) of the Autonomous Sanctions Act 2011 (the Act) provides that, before making a thematic sanctions listing decision, the Minister must consult and obtain the agreement in writing of the Attorney-General, and consult such other Ministers as the Minister considers appropriate. These provisions ensure that thematic sanctions listing decisions take account of all relevant foreign policy and other national interest considerations.

Subregulation 6A(7) of the Regulations provides that the Minister must not make a designation or declaration in response to a significant cyber incident/s unless the Minister is satisfied that the conduct of the person or entity concerned occurred, in whole or in part, outside Australia.

The Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 1) Instrument 2024 (the 2024 Instrument) gives effect to the listing of one person for a targeted financial sanction and a travel ban under the Significant Cyber Incident criteria in accordance with subregulation 6A(2) of the Regulations. The Minister exercised their discretion to make the designation and declaration being satisfied that the person met the Significant Cyber Incident criteria under subregulations 6A(2) and 6A(3), and being satisfied that the conduct concerned occurred, in whole or in part, outside Australia per subregulation 6A(7).

Details of the 2024 Instrument, which amends the 2022 List, are set out at Attachment A.

This listing demonstrates Australia’s ongoing commitment to deterring and responding robustly to malicious and significant cyber incidents.  The listing acts in our national interest to impose costs on, influence and deter those responsible for malicious cyber activity.

The legal framework for the imposition of thematic sanctions for significant cyber incidents was the focus of a 12‑month Parliamentary inquiry which received written and oral submissions from both government and civil society. Measures included in the Autonomous Sanctions Amendment (Magnitsky-style and Other Thematic Sanctions) Act 2021 implemented key aspects of the Australian Government’s response (tabled 5 August 2021) to the Joint Standing Committee on Foreign Affairs, Defence and Trade’s report on its inquiry ‘Criminality, corruption and impunity: Should Australia join the Global Magnitsky movement?’. 

The thematic sanctions listing criteria form part of Australia’s legal framework for the imposition and implementation of targeted financial sanctions and travel bans. 
This framework was the subject of extensive consultation with government and
non-government stakeholders at the time of its introduction. The new sanction being imposed through the making of the 2024 Instrument was subject to wide consultation within the Government (including the written agreement of the Attorney-General).

In order to meet the policy objective of prohibiting unauthorised financial transactions involving the person specified in the 2024 Instrument, the Minister is satisfied that wider consultations beyond those already undertaken would not be appropriate or reasonably practicable (subsections 17(1) and (2) of the Legislation Act 2003). Consultation would risk alerting persons to the impending sanctions and enabling capital flight before assets can be frozen.

The Office of Impact Analysis (OIA) has advised that a Regulation Impact Statement is not required for listing instruments of this nature (OBPR22-02078).

This Instrument is exempt from sunsetting under table item 10B of section 12 of the Legislation (Exemptions and Other Matters) Regulation 2015 on the basis that it is subject to a more stringent statutory review process than is set out in Part 4 of Chapter 3 of the Legislation Act 2003.

Attachment A

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 1) Instrument 2024

Section 1

The title of the instrument is the Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 1) Instrument 2024 (the 2024 Instrument).

Section 2

The whole of the 2024 Instrument commences the day after this instrument is registered.

Subsection 2(2) is a technical provision that makes clear that any information inserted in column 3 of the table about the specific date of commencement is not part of the Instrument and can be inserted or edited at a later date.

Section 3

The 2024 Instrument is made under subregulation 6A(2) of the Autonomous Sanctions Regulations 2011 (the Regulations).

Under subsection 33(3) of the Acts Interpretation Act 1901, where an Act confers a power to make, grant or issue any instrument of a legislative or administrative character (including rules, regulations or by laws), the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend, or vary any such instrument. Subsection 33(3) of the Acts Interpretation Act 1901 has been relied on, in conjunction with subregulation 6A(2) of the Regulations, to amend the Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022 (the 2022 List).

Section 4

Each instrument that is specified in a Schedule to the 2024 Instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to the 2024 Instrument has effect according to its terms.

Schedule 1

Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022

Item 1

Item 1 inserts a new section 7 which provides for:

• the designation of persons for paragraph 6A(2)(a) of the Regulations in the table in clause 1 of Schedule 3; and
• the declaration of persons for paragraph 6A(2)(b) of the Regulations in the table in clause 1 of Schedule 3

in accordance with subregulation 6A(2)(a) and/or 6A(2)(b) of regulation 6A (the Significant Cyber Incident criteria).

Item 2

Item 2 amends the 2022 List to insert a new Schedule 3 to list persons that satisfy the Significant Cyber Incident criteria. 

The person listed in the table in Item 2 is designated by the Minister for a targeted financial sanction under paragraph 6A(2)(a) of the Regulations and declared by the Minister for the purposes of a travel ban under paragraph 6A(2)(b) of the Regulations. These listings are made pursuant to the Minister being satisfied that:

• the person meets the criteria in subregulation 6A(2) of the Regulations;
• the relevant cyber incident was significant, having regard to the matters in subregulation 6A(3) of the Regulations; and
• the relevant conduct occurred in whole or in part outside of Australia per subregulation 6A(7) of the Regulations.

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the

Human Rights (Parliamentary Scrutiny) Act 2011

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 1) Instrument 2024

The Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 1) Instrument 2024 (the 2024 Instrument) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Australia’s autonomous sanctions frameworks impose highly targeted measures in response to situations of international concern. Such situations include threats to ongoing access to services, protection of private or sensitive information posed by the use of cyber enabled crime.

The autonomous sanctions designation and declaration made by the 2024 Instrument pursue legitimate objectives and have appropriate safeguards in place to ensure that any limitation on human rights engaged by the imposition of this sanction is a reasonable, necessary and proportionate response to the significant cyber incident, and do not affect particularly vulnerable groups. The Government keeps its sanctions frameworks under regular review, including in relation to whether more effective, less rights restrictive means are available to achieve similar foreign policy objectives.

The Autonomous Sanctions Regulations 2011 (the Regulations) make provision for, among other things, the proscription of persons or entities for autonomous sanctions. The 2024 Instrument designates a person for a targeted financial sanction and declares that person for the purposes of a travel ban. The Minister for Foreign Affairs (the Minister) made the designation and declaration being satisfied (pursuant to subregulation 6A(2) of the Regulations that the person has caused, assisted with causing, or been complicit in, a cyber incident or an attempted cyber incident that is significant or which, had it occurred, would have been significant in accordance with subregulation 6A(3). The Minister was also satisfied that the conduct of the person occurred wholly, or in part, outside of Australia (pursuant to subregulation 6A(7) of the Regulations).

The human rights compatibility of the 2024 Instrument is addressed by reference to each of the human rights engaged below.

Right to privacy

Right

Article 17 of the International Covenant on Civil and Political Rights (the ICCPR) prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence.

The use of the term ‘arbitrary’ in the ICCPR means that any interferences with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the individual circumstances. Arbitrariness connotes elements of injustice, unpredictability, unreasonableness, capriciousness and ‘unproportionality’.[1]

Permissible limitations

The 2024 Instrument is not an unlawful interference with an individual’s right to privacy. Section 10 of the Autonomous Sanctions Act 2011 (the Act) permits regulations relating to, among other things: ‘proscription of persons or entities (for specified purposes or more generally)’; and ‘restriction or prevention of uses of, dealings with, and making available of, assets’. The designation and declaration contained in the 2024 Instrument was made pursuant to regulation 6A of the Regulations, which provides that the Minister may, by legislative instrument, designate a person for targeted financial sanctions and/or declare a person for a travel ban.

The measures contained in the 2024 Instrument are not an arbitrary interference with an individual’s right to privacy. An interference with privacy will not be arbitrary where it is reasonable, necessary and proportionate in the individual circumstances.

In designating a person under the Regulations for targeted financial sanctions and/or declaring a person for a travel ban, the Minister uses predictable, publicly available criteria. These criteria are designed to capture only those persons the Minister is satisfied are involved in situations of international concern, as set out in regulation 6A of the Regulations.

Accordingly, targeted financial sanctions and travel bans imposed by the Minister through the designation and declaration of specific persons (as well as their continuation) under the Regulations are reasonable, necessary and proportionate to the individual circumstances the sanction is seeking to address. Any interference with the right to privacy created by the operation of the 2024 Instrument is not arbitrary or unlawful and is consistent with Australia’s obligations under Article 17 of the ICCPR.

Right to respect for the family

Right

The right to respect for the family is protected by Articles 17 and 23 of the ICCPR. It covers, among other things, the separation of family members under migration laws, and arbitrary or unlawful interferences with the family.

Limitations on the right to respect for the family under Articles 17 and 23 of the ICCPR will not violate those articles if the measures in question are lawful and non‑arbitrary. Any interference with respect for the family will be consistent with the ICCPR where it is necessary and proportionate, in accordance with the provisions, aims and objectives of the ICCPR, and is reasonable in the individual circumstances.

Permissible limitations

As set out above, the autonomous sanctions framework is authorised by domestic law and is not unlawful.

As the listing criteria in regulation 6A of the Regulations are drafted to address themes of international concern, and the requirement that, to constitute a significant cyber incident, relevant conduct must have occurred wholly, or in part, outside of Australia in accordance with regulation 6A(7), it is highly unlikely, as a practical matter, that a person declared for a travel ban holds an Australian visa, usually resides in Australia and/or has immediate family also in Australia.

The Department of Foreign Affairs and Trade (DFAT) consults relevant agencies, as appropriate, in advance of the designation and declaration of a person with known connections to Australia to consider the possible impacts of the designation and declaration on any family members in Australia.

To the extent that the travel ban imposed by the 2024 Instrument engages and limits the right to respect for the family in a particular case, the Regulations provide sufficient flexibility to treat each cases differently. Under subregulation 19(3) of the Regulations, the Minister may waive the operation of a travel ban on the grounds that it would be either: (a) in the national interest; or (b) on humanitarian grounds. This provides a mechanism to address circumstances in which issues such as the possible separation of family members in Australia are involved. In addition, this decision may be judicially reviewed. Finally, were such a separation to take place, for the reasons outlined in relation to Article 17 of the ICCPR (discussed above), such a separation would be reasonable, necessary, proportionate and justified in achieving the objective of the 2024 Instrument.

Accordingly, any interference with the right to respect for the family created by the operation of the 2024 Instrument is not unlawful or arbitrary and is consistent with Australia’s obligations under Articles 17 and 23 of the ICCPR.

Right to an adequate standard of living

Right

The right to an adequate standard of living is contained in Article 11(1) of the International Covenant on Economic, Social and Cultural Rights (ICESCR) and requires States to ensure the availability and accessibility of the resources that are essential to the realisation of the right: including adequate food, water, clothing, and housing.

Article 4 of the ICESCR provides that this right may be subject to such limitations ‘as are determined by law only in so far as this may be compatible with the nature of these rights and solely for the purpose of promoting the general welfare in a democratic society’. To be consistent with the ICESCR, limitations must be proportionate.

Permissible limitations

Any limitation on the enjoyment of Article 11(1) of the ICESCR, to the extent that it occurs, is reasonable and necessary to achieve the objective of the 2024 Instrument and is proportionate due to the targeted nature of the listing. The Regulations also provide sufficient flexibility to treat each case differently by allowing for any adverse impacts on family members, as a consequence of targeted financial sanctions, to be mitigated. The Regulations provide for the payment of basic expenses (among others) in accordance with permits granted by the Minister under regulation 18. The objective of regulation 20, which allows applications to be made to the Minister for permits to pay basic expenses is, in part, to enable the Australian Government to administer the sanctions framework in a manner compatible with relevant human rights standards.

The permit process is a flexible and effective safeguard on any limitation to the enjoyment of Article 11(1) of the ICESCR.

Right to freedom of movement

Right

Article 12 of the ICCPR protects the right to freedom of movement, which includes a right to leave Australia, as well as the right to enter, remain, or return to one’s ‘own country’.

The right to freedom of movement may be restricted under domestic law on any of the grounds in Article 12(3) of the ICCPR, namely national security, public order, public health or morals or the rights and freedoms of others. Any limitation on the enjoyment of the right also needs to be reasonable, necessary and proportionate.

Permissible limitations

As the listing criteria in regulation 6A of the Regulations are drafted to address themes of international concern, including cyber enabled conduct occurring wholly, or in part, outside of Australia, it is highly unlikely, as a practical matter, that a person declared for a travel ban would be an Australian citizen, or have spent such lengths of time in Australia, such that Australia could be considered their ‘own country’. Furthermore, travel bans – which are a power to refuse or to cancel a visa – do not apply to Australian citizens.

To the extent that Article 12(4) of the ICCPR is engaged in an individual case, such that a person listed in the 2024 Instrument is prevented from entering Australia and Australia is properly described as their ‘own country’, the imposition of the travel ban would be justified.

As set out above in relation to Article 17 of the ICCPR, travel bans are a reasonable, necessary and proportionate means of achieving the legitimate objectives of Australia’s autonomous sanctions framework. Travel bans are reasonable because they are only imposed on persons who the Minister is satisfied are responsible for giving rise to situations of international concern, including significant cyber incidents.

Preventing a person who has, or has attempted to, cause, assist with, or been complicit in a significant cyber incident, from travelling to, entering, or remaining in Australia through the operation of the 2024 Instrument, is a reasonable means to achieve the legitimate foreign policy objective of deterring and responding robustly to malicious and significant cyber incidents. Australia’s practice in this respect is consistent with that of other jurisdictions such as the United States, the European Union, and the United Kingdom.

The Minister may also waive the operation of a declaration that was made for the purpose of preventing a person from travelling to, entering or remaining in, Australia, on the grounds that it would be either: (a) in the national interest; or (b) on humanitarian grounds. This decision is subject to natural justice requirements, and may be judicially reviewed.

Non-refoulement

Right

The obligations relating to the prohibition on torture and other cruel, inhuman or degrading treatment or punishment under Article 3 of the Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment (the CAT) and Article 7 of the ICCPR, as well as the right to life and prohibition on arbitrary deprivation of life in Article 6 of the, are engaged by the travel restrictions in the 2024 Instrument. There is no permissible derogation from these implied or express non‑refoulement obligations.

Permissible limitations

To the extent that the travel bans imposed pursuant to the 2024 Instrument engage Australia’s non-refoulement obligations, the Regulations allow the Minister to waive the operation of a travel ban on the grounds that it would be either: (a) in the national interest; or (b) on humanitarian grounds.

A travel ban may lead to the cancellation of a visa held by a non-citizen lawfully in Australia, which can lead to removal under section 198 of the Migration Act 1958. Australia will continue to meet its non-refoulement obligations through mechanisms prior to the person becoming available for removal under the Migration Act 1958, including through the protection visa application process, and through the use of the Minister for Home Affairs’ personal powers in the Migration Act 1958.

The 2024 Instrument is consistent with Australia’s international non-refoulement obligations as, together with the Minister’s powers to revoke a declaration or waive its operation in an individual case, non‑refoulement obligations are considered prior to a person becoming available for removal under the Migration Act 1958.  A person must not be removed from Australia to another country if there is a real risk that the person may be subjected to arbitrary deprivation of life, the death penalty, torture, cruel or inhuman treatment or punishment, or degrading treatment or punishment.

Right to equality and non-discrimination

Right

The right to equality and non-discrimination under Article 26 of the ICCPR provides that everyone is entitled to enjoy their rights without discrimination of any kind, and that people are equal before the law and are entitled without discrimination to the equal and non-discriminatory protection of the law.

Differential treatment (including the differential effect of a measure that is neutral on its face) will not constitute unlawful discrimination if the differential treatment is based on reasonable and objective criteria, serves a legitimate objective, and is a proportionate means of achieving that objective.

Permissible limitations

Any differential treatment of people as a consequence of the application of the 2024 Instrument does not amount to discrimination pursuant to Article 26 of the ICCPR.

The criteria set out in regulation 6A of the Regulations are reasonable and objective. They are reasonable insofar as they allow the Minister to list only those persons and entities that the Minister is satisfied have been involved, in situations of international concern, including significant cyber incidents.  They are objective, as they provide a clear, consistent and objectively-verifiable reference point by which the Minister is able to make a designation or declaration. The Regulations serve a legitimate objective, as discussed throughout this Statement.

Denying access to international travel and the international financial system to certain designated persons is a highly targeted, justified and minimally  rights-restrictive means of achieving the aims of the Regulations, including in a context where other conventional mechanisms are unavailable.

While these measures may impact persons of certain nationalities and national origins more than others, there is no information to suggest that affected groups are particularly vulnerable. Rather, the person is listed in the 2024 Instrument as a result of the Minister being satisfied that the person was involved in a significant cyber incident.  Further, there are several safeguards in place, such as the availability of judicial review, and regular review processes, to ensure that any limitation on rights is proportionate to the 2024 Instrument’s objective.

[1] Manfred Nowak, United Nations Covenant on Civil and Political Rights: CCPR Commentary (NP Engel, 1993) 178.