Splitting the Critical Infrastructure Bill – an update from the Parliamentary Joint Committee report

Parliament is proposing to split the Security Legislation Amendment (Critical Infrastructure) Bill, which will allow pressing reforms to be promptly legislated in the initial Bill, with further deliberation on less urgent elements.

Here’s why the Bill is being split

On 29 September 2021, the Parliamentary Joint Committee on Intelligence and Security tabled its Advisory Report on the draft Bill and the Statutory Review of the Security of Critical Infrastructure Act 2018 (Cth).

The Advisory Report is released as part of a concurrent review by the Joint Committee both of the draft Bill and the Act. This made sense from a timing perspective as the Statutory Review of the Act was required to be commenced by 11 April 2021, and the draft Bill seeks to amend the Act.

In the Advisory Report, the Joint Committee has proposed major recommendations, including splitting the draft Bill into two separate bills to expedite the passage of critical elements of the draft Bill.

The Joint Committee believes splitting the draft Bill will allow:

• Parliament to promptly legislate pressing reforms in an initial Bill (Bill One); and
• give the Government and relevant industries adequate time to further deliberate the less urgent elements of the draft Bill in the subsequent Bill (Bill Two).

Navigating the Joint Committee's Recommendations

In total, the Joint Committee made 14 recommendations in its Advisory Report:

• four general recommendations.
• seven specific recommendations for Bill One.
• three specific recommendations for Bill Two.

Bill One – Dealing with immediate threats

Overall, the Joint Committee recommends prioritising elements of the draft Bill which is relevant to dealing with immediate threats to Australia's national interest. In that light, passing Bill One in an expedited manner achieves two key things:

• it allows the government and Joint Committee to recognise the increased risk of cyber-related crimes and cyber susceptibilities which can impact Australia's infrastructure; and
• it will provide Australia with a more comprehensive framework to immediately deal with serious cyber incidents and ransomware attacks.

The most important element retained in Bill One is Part 3A of the draft Bill, which will provide governmental bodies such as the Department of Home Affairs' Cyber and Infrastructure Security Centre and the Australian Signals Directorate (ASD) substantive powers to respond to critical infrastructure threats expeditiously.

These powers include directing an entity to gather information, undertake an action, or authorise the ASD to intervene, when a cyber security incident has occurred, is occurring, or is likely to occur, and protect assets immediately. These government 'assistance measures', despite having been identified as provisions of 'last resort', have attracted significant concerns from the industry. The Joint Committee acknowledged those concerns on the one hand, but on the other recognised that the potential threat faced by Australia's critical infrastructure assets is too great to stall introduction of these measures.

Other key elements of the draft Bill to be retained in Bill One include:

• the expanded definition and meaning of what constitutes a critical infrastructure sector and asset, where we note that the new sectors to be classed as "critical infrastructure" include:

• communications;
• financial services and markets;
• data storage and processing;
• defence;
• higher education and research;
• energy;
• food and grocery;
• health care and medical;
• space technology;
• transport; and
• water and sewerage; and

• changes to mandatory notification of cyber security incidents.

Bill Two – Less urgent elements

Bill Two is made of the non-urgent parts of the draft Bill, including:

• the requirement for responsible entities to have in place, and comply with, sector-specific risk management programs along with mandatory annual reporting (Part 2A of the draft Bill); and
• declaring 'Systems of National Significance', which are those assets that are the most critical to the security, economy and sovereignty of Australia, and will therefore attract enhanced cyber security obligations (Parts 2C and 6A of the draft Bill).

The aim of the delayed Bill Two is to address industry feedback that is not considered in the expedited passage of Bill One. The Joint Committee proposes Bill Two would take into account obligations which the industry and stakeholders have to their respective customers and follow a more collaborative process, incorporate various recommendations from industry representatives, and will be released as an exposure draft for extensive consultation with affected industries.

Subsequently, Bill Two will also revert back to the Joint Committee for comment and submissions before it makes its way to Parliament.

When the draft of Bill Two is released in the future, and the related consultation process commences, we encourage owners and operators to consider making a submission.

What this means and what the future holds for critical infrastructure

As this is a developing area of law, industry representatives must keep an eye on any changes. Significantly, the Joint Committee has proposed to expedite Bill One conscious that there is limited time left in the Parliamentary sitting calendar in 2021. It would be interesting to see whether Parliament does end up passing Bill One by the end of this calendar year in light of the urgency expressed by the Joint Committee and the general bipartisan support in regard to the Joint Committee's recommendations.

In the meantime, we recommend you have proper procedures in place to notify appropriate authorities of any critical cyber security incidents, and turn your mind to what the government's new powers may mean to your business.

Rest assured – we will continue to monitor and update you on any changes to the law.

Related Insights

• More sectors to be critical infrastructure, increased obligations, and wider government powers in draft Bill – so comment now