Explanatory Statement

Issued by the Authority of the Minister for Foreign Affairs (the Minister)

Autonomous Sanctions Regulations 2011

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 5) Instrument 2024

Autonomous sanctions are measures not involving the use of armed force which the Australian Government imposes as a matter of foreign policy in response to situations of international concern. Such situations include significant cybercrime incidents, and malicious cyber activity threatening Australians and Australian government entities. 

Autonomous thematic cyber sanctions demonstrate Australia’s commitment to deterring and responding robustly to malicious and significant cyber incidents. The imposition of sanctions also signals to persons and entities targeting Australia and other countries through malicious cyber activity, that they will be held responsible for their actions. Sanctions can have a serious deterrent effect on individual actors and entities, exposing their activities and imposing restrictions on their actions, particularly when imposed in collaboration with likeminded partners.

The Autonomous Sanctions Regulations 2011 (the Regulations) make provision for, among other things, the proscription of persons or entities for autonomous thematic sanctions in response to significant cyber incidents. Subregulation 6A(2) of the Regulations enables the Minister to designate a person or entity for targeted financial sanctions and/or declare a person for the purposes of a travel ban, in a range of circumstances, including if the Minister is satisfied (pursuant to paragraphs 6A(2)(a) and/or 6A(2)(b) of the Regulations, ‘Significant Cyber Incident criteria’) that the person or entity has caused, assisted with causing, or been complicit in, a cyber incident or an attempted cyber incident that is significant or which, had it occurred, would have been significant.

In determining whether a cyber incident is ‘significant’, the Minister may have regard to:

• whether the conduct of the person or entity was malicious;
• whether the cyber incident involved any of the following:
  • actions that destroyed, degraded or rendered unavailable an essential service or critical infrastructure;
  • actions that resulted in the loss of a person’s life, or caused serious risk of loss of a person’s life;
  • theft of intellectual property, trade secrets or confidential business information for the purposes of gaining a competitive advantage for an entity or a commercial sector;
  • interference with a political or governmental process, the exercise of a political right or duty, or the functions or operations of a parliament;
• whether the attempted cyber incident, had it occurred, could reasonably be expected to have involved one or more of the matters mentioned above; and
• any other matters the Minister considers relevant.

The purpose of a designation is to subject the designated person or entity to targeted financial sanctions. There are two types of targeted financial sanctions under the Regulations:

• the designated person or entity becomes the object of the prohibition in regulation 14 (which prohibits directly or indirectly making an asset available to, or for the benefit of, a designated person or entity, other than as authorised by a permit granted under regulation 18); and/or
• an asset owned or controlled by a designated person or entity is a “controlled asset”, subject to the prohibition in regulation 15 (which prohibits a person who holds that asset from either using or dealing with that asset, or allowing it to be used or dealt with, or facilitating the use of or dealing with it, other than as authorised by a permit granted under regulation 18).

The purpose of a declaration is to prevent a person from travelling to, entering or remaining in Australia.

Designated and declared persons, and designated entities, in relation to significant cyber incidents are listed in the Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022 (the 2022 List).

Section 10(4) of the Autonomous Sanctions Act 2011 (the Act) provides that, before deciding to designate or declare a person or entity for thematic sanctions, the Minister must consult and obtain the agreement in writing of the Attorney-General, and consult such other Ministers as the Minister considers appropriate. These provisions ensure that thematic sanctions listing decisions take account of all relevant foreign policy and other national interest considerations.

Subregulation 6A(7) of the Regulations provides that the Minister must not make a designation or declaration unless the Minister is satisfied that the conduct of the person or entity concerned occurred, in whole or in part, outside Australia.

The Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 5) Instrument 2024 (the Amending Instrument) designates and declares three persons for  targeted financial sanctions and travel bans under the Significant Cyber Incident criteria. The Minister exercised their discretion to make the designations and declarations being satisfied that each person met the criteria under subregulations 6A(2) and 6A(3), and being satisfied that the relevant conduct concerned occurred, in whole or in part, outside Australia per subregulation 6A(7).

Details of the Amending Instrument, which amends the 2022 List, are set out at Attachment A.

This listing demonstrates Australia’s ongoing commitment to deterring and responding robustly to malicious and significant cyber incidents.  The listing is consistent with our national interest to impose costs on, influence and deter those responsible for malicious cyber activity.

Under subregulations 9(1) and (2) of the Regulations, designations and declarations that are made under regulation 6A of the Regulations cease to have effect three years after the date on which they took effect, unless the Minister declares they are to continue pursuant to subregulation 9(3).

The legal framework for the imposition of thematic sanctions for significant cyber incidents was a focus of a 12‑month Parliamentary inquiry which received written and oral submissions from both government and civil society. Measures included in the Autonomous Sanctions Amendment (Magnitsky-style and Other Thematic Sanctions) Act 2021 implemented key aspects of the Australian Government’s response (tabled 5 August 2021) to the Joint Standing Committee on Foreign Affairs, Defence and Trade’s report on its inquiry ‘Criminality, corruption and impunity: Should Australia join the Global Magnitsky movement?’. 

The power to list persons and entities for thematic sanctions forms part of Australia’s legal framework for the imposition and implementation of targeted financial sanctions and travel bans. This framework was the subject of extensive consultation with government and non-government stakeholders at the time of its introduction. The new sanctions being imposed through the making of the Amending Instrument were subject to wide consultation within the Government (including the written agreement of the Attorney-General).

In order to meet the policy objective of prohibiting unauthorised financial transactions involving the persons specified in the Amending Instrument, the Minister is satisfied that wider consultations beyond those already undertaken would not be appropriate or reasonably practicable (subsections 17(1) and (2) of the Legislation Act 2003). Consultation would risk alerting persons to the impending sanctions and enabling capital flight before assets can be frozen.

The Office of Impact Analysis has advised that a Regulation Impact Statement is not required for listing instruments of this nature (OBPR22-02078).

This Instrument is exempt from sunsetting under table item 10B of section 12 of the Legislation (Exemptions and Other Matters) Regulation 2015 on the basis that it is subject to a more stringent statutory review process than is set out in Part 4 of Chapter 3 of the Legislation Act 2003.

Attachment A

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 5) Instrument 2024

Section 1

The title of the instrument is the Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No.5) Instrument 2024 (the Amending Instrument).

Section 2

The whole of the Amending Instrument commences the day after the instrument is registered.

Subsection 2(2) is a technical provision that makes clear that any information inserted in column 3 of the table about the specific date of commencement is not part of the Amending Instrument and can be inserted or edited at a later date.

Section 3

The Amending Instrument is made under subregulation 6A(2) of the Autonomous Sanctions Regulations 2011 (the Regulations).

Section 4

Each instrument that is specified in a Schedule to the Amending Instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to the Amending Instrument has effect according to its terms.

Schedule 1

Autonomous Sanctions (Designated Persons and Entities and Declared Persons – Thematic Sanctions) Instrument 2022

Item 1

The persons listed in the table in Item 1 are designated by the Minister for targeted financial sanctions under paragraph 6A(2)(a) of the Regulations and declared by the Minister for the purposes of a travel ban under paragraph 6A(2)(b) of the Regulations.

The Minister exercised their discretion to make these designations and declarations being satisfied that:

• the persons meet the criteria in subregulation 6A(2) of the Regulations;
• the relevant cyber incident was significant, having regard to the matters in subregulation 6A(3) of the Regulations; and
• the relevant conduct occurred in whole or in part outside of Australia per subregulation 6A(7) of the Regulations.

The three persons are all cybercriminals with senior involvement in the Russian cybercrime syndicate Evil Corp, as well as its precursor groups and subgroups.

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the

Human Rights (Parliamentary Scrutiny) Act 2011

Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 5) Instrument 2024

The Autonomous Sanctions (Designated Persons and Entities and Declared Persons—Thematic Sanctions) Amendment (No. 5) Instrument 2024 (the Amending Instrument) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Australia’s autonomous sanctions frameworks impose highly targeted measures in response to situations of international concern. Such situations include threats to ongoing access to services and to the protection of private or sensitive information posed by the use of cyber enabled crime.

The autonomous sanctions designations and declarations made by the Amending Instrument pursue legitimate objectives and have appropriate safeguards in place to ensure that any limitation on human rights engaged by the imposition of these sanctions is a reasonable, necessary and proportionate response to the relevant significant cyber incident, and do not affect particularly vulnerable groups. The Government keeps its sanctions frameworks under regular review, including in relation to whether more effective, less rights restrictive means are available to achieve similar foreign policy objectives.

The Autonomous Sanctions Regulations 2011 (the Regulations) make provision for, among other things, the proscription of persons or entities for autonomous sanctions. The Amending Instrument designates persons for targeted financial sanction and declares persons for the purposes of travel bans. The Minister for Foreign Affairs (the Minister) made the designations and declarations being satisfied (pursuant to subregulation 6A(2) of the Regulations) that the persons have caused, assisted with causing, or been complicit in, a cyber incident or an attempted cyber incident that is significant or which, had it occurred, would have been significant, in accordance with subregulation 6A(3). The Minister was also satisfied that the conduct of the persons occurred, wholly or in part, outside of Australia (pursuant to subregulation 6A(7) of the Regulations).

The human rights compatibility of the Amending Instrument is addressed by reference to each of the human rights engaged below.

Right to privacy

Right

Article 17 of the International Covenant on Civil and Political Rights (the ICCPR) prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence.

The use of the term ‘arbitrary’ in the ICCPR means that any interferences with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the individual circumstances. Arbitrariness connotes elements of injustice, unpredictability, unreasonableness, capriciousness and ‘unproportionality’.[1]

Permissible limitations

The Amending Instrument is not an unlawful interference with an individual’s right to privacy. Section 10 of the Autonomous Sanctions Act 2011 permits regulations relating to, among other things: ‘proscription of persons or entities (for specified purposes or more generally)’; and ‘restriction or prevention of uses of, dealings with, and making available of, assets’. The designation and declaration contained in the Amending Instrument was made pursuant to regulation 6A of the Regulations, which provides that the Minister may, by legislative instrument, designate a person for targeted financial sanctions and/or declare a person for a travel ban.

The measures contained in the Amending Instrument are not an arbitrary interference with an individual’s right to privacy. An interference with privacy will not be arbitrary where it is reasonable, necessary and proportionate in the individual circumstances.

In designating a person under the Regulations for targeted financial sanctions and/or declaring a person for a travel ban, the Minister uses predictable, publicly available criteria. These criteria are designed to capture only those persons the Minister is satisfied are involved in situations of international concern, as set out in regulation 6A of the Regulations.

Accordingly, targeted financial sanctions and travel bans imposed by the Minister through the designation and declaration of specific persons (as well as their continuation) under the Regulations are reasonable, necessary and proportionate to the individual circumstances the sanction is seeking to address. Any interference with the right to privacy created by the operation of the Amending Instrument is not arbitrary or unlawful and is consistent with Australia’s obligations under Article 17 of the ICCPR.

Right to respect for the family

Right

The right to respect for the family is protected by Articles 17 and 23 of the ICCPR. It covers, among other things, the separation of family members under migration laws, and arbitrary or unlawful interferences with the family.

Limitations on the right to respect for the family under Articles 17 and 23 of the ICCPR will not violate those articles if the measures in question are lawful and non‑arbitrary. Any interference with respect for the family will be consistent with the ICCPR where it is necessary and proportionate, in accordance with the provisions, aims and objectives of the ICCPR, and is reasonable in the individual circumstances.

Permissible limitations

As set out above, the autonomous sanctions framework is authorised by domestic law and is not unlawful.

As the listing criteria in regulation 6A of the Regulations are drafted to address themes of international concern, and it is a requirement that, to constitute a significant cyber incident, the relevant conduct must have occurred wholly, or in part, outside of Australia in accordance with regulation 6A(7), it is highly unlikely, as a practical matter, that a person declared for a travel ban holds an Australian visa, usually resides in Australia and/or has immediate family also in Australia.

The Department of Foreign Affairs and Trade consults relevant agencies, as appropriate, in advance of the designation and declaration of a person with known connections to Australia to consider the possible impacts of the designation and declaration on any family members in Australia.

To the extent that the travel ban imposed by the Amending Instrument engages and limits the right to respect for the family in a particular case, the Regulations provide sufficient flexibility to treat each case differently. Under subregulation 19(3) of the Regulations, the Minister may waive the operation of a travel ban either: (a) on the grounds that it would be in the national interest; or (b) on humanitarian grounds. This provides a mechanism to address circumstances in which issues such as the possible separation of family members in Australia are involved. In addition, this decision may be judicially reviewed. Finally, were such a separation to take place, for the reasons outlined in relation to Article 17 of the ICCPR (discussed above), such a separation would be reasonable, necessary, proportionate and justified in achieving the objectives of the Amending Instrument.

Accordingly, any interference with the right to respect for the family created by the operation of the Amending Instrument is not unlawful or arbitrary and is consistent with Australia’s obligations under Articles 17 and 23 of the ICCPR.

Right to an adequate standard of living

Right

The right to an adequate standard of living is contained in Article 11(1) of the International Covenant on Economic, Social and Cultural Rights (the ICESCR) and requires States to ensure the availability and accessibility of the resources that are essential to the realisation of the right, including adequate food, water, clothing, and housing.

Article 4 of the ICESCR provides that this right may be subject to such limitations ‘as are determined by law only in so far as this may be compatible with the nature of these rights and solely for the purpose of promoting the general welfare in a democratic society’. To be consistent with the ICESCR, limitations must be proportionate.

Permissible limitations

Any limitation on the enjoyment of Article 11(1) of the ICESCR, to the extent that it occurs, is reasonable and necessary to achieve the objective of the Amending Instrument and is proportionate due to the targeted nature of the listing. The Regulations also provide sufficient flexibility to treat each case differently by allowing for any adverse impacts on family members, as a consequence of targeted financial sanctions, to be mitigated. The Regulations provide for the payment of basic expenses (among others) in accordance with permits granted by the Minister under regulation 18. The objective of regulation 20, which allows applications to be made to the Minister for permits to pay basic expenses is, in part, to enable the Australian Government to administer the sanctions framework in a manner compatible with relevant human rights standards.

The permit process is a flexible and effective safeguard on any limitation to the enjoyment of Article 11(1) of the ICESCR.

Right to freedom of movement

Right

Article 12 of the ICCPR protects the right to freedom of movement, which includes a right to leave Australia, as well as the right to enter, remain, or return to one’s ‘own country’.

The right to freedom of movement may be restricted under domestic law on any of the grounds in Article 12(3) of the ICCPR, namely national security, public order, public health or morals or the rights and freedoms of others. Any limitation on the enjoyment of the right also needs to be reasonable, necessary and proportionate.

Permissible limitations

As the listing criteria in regulation 6A of the Regulations are drafted to address themes of international concern, including cyber enabled conduct occurring wholly, or in part, outside of Australia, it is highly unlikely, as a practical matter, that a person declared for a travel ban would be an Australian citizen, or have spent such lengths of time in Australia, such that Australia could be considered their ‘own country’. Furthermore, travel bans – which are a power to refuse or to cancel a visa – do not apply to Australian citizens.

To the extent that Article 12(4) of the ICCPR is engaged in an individual case, such that a person listed in the Amending Instrument is prevented from entering Australia and Australia is properly described as their ‘own country’, the imposition of the travel ban would be justified.

As set out above in relation to Article 17 of the ICCPR, travel bans are a reasonable, necessary and proportionate means of achieving the legitimate objectives of Australia’s autonomous sanctions framework. Travel bans are reasonable because they are only imposed on persons who the Minister is satisfied are responsible for giving rise to situations of international concern, including significant cyber incidents.

Preventing a person who has, or has attempted to, cause, assist with, or been complicit in a significant cyber incident, from travelling to, entering, or remaining in Australia through the operation of the Amending Instrument, is a reasonable means to achieve the legitimate foreign policy objective of deterring and responding robustly to malicious and significant cyber incidents. Australia’s practice in this respect is consistent with that of other jurisdictions such as the United States, the European Union, and the United Kingdom.

The Minister may also waive the operation of a declaration that was made for the purpose of preventing a person from travelling to, entering or remaining in, Australia, either: (a) on the grounds that it would be in the national interest; or (b) on humanitarian grounds. This decision is subject to natural justice requirements, and may be judicially reviewed.

Non-refoulement

Right

The obligations relating to the prohibition on refoulement under Article 3 of the Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment (the CAT) and the prohibition on torture and other cruel, inhuman or degrading treatment or punishment in Article 7 of the ICCPR, as well as the right to life and prohibition on arbitrary deprivation of life in Article 6 of the ICCPR, may be engaged by the travel restrictions in the Amending Instrument. There is no permissible derogation from these implied or express non‑refoulement obligations.

Permissible limitations

To the extent that the travel bans imposed pursuant to the Amending Instrument engage Australia’s non-refoulement obligations, the Regulations allow the Minister to waive the operation of a travel ban either: (a) on the grounds that it would be in the national interest; or (b) on humanitarian grounds.

A travel ban may lead to the cancellation of a visa held by a non-citizen lawfully in Australia, which can lead to removal under section 198 of the Migration Act 1958. Australia will continue to meet its non-refoulement obligations through mechanisms prior to the person becoming available for removal under the Migration Act 1958, including through the protection visa application process, and through the use of the Minister for Home Affairs’ personal powers in the Migration Act 1958.

The Amending Instrument is consistent with Australia’s international non-refoulement obligations as, together with the Minister’s powers to revoke a declaration or waive its operation in an individual case, non‑refoulement obligations are considered prior to a person becoming available for removal under the Migration Act 1958.  A person must not be removed from Australia to another country if there is a real risk that the person may be subjected to arbitrary deprivation of life, the death penalty, torture, cruel or inhuman treatment or punishment, or degrading treatment or punishment.

Right to equality and non-discrimination

Right

The right to equality and non-discrimination under Article 26 of the ICCPR provides that everyone is entitled to enjoy their rights without discrimination of any kind, and that people are equal before the law and are entitled without discrimination to the equal and non-discriminatory protection of the law.

Differential treatment (including the differential effect of a measure that is neutral on its face) will not constitute unlawful discrimination if the differential treatment is based on reasonable and objective criteria, serves a legitimate objective, and is a proportionate means of achieving that objective.

Permissible limitations

Any differential treatment of people as a consequence of the application of the Amending Instrument does not amount to discrimination pursuant to Article 26 of the ICCPR.

The criteria set out in regulation 6A of the Regulations are reasonable and objective. They are reasonable insofar as they allow the Minister to list only those persons and entities that the Minister is satisfied have been involved in situations of international concern, including significant cyber incidents. They are objective, as they provide a clear, consistent and objectively-verifiable reference point by which the Minister is able to make a designation or declaration. The Regulations serve a legitimate objective, as discussed throughout this Statement.

Denying access to international travel and the international financial system to certain designated persons is a highly targeted, justified and minimally rights-restrictive means of achieving the aims of the Regulations, including in a context where other conventional mechanisms are unavailable.

While these measures may impact persons of certain nationalities and national origins more than others, there is no information to suggest that any affected person is particularly vulnerable. Rather, the person is listed in the Amending Instrument as a result of the Minister being satisfied that they were involved in a significant cyber incident.  Further, there are several safeguards in place, such as the availability of judicial review, and regular review processes, to ensure that any limitation on rights is proportionate to the Amending Instrument’s objective.

[1] Manfred Nowak, United Nations Covenant on Civil and Political Rights: CCPR Commentary (NP Engel, 1993) 178.