REPLACEMENT EXPLANATORY STATEMENT
This Explanatory Statement replaces the Explanatory Statement registered on 4 July 2024 for the Financial Framework (Supplementary Powers) Amendment (Finance Measures No. 2) Regulations 2024 [F2024L00859] to provide further information about delegation of decision making in relation to the Voter Information Security Enhancement program.
Issued by the Authority of the Minister for Finance
Financial Framework (Supplementary Powers) Act 1997
Financial Framework (Supplementary Powers) Amendment
(Finance Measures No. 2) Regulations 2024
The Financial Framework (Supplementary Powers) Act 1997 (the FFSP Act) confers on the Commonwealth, in certain circumstances, powers to make arrangements under which money can be spent; or to make grants of financial assistance; and to form, or otherwise be involved in, companies. The arrangements, grants, programs and companies (or classes of arrangements or grants in relation to which the powers are conferred) are specified in the Financial Framework (Supplementary Powers) Regulations 1997 (the Principal Regulations). The powers in the FFSP Act to make, vary or administer arrangements or grants may be exercised on behalf of the Commonwealth by Ministers and the accountable authorities of non‑corporate Commonwealth entities, as defined under section 12 of the Public Governance, Performance and Accountability Act 2013.
The Principal Regulations are exempt from sunsetting under section 12 of the Legislation (Exemptions and Other Matters) Regulation 2015 (item 28A). If the Principal Regulations were subject to the sunsetting regime under the Legislation Act 2003, this would generate uncertainty about the continuing operation of existing contracts and funding agreements between the Commonwealth and third parties (particularly those extending beyond 10 years), as well as the Commonwealth’s legislative authority to continue making, varying or administering arrangements, grants and programs.
Additionally, the Principal Regulations authorise a number of activities that form part of intergovernmental schemes. It would not be appropriate for the Commonwealth to unilaterally sunset an instrument that provides authority for Commonwealth funding for activities that are underpinned by an intergovernmental arrangement. To ensure that the Principal Regulations continue to reflect government priorities and remain up to date, the Principal Regulations are subject to periodic review to identify and repeal items that are redundant or no longer required.
Section 32B of the FFSP Act authorises the Commonwealth to make, vary and administer arrangements and grants specified in the Principal Regulations. Section 32B also authorises the Commonwealth to make, vary and administer arrangements for the purposes of programs specified in the Principal Regulations. Section 32D of the FFSP Act confers powers of delegation on Ministers and the accountable authorities of non-corporate Commonwealth entities, including subsection 32B(1) of the Act. Schedule 1AA and Schedule 1AB to the Principal Regulations specify the arrangements, grants and programs.
Section 65 of the FFSP Act provides that the Governor-General may make regulations prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
The Financial Framework (Supplementary Powers) Amendment (Finance Measures No. 2) Regulations 2024 (the Regulations) amend Schedule 1AB to the Principal Regulations to establish legislative authority for government spending on the Voter Information Security Enhancement (VISE) grant program. The VISE program is administered by the Department of Finance.
The VISE program provides grants to qualifying Australian political parties to enhance the security of their constituent management systems and associated data, protect sensitive and personal information held on party systems, networks or premises, and strengthen the overall security of the information holdings and information networks. Qualifying political parties are the Australian Labor Party, the Liberal Party of Australia, The Nationals, and the Australian Greens.
Funding of $2.8 million over three years from 2023-24 is available for the VISE program.
Details of the Regulations are set out at Attachment A. A Statement of Compatibility with Human Rights is at Attachment B.
The Regulations are a legislative instrument for the purposes of the Legislation Act 2003.
The Regulations commence on the day after registration on the Federal Register of Legislation.
Consultation
In accordance with section 17 of the Legislation Act 2003, consultation has occurred with the qualifying political parties.
A regulatory impact analysis is not required as the Regulations only apply to non‑corporate Commonwealth entities and do not adversely affect the private sector.
Attachment A
Details of the Financial Framework (Supplementary Powers) Amendment
(Finance Measures No. 2) Regulations 2024
Section 1 – Name
This section provides that the title of the Regulations is the Financial Framework (Supplementary Powers) Amendment (Finance Measures No. 2) Regulations 2024.
Section 2 – Commencement
This section provides that the Regulations commence on the day after registration on the Federal Register of Legislation.
Section 3 – Authority
This section provides that the Regulations are made under the Financial Framework (Supplementary Powers) Act 1997.
Section 4 – Schedules
This section provides that the Financial Framework (Supplementary Powers) Regulations 1997 are amended as set out in the Schedule to the Regulations.
Schedule 1 – Amendments
Financial Framework (Supplementary Powers) Regulations 1997
Item 1 – In the appropriate position in Part 4 of Schedule 1AB (table)
This item adds one new table item to Part 4 of Schedule 1AB to establish legislative authority for government spending on an activity to be administered by the Department of Finance (the department).
New table item 668 establishes legislative authority for government spending on the Voter Information Security Enhancement (VISE) grant program.
Established in 2019-20, the VISE program is for qualifying political parties (the Australian Labor Party, the Liberal Party of Australia, The Nationals, and the Australian Greens) to enhance the security of their constituent management systems and associated data, to protect sensitive and personal information held on party systems, networks or premises, and to strengthen the overall security of the information holdings and information networks.
Grants funding of $2.8 million over three years from 2023-24 is available to the qualifying political parties to maintain or enhance security of sensitive voter data, or other policy or personal information, consistent with the intent of the policy. The protection of sensitive information includes information pertaining to the electoral rolls and voter information and can also include policy information and financial data. Funded activities may include measures that maintain, enhance, or build cyber or physical security capabilities such as:
- consulting services or other specialist labour providers for the design, planning, investigation, implementation and integration of the security controls, mitigation strategies, monitoring to detect attempted intrusion or attacks and assessment of security posture;
- information and communications technology hardware and software expenditure required to support the implementation of security controls and mitigation strategies; and
- physical security expenditure to support the implementation of enhanced security controls and mitigation strategies.
Eligible funding recipients can only spend grant funds on expenditure they have incurred on eligible grant activities or agreed project activities.
Qualifying political parties may apply for VISE grant funding annually, multiple times throughout a financial year, or apply for a grant that spans two or more financial years. The Government determined the four largest political parties to be eligible to apply for the grant. Funding is tiered based on the cyber security risk level faced by the largest political parties. Parties with a higher parliamentary representation have access to a larger quantity of sensitive voter information sourced from the Commonwealth Electoral Roll and consequently have a higher risk of damage from cyber penetration.
Qualifying political parties are required to submit an application for consideration by the department’s delegate, addressing how their proposed projects/activities align with the policy intent of the grant program including details about the overall project costs and design. The assessment will take into consideration that activities are consistent with eligible grant activities as outlined in the grant guidelines, how well the application meets the criteria, and whether it provides value with relevant money.
If the grant is approved, the application and signed Letter of Agreement forms a legally binding grant agreement between the Commonwealth, represented by the department and the political party responsible for the delivery of the approved grant activities. The department makes an initial payment on execution of the grant agreement subject to receipt of a valid tax invoice, for the first year of the grant project. For multi-year grants, subsequent payments are made annually as the political party achieves agreed milestones. This includes the provision of an updated project plan and receipt of a valid tax invoice, based on forecast eligible expenditure. Payments are subject to satisfactory progress.
Expenditure on VISE grants must be incurred between the start date and end (or completion) date of the grant activity for it to be eligible. Funding will only be provided as grants for substantiated expenditure that meet the eligibility requirements.
Grant funds cannot be pooled or carried across financial years, nor is it possible for grant recipients to draw upon other financial years’ allocations to fund activities from within the financial year for which they are claimed. Grant funds cannot be spent on activities that are not eligible grant activities or agreed project activities as outlined in the VISE Grant Guidelines. Specifically, grant funds are not to be used for the following activities:
- wages;
- major capital works; and
- administrative costs.
Eligible funding recipients must submit reports in line with the grant agreement and grant guidelines including annual reports where required and a final report on completion of the grant activity. Ad hoc reports may also be requested by the department to provide an update on progress, or any significant delays or difficulties in completing the grant activity.
The financial arrangement is in the form of a grant payment. The grant opportunity is a closed non-competitive selection process where applicants are invited by the entity to submit applications for a grant. Applications/proposals are not assessed against other applicants’ submissions but assessed individually against the grant assessment criteria.
The Public Governance, Performance and Accountability Act 2013 (PGPA Act) and the Commonwealth Grants Rules and Guidelines 2017 (CGRGs) govern the program and administration of funding, requiring that all commitments of public resources to be efficient, effective, economical and ethical.
The VISE grant is assessed on the merits of the application relative to the grant guidelines (how well it meets the assessment criteria and whether it provides value with relevant money). The assessment for each application will be assessed by the Assistant Secretary responsible for the grant administered by the department. The assessment will also be considering the availability of grant funds for the purposes of the grant program.
The Assistant Secretary is responsible for administration of the grant, including making final decisions on allocation of grant fundings following assessment of successful applicants. The Assistant Secretary responsible is required to have experience and qualifications in exercising appropriate financial delegations. Additionally, the Assistant Secretary requires appropriate skills and experience in the Information Technology field and/or a network of subject matter experts with whom to consult as required. This is the case with the current holder of the position.
The delegate’s function is limited to the annual appropriation for the grant, the grant guidelines and the department’s Internal Financial Delegation Instrument and Accountable Authority Instructions.
The VISE program grant opportunity guidelines have been exempted from publication on GrantConnect.
Merits review of decisions made in connection with the VISE grant program would not be considered appropriate. The grant is delivered as a closed non-competitive process with finite amount of funding available for each financial year. The allocation of funding is fixed and any variation to the funding will require further consideration by the Government. In line with the Commonwealth Grants Policy Framework, grants cannot exceed the amount of available funds. In addition, the Government determined the Australian Labor Party, the Liberal Party of Australia, The Nationals and the Australian Greens to be eligible to apply for a grant. This means an allocation that has already been made to another party would be affected by overturning the original decision. The Administrative Review Council has recognised that it is justifiable to exclude merits review in relation to decisions of this nature (see paragraphs 4.11 to 4.15 of the guide, What decisions should be subject to merit review?).
The four largest political parties were identified and assessed as being eligible to apply for a grant due to their higher parliamentary representation and access to a larger quantity of sensitive voter information sourced from the Commonwealth Electoral Roll. Consequently, these parties have a higher risk of damage from cyber penetration.
The department consulted with the qualifying political parties on the VISE Grant Guidelines prior to the program being re-established. As the recipients of the grant and the primary organisations affected by the program, these parties were consulted on the guidelines. Public consultation was not considered appropriate due to the nature of the program and potential security implications of releasing the guidelines to the public. The department also sought expertise from Australian security agencies on the draft grant guidelines.
In preparing for the continuation of the VISE grant for 2023-26, expertise was also sought from the Department of the Prime Minister and Cabinet.
Funding of $2.8 million is provided over three years, commencing in 2023-24. Funding is drawn from Program 3.1: Ministerial and Parliamentary Services, which is part of Outcome 3. Details are set out in the Portfolio Budget Statements 2023-24, Budget Related Paper No. 1.7 Finance Portfolio at page 61.
Initially, funding of $2.7 million for the program was included in the 2019-20 Mid-Year Economic and Fiscal Outlook under the measure ‘Cyber Security Resilience and Workforce Package’ for a period of four years commencing in 2019-20 (page 179 and 203).
Noting that it is not a comprehensive statement of relevant constitutional considerations, the objective of the item references the following powers in the Constitution:
• the communications power (section 51(v) of the Constitution);
• the external affairs power (section 51(xxix) of the Constitution);
• various powers to make laws in relation to elections and referendums (sections 9, 10, 30, 31, 128 and 51(xxxvi) of the Constitution);
• the defence power (section 51(vi) of the Constitution); and
• the express incidental power and the executive power (sections 51(xxxix) and 61 of the Constitution), including the nationhood aspect.
Communications power
Section 51(v) of the Constitution empowers the Parliament to make laws with respect to ‘postal, telegraphic, telephonic and other like services’. An objective of VISE is to enable the main political parties to protect their IT systems against cyber-attack, which are carried out by making online communications.
External affairs power
Section 51(xxix) of the Constitution empowers the Parliament to make laws with respect to ‘external affairs’. The external affairs power supports legislation implementing Australia’s international obligations under treaties to which it is a party.
Article 17 of the International Covenant on Civil and Political Rights (ICCPR) provides a right against arbitrary and unlawful interference with a person’s privacy, family, home, or correspondence. Article 2 of the ICCPR provides an obligation on State Parties to adopt laws and measures to give effect to the rights outlined in the treaty.
The objective of VISE is to protect the security of voter information on electoral rolls, which assists to prevent arbitrary or unlawful interference with private information and assists with meeting Australia’s obligations under Articles 2 and 17 of the ICCPR.
Various powers to make laws in relation to elections
Sections 9, 10, 30, 31, 128 and 51(xxxvi) of the Constitution empower the Parliament to make laws in relation to elections. VISE will provide grants to protect the security of voter information contained on electoral rolls and used for elections by political parties.
Defence power
Section 51(vi) of the Constitution empowers the Parliament to make laws with respect to ‘the naval and military defence’ of the Commonwealth and States, and ‘the control of the forces to execute and maintain the laws of the Commonwealth’. An objective of VISE is to protect voter information being used or manipulated by entities seeking to disrupt Australian elections or otherwise cause harm to Australia.
Executive power and express incidental power
The express incidental power in section 51(xxxix) of the Constitution empowers the Parliament to make laws with respect to matters incidental to the execution of any power vested in the Parliament, the executive or the courts by the Constitution. Section 61 of the Constitution supports activities that are peculiarly adapted to the government of a nation and cannot be carried out for the benefit of the nation otherwise than by the Commonwealth.
As with the powers to make laws in relation to elections, the grants will assist with the protection of the integrity and effectiveness of Australia’s parliamentary system by securing voter information contained on electoral rolls and used for elections by political parties.
Attachment B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Financial Framework (Supplementary Powers) Amendment (Finance Measures No. 2) Regulations 2024
This disallowable legislative instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the legislative instrument
Section 32B of the Financial Framework (Supplementary Powers) Act 1997 (the FFSP Act) authorises the Commonwealth to make, vary and administer arrangements and grants specified in the Financial Framework (Supplementary Powers) Regulations 1997 (the FFSP Regulations) and to make, vary and administer arrangements and grants for the purposes of programs specified in the Regulations. Schedule 1AA and Schedule 1AB to the FFSP Regulations specify the arrangements, grants and programs. The powers in the FFSP Act to make, vary or administer arrangements or grants may be exercised on behalf of the Commonwealth by Ministers and the accountable authorities of non‑corporate Commonwealth entities, as defined under section 12 of the Public Governance, Performance and Accountability Act 2013.
The Financial Framework (Supplementary Powers) Amendment (Finance Measures No. 2) Regulations 2024 amend Schedule 1AB to the FFSP Regulations to establish legislative authority for government spending on the Voter Information Security Enhancement (VISE) grant program. The VISE program is administered by the Department of Finance.
The VISE program (new item 668 in Part 4 of Schedule 1AB of the FFSP Regulations) provides grant funding to qualifying political parties (the Australian Labor Party, the Liberal Party of Australia, The Nationals, and the Australian Greens) to enhance the security of their constituent management systems and associated data, protect sensitive and personal information held on party systems, networks or premises, and strengthen the overall security of the information holdings and information networks.
Grants funding of $2.8 million over three years from 2023-24 is available to the qualifying political parties to maintain or enhance security of sensitive voter data, or other policy or personal information, consistent with the intent of the policy. This includes measures that maintain, enhance, or build cyber or physical security capabilities such as:
- consulting services or other specialist labour providers for the design, planning, investigation, implementation and integration of the security controls, mitigation strategies, monitoring to detect attempted intrusion or attacks and assessment of security posture;
- ICT Hardware and Software expenditure required to support the implementation of security controls and mitigation strategies; and
- physical security expenditure to support the implementation of enhanced security controls and mitigation strategies.
Human rights implications
This disallowable legislative instrument engages the right against arbitrary or unlawful interference with privacy as set out in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), read with Article 2 of the ICCPR.
Article 2 of the ICCPR requires each State Party to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognised in the ICCPR, without distinction of any kind, such as race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status. It further provides where not already provided for by existing legislative or other measures, each State Party will take the necessary steps, in accordance with its constitutional processes to adopt such laws or other measures as may be necessary to give effect to the rights recognised in the ICCPR.
Article 17 of the ICCPR provides that no one shall be subjected to arbitrary interference with their privacy, family, home or correspondence, nor to attacks upon their honour and reputation.
The VISE grant program supports these rights by enhancing the cyber security of voters’ information and their personal data. This supports and promotes the protection of individual rights to privacy.
Conclusion
This disallowable legislative instrument is compatible with human rights because it promotes the protection of human rights.
Senator the Hon Katy Gallagher
Minister for Finance