Proposed updates to security of critical infrastructure legislation

The 'communications sector' is defined as the sector of the economy that involves:

1. suppling a carriage service; or
2. providing a broadcasting service; or
3. owning or operating assets used in connection with the supply of a carriage service; or
4. owning or operating assets used in connection with the transmission of a broadcasting service; or
5. administering an Australian domain system.

This definition aims to capture:

• all entities involves in the supply, maintenance or operation of communication services and assets located in Australia; and
• all entities involved in administering the Australian domain name system, specifically the .au namespace.

The definition is also intentionally flexible to accommodate evolving technology and infrastructure.

The Draft Bill introduces three types of critical infrastructure assets in the communications sector:

1. A critical telecommunications asset includes:
   1. a telecommunications network or facility owned or operated by a carrier and used to supply a carriage service;
   2. a telecommunications network or asset owned or operated by a carriage service provider and used in connection with the supply of a carriage service.

   Responsible entity: The carrier that holds the carrier licence for the telecommunications network, or a carriage service provider, or, another prescribed entity, as defined under the Telecommunications Act 1997.

   Carveout: The Department intends to implement a carve-out in the rules to ensure that the definition will not include Over-the-Top applications which operate over the top of this infrastructure (for example, Netflix and Skype).

2. Broadcasting transmission(section 12E) – aims to capture the transmission and distribution infrastructure which Australian broadcasters rely on. This is defined as a radio communications transmitter, a broadcasting transmission tower, or an associated transmission facility, that is owned and operated by the same entity and:
   1. is operating from at least 50 different sites; or
   2. is located on a prescribed site.

   Further, the asset must be used, or be capable of being used, in connection with the transmission of a national, radio or television broadcasting service.

   Responsible entity is the owner or operator of the asset or another prescribed entity.

3. Domain name systems (section 5) – this is defined as a system owned by an entity that:
   1. has been declared to be a 'manager of electronic addressing' by ACMA under section 474(1) of the Telecommunications Act 1997; and
   2. is used to administer an Australian domain name system.

   Note: the regs may prescribe that specified systems are excluded.

   Responsible entity is the 'declared manager of electronic addressing' that is the subject of a determination under subsection 474(1) of the Telecommunications Act 1997, or another prescribed entity.

   In recognition of the current governance and oversight mechanisms, it is proposed that the Positive Security Obligation will remain dormant for this subsector.

No systems of national significance have been designated at this stage.

The 'data storage and processing sector' is defined as the sector of the economy that involves providing commercial data storage (including data back-up) or processing services (section 5).

As well as capturing various kinds of data centres (enterprise data centres, managed services data centres, colocation data centres and cloud data centres), this definition also captures the different types of cloud services: infrastructure as a service (IaaS), software as a service (SaaS) and platform as a service (PaaS).

The definition of 'critical data storage or processing asset’ captures the physical infrastructure or computing platforms used primarily for storing or processing data on a commercial basis, where the entity knows that it is a direct supplier to:

1. Australian Government clients;
2. State and Territory government clients; or
3. a responsible entity of a critical infrastructure asset, where the data or information is business critical data or information

'Business critical data' is defined in the Draft Bill as:

1. personal data that relates to at least 20,000 individuals or sensitive information (as defined in the Privacy Act 1988); or
2. information relating to any research and development in relation to a critical infrastructure asset; or
3. information relating to any systems needed to operate a critical infrastructure asset; or
4. information relating to risk management and business continuity (however described) in relation to a critical infrastructure asset.

There is a corresponding obligation in section 12F(3) for responsible entities for critical infrastructure assets to notify their data storage and processing service providers where the services being provided relate to business critical data.

Responsible entity is the entity that is a data storage or processing provider to the end-user identified above; vis, the Commonwealth, State or Territory Government clients and other responsible entities for critical infrastructure assets. (Section 12L(4)).

No systems of national significance have been designated at this stage.

The 'defence industry sector' means the sector that involves the provision of critical defence capabilities.

‘critical defence capability’ includes the following: material, technology, a platform, a network, a system, and a service, that is required in connection with the defence of Australia or national security. This definition intends to exclude entities captured under other sectors in the Draft Bill (e.g. electricity or water).

A 'critical defence industry asset' is an asset that is, or will be, supplied by an entity to the Department of Defence, or the Australian Defence Force, under a contract; and consists of, or enables, a critical defence capability.

The definition of critical defence industry asset is intended to be a sub-set of the ‘critical military related goods, services and technologies’ identified in the context of the proposed reforms to the Foreign Acquisitions and Takeovers Regulations 2015; noting reforms to Australia’s foreign investment review framework are still subject to Parliamentary consideration.

A responsible entity is an entity that would be the authorised operator or supplier of critical defence industry assets (section 12L(22)).

No systems of national significance have been designated at this stage.

The 'financial services and markets sector' is defined as the sector of the economy that involves:

1. carrying on a banking business (defined in the Banking Act 1959);
2. operating a superannuation fund (defined in the Superannuation Industry (Supervision) Act 1993);
3. carrying on insurance business (defined in the Insurance Act 1973);
4. carrying on life insurance business (defined in the Life Insurance Act 1995);
5. carrying on health insurance business (defined in the Private Health Insurance Act 2007);
6. operating a financial market (defined in Chapter 7 of the Corporations Act 2001);
7. operating a clearing and settlement facility (defined in Chapter 7 of the Corporations Act 2001);
8. operating a derivative trade repository (defined in Chapter 7 of the Corporations Act 2001);
9. administering a financial benchmark (defined in Part 7.5B of the Corporations Act 2001);
10. operating a payment system (defined in the Payment Systems (Regulation) Act 1998);
11. carrying on a financial services business (defined in Corporations Act 2001); or
12. operating a credit facility business (as defined in the Australian Securities and Investments Commission Regulations 2001

1. Banking assets as defined in s 12G of the SCI Act. The rules may prescribe specific assets that are critical to the carrying on of banking business by an authorised deposit-taking institution (ADI) and requirements for such assets.

   Proposed rules threshold: the Department is proposing a threshold that captures those banking entities with total assets above $50 billion. This threshold is likely to capture around 10 entities.

2. Superannuation assets that are critical to the operation of a registrable superannuation entity, as defined in s 12J of the SCI Act.

   Proposed rules threshold the Department is proposing a threshold that captures those superannuation entities with total assets above $20 billion. This threshold would capture approximately 30 superannuation entities.

3. Insurance assets owned or operated by (and critical to the carrying on of) insurance business; or life insurance business; or health insurance business, as defined in s12H of the SCI Act.

   Proposed rules threshold: the Department is proposing a threshold that captures:

   • insurance businesses that have total assets above $2 billion – likely around 15 businesses;
   • private health insurance businesses that have more than $0.5 billion in total assets – likely around 10 businesses; and
   • life insurance businesses with total assets above $5 billion – likely around 10 businesses.
4. Financial market infrastructure assets (defined under s12D of the SCI Act) as any of the following assets that are critical to the following components of the financial system:
   1. Domestic financial market: includes assets owned or operated by the holder of an Australian market licence that is incorporated in Australia or a related body corporate of that licence holder.

      Proposed rules threshold: the Department is proposing a threshold to capture a narrower cohort of the 11 Domestic (s795B(1)) Tier 1 market licensees, and be determined by a turnover metric).

   2. Australian clearing and settlement facilities: includes assets owned or operated by the holder of an Australian clearing and settlement facility licence that is incorporated in Australia or a related body corporate of that licence holder and is critical to the operation of a clearing and settlement facility.

      Proposed rules threshold: the Department is proposing a threshold that would likely cover the four ASX Group clearing and settlement facilities).

   3. Benchmark administrators: includes assets owned or operated by the holder of a benchmark administrator licence that is incorporated in Australia or a related body corporate of that licence holder and is critical to the administration of a financial benchmark.
   4. Derivative trade depositories: includes assets owned or operated by the holder of an Australian derivative trade repository licence that is incorporated in Australia or a related body corporate of that licence holder and is critical to the operation of a derivative trade repository.

      Proposed rules threshold: the Department is proposing a metric to determine a threshold for criticality.

   5. Payment systems: includes assets that are critical to the operation of a critical payment system. Rules may prescribe attributes which, if present in a payment system, mean that such a payment system is critical to ensuring the security and reliability of the payment system.

The responsible entities for each of these critical infrastructure assets is the entity licenced or authorised to operate the asset, or any other entity prescribed by the rules in relation to the asset. For example, this approach would mean that the obligations in respect of a critical superannuation asset apply to an registrable superannuation entity, as defined under the Superannuation Industry (Supervision) Act 1993 (Cth), in addition to any other entity specified in the rules.

No systems of national significance have been designated at this stage.

The 'food and grocery sector' is the sector of the Australian economy that involves manufacturing, processing, packaging, distributing, or supplying food or groceries on a commercial basis.

Carveout: the Department has noted that this definition is not intended to capture farming.

A 'critical food and grocery asset' is an asset or network that is used for the distribution or supply of food or groceries; and is owned or operated by an entity that is prescribed within the rules to be a critical supermarket retailer; critical food wholesaler or a critical grocery wholesaler. The exact scope of those terms will be determined though industry consultation on the rules.

In practice, this means that if a supermarket (as prescribed within the rules) were to subcontract out the trucking of groceries from a warehouse to a supermarket, then the trucking portion of the food and grocery network would still be considered a critical food and grocery asset, even though it would not be directly operated by a critical retailer or wholesaler as prescribed by the rules.

The responsible entity for a critical food and grocery asset is the owner or operator of an entity declared by the rules to be a critical supermarket retailer, critical food wholesaler, or critical grocery wholesaler. Another responsible entity may also be prescribed by the rules if operated in relation to a critical food and grocery asset.

Carveout: The Department has noted that it does not consider other parts of the sector (for example food manufacturing) fall within the definition of critical food and grocery assets, as they are often disaggregated and, if disrupted, are unlikely to have a severe and widespread impact on the availability of food and grocery

No systems of national significance have been designated at this stage.

'Higher education and research sector' means the sector of the Australian economy that involves:

1. being a higher education provider (as defined in the Tertiary Education Quality and Standards Agency Act 2011 (TEQSA Act)); or
2. undertaking a program of research that:
   1. is supported financially (in whole or in part) by the Commonwealth; or
   2. is relevant to a critical infrastructure sector (other than the higher education and research sector).

The sector definition captures 178 higher education providers that are registered with the Tertiary Education and Quality and Standards Agency. This could include institutions that carry out medical research or institutions that own large scale infrastructure.  

For example, the sector definition seeks to capture those entities that have received financial assistance from the Australian Research Council or the National Health and Medical Research Council, and research activities that are relevant to the space or health sector.

'Critical education asset' means a university that is owned or operated by an entity that is registered in the Australian university category of the National Register of Higher Education Providers (as established under TEQSA Act).

Responsible entity: mirrors the definition of a critical education asset, being a registered higher education provider, or another that may be prescribed by the rules.

The effect of the these definitions will be to:

• provide positive security obligations on entire universities, rather than particular assets owned by a university.
• capture all 40 Australian owned and operated universities (excluding foreign universities)
• exclude private research institutions (although these may be captured in respect of other sectors).

No systems of national significance have been designated at this stage.

The definition drafted intentionally broad to capture assets that are developed and become critical to the sector in the future.

‘Health care and medical sector’ means the sector of the Australian economy that involves the provision of health care, or the production, distribution or supply of medical supplies.

• 'health care' is broadly defined to include services provided by individuals who practise in a list of professions or occupations, as well as treatment and maintenance as a patient at a hospital.
• 'medical supplies' is similarly broad, and includes goods for therapeutic use, and other things specified in the rules.

The sector definition intends to capture:

• physical, electronic and other assets that are involved in the provision of health care services (such as public health and preventive services, primary health care, emergency health services, hospital-based treatment, e-health services, pharmaceutical services, rehabilitation and palliative care, and diagnostic and imaging services);
• assets involved in the production of medical supplies and devices which includes products that support the provision of health care services (such as personal protective equipment, and diagnostic equipment), pharmaceutical products and medicines, pacemakers and prosthetics.

A 'critical hospital' is defined as a hospital that has a general intensive care unit.

• 'Hospital' has the same meaning as in the Private Health Insurance Act 2007.
• 'General intensive care unit' is defined as an area within a hospital that is:
  1. equipped and staffed so it is capable of providing a patient with:
     1. mechanical ventilation for several days; and
     2. invasive cardiovascular monitoring; and
  2. is supported by:
     1. during normal working hours – at least one specialist or consultant physician specialising in intensive care, who is immediately available and exclusively rostered to that area; and
     2. at all times – at least one medical practitioner who is present in the hospital and immediately available to that area; and
     3. at least 18 hours each days – at least one nurse; and
  3. has admission and discharge policies in operation

The responsible entity for a critical hospital is:

1. if the critical hospital is a public hospital—the local hospital network that operates the hospital; or
2. if the critical hospital is a private hospital—the entity that holds the licence, approval or authorisation (however described), under a law of a State or a Territory to operate the hospital; or
3. if another entity is prescribed by the rules in relation to the hospital—that other entity.

Carveout: Digital infrastructure has been carved out of this definition on the basis that existing safeguards exist within legislation such as the My Health Records Act 2012.

No systems of national significance have been designated at this stage.

The 'transport sector' means the sector of the Australian economy that involves the transport of goods or passengers on a commercial basis, or the owning or operating assets used in connection with the transport of goods or passengers on a commercial basis s 8E(10)

The definition extends beyond the primary service of providing transport for goods or passengers on a commercial basis, to entities that own or operate assets used in connection with that service.

The definition is intended to capture the first link of the supply chain that enables the transport sector to function, recognising that disruption to those underlying assets can undermine the operation of Australia’s transport sector in a manner that damages Australia’s economic activity and national security.

Critical assets in the aviation and maritime sectors

There is currently no intention to apply the SCI Act positive security obligations to the aviation or maritime sectors. Instead, for the obligations to apply, a rule must be made by the Minister.  This will allow sufficient time to amend both the Aviation Transport Security Act 2004 and the Maritime Transport and Offshore Facilities Security Act 2003 and will avoid duplicating industry regulatory requirements.

1. 'critical port' includes the 20 maritime ports already identified as critical under section 11 of the current SCI Act.
2. 'critical aviation asset' means assets owned or operated by an aircraft operator or a regulated air cargo agent where those assets are used in connection with the provision of an air service. This also includes assets owned and operated by an airport operator where those assets are used in connection with the operation of an airport.
   

   Critical freight infrastructure asset – road and rail corridors and intermodal transfer facilities

3. A 'critical freight infrastructure asset' means a road or rail network that functions as a critical corridor for, or an intermodal transfer facility that is critical to, the transportation of goods between two states, a state or territory, two territories, or two cities or towns with populations of 10,000 or more. 

   The responsible entity is defined to mean a Commonwealth, State or Territory, or statutory authority established under a Commonwealth, State or Territory law, that is responsible for the management of the critical freight asset.

   A 'critical freight infrastructure asset' means a road or rail network that functions as a critical corridor for, or an intermodal transfer facility that is critical to, the transportation of goods between two states, a state or territory, two territories, or two cities or towns with populations of 10,000 or more.
4. 'critical freight services asset' means a network used by an entity carrying on a business that is critical to the transportation of goods by road, rail, inland waters or sea.
   

   The responsible entity is the operator of the critical freight services asset, or any other prescribed entity.

5. 'critical public transport asset' is a public transport network or system managed by a single entity that is capable of handling at least 5 million passenger journeys per month.
   

   The responsible entity is the single entity managing the critical public transport asset or any other prescribed entity.

No systems of national significance have been designated at this stage.

The 'energy sector' is defined as the sector of the Australian economy that involves:

1. the production, distribution or supply of electricity; or
2. the production, processing, distribution or supply of gas; or
3. the production, processing, distribution or supply of liquid fuel.

This definition reflects those functions that are critical to maintaining the ongoing availability of energy, essential to maintaining Australia’s security and economy.

1. 'critical electricity asset is defined as:
   1. an electricity generation asset that is critical to ensuring the security and reliability of electricity networks or electricity systems in a state or territory;
   2. an asset that is a network, system, or interconnector, for the transmission or distribution of electricity to ultimately service at  least 100,000 customers.

   Note that the existing Security of Critical Infrastructure Rules currently prescribe capacity thresholds for generation assets to determine whether an asset is critical to the security and reliability of electricity networks or electricity systems in a state or territory.

   The responsible entity for a critical electricity asset will continue to be defined as the entity that holds the licence, approval or authorisation (however described), under a law of the Commonwealth, a State or a Territory to provide the service to be delivered by the asset – or, where another entity is prescribed by the rules in relation to the asset, that other entity.

2. A 'critical gas asset' is defined as:
   1. a gas processing facility that has a capacity of at least 300 terajoules per day or any other capacity prescribed by the rules; or
   2. a gas storage facility that has a maximum daily withdrawal capacity of at least 75 terajoules per day or any other quantity prescribed by the rules; or
   3. a network or system for the distribution of gas to ultimately service at least 100,000 customers or any other number of customers prescribed by the rules; or
   4. a gas transmission pipeline that is critical to ensuring the security and reliability of a gas market, in accordance with subsection (2).

      Gas is defined as a substance that:

   5. is in a gaseous state at standard temperature and pressure; and
   6. consists of naturally occurring hydrocarbons, or a naturally occurring mixture of hydrocarbons and non-hydrocarbons, the principal constituent of which is methane; and is suitable for consumption.

   The responsible entity for a critical gas asset will continue to be defined as the entity that holds the licence, approval or authorisation (however described), under a law of the Commonwealth, a State or a Territory to provide the service to be delivered by the asset – or, where another entity is prescribed by the rules in relation to the asset, that other entity.

3. A 'critical liquid fuel asset' means:
   1. a liquid fuel refinery that is critical to ensuring the security and reliability of a liquid fuel market; or
   2. a liquid fuel transmission pipeline that is critical to ensuring the security and reliability of a liquid fuel market (a threshold for pipelines with a minimum pressure of 2500kPag is proposed to be included in the rules); or
   3. a liquid fuel storage facility that is critical to ensuring the security and reliability of a liquid fuel market.

   These definitions will capture liquid fuel refineries, pipelines and storage facilities. Distribution pipelines are critical for inter-city distribution and for movement from refineries and ports to terminals.

   The responsible entity for a critical liquid fuel asset is:

   1. if the asset is a liquid fuel refinery – the relevant fuel industry corporation as defined by the Liquid Fuels Emergency Act 1984 that operates the asset;
   2. if the asset is a liquid fuel pipeline – the operator of the pipeline;
   3. if the asset is a liquid fuel storage facility – the operator of the facility;
   4. if another entity is prescribed by the rules in relation to the asset—that other entity.
4. A 'critical energy market operator asset' means an asset that:
   1. is used by the Australian Energy Market Operator Limited (AEMO); or Power and Water Corporation; or Regional Power Corporation (Horizon Power - ABN 57 955 011 697); or Electricity Networks Corporation (Western Power- ABN 18540492861); and
   2. is critical to ensuring the security and reliability of an energy market.

   The responsible entity for a critical energy market operator asset is defined as the entity that uses the asset.

No systems of national significance have been designated at this stage.

The 'space technology sector' is the sector that involves the commercial provision of space-related services, and reflects those functions that are critical to maintaining the supply and availability of space-related services in Australia.

For example, this would include those assets, functions and components enabling the operation of a space service or activity, including:

1. position, navigation and timing in relation to space objects;
2. space situational awareness services;
3. space weather monitoring and forecasting;
4. communications, tracking, telemetry & control in relation to space objects;
5. remote sensing earth observations from space;
6. facilitating access to space.

A 'critical space technology asset' is not specifically defined in the Draft Bill, as most of these assets are likely to already be covered under the communications sector.

Additional assets may be prescribed by the Minister under sections 9 and 51 of the SCI Act.

As such, the relevant responsible entity is the responsible entity for a 'critical telecommunications asset'. See the Communications sector notes above.

No systems of national significance have been designated at this stage.

The 'water and sewerage sector' is defined as the sector of the Australian economy that involves operating water or sewerage systems or networks.

The definition intends to capture wastewater, potable water, raw water and recycled water, and will therefore include desalination plants, water utilities and bulk water providers.

The definition of a 'critical water asset' under the SCI Act remains unchanged, and means one or more water sewerage systems or networks managed by a single water utility, which ultimately deliver(s) services to at least 100,000 water or sewerage connections.

This captures approximately 29 water and sewerage systems or networks.

The responsible entity means the entity that holds a licence, approval or authorisation (however described), under a law of the Commonwealth, a State or a Territory, to provide the service to be delivered by the critical water asset.

The Minister for Home Affairs may choose to designate additional assets that fall below the 100,000 connection requirement but are considered critical for electricity generation or for other purposes

No systems of national significance have been designated at this stage.