This section applies if the Minister is satisfied that:
an incident:
has occurred; or
is occurring; or
is imminent; and
the incident has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets (each of which is a primary asset); and
there is a material risk that the incident has seriously prejudiced, is seriously prejudicing, or is likely to seriously prejudice:
the social or economic stability of Australia or its people; or
the defence of Australia; or
national security; and
no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident.
This section also applies if the Minister is satisfied that:
an incident:
has occurred; or
is occurring; or
is imminent; and
the incident has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets (each of which is a primary asset); and
the incident relates to an emergency specified in a national emergency declaration (within the meaning of the National Emergency Declaration Act 2020) that is in force; and
no existing regulatory system of the Commonwealth, a State or a Territory could be used to provide a practical and effective response to the incident.
The Minister may, on application by the Secretary, do any or all of the following things:
authorise the Secretary to give directions under section 35AK, relating to the incident and one or more primary assets, to one or more relevant entities;
authorise the Secretary to give directions under section 35AK, relating to the incident and one or more specified critical infrastructure sector assets, to one or more relevant entities;
authorise the Secretary to give to one or more specified entities a specified direction under section 35AQ that relates to the incident and one or more specified primary assets;
authorise the Secretary to give to one or more specified entities a specified direction under section 35AQ that relates to the incident and one or more specified critical infrastructure sector assets;
authorise the Secretary to give one or more specified requests under section 35AX that relate to the incident and one or more specified primary assets;
authorise the Secretary to give one or more specified requests under section 35AX that relate to the incident and one or more specified critical infrastructure sector assets.
Note 1: Section 35AK deals with information gathering directions.
Note 2: Section 35AQ deals with action directions.
Note 3: Section 35AX deals with intervention requests. The Minister must not give an authorisation under paragraph (2)(e) or (f) unless the Minister is satisfied that the incident is a cyber security incident: see subsection (10).
An authorisation under subsection (2) is to be known as a Ministerial authorisation.
Subsection 33(3AB) of the Acts Interpretation Act 1901 does not apply to subsection (2) of this section.
Note: Subsection 33(3AB) of the Acts Interpretation Act 1901 deals with specification by class.
A Ministerial authorisation under paragraph (2)(a) or (b):
is generally applicable to the incident and the asset or assets concerned; and
is to be made without reference to any specific directions.
The Minister must not give a Ministerial authorisation under paragraph (2)(a) or (b) unless the Minister is satisfied that the directions that could be authorised by the Ministerial authorisation are likely to facilitate a practical and effective response to the incident.
The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) in relation to a specified entity unless the Minister is satisfied that:
the specified entity is unwilling or unable to take all reasonable steps to respond to the incident; and
the specified direction is reasonably necessary for the purposes of responding to the incident; and
the specified direction is a proportionate response to the incident; and
compliance with the specified direction is technically feasible.
Note: Section 12P provides examples of responding to an incident (including a cyber security incident).
In determining whether the specified direction is a proportionate response to the incident, the Minister must have regard to:
the impact of the specified direction on:
the activities carried on by the specified entity; and
the functioning of the asset or assets concerned; and
the consequences of compliance with the specified direction; and
such other matters (if any) as the Minister considers relevant.
The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) in relation to a specified entity if the specified direction:
requires the specified entity to permit the authorised agency to do an act or thing that could be the subject of a request under section 35AX; or
requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident.
Without limiting paragraph (2)(c) or (d), a direction referred to in that paragraph may require a specified entity to disclose specified personal information (within the meaning of the Privacy Act 1988) held by the entity to another specified entity for a specified purpose.
However, the Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d), to the extent that it authorises the giving of a direction covered by subsection (9A), unless the Minister has obtained the agreement of the Minister administering the Privacy Act 1988.
The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) that relates to the incident and an asset unless the Minister is satisfied that:
the incident is a cyber security incident; and
giving a Ministerial authorisation under paragraph (2)(c) or (d) would not amount to a practical and effective response to the incident; and
if there is only one relevant entity for the asset—the relevant entity is unwilling or unable to take all reasonable steps to respond to the incident; and
if there are 2 or more relevant entities for the asset—those entities, when considered together, are unwilling or unable to take all reasonable steps to respond to the incident; and
the specified request is reasonably necessary for the purposes of responding to the incident; and
the specified request is a proportionate response to the incident; and
compliance with the specified request is technically feasible; and
each of the acts or things specified in the specified request is an act or thing of a kind covered by section 35AC.
Note: Section 12P provides examples of responding to a cyber security incident.
In determining whether the specified request is a proportionate response to the incident, the Minister must have regard to:
the impact of compliance with the specified request on the functioning of the asset; and
the consequences of acts or things that would be done in compliance with the specified request; and
such other matters (if any) as the Minister considers relevant.
The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) if compliance with the specified request would involve the authorised agency taking offensive cyber action against a person who is directly or indirectly responsible for the incident.
The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) unless the Minister has obtained the agreement of:
the Prime Minister; and
the Defence Minister.
An agreement under subsection (13) may be given:
orally; or
in writing.
If an agreement under subsection (13) is given orally, the Prime Minister or the Defence Minister, as the case requires, must:
do both of the following:
make a written record of the agreement;
give a copy of the written record of the agreement to the Minister; and
do so within 48 hours after the agreement is given.
A Ministerial authorisation is not a legislative instrument.
This section does not, by implication, limit a power conferred by another provision of this Act.