Explanatory Statement

Issued by the Authority of the Minister for Foreign Affairs (the Minister)

Autonomous Sanctions Regulations 2011

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 3) Instrument 2025

Autonomous sanctions are measures not involving the use of armed force which the Australian Government imposes as a matter of foreign policy in response to situations of international concern.

Section 3 of the Autonomous Sanctions Act 2011 (the Act) provides that one of the objects of the Act is to enable the imposition of country‑specific or thematic sanctions. The thematic sanctions framework allows Australia to respond flexibly and swiftly to egregious situations of international concern wherever they occur.

Autonomous thematic cyber sanctions demonstrate Australia’s commitment to deterring and responding robustly to malicious and significant cyber incidents. The imposition of sanctions also signals to persons and entities targeting Australia and other countries through malicious cyber activity, that they will be held responsible for their actions. Sanctions can have a serious disrupting effect on individual actors and entities, exposing their activities and imposing restrictions on their actions, particularly when imposed in collaboration with likeminded partners.

The Autonomous Sanctions Regulations 2011 (the Regulations) make provision for, among other things, the proscription of persons or entities for thematic autonomous sanctions in response to significant cyber incidents. Subregulation 6A(2) of the Regulations enables the Minister to designate a person or entity and/or declare a person for the purpose of implementing a travel ban if the Minister is satisfied (pursuant to sub-regulation 6A(2) of the Regulations, ‘Significant Cyber Incident criteria’) that the person or entity has caused or attempted to cause, assisted with causing or attempted to assist with causing, or been otherwise complicit in causing or attempting to cause, a significant cyber incident or an attempted cyber incident that which, had it occurred, would have been significant.

In determining whether a cyber incident is ‘significant’, the Minister may have regard to:

• whether the conduct of the person or entity was malicious;
• whether the cyber incident involved any of the following:
  • actions that destroyed, degraded or rendered unavailable an essential service or critical infrastructure;
  • actions that resulted in the loss of a person’s life, or caused serious risk of loss of a person’s life;
  • theft of intellectual property, trade secrets or confidential business information for the purposes of gaining a competitive advantage for an entity or a commercial sector;
  • interference with a political or governmental process, the exercise of a political right or duty, or the functions or operations of a parliament;
• whether the attempted cyber incident, had it occurred, could reasonably be expected to have involved one or more of the matters mentioned above; and
• any other matters the Minister considers relevant.

The purpose of a designation is to subject the designated person or entity to targeted financial sanctions. There are two types of targeted financial sanctions that apply to a designated person or entity under the Regulations:

• the designated person or entity becomes the object of the prohibition in regulation 14 (which prohibits directly or indirectly making an asset available to, or for the benefit of, a designated person or entity, other than as authorised by a permit granted under regulation 18); and/or
• an asset owned or controlled by a designated person or entity is a “controlled asset”, subject to the prohibition in regulation 15 (which prohibits a person who holds that asset from either using or dealing with that asset, or allowing it to be used or dealt with, or facilitating the use of or dealing with it, other than as authorised by a permit granted under regulation 18).

The purpose of a declaration is to prevent a person from travelling to, entering or remaining in Australia.

Designations and declarations of persons, and designations of entities, are referred to collectively as ‘listings.’ Listings in relation to significant cyber incidents are contained in the Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022 (the 2022 List).

Section 10(4) of the Autonomous Sanctions Act 2011 (the Act) provides that, before deciding to designate or declare a person or entity for thematic sanctions, the Minister must consult and obtain the agreement in writing of the Attorney-General, and consult such other Ministers as the Minister considers appropriate. These provisions ensure that thematic sanctions listing decisions take account of all relevant foreign policy and other national interest considerations.

Subregulation 6A(7) of the Regulations provides that the Minister must not make a designation or declaration, including for a significant cyber incident, unless the Minister is satisfied that the conduct of the person or entity concerned occurred, in whole or in part, outside Australia.

The Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 3) Instrument 2025 (the Amending Instrument) lists two persons for targeted financial sanctions and travel bans, and designates two entities for targeted financial sanctions under the Significant Cyber Incident criteria. The Minister exercised their discretion to make the designations, being satisfied that each entity met the Significant Cyber Incident criteria, and being satisfied that the relevant conduct concerned occurred, in whole or in part, outside Australia per subregulation 6A(7).

Details of the Amending Instrument, which amends the 2022 List, are set out at Attachment A.

These listings demonstrate Australia’s ongoing commitment to deterring and responding robustly to significant cyber incidents. The listings are consistent with our national interest to impose costs on, influence, and deter those responsible for malicious cyber activity.

The legal framework for the imposition of thematic sanctions for significant cyber incidents was a focus of a 12‑month Parliamentary inquiry into whether Australia should examine the use of targeted sanctions to address abuses.  This inquiry received written and oral submissions from both government and civil society. Measures in the Autonomous Sanctions Amendment (Magnitsky-style and Other Thematic Sanctions) Act 2021 implemented key aspects of the Australian Government’s response (tabled 5 August 2021) to the Joint Standing Committee on Foreign Affairs, Defence and Trade’s report on its inquiry ‘Criminality, corruption and impunity: Should Australia join the Global Magnitsky movement?’. 

The power to list persons and entities for thematic sanctions forms part of Australia’s legal framework for the imposition and implementation of targeted financial sanctions and travel bans. This framework was the subject of extensive consultation with government and non-government stakeholders at the time of its introduction. The sanctions imposed through the making of the Amending Instrument were subject to wide consultation within the Government and received the written agreement of the Attorney-General.

In order to meet the policy objective of prohibiting unauthorised financial transactions involving the person or entities specified in the Amending Instrument, the Minister is satisfied that wider consultations beyond those already undertaken would not be appropriate or reasonably practicable (subsections 17(1) and (2) of the Legislation Act 2003). Consultation would risk alerting persons and/or entities to the impending sanctions and enabling capital flight before assets can be frozen.

The Office of Impact Analysis has advised that a Regulation Impact Statement is not required for listing instruments of this nature (OBPR22-02078).

The Amending Instrument is exempt from sunsetting under table item 10B of section 12 of the Legislation (Exemptions and Other Matters) Regulation 2015. This item was introduced on the basis that instruments made under regulation 8(1) of the Regulations were subject to a more stringent statutory review process than is set out in Part 4 of Chapter 3 of the Legislation Act 2003. This review process was contained in regulation 9 of the Regulation, which has subsequently been repealed. While the statutory review process has been repealed, it is noted the Regulation themselves are due to sunset on 1 October 2027. Review of these instruments, including sunsetting requirements, will be considered as part of the process to remake or replace the Regulations.

The Amending Instrument relies on subsection 33(3) of the Acts Interpretation Act 1901 (AIA) as it applies to subregulation 6A(2) of the Regulations by virtue of paragraph 13(1)(a) of the Legislation Act 2003 (Legislation Act). Subsection 33(3) of the AIA (read with paragraph 13(1)(a) of the Legislation Act) provides that where an instrument (like subregulation 6A(2) of the Regulations) confers a power to make, grant or issue any instrument of a legislative or administrative character (including rules, regulations or by-laws) the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend or vary any such instrument.

Attachment A

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 3) Instrument 2025

Section 1

The title of the instrument is the Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 3) Instrument 2025 (the Amending Instrument).

Section 2

The whole of the Amending Instrument commences the day after the instrument is registered.

Subsection 2(2) is a technical provision that makes clear that any information inserted in column 3 of the table about the specific date of commencement is not part of the Amending Instrument and can be inserted or edited at a later date.

Section 3

The Amending Instrument is made under subregulation 6A(2) of the Autonomous Sanctions Regulations 2011 (the Regulations).

Section 4

Each instrument that is specified in a Schedule to the Amending Instrument is amended as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to the Amending Instrument has effect according to its terms.

Schedule 1

Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022 (the 2022 List)

Item 1
The persons listed in Item 1 of Schedule 1 are designated by the Minister for Foreign Affairs (the Minister) for targeted financial sanctions and declared by the Minister for travel bans under subregulation 6A(2) of the Regulations.

The Minister exercised their discretion to make the designations being satisfied that:

• the entities meet the criteria in subregulation 6A(2) of the Regulations;
• the relevant cyber incidents were significant, having regard to the matters in subregulation 6A(3) of the Regulations; and
• the relevant conduct occurred in whole or in part outside of Australia per subregulation 6A(7) of the Regulations.

The persons support the day-to-day operations of both entities listed in Item 3 of this Schedule, including through advertising their services on cybercriminal forums and marketplaces.

Item 2

This amendment to subsection 7(1) is to fix an existing drafting error in the 2022 List by including a cross-reference to clause 2 of Schedule 3.

Item 3

The entities listed in the table in Item 3 are designated by the Minister for targeted financial sanctions under paragraph 6A(2)(a) of the Regulations.

The Minister exercised their discretion to make the designations being satisfied that:

• the entities meet the criteria in subregulation 6A(2) of the Regulations;
• the relevant cyber incidents were significant, having regard to the matters in subregulation 6A(3) of the Regulations; and
• the relevant conduct occurred in whole or in part outside of Australia per subregulation 6A(7) of the Regulations.

The entities are two Russian bulletproof hosting providers whose infrastructure and services have been utilised by malicious cyber actors to engage in illegal activity such as ransomware, phishing attacks, brute-force attacks and other computer-related criminal schemes.  

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the

Human Rights (Parliamentary Scrutiny) Act 2011

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 3) Instrument 2025

The Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 3) Instrument 2025 (the Amending Instrument) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Australia’s autonomous sanctions framework imposes highly targeted measures in response to situations of international concern. This includes significant cyber incidents, wherever they occur.  

The Autonomous Sanctions Regulations 2011 (the Regulations) make provision for, among other things, the proscription of persons or entities for autonomous sanctions. The Amending Instrument designates two persons and two entities for targeted financial sanctions. The Minister for Foreign Affairs (the Minister) made the designations being satisfied pursuant to subregulation 6A(2) of the Regulations, that each entity or person caused, assisted with causing, or been otherwise complicit in, a significant cyber incident or an attempted cyber incident that which, had it occurred, would have been significant, in accordance with subregulation 6A(3). The Minister was also satisfied that the conduct of the persons and entities occurred, wholly or in part, outside of Australia (pursuant to subregulation 6A(7) of the Regulations).

The autonomous sanctions designations and declarations made by the Amending Instrument pursue legitimate objectives and have appropriate safeguards in place to ensure that any limitation on human rights engaged by the imposition of these sanctions is a reasonable, necessary and proportionate response to the relevant significant cyber incident, and do not affect particularly vulnerable groups. The Government keeps its sanctions frameworks under regular review, including in relation to whether more effective, less rights restrictive means are available to achieve similar foreign policy objectives.

The human rights compatibility of the Amending Instrument is addressed by reference to each of the human rights engaged below.

Right to privacy

Right

Article 17 of the International Covenant on Civil and Political Rights (the ICCPR) prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence.

The use of the term ‘arbitrary’ in the ICCPR means that any interferences with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the individual circumstances. Arbitrariness connotes elements of injustice, unpredictability, unreasonableness, capriciousness and ‘unproportionality’.[1]

Permissible limitations

The Amending Instrument is not an unlawful interference with an individual’s right to privacy. Section 10 of the Autonomous Sanctions Act 2011 (the Act) permits regulations relating to, among other things: ‘proscription of persons or entities (for specified purposes or more generally)’; and ‘restriction or prevention of uses of, dealings with, and making available of, assets’. The designations and declarations contained in the Amending Instrument were made pursuant to subregulation 6A(2) of the Regulations, which provides that the Minister may, by legislative instrument, designate a person for targeted financial sanctions and/or declare a person for a travel ban.

The measures contained in the Amending Instrument are not an arbitrary interference with an individual’s right to privacy. An interference with privacy will not be arbitrary where it is reasonable, necessary and proportionate in the individual circumstances.

In designating an individual under the Regulations for targeted financial sanctions and/or declaring an individual for a travel ban, the Minister must be satisfied that the individual meets publicly available criteria. These criteria are designed to capture only those persons who are involved in significant cyber incidents, as set out in subregulation 6A(2) of the Regulations.

Accordingly, targeted financial sanctions and travel bans imposed by the Minister through the designation and declaration of specific individuals under the Regulations are reasonable, necessary and proportionate to the individual circumstances the sanctions are seeking to address. Any interference with the right to privacy created by the operation of the Amending Instrument is not arbitrary or unlawful and is consistent with Australia’s obligations under Article 17 of the ICCPR.

Right to respect for the family

Right

The right to respect for the family is protected by Articles 17 and 23 of the ICCPR. It covers, among other things, the separation of family members under migration laws, and arbitrary or unlawful interferences with the family.

Limitations on the right to respect for the family under Articles 17 and 23 of the ICCPR will not violate those Articles if the measures in question are lawful and non‑arbitrary. An interference with respect for the family will be consistent with the ICCPR where it is necessary and proportionate, in accordance with the provisions, aims and objectives of the ICCPR, and is reasonable in the individual circumstances.

Permissible limitations

As set out above, the autonomous sanctions framework is authorised by domestic law and is not unlawful.

As the listing criteria in regulation 6A of the Regulations are drafted to address themes of international concern, and the listings in the Amending Instrument are made in relation to conduct occurring, in whole, or in part, outside of Australia, it is highly unlikely, as a practical matter, that a person declared for a travel ban will hold an Australian visa, usually reside in Australia, or have immediate family in Australia.

The Department of Foreign Affairs and Trade consults relevant agencies as appropriate in advance of a designation and declaration of a person with known connections to Australia to consider the possible impacts of the designation and declaration on any family members in Australia.

To the extent that the travel bans imposed pursuant to the Amending Instrument engage and limit the right to respect for the family in a particular case, the Regulations provide sufficient flexibility to treat different cases differently. Under subregulation 19(3) of the Regulations, the Minister may waive the operation of a travel ban on the grounds that it would be either: (a) in the national interest; or (b) on humanitarian grounds. This provides a mechanism to address circumstances in which issues such as the possible separation of family members in Australia are involved. In addition, this decision may be judicially reviewed. Finally, were such a separation to take place, for the reasons outlined in relation to Article 17 above, such a separation would be reasonable, necessary, proportionate and justified in achieving the objective of the Amending Instrument.

Accordingly, any interference with the right to respect for the family created by the operation of the Amending Instrument is not unlawful or arbitrary and is consistent with Australia’s obligations under Articles 17 and 23 of the ICCPR.

Right to an adequate standard of living

Right

The right to an adequate standard of living is contained in Article 11(1) of the International Covenant on Economic, Social and Cultural Rights (the ICESCR) and requires States to ensure the availability and accessibility of the resources that are essential to the realisation of the right, including adequate food, water, clothing and housing.

Article 4 of the ICESCR provides that this right may be subject to such limitations ‘as are determined by law only in so far as this may be compatible with the nature of these rights and solely for the purpose of promoting the general welfare in a democratic society’. To be consistent with the ICESCR, limitations must be proportionate.

Permissible limitations

Any limitation on the enjoyment of the right contained in Article 11(1) of the ICESCR, to the extent that it occurs, is reasonable and necessary to achieve the objective of the Amending Instrument and is proportionate due to the targeted nature of the listings. The Regulations also provide sufficient flexibility to treat different cases differently by allowing for any adverse impacts on family members as a consequence of targeted financial sanctions to be mitigated. The Regulations provide for the payment of basic expenses (among others) in accordance with permits granted by the Minister under regulation 18. The objective of the ‘basic expenses exemption’ in regulation 20 of the Regulations, which allows applications to be made to the Minister for permits to pay basic expenses, is, in part, to enable the Australian Government to administer the sanctions framework in a manner compatible with relevant human rights standards.

The permit process is a flexible and effective safeguard on any limitation to the enjoyment of the right contained in Article 11(1) of the ICESCR.

Right to freedom of movement

Right

Article 12 of the ICCPR protects the right to freedom of movement, which includes a right to leave Australia, as well as the right to enter, remain, or return to one’s ‘own country’.

The right to freedom of movement may be restricted under domestic law on any of the grounds in Article 12(3) of the ICCPR, namely national security, public order, public health or morals or the rights and freedoms of others. Any limitation on the enjoyment of the right also needs to be reasonable, necessary and proportionate.

Permissible limitations

As the listing criteria in regulation 6A of the Regulations are drafted to address themes of international concern, and the listings in the Amending Instrument are made in relation to conduct occurring, in whole, or in part, outside of Australia, it is highly unlikely, as a practical matter, that a person declared for a travel ban would be an Australian citizen, or have spent such lengths of time in Australia, such that Australia could be considered their ‘own country’. Furthermore, travel bans – which are a power to refuse a visa and to cancel a visa – do not apply to Australian citizens.

To the extent that Article 12(4) is engaged in an individual case, such that a person listed in the Amending Instrument is prevented from entering Australia as their ‘own country’, the imposition of the travel ban would be justified.

As set out above in relation to Article 17 of the ICCPR, travel bans are a reasonable, necessary and proportionate means of achieving the legitimate objectives of Australia’s autonomous sanctions framework. The travel bans imposed by the Amending Instrument are reasonable because they are only imposed on persons who the Minister is satisfied have caused or attempted to cause, assisted with causing or attempted to assist with causing, or been otherwise complicit in causing or attempting to cause, a significant cyber incident or an attempted cyber incident that which, had it occurred, would have been significant

Preventing a person who meets the listing criteria in subregulation 6A(2) of the Regulations in relation to a serious cyber incident from travelling to, entering or remaining in Australia through operation of the Amending Instrument, is a reasonable means to achieve the legitimate foreign policy objective of signalling Australia’s stance on situations of international concern. Australia’s practice in this respect is consistent with that of other countries such as the United States, Canada, New Zealand, the European Union, and the United Kingdom.

The Minister may also waive the operation of a declaration that was made for the purpose of preventing a person from travelling to, entering or remaining in Australia, on the grounds that it would be in the national interest, or on humanitarian grounds. This decision is subject to natural justice requirements, and may be judicially reviewed.

Non refoulement

Right

The obligations relating to non-refoulement and the prohibition on torture and other cruel, inhuman or degrading treatment or punishment under Article 3 of the Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment (the CAT) and Article 7 of the ICCPR, as well as Article 6 of the ICCPR on the right to life and prohibition on arbitrary deprivation of life, may be engaged by the travel restrictions in the Amending Instrument. There is no permissible derogation from these implied or express non‑refoulement obligations.

No breach of obligations

To the extent that the travel bans imposed pursuant to the Amending Instrument engage Australia’s non-refoulement obligations, the Regulations allow the Minister to waive the operation of a travel ban on the grounds that it would be either: (a) in the national interest; or (b) on humanitarian grounds.

A travel ban may lead to the cancellation of a visa held by a non-citizen lawfully in Australia, which can lead to removal under section 198 of the Migration Act 1958. Australia will continue to meet its non‑refoulement obligations prior to the person becoming available for removal under the Migration Act 1958, including through the protection visa application process, and through the use of the Minister for Home Affairs’ personal powers in the Migration Act 1958.

The Amending Instrument is consistent with Australia’s international non-refoulement obligations as, together with the Minister’s powers to revoke a declaration or waive its operation in an individual case, non‑refoulement obligations are considered prior to a person becoming available for removal under the Migration Act 1958. A person must not be removed from Australia to another country if there is a real risk that the person may be subjected to arbitrary deprivation of life, the death penalty, torture, cruel or inhuman treatment or punishment, or degrading treatment or punishment.

Right to equality and non-discrimination

Right

The right to equality and non-discrimination under Article 26 of the ICCPR provides that everyone is entitled to enjoy their rights without discrimination of any kind, and that people are equal before the law and are entitled without discrimination to the equal and non-discriminatory protection of the law.

Differential treatment (including the differential effect of a measure that is neutral on its face) will not constitute unlawful discrimination if the differential treatment is based on reasonable and objective criteria, serves a legitimate objective, and is a proportionate means of achieving that objective.

Permissible limitations

Any differential treatment of people as a consequence of the application of the Amending Instrument does not amount to discrimination pursuant to Article 26 of the ICCPR.

The criteria set out in subregulation 6A(2) of the Regulations are reasonable and objective. They are reasonable insofar as they allow the Minister to list only those persons and entities the Minister is satisfied have caused or attempted to cause, assisted with causing or attempted to assist with causing, or been otherwise complicit in causing or attempting to cause, a significant cyber incident or an attempted cyber incident that which, had it occurred, would have been significant. They are objective, as they provide a clear, consistent and objectively verifiable reference point by which the Minister is able to make a designation or declaration. The Regulations serve a legitimate objective, as discussed throughout this Statement.

Denying access to international travel and the international financial system to certain designated individuals is a highly targeted, justified and less rights-restrictive means of achieving the aims of the Regulations, including in a context where other conventional mechanisms are unavailable.

While these measures may impact individuals of certain nationalities and national origins more than others, there is no information to support the view that affected groups are vulnerable. Rather, the individuals designated in the Amending Instrument are persons the Minister is satisfied are involved in activities that relate to a significant cyber incident.  Further, there are several safeguards, such as the availability of judicial review and regular review processes in place, to ensure that any limitation is proportionate to the objective being sought.

[1] Manfred Nowak, United Nations Covenant on Civil and Political Rights: CCPR Commentary (NP Engel, 1993) 178.