EXPLANATORY STATEMENT
Issued by authority of the Minister for Home Affairs
Security of Critical Infrastructure Act 2018
Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/021) 2022
1 The instrument, Departmental reference LIN 22/021, is made under section 61 of the Security of Critical Infrastructure Act 2018 (the Act).
2 The instrument amends the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (LIN 21/039) (F2021L01769) in accordance with subsection 33(3) of the Acts Interpretation Act 1901 (Acts Interpretation Act). That subsection provides that a power to make a legislative instrument includes a power to amend or repeal that instrument in the same manner, and subject to the same conditions, as the power to make the instrument.
3 The instrument commences on the day after registration on the Federal Registrar of Legislation and is a legislative instrument for the purposes of the Legislation Act 2003.
Purpose
4 The purpose of this instrument is to amend LIN 21/039 to:
- provide that the Department of Home Affairs is the ‘relevant Commonwealth body’ for the purpose of subsections 30BC(5) and 30BD(5) of the Act;
- clarify that the entities mentioned in Schedule 1 of LIN 21/039 are, for paragraph 12L(18)(e) of the Act, responsible entities for the intermodal transfer facilities that are ‘critical freight infrastructure assets’ under section 8;
- update the responsible entities for the intermodal transfer facilities located at Dynon—North and the Brighton Transport Hub; and
- correct a minor error in the drafting of the heading of section 16 of the instrument.
Consultation
5 The Office of Best Practice Regulation (OBPR) was consulted and considered that this instrument dealt with matters of a minor nature and no regulatory impact statement was required. The OBPR reference number is OBPR22-01797.
6 No further consultation was done for this instrument. This is because the instrument is only making minor amendments to ensure the correct operation of the Act, and broadly maintains what is already in force.
Details of the instrument
7 Details of the instrument are set out in Attachment A.
Parliamentary scrutiny etc.
8 The instrument is subject to disallowance under section 42 of the Legislation Act. A Statement of Compatibility with Human Rights has been prepared in relation to the instrument, and provides that there is no impact on human rights. The Statement is included at Attachment B.
9 The instrument was made by Karen Andrews, Minister for Home Affairs, in accordance with section 61 of the Act.
Attachment A
Details of the Security of Critical Infrastructure (Definitions) Amendment Instrument (LIN 22/021) 2022
Section 1 Name
This section provides that the name of the instrument is the Security of Critical Infrastructure (Definitions) Amendment Instrument (LIN 22/021) 2022 (the instrument).
Section 2 Commencement
This section provides that the instrument commences on the day after registration of the instrument on the Federal Register of Legislation.
Section 3 Amendment
This section provides that Schedule 1 to the instrument amends Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (LIN 21/039).
Schedule 1—Amendment
Item 1 Section 8
This item repeals and replaces section 8 of LIN 21/039.
Section 12B of the Act relevantly provides that a ‘critical freight infrastructure asset’ includes an intermodal transfer facility that, in accordance with subsection 12B(4), is critical to the transportation of goods between 2 States, a State and a Territory, 2 Territories or 2 regional centres.
New subsection 8(1) of LIN 21/039 provides that an intermodal transfer facility specified in Schedule 1 is critical to the transportation of goods between the places referred to in the subsection. New subsection 8(1) is substantially the same as the existing section 8 of the instrument. However, an updated list of intermodal transfer facilities is specified under item 4 of Schedule 1 (see below).
Subsection 12L(18) of the Act relevantly provides that the responsible entity for a critical freight infrastructure asset is the asset prescribed by the rules (see paragraph (e)). New subsection 8(2) clarifies that the entities mentioned in Schedule 1 (see item 4 of Schedule 1 below) are the responsible entities for the critical infrastructure assets mentioned in Schedule 1.
Item 2 Section 16 (heading)
This item amends the heading for section 16 of LIN 21/039 to refer to a ‘critical domain name asset’.
Item 3 After section 17
This item inserts a new section 18 into LIN 21/039, to prescribe the Department (i.e. the Department of Home Affairs) as the ‘relevant Commonwealth body’ for subsections 30BC(5) and 30BD(5) of the Act.
Under Part 2B of the Act, a responsible entity for an asset to which Part 2B applies is required to provide an oral or written report about a cyber security incident to the ‘relevant Commonwealth body’:
- for a critical cyber security incident—within 12 hours of becoming aware of the incident (subsection 30BC(1) of the Act); or
- for other cyber security incidents—within 72 hours of being aware (subsection 30BD(1)).
If a report is provided orally, the responsible entity is subsequently required to provide a written report about the incident (subsections 30BC(3) and 30BD(3) respectively) to the ‘relevant Commonwealth body’, unless that body has provided an exemption from providing the subsequent written report (subsections 30BC(5) and 30BD(5)).
Section 30BF of the Act provides that the ‘relevant Commonwealth body’ is the Australian Signals Directorate unless a Commonwealth Department or statutory agency has been prescribed for paragraphs (a) and (b). New section 18 of the instrument prescribes the Department (currently the Department of Home Affairs) to be the ‘relevant Commonwealth body’ for the purpose of subsections 30BC(5) and 30BD(5) only—this being provided for by subsection 33(3A) of the Acts Interpretation Act.
This provision will enable the Department to exercise those functions that relate to regulation and compliance, consistent with the other regulatory functions undertaken by the Department under the Act. ASD will remain as the ‘relevant Commonwealth body’ for the purpose of receiving reports about cyber security incidents. Subsection 18(1) provides that the Department of Home Affairs is the ‘relevant Commonwealth body’ for Part 2B of the Act (see paragraph 30BF(a)). However, subsection 18(2) qualifies this to provide that the Department of Home Affairs is only the relevant Commonwealth body for subsections 30BC(5) and 30BD(5) of the Act.
This means that the Department of Home Affairs is only the relevant Commonwealth body for the purposes of providing a responsible entity with an exemption from the requirement to provide a subsequent written report about the incident following an initial verbal report. The Australian Signals Directorate remains the relevant Commonwealth body for all other purposes in Part 2B of the Act, including to receive cyber security incident reports.
Item 4 Schedule 1, table
This item repeals and replaces the table in Schedule 1 to LIN 21/039 to include an updated list of intermodal transfer facilities (see subsection 8(1)) and the corresponding responsible entity (see subsection 8(2)).
By the operation of paragraph 12B(1)(c) of the Act and section 8 of LIN 21/039, this will mean that these intermodal transfer facilities are critical infrastructure assets for the purposes of the Act.
Attachment B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/021) 2022
This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Disallowable Legislative Instrument
The purpose of the Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/021) 2022 is to amend the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (LIN 21/039) to;
- clarify that the entities mentioned in Schedule 1 to the instrument are prescribed as the responsible entities for the critical freight infrastructure assets mentioned in the Schedule;
- specify that the Department of Home Affairs is the relevant Commonwealth body for the purposes of subsections 30BC(5) and 30BD(5) of the Security of Critical Infrastructure Act 2018 (the Act), under sections 30BF and 61 of that Act; and
- correct a minor typographical issue (the title of ‘critical domain name system’ in section 16 of LIN 21/039).
Responsible entities for critical freight infrastructure assets
Section 8 of, and Schedule 1 to, LIN 21/039 prescribe the intermodal terminals that are ‘critical freight infrastructure assets’ for the purpose of section 12B of the Act. These provisions are being amended to clarify that the entities listed in Schedule 1 are the responsible entities for the intermodal terminals for paragraph 12L(18)(e) of the Act.
Relevant Commonwealth body
Under Part 2B of the Act, there is a requirement that a responsible entity for a critical infrastructure asset provide a report on certain cyber security incidents to the relevant Commonwealth Body (see ss30BC and 30BD). Section 30BC(5) provides that the relevant Commonwealth Body is able to exempt a responsible entity from this requirement to report.
Section 30BF(c) provides that the default Commonwealth Body for the purposes of this section is Australian Signals Directorate (ASD). The intention of Security of Critical Infrastructure (Definitions) Rules (LIN 22/021) 2022 is to declare the Department of Home Affairs as the relevant Commonwealth Body, to enable it to provide this exemption. This change is purely an administrative adjustment to the operation of the legislation, i.e. to make the Department of Home Affairs the relevant Commonwealth body instead of ASD and therefore does not engage any of the applicable rights or freedoms.
Human rights implications
This Disallowable Legislative Instrument does not engage any of the applicable rights or freedoms.
Conclusion
This Disallowable Legislative Instrument is compatible with human rights as it does not raise any human rights issues.