Security Legislation Amendment (Critical Infrastructure) Act 2021 (124 of 2021)

Schedule 2   Australian Signals Directorate

Criminal Code Act 1995

6   At the end of Division 476 of the Criminal Code

Add:

476.6 Liability for certain acts - ASD

(1) A staff member or agent of ASD is not subject to any civil or criminal liability for engaging in conduct inside or outside Australia if:

(a) the conduct is engaged in on the reasonable belief that it is likely to cause a computer-related act, event, circumstance or result to take place outside Australia (whether or not it in fact takes place outside Australia); and

(b) the conduct is engaged in in the proper performance of a function of ASD.

(2) A person is not subject to any civil or criminal liability for engaging in conduct inside or outside Australia if:

(a) the conduct is preparatory to, in support of, or otherwise directly connected with, overseas activities of ASD; and

(b) the conduct:

(i) taken together with a computer-related act, event, circumstance or result that took place, or was intended to take place, outside Australia, could amount to an offence; but

(ii) in the absence of that computer-related act, event, circumstance or result, would not amount to an offence; and

(c) the conduct is engaged in in the proper performance of a function of ASD.

(3) Subsection (2) is not intended to permit any conduct in relation to premises, persons, computers, things, or carriage services in Australia, being:

(a) conduct which ASIO could not engage in without a Minister authorising it by warrant issued under Division 2 of Part III of the Australian Security Intelligence Organisation Act 1979 or under Part 2-2 of the Telecommunications (Interception and Access) Act 1979; or

(b) conduct engaged in to obtain information that ASIO could not obtain other than in accordance with Division 3 of Part 4-1 of the Telecommunications (Interception and Access) Act 1979.

(4) Subsections (1) and (2) have effect despite anything in a law of the Commonwealth or of a State or Territory, whether passed or made before or after the commencement of this subsection, unless the law expressly provides otherwise.

(5) Subsection (4) does not affect the operation of subsection (3).

Certificate

(6) The Inspector-General of Intelligence and Security may give a certificate in writing certifying any fact relevant to the question of whether conduct was engaged in in the proper performance of a function of ASD.

(7) In any proceedings, a certificate given under subsection (6) is prima facie evidence of the facts certified.

Notice to Inspector-General of Intelligence and Security

(8) If:

(a) a person engages in conduct referred to in subsection (1) or (2) in relation to ASD; and

(b) the conduct causes material damage, material interference or material obstruction to a computer (within the meaning of section 22 of the Australian Security Intelligence Organisation Act 1979) in Australia; and

(c) apart from this section, the person would commit an offence against this Part;

then the agency head (within the meaning of the Intelligence Services Act 2001) of ASD must, as soon as practicable, give a written notice to the Inspector-General of Intelligence and Security that:

(d) informs the Inspector-General of Intelligence and Security of that fact; and

(e) provides details about the conduct that caused the damage, interference or obstruction to the computer.

(9) This section has effect in addition to, and does not limit, section 14 of the Intelligence Services Act 2001.

Definitions

(10) In this section:

ASD means the Australian Signals Directorate.

civil or criminal liability means any civil or criminal liability (whether under this Part, under another law or otherwise).

computer-related act, event, circumstance or result means an act, event, circumstance or result involving:

(a) the reliability, security or operation of a computer; or

(b) access to, or modification of, data held in a computer or on a data storage device; or

(c) electronic communication to or from a computer; or

(d) the reliability, security or operation of any data held in or on a computer, computer disk, credit card, or other data storage device; or

(e) possession or control of data held in a computer or on a data storage device; or

(f) producing, supplying or obtaining data held in a computer or on a data storage device.

staff member , in relation to ASD, means:

(a) the Director-General of ASD; or

(b) a member of the staff of ASD (whether an employee of ASD, a consultant or contractor to ASD, or a person who is made available by another Commonwealth or State authority or other person to perform services for ASD).