Security of Critical Infrastructure Rules 2018

10.  This clause provides that the title of the instrument is the Security of Critical Infrastructure Rules 2018.

11.  This clause provides that the provisions in this instrument will come into effect on the day the instrument is registered, or the day the Security of Critical Infrastructure Act 2018 (the SOCI Act) commences, whichever occurs later.

12.  The SOCI Act will commence on 11 July 2018.  It is intended that the Rules commence on the same day as the SOCI Act to ensure there is certainty about which electricity generation stations and gas transmission pipelines are captured under the SOCI Act.  These Rules also further clarify what ‘operational information’ is required to be provided under the SOCI Act.    

14.  Act in the Rules means the SOCI Act.

15.  Nameplate rating relates to gas transmission pipelines specifically, and means the maximum quantity of gas that a specific gas transmission pipeline can transport on a day under normal operating conditions.  This definition is consistent with industry understanding and the regulations under which gas is transmitted by the Australian Energy Market Operator.  While nameplate capacities can change frequently, they do not do so with such significance as would likely cause a particular gas pipeline to fall within and outside of the threshold on a regular basis.   

16.  Smart meter means a meter or device that can measure and remotely communicate information relating to the usage or consumption of electricity, water, gas, or any other product, that is produced or supplied by an infrastructure asset.  Unlike meters that need to be manually read by a meter reader, smart meters are able to communicate information remotely. Usage of electricity, water, gas refer to three of the four sectors currently covered by the Act, as smart meters do not have the same direct relevance to the ports sector). 

17.  The terms ‘or any other product’ is included as a measure to future-proof the definition if at a later stage further sectors are included under the Act.  The terms ‘produced or supplied’ clarify that while some sectors may ‘produce’ the product (for example the energy sectors ‘produce’ gas and electricity), other sectors may only ‘supply’ the product (for example the water sector ‘supplies’ water, rather than a produces it).   

18.  Read in conjunction, the phrase ‘that is produced or supplied by an infrastructure asset’ ensures that the responsible entity for a critical infrastructure asset is only required to provide this information in relation to that particular infrastructure asset.  For example, if a responsible entity for a critical electricity asset is providing operational information on the Register, but it also has access to smart meters or consumption information in relation to a critical gas asset, it is not required to provide the gas asset information. 

21.  System restart ancillary service is defined at clause 6(2) and means an electricity generation station that is able to start without an external power supply; and connect and provide energy to an electricity network or an electricity system for the transmission of distribution of electricity.  An electricity generation station includes all the generating units in the station.  Electricity generation stations that provide a system restart ancillary service are able to restart generators in the electricity network and ultimately commence restoration of load in the event of a blackout.

22.  This clause sets out what data arrangements responsible entities must report as ‘operational information’ on the Register of Critical Infrastructure Assets (the ‘Register’) as authorised under paragraphs 7(1)(f) and (g) of the Act.

23.  Part 2, Division 2 of the SOCI Act establishes the ‘Register’ which provides a more detailed understanding of who owns and controls ‘critical infrastructure assets.’ The ‘Register’ requires ‘reporting entities,’ who are either ‘direct interest holders’ or the ‘responsible entity’ of ‘critical infrastructure assets,’ to provide ‘interest and control information’ and ‘operational information’ within a certain timeframe. This information will assist the Government to identify who owns and controls the asset, its board structure, ownership rights of interest holders, and operational, outsourcing and offshoring information.

24.  The information which will be required to be reported under clause 5 by the ‘responsible entity’ will provide the Government with visibility of those data arrangements in the ‘critical infrastructure assets’ covered by the Act. This information contributes to the Government’s understanding of how the ‘critical infrastructure asset’ and sector operates, and where there may be vulnerabilities. It also informs the Government’s ability to work cooperatively with industry to develop strategies to mitigate or reduce ‘national security’ risk.

25.  Given the critical importance of data, and its potential attractiveness for espionage and sabotage purposes, this clause ensures the Australian Government has visibility of any outsourced and offshored arrangements relating to data. Clause 5(2) clarifies that this provision only applies if the responsible entity for a critical infrastructure asset do not maintain the data itself; or if it is maintained by the responsible entity, but at a location outside Australia.

26.  Clause 5(2)(c) specifies which sets of data are relevant for the purposes of this provision:

27.  These data sets bear the highest level of risk in relation to acts of sabotage, espionage or coercion. This has been assessed with respect to each data set’s value and vulnerability. The consequence of unintended disclosure of information will depend on the profile of that information and could affect the:

28.  Clause 5(3) provides a description of what information the responsible entity needs to provide in relation to its data arrangements including:

29.  The information required to be provided under clause 5(3)(b)(i)-(iii) is consistent with operational information the responsible entity is required to provide about itself and its operators under section 7 of the Act.

30.  The SOCI Act contains a range of powers, functions and obligations that apply to those assets captured by the Act. The assets captured by the SOCI Act include networks, systems or interconnectors used for the transmission or distribution of electricity that ultimately service 100,000 customers. The SOCI Act also applies to electricity generation stations that are critical to ensuring the security and reliability of an electricity system or network in a state or territory. The SOCI Act enables the rules to prescribe the requirements for an electricity generation station to be critical.

31.  This clause prescribes the requirements for an electricity generation station to be a ‘critical electricity asset’ for the purposes of the SOCI Act, as authorised by subsection 10(2).

32.  For the purposes of the SOCI Act, an electricity generation station is a ‘critical infrastructure asset’ if it meets specified thresholds or is contracted to provide system restart services.

33.  Clause 6(1) has the effect of applying the Act to synchronous electricity generation stations above a particular megawatt (MW) threshold in the jurisdiction in which it is located. The thresholds for each jurisdiction are:

34.  These thresholds are consistent with the MW capacities held in reserve for each jurisdiction (i.e. the system is designed to be able to withstand the loss of this level of MW capacity).

35.  Synchronous electricity generators play a significant role in the security and reliability of an electricity system or network in a state or territory because their output frequency can be more easily regulated to remain at a constant value, and they can easily accommodate load power variations.

36.  Clause 6(1) also has the effect of applying the SOCI Act to electricity generation stations contracted to provide a system restart ancillary service in the station’s State or Territory.

37.  These generation stations are able to start without an external power supply and, connect and provide energy to an electricity system or network for the transmission or distribution of electricity. They provide the ability to restart generators in the electricity network and ultimately commence restoration of load, such as in the event of a black out.

38.  The SOCI Act contains a range of powers, functions and obligations that apply to assets captured by the Act. Section 12 of the SOCI Act sets out the gas assets which are captured by the Act. This includes storage, processing and distribution gas assets that meet certain specified thresholds. The SOCI Act also captures those gas transmission pipelines critical to ensuring the security and reliability of a gas market. The SOCI Act enables the rules to specify certain pipelines that are critical, or prescribe the requirements for a gas transmission pipeline to be critical, to ensuring the security and reliability of a gas market.

39.  Clause 7 prescribes the Tasmanian Gas Pipeline to be critical to ensuring the security and reliability of a gas market as authorised by paragraph 12(2)(a).

40.  The Tasmanian Gas Pipeline does not meet the threshold for the gas market it services (as per clause 8 of the rules), as it only has a nameplate rating of 129 terajoules per day, which is below the 200 terajoules per day threshold for the Eastern gas market. However, the pipeline is critical for transporting gas from processing plants to a major demand centre for distribution networks or large gas users such as electricity generators and industrial users.

41.  The Tasmanian Gas Pipeline is the sole gas transmission pipeline connecting Tasmania to mainland Australia. As Tasmania does not produce any of its own gas, it is wholly reliant on the Tasmanian Gas Pipeline as a source of gas for industrial, residential and electricity generation purposes. Furthermore, Tasmania’s reliance on gas for electricity generation increases in the event of a natural disaster (such as drought) or if there are failures to key assets involved in maintaining the security and supply of electricity in Tasmania.

42.  Clause 8 prescribes the requirements for a gas transmission pipeline to be critical to ensuring the security and reliability of a particular gas market for the purposes of the Act as authorised by paragraph 12(2)(b).

43.  For the purposes of the SOCI Act, a gas transmission pipeline is a ‘critical infrastructure asset’ if it meets the requirements in clause 8 to be a ‘critical gas asset.’

44.  A gas transmission pipeline is a ‘critical gas asset’ if its nameplate rating meets the terajoule capacity per day for the particular market the pipeline services. The thresholds for each gas market are:

45.  The thresholds for each gas market captures those pipelines that are critical to ensuring the varying industrial, residential and export demands in each market are met. As a result, the thresholds ensure the Act only applies to gas transmission pipelines that are critical for transporting gas from processing plants to major demand centres for distribution networks or large gas users such as electricity generators and industrial users, and to certain facilities and hubs for export purposes.

46.  This clause clarifies how the Act applies to those electricity generation stations or gas transmission pipelines that are not operating.

47.  Subclause 9(1) clarifies that an electricity generation station or gas transmission pipeline is not captured by the Act if it has not begun to operate since first being built.

48.  This clause ensures that an electricity generation station or gas transmissions pipeline is not captured by the Act if the station or pipeline:

a)      meets the thresholds or is listed by the rules; and

b)     has been built; but

c)      is not yet operating.

49.  An electricity generation station is considered to not be operating if it has not generated electricity to fulfil its function as a synchronous generator and/or contract to provide a system restart service. A gas transmission pipeline is considered to not be operating if it has not transported gas from processing plants to major demand centres and to facilities and hubs for export purposes.

50.  Understanding that there may be an intervening period between when an asset is built and when it starts operating, this provisions confirms that during that intervening period, the asset is not captured under the Act.

51.  Subclause 9(2) clarifies that the Act applies to electricity generation stations or gas transmission pipelines that are not currently being operated but have previously operated since first being built, and meet the requirements to be a ‘critical electricity asset’ or ‘critical gas asset.’ An electricity generation station is considered to have operated if it has generated electricity to fulfil its function as a synchronous generator and/or contract to provide a system restart service. A gas transmission pipeline is considered to have operated if it has transported gas from processing plants to major demand centres and to facilities and hubs for export purposes.

b.      Subsection 10(2) which provides that the Minister may, by rules, prescribe the requirements for an electricity generation station to be critical to ensuring the security and reliability of electricity networks or systems in a particular State or Territory. Specifically, this captures an electricity generation station as a critical infrastructure asset if it:

c.       Paragraphs 12(2)(a) and (b) which provide that the Minister may, by rules, prescribe specified gas transmission pipelines or the requirements for gas transmission pipelines to be critical to ensuring the security and reliability of a gas market.

d.      The Rules also clarifies how the Act applies to those electricity generation stations or gas transmission pipelines that are not operating. Subclause 9(1) clarifies that an electricity generation station or gas transmission pipeline is not captured by the Act if it has not begun to operate since first being built. However Subclause 9(2) clarifies that the Act applies to electricity generation stations or gas transmission pipelines that are not currently being operated but have previously operated since first being built, and meet the requirements to be a critical electricity asset or critical gas asset.

3.      These matters are suitable to be dealt with through the making of a rule because they may require amendments over time depending on technological advances and changes to the market.

4.      The Rules are in subordination to the Act and specify the electricity generation stations and gas transmission pipelines that are critical infrastructure assets for the purposes of subsection 10(2) and subsection 12(2) of the Act.

5.      The Rules also ensure the Government has access to operational information, including that which relates to data arrangements under clause 5, in order to determine the national security risks in critical infrastructure assets. Operational information assists in the Government’s understanding of who is in a position to influence the control and operation of critical infrastructure assets. Specifically, the information provided by the responsible entity on the Register, including in fulfilling their obligations under clause 5, will assist the Secretary administering the Act to identify which critical infrastructure assets should be the subject of a risk assessment in accordance with section 57 of the Act.

6.      Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour or reputation, and that everyone has the right to the protection of the law against such interference or attacks.

7.      The rule which relates to paragraphs 7(1)(f) and (g) of the Act and commences on 11 July 2018  positively engages the prohibition on arbitrary or unlawful interference with privacy under Article 17 of the ICCPR. This rule will give the Government visibility of how and where owners and operators of critical infrastructure assets are storing sensitive data.

8.      Certain critical infrastructure sectors may collect sensitive information that is not publicly available. Owners and operators of critical infrastructure assets have access to, and manage sensitive data sets including those identified in the Rules.

9.      In order to assess risks to national security with regard to a particular critical infrastructure asset, the Government needs to have visibility of how these sets of sensitive data are maintained.  For clarity, the Rules do not permit the Government to obtain the data information itself.

10.  Responsible entities may outsource or offshore the management of this data in the absence of capability and infrastructure, and/or in order to reduce costs. However by engaging in such arrangements, responsible entities may lack the appropriate oversight, or may be unable to ensure appropriate safeguards have been implemented to protect this data. As a result, outsourcing or offshoring data arrangements can increase the susceptibility of the data being exposed to actors that are not approved to access the data, and this data being used for espionage, sabotage and coercion purposes. Consequences of these data sets being the subject of acts sabotage, espionage or coercion may include:

11.  For example, water utilities hold large data sets about customers, including sensitive personal information, and their usage. Outsourcing or offshoring the management of this data may place at risk the sensitive data of a significant part of Australia’s population.

12.  Providing the Government visibility of how certain data sets are being managed through the Rules will inform assessments of which critical infrastructure assets may be at risk to acts of espionage, sabotage and coercion through its offshoring or outsourcing arrangements. The Government will then be able to proactively engage with relevant owners and operators to address understand and manage these risks. This ensures sensitive information is afforded the appropriate protections, and mitigates the risk of arbitrary or unlawful interference on privacy, and interference or attacks on reputation.

13.  In providing specific thresholds and listing a specific asset, the Rules specify which electricity generation stations and which gas transmission pipelines are critical electricity assets (as per section 10 of the Act) and critical gas assets (as per section 12 of the Act). The Act contains a range of powers, functions and obligations that will apply to these electricity generation and gas transmission assets as critical infrastructure assets. Some of these obligations and powers engage the prohibition on arbitrary or unlawful interference with privacy under Article 17 of the ICCPR.

14.  First, the reporting entities of these electricity generation and gas transmission assets will be required to provide high-level interest and control information (which includes information on who ultimately controls or influences an asset though ownership including beneficial ownership), and operational information (which includes an asset’s operational arrangements, such as outsourcing arrangements).

15.  The reporting entity is required, under the Act, to provide this information on the Register. This information may include personal and/or commercially sensitive information, thereby engaging the prohibition on arbitrary or unlawful interference with privacy in Article 17.  However, any limitation is permissible as the collection of personal information would be lawful, would not be arbitrary and would be reasonable, necessary and proportionate to achieving a legitimate national security objective.

16.  The Register is used by the Government to prioritise and inform risk assessments to identify and manage national security risks in critical infrastructure assets. The interest and control information and operational information on the Register provides the Government with a more comprehensive understanding of how the asset and sector operates, and where there may be vulnerabilities. It also influences the Government’s ability to develop strategies in collaboration with industry on how best to mitigate or reduce national security risk for these assets.

17.  Secondly, the Act includes an information-gathering power that allows the Secretary to request further information from reporting entities and operators of critical infrastructure assets in certain circumstances. The Secretary can request information or documents that may be relevant to:

18.  The information requested may include procurement plans, tender documentation, contracts, name and citizenship of board members and other documents specifying business operations. The notice may require personal information which engages the prohibition on arbitrary or unlawful interference with privacy.

19.  The information gathering power is limited to obtaining information or documents that are directly relevant to the purposes of the legislation, as stated in the objects of the Act, as well as the functions, duties, powers and purposes prescribed in the Act. Any personal information collected is incidental to the key objective of developing a more detailed understanding of possible national security risks.

20.  This power has been drafted with reference to the Administrative Review Council’s best practice principles for implementing and exercising information gathering powers in its 2008 report, Coercive Information Gathering Powers of Government Agencies.

21.  In practice, the Government agency responsible for administering the Act will engage with the relevant entity prior to issuing a notice to discuss the nature of the information required and, if necessary, the terms of the notice. This ensures the Secretary’s notice is a proportionate response which has regard to a range of matters including the prohibition on arbitrary or unlawful interference with privacy.

22.  The Government has taken sufficient steps to ensure that any limitations on privacy imposed by these obligations and power to require information, are no more restrictive than necessary. Under the Act, information provided under the Register or to the Secretary is protected information. The use and disclosure of protected information is restricted under Part 4, Division 3, Subdivision A of the Act. This Division enables disclosure to specified classes of persons responsible for national security, law enforcement, foreign investment in Australia, taxation policy, industry policy, defence purposes or to assist regulatory bodies with oversight of any relevant industry for the critical infrastructure asset. Part 4, Division 3, Subdivision B of the Act provides criminal penalties for unauthorised use or disclosure of protected information.

23.  The protected information may be shared with the relevant states and territories because it may have broader policy implications for jurisdictions.  For example, it may impact the security and resilience of critical infrastructure assets critical for their jurisdiction. This acknowledges that the states and territories, as owners and regulators of critical infrastructure assets share the responsibility with the Government to manage national security risks.

24.  Further, safeguards for the protection of personal information specified in the Australian Privacy Principles (APPs) under the Privacy Act 1988 will apply to interest and control information, and operational information gathered under Part 2 and Part 4 of the Act. This includes requirements regarding the security of personal information specified under Australian Privacy Principle 11 and requirements regarding use or disclosure under Australian Privacy Principle 6.

25.  Article 14 of the ICCPR provides for the right of protection against self-incrimination.

26.  Section 40 of the Act requires an entity to abide with a notice under the Secretary’s information gathering power even if it exposes the person (an individual or a body corporate) to criminal or civil liability. This power will apply to the reporting entities and operators of those electricity generation and gas transmission assets which meet the specific thresholds or are specifically listed in the Rules.

27.  The information gathering power has been modelled on the Evidence Act 1995, which abolishes the privilege against self-incrimination for bodies corporate, including where the body corporate is required to answer a question, give information or produce a document under a law of the Commonwealth.

28.  However, subsection 40(2) of the Act provides broad protections for individuals against criminal or civil proceedings if the information is self-incriminating. It clarifies that the documents or information cannot be used in evidence in any criminal or civil proceedings against the individual with the exception of Commonwealth criminal proceedings for providing false or misleading information or documents or civil proceedings to recover a penalty for non-compliance with the exercise of the information gathering power itself. This does not prevent the information or document being used if obtained through means unrelated to the Act.

29.  The Rules are compatible with the applicable human rights and freedoms recognised or declared in the international instruments listed in the definition of human rights in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011. Specifically, the Rules are compatible with human rights because it protects the prohibition on arbitrary or unlawful interference with privacy under Article 17 of the ICCPR

30.  To the extent that the measures in the Rules may limit those rights and freedoms under Article 17 of the ICCPR, such limitations are reasonable, necessary and proportionate in achieving the legitimate objectives of managing national security risks from foreign involvement in critical infrastructure assets.