13 July 2018

Critical Infrastructure

The Critical Infrastructure Security Act 2018 (Cth) is meant to provide a framework for managing risks to national security relating to critical infrastructure, including by:
(a) improving the transparency of the ownership and operational control of critical infrastructure in Australia in order to better understand those risks; and 
(b) facilitating cooperation and collaboration between all levels of government, and regulators, owners and operators of critical infrastructure, in order to identify and manage those risks. 
That framework does not construe telecommunications as critical infrastructure, in contrast to much overseas planning in terms of  'critical information infrastructure'.

The framework centres on disclosure of ownership and control, reflecting recent anxieties regarding overseas ownership of major facilities. It consists of
 (a) the keeping of a register of information in relation to critical infrastructure assets (the register will not be 6 made public); 
(b) requiring certain entities relating to a critical 8 infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation  to the asset; 
(c) allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security; 
(d) allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain  information or documents; 
(e) allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.
Certain information obtained under, or relating to the operation of, the Act is 'protected information'. with restrictions on when a person may make a record of, use or disclose that information.Protected information is
(a) obtained by a person in the course of exercising powers, or performing duties or functions, under this Act; or 
(b) is the fact that the asset is declared under section 51 to be a  critical infrastructure asset; or 
(c) was information to which paragraph (a) or (b) applied and is obtained by a person by way of an authorised disclosure 21 under Division 3 of Part 4 or in accordance with section 46.
Civil penalty provisions of the Act may be enforced using civil penalty orders or injunctions, and enforceable undertakings may be accepted in relation to compliance with civil penalty provisions. The Regulatory Powers (Standard Provisions) Act 2014 (Cth) is applied for these purposes. Other provisions may be enforced by imposing a criminal penalty.

The Minister for Home Affairs  may privately declare a particular asset to be a critical  infrastructure asset so that the Act applies to it. A private declaration can only be made if there would be a risk to national  security if it were publicly known that the asset is critical  infrastructure that affects national security. Presumably many people in academia, the consulting sector and journalists will make correct inferences.

The Secretary of the Home Affairs Department must give the Minister reports, for presentation to the Parliament, on the operation of the Act. Do not expect, of course, that the reports will be particularly detailed.

Under section 9 an asset is a critical infrastructure asset if it is:
 (a) a critical electricity asset; or 
(b) a critical port; or 
(c) a critical water asset; or 
(d) a critical gas asset; or 
(e) an asset declared under section 51 to be a critical infrastructure asset; or 
(f) an asset prescribed by the rules for the purposes of s 9. 
An asset is a critical electricity asset if it is:
 (a) a network, system, or interconnector, for the transmission or  distribution of electricity to ultimately service at least  100,000 customers; or 
(b) an electricity generation station that is critical to ensuring the  security and reliability of electricity networks or electricity  systems in a State or Territory, in accordance with  subsection (2). 
Rules may prescribe  requirements for an electricity generation station to be critical to  ensuring the security and reliability of electricity networks or   electricity systems in a particular State or Territory.

An asset is a critical port if it is land that forms part of any of  specified security regulated ports:  Broome;  Adelaide;   Brisbane;   Cairns;  Christmas Island;  Dampier;  Darwin;  Eden;  Fremantle;  Geelong;  Gladstone;  Hay Point;  Hobart;  Melbourne;  Newcastle;  Port Botany;  Port Hedland;   Rockhampton;  Sydney Harbour; Townsville;

 An asset is a critical gas asset if it is any of the following:
 (a) a gas processing facility that has a capacity of at least 300  terajoules per day or any other capacity prescribed by the  rules;  
(b) a gas storage facility that has a maximum daily quantity of 75  terajoules per day or any other quantity prescribed by the  rules;  
(c) a network or system for the distribution of gas to ultimately  service at least 100,000 customers or any other number of  customers prescribed by the rules;  
(d) a gas transmission pipeline that is critical to ensuring the 24 security and reliability of a gas market, in accordance with  subsection (2).  
The rules may prescribe   (a) specified gas transmission pipelines that are critical to 30 ensuring the security and reliability of a gas market; or  (b) requirements for a gas transmission pipeline to be critical to  ensuring the security and reliability of a gas market