{"id":"qld:act-2008-063","name":"Transport Security (Counter-Terrorism) Act 2008","slug":"transport-security-counter-terrorism-act-2008","collection":"act","jurisdiction":"qld","status":"in_force","isInForce":true,"actNumber":"63 of 2008","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":30116,"registerId":"qld-act-2008-063-current","compilationNumber":null,"startDate":"2026-04-01","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"ch.1-pt.1","sectionType":"part","heading":"General","content":"# General","sortOrder":0},{"sectionNumber":"sec.1","sectionType":"section","heading":"Short title","content":"### sec.1 Short title\n\nThis Act may be cited as the Transport Security (Counter-Terrorism) Act 2008 .","sortOrder":1},{"sectionNumber":"sec.2","sectionType":"section","heading":"Commencement","content":"### sec.2 Commencement\n\nThis Act commences on a day to be fixed by proclamation.","sortOrder":2},{"sectionNumber":"sec.3","sectionType":"section","heading":"Main purpose","content":"### sec.3 Main purpose\n\nThe main purpose of this Act is to provide for planning for the protection of particular surface transport operations and their users against significant adverse impacts associated with terrorist acts involving those surface transport operations.\nThis Act achieves the main purpose by—\nproviding for the declaration of particular surface transport operations as security-identified surface transport operations; and\nestablishing a regulatory framework for the preparation, implementation and review of risk management plans—\naddressing and mitigating the risks of terrorist acts for those surface transport operations; and\nproviding for the recovery and continuity of those surface transport operations in the event of a terrorist act.\n(sec.3-ssec.1) The main purpose of this Act is to provide for planning for the protection of particular surface transport operations and their users against significant adverse impacts associated with terrorist acts involving those surface transport operations.\n(sec.3-ssec.2) This Act achieves the main purpose by— providing for the declaration of particular surface transport operations as security-identified surface transport operations; and establishing a regulatory framework for the preparation, implementation and review of risk management plans— addressing and mitigating the risks of terrorist acts for those surface transport operations; and providing for the recovery and continuity of those surface transport operations in the event of a terrorist act.\n- (a) providing for the declaration of particular surface transport operations as security-identified surface transport operations; and\n- (b) establishing a regulatory framework for the preparation, implementation and review of risk management plans— (i) addressing and mitigating the risks of terrorist acts for those surface transport operations; and (ii) providing for the recovery and continuity of those surface transport operations in the event of a terrorist act.\n- (i) addressing and mitigating the risks of terrorist acts for those surface transport operations; and\n- (ii) providing for the recovery and continuity of those surface transport operations in the event of a terrorist act.\n- (i) addressing and mitigating the risks of terrorist acts for those surface transport operations; and\n- (ii) providing for the recovery and continuity of those surface transport operations in the event of a terrorist act.","sortOrder":3},{"sectionNumber":"sec.4","sectionType":"section","heading":"Overall objectives","content":"### sec.4 Overall objectives\n\nThe overall objectives of this Act are the following—\nto achieve an appropriate balance in relation to the security of SISTOs, public confidence, and the cost of requirements under this Act on SISTOs;\nto promote efficient and affordable counter-terrorism measures for SISTOs and an overall benefit for the community in the security-preparedness of SISTOs;\nto take into account relevant national and international benchmarks for best practice;\nto promote consultation, communication and cooperation between the government, surface transport operations and the community;\nto seek voluntary compliance in preference to enforcement.\n- (a) to achieve an appropriate balance in relation to the security of SISTOs, public confidence, and the cost of requirements under this Act on SISTOs;\n- (b) to promote efficient and affordable counter-terrorism measures for SISTOs and an overall benefit for the community in the security-preparedness of SISTOs;\n- (c) to take into account relevant national and international benchmarks for best practice;\n- (d) to promote consultation, communication and cooperation between the government, surface transport operations and the community;\n- (e) to seek voluntary compliance in preference to enforcement.","sortOrder":4},{"sectionNumber":"sec.5","sectionType":"section","heading":"Act binds all persons","content":"### sec.5 Act binds all persons\n\nThis Act binds all persons, including the State, and so far as the legislative power of the Parliament permits, the other States and the Commonwealth.\nNothing in this Act makes a State or the Commonwealth liable to be prosecuted for an offence.\n(sec.5-ssec.1) This Act binds all persons, including the State, and so far as the legislative power of the Parliament permits, the other States and the Commonwealth.\n(sec.5-ssec.2) Nothing in this Act makes a State or the Commonwealth liable to be prosecuted for an offence.","sortOrder":5},{"sectionNumber":"sec.6","sectionType":"section","heading":"Relationship to other Acts","content":"### sec.6 Relationship to other Acts\n\nThis Act is in addition to, and does not limit any other Act that makes provision for the safety of the public, including, for example, the following Acts—\nWork Health and Safety Act 2011 ;\nDisaster Management Act 2003 ;\nPolice Powers and Responsibilities Act 2000 ;\nPublic Safety Preservation Act 1986 ;\nState Transport Act 1938 .\ns 6 amd 2011 No. 18 s 404 sch 4 pt 2 div 2\n- (a) Work Health and Safety Act 2011 ;\n- (b) Disaster Management Act 2003 ;\n- (c) Police Powers and Responsibilities Act 2000 ;\n- (d) Public Safety Preservation Act 1986 ;\n- (e) State Transport Act 1938 .","sortOrder":6},{"sectionNumber":"ch.1-pt.2","sectionType":"part","heading":"Interpretation","content":"# Interpretation","sortOrder":7},{"sectionNumber":"sec.7","sectionType":"section","heading":"Definitions","content":"### sec.7 Definitions\n\nThe dictionary in the schedule defines particular words used in this Act.","sortOrder":8},{"sectionNumber":"sec.8","sectionType":"section","heading":"Meaning of surface transport operation","content":"### sec.8 Meaning of surface transport operation\n\nA surface transport operation is an activity or system for—\ntransporting passengers by high occupancy vehicles; or\ntransporting goods by high payload vehicles.\nIn this section—\nhigh occupancy vehicle means a vehicle designed to carry 10 or more seated adults, including the driver.\nhigh payload vehicle means a vehicle with a payload of more than 20t.\n(sec.8-ssec.1) A surface transport operation is an activity or system for— transporting passengers by high occupancy vehicles; or transporting goods by high payload vehicles.\n(sec.8-ssec.2) In this section— high occupancy vehicle means a vehicle designed to carry 10 or more seated adults, including the driver. high payload vehicle means a vehicle with a payload of more than 20t.\n- (a) transporting passengers by high occupancy vehicles; or\n- (b) transporting goods by high payload vehicles.","sortOrder":9},{"sectionNumber":"sec.9","sectionType":"section","heading":"Meaning of security-identified surface transport operation or SISTO","content":"### sec.9 Meaning of security-identified surface transport operation or SISTO\n\nA security-identified surface transport operation or SISTO is a surface transport operation declared by the chief executive under section 11 to be a security-identified surface transport operation.","sortOrder":10},{"sectionNumber":"ch.3-pt.1","sectionType":"part","heading":"Preparing risk management plan","content":"# Preparing risk management plan","sortOrder":11},{"sectionNumber":"sec.15","sectionType":"section","heading":"Requirement to prepare a risk management plan and give a copy of it to the chief executive","content":"### sec.15 Requirement to prepare a risk management plan and give a copy of it to the chief executive\n\nA SISTO entity must—\nprepare a risk management plan for the SISTO under this part; and\ngive a copy of the plan, in written or electronic form, to the chief executive within the prescribed period.\nMaximum penalty—60 penalty units.\nIn this section—\nprescribed period , for giving a copy of a risk management plan to the chief executive, means—\nif a period of 3 months or longer is stated in the declaration notice for the SISTO for giving the copy—the stated period; or\nif paragraph (a) does not apply—the 3 month period after the declaration notice is gazetted.\n(sec.15-ssec.1) A SISTO entity must— prepare a risk management plan for the SISTO under this part; and give a copy of the plan, in written or electronic form, to the chief executive within the prescribed period. Maximum penalty—60 penalty units.\n(sec.15-ssec.2) In this section— prescribed period , for giving a copy of a risk management plan to the chief executive, means— if a period of 3 months or longer is stated in the declaration notice for the SISTO for giving the copy—the stated period; or if paragraph (a) does not apply—the 3 month period after the declaration notice is gazetted.\n- (a) prepare a risk management plan for the SISTO under this part; and\n- (b) give a copy of the plan, in written or electronic form, to the chief executive within the prescribed period.\n- (a) if a period of 3 months or longer is stated in the declaration notice for the SISTO for giving the copy—the stated period; or\n- (b) if paragraph (a) does not apply—the 3 month period after the declaration notice is gazetted.","sortOrder":12},{"sectionNumber":"sec.16","sectionType":"section","heading":"Preparing a plan","content":"### sec.16 Preparing a plan\n\nA risk management plan must be prepared in accordance with each of the following documents as amended, or remade, from time to time—\nan AS/NZS providing for counter-terrorism risk management that is prescribed under a regulation;\nto the extent the document mentioned in paragraph (a) does not provide for a matter relating to the preparation of the risk management plan, AS/NZS ISO 31000:2009 Risk management—Principles and guidelines.\nThe objectives of the risk management plan are each of the following—\nto prevent or reduce the risks to the SISTO of a terrorist act involving the SISTO;\nto lessen the effects on the SISTO of a terrorist act involving the SISTO;\nto provide for the recovery and continuity of the SISTO in the event of a terrorist act;\nto foster communication and cooperation, in relation to counter-terrorism measures, with the following—\nif the SISTO has 1 or more related SISTOs—each related SISTO entity;\nthe owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO.\nThe risk management plan may comprise an existing plan that complies with section 17 and addresses the threat and consequences of the SISTO being a target of a terrorist act.\nan existing security plan\nan existing on-site emergency response plan\nan existing business continuity plan\nIn this section—\nAS/NZS means a standard published jointly by Standards Australia and Standards New Zealand.\ns 16 amd 2010 No. 13 s 138 sch\n(sec.16-ssec.1) A risk management plan must be prepared in accordance with each of the following documents as amended, or remade, from time to time— an AS/NZS providing for counter-terrorism risk management that is prescribed under a regulation; to the extent the document mentioned in paragraph (a) does not provide for a matter relating to the preparation of the risk management plan, AS/NZS ISO 31000:2009 Risk management—Principles and guidelines.\n(sec.16-ssec.2) The objectives of the risk management plan are each of the following— to prevent or reduce the risks to the SISTO of a terrorist act involving the SISTO; to lessen the effects on the SISTO of a terrorist act involving the SISTO; to provide for the recovery and continuity of the SISTO in the event of a terrorist act; to foster communication and cooperation, in relation to counter-terrorism measures, with the following— if the SISTO has 1 or more related SISTOs—each related SISTO entity; the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO.\n(sec.16-ssec.3) The risk management plan may comprise an existing plan that complies with section 17 and addresses the threat and consequences of the SISTO being a target of a terrorist act. an existing security plan an existing on-site emergency response plan an existing business continuity plan\n(sec.16-ssec.4) In this section— AS/NZS means a standard published jointly by Standards Australia and Standards New Zealand.\n- (a) an AS/NZS providing for counter-terrorism risk management that is prescribed under a regulation;\n- (b) to the extent the document mentioned in paragraph (a) does not provide for a matter relating to the preparation of the risk management plan, AS/NZS ISO 31000:2009 Risk management—Principles and guidelines.\n- (a) to prevent or reduce the risks to the SISTO of a terrorist act involving the SISTO;\n- (b) to lessen the effects on the SISTO of a terrorist act involving the SISTO;\n- (c) to provide for the recovery and continuity of the SISTO in the event of a terrorist act;\n- (d) to foster communication and cooperation, in relation to counter-terrorism measures, with the following— (i) if the SISTO has 1 or more related SISTOs—each related SISTO entity; (ii) the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO.\n- (i) if the SISTO has 1 or more related SISTOs—each related SISTO entity;\n- (ii) the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO.\n- (i) if the SISTO has 1 or more related SISTOs—each related SISTO entity;\n- (ii) the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO.\n- • an existing security plan\n- • an existing on-site emergency response plan\n- • an existing business continuity plan","sortOrder":13},{"sectionNumber":"sec.17","sectionType":"section","heading":"Content of a plan","content":"### sec.17 Content of a plan\n\nA risk management plan for a SISTO must—\ncontain an assessment of the risks to the SISTO of a terrorist act involving the SISTO; and\nstate the measures to be taken to prevent or reduce the risks; and\ncontain a range of measures to respond to changes in the national counter-terrorism alert level or the SISTO’s level of risk.\nThe risk management plan must also state the measures to be taken in the event of a particular security incident involving the SISTO, including the procedures for each of the following—\nresponding to the security incident;\nrecovering the SISTO from the security incident;\nproviding for the SISTO’s continuity;\ncommunicating immediately with the Queensland Police Service;\nunless otherwise instructed by the chief executive, communicating as soon as practicable with—\nthe chief executive; and\nif the SISTO has 1 or more related SISTOs—each related SISTO entity; and\nthe owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO;\ncoordinating the risk management plan with any relevant—\nemergency plan and procedure prepared under the Work Health and Safety Act 2011 ; and\ndisaster management plan prepared under the Disaster Management Act 2003 ; and\npotential exercise of power under the Public Safety Preservation Act 1986 .\nThe risk management plan must also—\nstate details, including the frequency, of relevant training to be given to the employees engaged in carrying on the SISTO; and\nprovide for the keeping of a record of training given to the employees in accordance with the risk management plan.\nThe risk management plan must clearly identify each person, whether by reference to the person’s position or title, who has an obligation to comply with the risk management plan.\nThe risk management plan must also state the following—\nthe positions or titles of the persons involved in carrying on the SISTO who are responsible for implementing the risk management plan;\nthe contact details, in the case of a security incident, for the persons mentioned in paragraph (a) ;\nthe measures to be taken for maintaining security of the auditable records for the SISTO.\nIf the SISTO has 1 or more related SISTOs, the risk management plan must include the arrangements for coordinating the plan with the risk management plans of the related SISTOs.\nIn this section—\nrelevant training means training about the procedures to be followed to prevent or respond to a security incident.\ns 17 amd 2011 No. 18 s 404 sch 4 pt 2 div 2\n(sec.17-ssec.1) A risk management plan for a SISTO must— contain an assessment of the risks to the SISTO of a terrorist act involving the SISTO; and state the measures to be taken to prevent or reduce the risks; and contain a range of measures to respond to changes in the national counter-terrorism alert level or the SISTO’s level of risk.\n(sec.17-ssec.2) The risk management plan must also state the measures to be taken in the event of a particular security incident involving the SISTO, including the procedures for each of the following— responding to the security incident; recovering the SISTO from the security incident; providing for the SISTO’s continuity; communicating immediately with the Queensland Police Service; unless otherwise instructed by the chief executive, communicating as soon as practicable with— the chief executive; and if the SISTO has 1 or more related SISTOs—each related SISTO entity; and the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO; coordinating the risk management plan with any relevant— emergency plan and procedure prepared under the Work Health and Safety Act 2011 ; and disaster management plan prepared under the Disaster Management Act 2003 ; and potential exercise of power under the Public Safety Preservation Act 1986 .\n(sec.17-ssec.3) The risk management plan must also— state details, including the frequency, of relevant training to be given to the employees engaged in carrying on the SISTO; and provide for the keeping of a record of training given to the employees in accordance with the risk management plan.\n(sec.17-ssec.4) The risk management plan must clearly identify each person, whether by reference to the person’s position or title, who has an obligation to comply with the risk management plan.\n(sec.17-ssec.5) The risk management plan must also state the following— the positions or titles of the persons involved in carrying on the SISTO who are responsible for implementing the risk management plan; the contact details, in the case of a security incident, for the persons mentioned in paragraph (a) ; the measures to be taken for maintaining security of the auditable records for the SISTO.\n(sec.17-ssec.6) If the SISTO has 1 or more related SISTOs, the risk management plan must include the arrangements for coordinating the plan with the risk management plans of the related SISTOs.\n(sec.17-ssec.7) In this section— relevant training means training about the procedures to be followed to prevent or respond to a security incident.\n- (a) contain an assessment of the risks to the SISTO of a terrorist act involving the SISTO; and\n- (b) state the measures to be taken to prevent or reduce the risks; and\n- (c) contain a range of measures to respond to changes in the national counter-terrorism alert level or the SISTO’s level of risk.\n- (a) responding to the security incident;\n- (b) recovering the SISTO from the security incident;\n- (c) providing for the SISTO’s continuity;\n- (d) communicating immediately with the Queensland Police Service;\n- (e) unless otherwise instructed by the chief executive, communicating as soon as practicable with— (i) the chief executive; and (ii) if the SISTO has 1 or more related SISTOs—each related SISTO entity; and (iii) the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO;\n- (i) the chief executive; and\n- (ii) if the SISTO has 1 or more related SISTOs—each related SISTO entity; and\n- (iii) the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO;\n- (f) coordinating the risk management plan with any relevant— (i) emergency plan and procedure prepared under the Work Health and Safety Act 2011 ; and (ii) disaster management plan prepared under the Disaster Management Act 2003 ; and (iii) potential exercise of power under the Public Safety Preservation Act 1986 .\n- (i) emergency plan and procedure prepared under the Work Health and Safety Act 2011 ; and\n- (ii) disaster management plan prepared under the Disaster Management Act 2003 ; and\n- (iii) potential exercise of power under the Public Safety Preservation Act 1986 .\n- (i) the chief executive; and\n- (ii) if the SISTO has 1 or more related SISTOs—each related SISTO entity; and\n- (iii) the owners or occupiers of areas immediately neighbouring a facility used for carrying on the SISTO;\n- (i) emergency plan and procedure prepared under the Work Health and Safety Act 2011 ; and\n- (ii) disaster management plan prepared under the Disaster Management Act 2003 ; and\n- (iii) potential exercise of power under the Public Safety Preservation Act 1986 .\n- (a) state details, including the frequency, of relevant training to be given to the employees engaged in carrying on the SISTO; and\n- (b) provide for the keeping of a record of training given to the employees in accordance with the risk management plan.\n- (a) the positions or titles of the persons involved in carrying on the SISTO who are responsible for implementing the risk management plan;\n- (b) the contact details, in the case of a security incident, for the persons mentioned in paragraph (a) ;\n- (c) the measures to be taken for maintaining security of the auditable records for the SISTO.","sortOrder":14},{"sectionNumber":"sec.18","sectionType":"section","heading":"Guidelines for preparing a risk management plan","content":"### sec.18 Guidelines for preparing a risk management plan\n\nThe chief executive may make, and give to a SISTO entity, guidelines about the following—\nthe preparation of a risk management plan;\nthe matters to be included in a risk management plan.\nIf the guidelines are inconsistent with a document mentioned in section 16 (1) , the document mentioned in that subsection prevails to the extent of the inconsistency.\nIf the guidelines for a matter are consistent with a document mentioned in section 16 (1) , compliance with the guidelines in relation to the matter is sufficient compliance with section 16 (1) to the extent it relates to the matter.\n(sec.18-ssec.1) The chief executive may make, and give to a SISTO entity, guidelines about the following— the preparation of a risk management plan; the matters to be included in a risk management plan.\n(sec.18-ssec.2) If the guidelines are inconsistent with a document mentioned in section 16 (1) , the document mentioned in that subsection prevails to the extent of the inconsistency.\n(sec.18-ssec.3) If the guidelines for a matter are consistent with a document mentioned in section 16 (1) , compliance with the guidelines in relation to the matter is sufficient compliance with section 16 (1) to the extent it relates to the matter.\n- (a) the preparation of a risk management plan;\n- (b) the matters to be included in a risk management plan.","sortOrder":15},{"sectionNumber":"ch.3-pt.2","sectionType":"part","heading":"Other provisions about plan","content":"# Other provisions about plan","sortOrder":16},{"sectionNumber":"sec.19","sectionType":"section","heading":"Implementing and complying with a plan","content":"### sec.19 Implementing and complying with a plan\n\nA SISTO entity must implement the risk management plan for the SISTO as soon as possible after the plan is prepared.\nMaximum penalty—50 penalty units.\nA SISTO entity must take all reasonable steps to ensure each person who has an obligation to comply with the risk management plan for the SISTO complies with it.\nMaximum penalty—50 penalty units.\n(sec.19-ssec.1) A SISTO entity must implement the risk management plan for the SISTO as soon as possible after the plan is prepared. Maximum penalty—50 penalty units.\n(sec.19-ssec.2) A SISTO entity must take all reasonable steps to ensure each person who has an obligation to comply with the risk management plan for the SISTO complies with it. Maximum penalty—50 penalty units.","sortOrder":17},{"sectionNumber":"sec.20","sectionType":"section","heading":"Annual audit of risk management plan","content":"### sec.20 Annual audit of risk management plan\n\nA SISTO entity must conduct an audit each year, not more than 1 year after the previous audit, to check whether the risk management plan for the SISTO is being implemented, and complied with, by the entity’s employees.\nMaximum penalty—50 penalty units.","sortOrder":18},{"sectionNumber":"sec.21","sectionType":"section","heading":"Audit record","content":"### sec.21 Audit record\n\nA SISTO entity must keep a record of an audit conducted under section 20 for the SISTO, as required under this section.\nMaximum penalty—50 penalty units.\nThe record must contain the following information—\nthe date of the audit;\nthe name of the person (the auditor ) who carried out the audit;\nthe auditor’s contact details and, if applicable, the auditor’s position or title within an entity responsible for conducting the audit;\nthe audit results, including the auditor’s recommended actions and recommended implementation dates for the actions;\nthe auditor’s recommended actions that have been implemented and the dates on which they were implemented;\nthe auditor’s recommended actions that have not been implemented and the reasons why they have not been implemented.\nThe record must be kept for 3 years after the date of the last entry in the record.\n(sec.21-ssec.1) A SISTO entity must keep a record of an audit conducted under section 20 for the SISTO, as required under this section. Maximum penalty—50 penalty units.\n(sec.21-ssec.2) The record must contain the following information— the date of the audit; the name of the person (the auditor ) who carried out the audit; the auditor’s contact details and, if applicable, the auditor’s position or title within an entity responsible for conducting the audit; the audit results, including the auditor’s recommended actions and recommended implementation dates for the actions; the auditor’s recommended actions that have been implemented and the dates on which they were implemented; the auditor’s recommended actions that have not been implemented and the reasons why they have not been implemented.\n(sec.21-ssec.3) The record must be kept for 3 years after the date of the last entry in the record.\n- (a) the date of the audit;\n- (b) the name of the person (the auditor ) who carried out the audit;\n- (c) the auditor’s contact details and, if applicable, the auditor’s position or title within an entity responsible for conducting the audit;\n- (d) the audit results, including the auditor’s recommended actions and recommended implementation dates for the actions;\n- (e) the auditor’s recommended actions that have been implemented and the dates on which they were implemented;\n- (f) the auditor’s recommended actions that have not been implemented and the reasons why they have not been implemented.","sortOrder":19},{"sectionNumber":"sec.22","sectionType":"section","heading":"Reviewing a plan","content":"### sec.22 Reviewing a plan\n\nA SISTO entity must review the risk management plan for the SISTO under subsection (2) to check the plan’s continued compliance with sections 16 and 17 .\nMaximum penalty—50 penalty units.\nThe risk management plan must be reviewed as soon as possible after any of the following happens—\nthe SISTO entity is given a notice under section 13 (3) that the declaration notice for the SISTO has been amended;\nthe entity becomes aware of a systemic problem with the plan because of an audit of the plan under section 20 , or an exercise conducted under section 25 to test the operation of the plan;\nthe SISTO’s circumstances change in a way that may affect the SISTO’s level of risk;\na security incident involving the SISTO;\nthe end of 5 years after the risk management plan was prepared, or last reviewed under this section.\n(sec.22-ssec.1) A SISTO entity must review the risk management plan for the SISTO under subsection (2) to check the plan’s continued compliance with sections 16 and 17 . Maximum penalty—50 penalty units.\n(sec.22-ssec.2) The risk management plan must be reviewed as soon as possible after any of the following happens— the SISTO entity is given a notice under section 13 (3) that the declaration notice for the SISTO has been amended; the entity becomes aware of a systemic problem with the plan because of an audit of the plan under section 20 , or an exercise conducted under section 25 to test the operation of the plan; the SISTO’s circumstances change in a way that may affect the SISTO’s level of risk; a security incident involving the SISTO; the end of 5 years after the risk management plan was prepared, or last reviewed under this section.\n- (a) the SISTO entity is given a notice under section 13 (3) that the declaration notice for the SISTO has been amended;\n- (b) the entity becomes aware of a systemic problem with the plan because of an audit of the plan under section 20 , or an exercise conducted under section 25 to test the operation of the plan;\n- (c) the SISTO’s circumstances change in a way that may affect the SISTO’s level of risk;\n- (d) a security incident involving the SISTO;\n- (e) the end of 5 years after the risk management plan was prepared, or last reviewed under this section.","sortOrder":20},{"sectionNumber":"sec.23","sectionType":"section","heading":"Review record","content":"### sec.23 Review record\n\nA SISTO entity must prepare and keep a record of a review conducted under section 22 for the SISTO as required under this section.\nMaximum penalty—50 penalty units.\nThe record must be prepared within 28 days after the review ends.\nThe record must contain the following information—\nthe date of the review;\nthe happening mentioned in section 22 (2) that caused the review;\nthe name of the person (the reviewer ) who carried out the review;\nthe reviewer’s position or title and the reviewer’s relationship to the SISTO;\nthe review results, including the reviewer’s recommended actions and recommended implementation dates for the actions;\nthe reviewer’s recommended actions that have been implemented and the dates on which the actions were implemented;\nthe reviewer’s recommended actions that have not been implemented and the reasons why they have not been implemented.\nThe record must be kept for 3 years after the date of the last entry in the record.\n(sec.23-ssec.1) A SISTO entity must prepare and keep a record of a review conducted under section 22 for the SISTO as required under this section. Maximum penalty—50 penalty units.\n(sec.23-ssec.2) The record must be prepared within 28 days after the review ends.\n(sec.23-ssec.3) The record must contain the following information— the date of the review; the happening mentioned in section 22 (2) that caused the review; the name of the person (the reviewer ) who carried out the review; the reviewer’s position or title and the reviewer’s relationship to the SISTO; the review results, including the reviewer’s recommended actions and recommended implementation dates for the actions; the reviewer’s recommended actions that have been implemented and the dates on which the actions were implemented; the reviewer’s recommended actions that have not been implemented and the reasons why they have not been implemented.\n(sec.23-ssec.4) The record must be kept for 3 years after the date of the last entry in the record.\n- (a) the date of the review;\n- (b) the happening mentioned in section 22 (2) that caused the review;\n- (c) the name of the person (the reviewer ) who carried out the review;\n- (d) the reviewer’s position or title and the reviewer’s relationship to the SISTO;\n- (e) the review results, including the reviewer’s recommended actions and recommended implementation dates for the actions;\n- (f) the reviewer’s recommended actions that have been implemented and the dates on which the actions were implemented;\n- (g) the reviewer’s recommended actions that have not been implemented and the reasons why they have not been implemented.","sortOrder":21},{"sectionNumber":"sec.24","sectionType":"section","heading":"Amending a plan after review","content":"### sec.24 Amending a plan after review\n\nWithin 28 days after a SISTO entity becomes aware of a deficiency in the risk management plan for the SISTO, the entity must amend the plan to rectify the deficiency.\nMaximum penalty—50 penalty units.\nWithin 28 days after an amendment is made under subsection (1) , the SISTO entity must give a copy of the amendment, or a copy of the plan as amended, to the chief executive.\nMaximum penalty—60 penalty units.\nIn this section—\ndeficiency , in relation to a risk management plan, means a deficiency in the plan’s compliance with section 16 or 17 .\n(sec.24-ssec.1) Within 28 days after a SISTO entity becomes aware of a deficiency in the risk management plan for the SISTO, the entity must amend the plan to rectify the deficiency. Maximum penalty—50 penalty units.\n(sec.24-ssec.2) Within 28 days after an amendment is made under subsection (1) , the SISTO entity must give a copy of the amendment, or a copy of the plan as amended, to the chief executive. Maximum penalty—60 penalty units.\n(sec.24-ssec.3) In this section— deficiency , in relation to a risk management plan, means a deficiency in the plan’s compliance with section 16 or 17 .","sortOrder":22},{"sectionNumber":"sec.25","sectionType":"section","heading":"Preparing, conducting and participating in exercises to test the operation of a plan","content":"### sec.25 Preparing, conducting and participating in exercises to test the operation of a plan\n\nA SISTO entity must test the operation of the risk management plan for the SISTO at least once in each year by—\neither—\nplanning and conducting 1 or more exercises complying with the prescribed standard; or\ncontributing to the planning and conduct of at least 1 exercise conducted by another entity to test surface transport security plans and arrangements; and\na government agency, another SISTO\ntaking all reasonable steps to ensure that each person having an obligation under the risk management plan participates in at least 1 exercise that tests the part of the plan relevant to the person’s obligation.\nMaximum penalty—60 penalty units.\nA SISTO entity must also comply with any direction given to the entity by the chief executive to test the operation of the risk management plan for the SISTO by participating in an exercise mentioned in subsection (1) (a) (ii) .\nMaximum penalty—60 penalty units.\nHowever, subsection (2) does not apply to a SISTO entity if it has already participated in an exercise mentioned in subsection (1) (a) (ii) in relation to the SISTO in the year in which the direction is given.\nAt least 28 days before an exercise mentioned in subsection (1) (a) is conducted for a SISTO, the SISTO entity must, unless the entity has a reasonable excuse—\ngive the chief executive a copy of the plan for the exercise; and\ntell the chief executive the date and time of the exercise.\nMaximum penalty—60 penalty units.\nAn authorised officer may observe the exercise.\nIn this section—\nprescribed standard means—\na standard prescribed under a regulation; or\nif no standard is prescribed—the ‘Australian Emergency Manuals Series, part V—The management of training— manual 42—Managing exercises’ published by Emergency Management Australia from time to time.\ns 25 amd 2010 No. 19 s 281 sch\n(sec.25-ssec.1) A SISTO entity must test the operation of the risk management plan for the SISTO at least once in each year by— either— planning and conducting 1 or more exercises complying with the prescribed standard; or contributing to the planning and conduct of at least 1 exercise conducted by another entity to test surface transport security plans and arrangements; and a government agency, another SISTO taking all reasonable steps to ensure that each person having an obligation under the risk management plan participates in at least 1 exercise that tests the part of the plan relevant to the person’s obligation. Maximum penalty—60 penalty units.\n(sec.25-ssec.2) A SISTO entity must also comply with any direction given to the entity by the chief executive to test the operation of the risk management plan for the SISTO by participating in an exercise mentioned in subsection (1) (a) (ii) . Maximum penalty—60 penalty units.\n(sec.25-ssec.3) However, subsection (2) does not apply to a SISTO entity if it has already participated in an exercise mentioned in subsection (1) (a) (ii) in relation to the SISTO in the year in which the direction is given.\n(sec.25-ssec.4) At least 28 days before an exercise mentioned in subsection (1) (a) is conducted for a SISTO, the SISTO entity must, unless the entity has a reasonable excuse— give the chief executive a copy of the plan for the exercise; and tell the chief executive the date and time of the exercise. Maximum penalty—60 penalty units.\n(sec.25-ssec.5) An authorised officer may observe the exercise.\n(sec.25-ssec.6) In this section— prescribed standard means— a standard prescribed under a regulation; or if no standard is prescribed—the ‘Australian Emergency Manuals Series, part V—The management of training— manual 42—Managing exercises’ published by Emergency Management Australia from time to time.\n- (a) either— (i) planning and conducting 1 or more exercises complying with the prescribed standard; or (ii) contributing to the planning and conduct of at least 1 exercise conducted by another entity to test surface transport security plans and arrangements; and Examples of another entity— a government agency, another SISTO\n- (i) planning and conducting 1 or more exercises complying with the prescribed standard; or\n- (ii) contributing to the planning and conduct of at least 1 exercise conducted by another entity to test surface transport security plans and arrangements; and Examples of another entity— a government agency, another SISTO\n- (b) taking all reasonable steps to ensure that each person having an obligation under the risk management plan participates in at least 1 exercise that tests the part of the plan relevant to the person’s obligation.\n- (i) planning and conducting 1 or more exercises complying with the prescribed standard; or\n- (ii) contributing to the planning and conduct of at least 1 exercise conducted by another entity to test surface transport security plans and arrangements; and Examples of another entity— a government agency, another SISTO\n- (a) give the chief executive a copy of the plan for the exercise; and\n- (b) tell the chief executive the date and time of the exercise.\n- (a) a standard prescribed under a regulation; or\n- (b) if no standard is prescribed—the ‘Australian Emergency Manuals Series, part V—The management of training— manual 42—Managing exercises’ published by Emergency Management Australia from time to time.","sortOrder":23},{"sectionNumber":"sec.26","sectionType":"section","heading":"Test exercise record","content":"### sec.26 Test exercise record\n\nA SISTO entity must prepare and keep a record of each exercise conducted under section 25 involving the SISTO, as required under this section.\nMaximum penalty—50 penalty units.\nThe record must be prepared within 28 days after the exercise ends.\nThe record must contain the following information—\nthe date the exercise was conducted;\nthe name, contact details and position or title in relation to the SISTO entity or other entity of the person who planned and conducted the exercise;\nwhat part of the risk management plan was tested.\nThe record must be kept for 3 years after the date of the last entry in the record.\n(sec.26-ssec.1) A SISTO entity must prepare and keep a record of each exercise conducted under section 25 involving the SISTO, as required under this section. Maximum penalty—50 penalty units.\n(sec.26-ssec.2) The record must be prepared within 28 days after the exercise ends.\n(sec.26-ssec.3) The record must contain the following information— the date the exercise was conducted; the name, contact details and position or title in relation to the SISTO entity or other entity of the person who planned and conducted the exercise; what part of the risk management plan was tested.\n(sec.26-ssec.4) The record must be kept for 3 years after the date of the last entry in the record.\n- (a) the date the exercise was conducted;\n- (b) the name, contact details and position or title in relation to the SISTO entity or other entity of the person who planned and conducted the exercise;\n- (c) what part of the risk management plan was tested.","sortOrder":24},{"sectionNumber":"sec.27","sectionType":"section","heading":"Annual certificate about auditing, reviewing and testing the operation of the plan","content":"### sec.27 Annual certificate about auditing, reviewing and testing the operation of the plan\n\nEach year, a SISTO entity must give the chief executive a certificate in the approved form about the risk management plan for the SISTO ( annual certificate ) as required under subsection (2) .\nMaximum penalty—60 penalty units.\nThe annual certificate must be signed by or for the SISTO entity and given to the chief executive before the later of the following—\n1 September;\nthe day stated by the chief executive in a written notice given to the entity.\nThe approved form must provide for information about the following to be included in the form—\nwhether there is a risk management plan for the SISTO addressing the threat and consequences of the SISTO being a target of a terrorist act;\nthe date the plan was prepared;\nthe information mentioned in section 21 (2) about the most recent audit of the plan;\nthe information mentioned in section 23 (3) about the most recent review of the plan;\nthe information mentioned in section 26 (3) about the most recent exercise testing the operation of the plan.\n(sec.27-ssec.1) Each year, a SISTO entity must give the chief executive a certificate in the approved form about the risk management plan for the SISTO ( annual certificate ) as required under subsection (2) . Maximum penalty—60 penalty units.\n(sec.27-ssec.2) The annual certificate must be signed by or for the SISTO entity and given to the chief executive before the later of the following— 1 September; the day stated by the chief executive in a written notice given to the entity.\n(sec.27-ssec.3) The approved form must provide for information about the following to be included in the form— whether there is a risk management plan for the SISTO addressing the threat and consequences of the SISTO being a target of a terrorist act; the date the plan was prepared; the information mentioned in section 21 (2) about the most recent audit of the plan; the information mentioned in section 23 (3) about the most recent review of the plan; the information mentioned in section 26 (3) about the most recent exercise testing the operation of the plan.\n- (a) 1 September;\n- (b) the day stated by the chief executive in a written notice given to the entity.\n- (a) whether there is a risk management plan for the SISTO addressing the threat and consequences of the SISTO being a target of a terrorist act;\n- (b) the date the plan was prepared;\n- (c) the information mentioned in section 21 (2) about the most recent audit of the plan;\n- (d) the information mentioned in section 23 (3) about the most recent review of the plan;\n- (e) the information mentioned in section 26 (3) about the most recent exercise testing the operation of the plan.","sortOrder":25},{"sectionNumber":"sec.28","sectionType":"section","heading":"Giving chief executive notice of change to contact information in risk management plan","content":"### sec.28 Giving chief executive notice of change to contact information in risk management plan\n\nThis section applies if a change happens in the information stated in a risk management plan for a SISTO under section 17 (5) (a) and (b) (the emergency contact information ).\nWithin 2 business days after becoming aware of the change, the SISTO entity must give written notice of the updated emergency contact information to—\nthe chief executive; and\nif the SISTO has 1 or more related SISTOs—each related SISTO entity.\nMaximum penalty—60 penalty units.\n(sec.28-ssec.1) This section applies if a change happens in the information stated in a risk management plan for a SISTO under section 17 (5) (a) and (b) (the emergency contact information ).\n(sec.28-ssec.2) Within 2 business days after becoming aware of the change, the SISTO entity must give written notice of the updated emergency contact information to— the chief executive; and if the SISTO has 1 or more related SISTOs—each related SISTO entity. Maximum penalty—60 penalty units.\n- (a) the chief executive; and\n- (b) if the SISTO has 1 or more related SISTOs—each related SISTO entity.","sortOrder":26},{"sectionNumber":"ch.4-pt.1","sectionType":"part","heading":"Authorised officers","content":"# Authorised officers","sortOrder":27},{"sectionNumber":"sec.29","sectionType":"section","heading":"Appointment and qualifications","content":"### sec.29 Appointment and qualifications\n\nThe chief executive may appoint any of the following persons as an authorised officer—\nan officer of the department;\nanother person decided by the chief executive.\nHowever, the chief executive may appoint a person as an authorised officer only if the chief executive is satisfied the person is qualified for appointment because the person has the necessary expertise or experience.\n(sec.29-ssec.1) The chief executive may appoint any of the following persons as an authorised officer— an officer of the department; another person decided by the chief executive.\n(sec.29-ssec.2) However, the chief executive may appoint a person as an authorised officer only if the chief executive is satisfied the person is qualified for appointment because the person has the necessary expertise or experience.\n- (a) an officer of the department;\n- (b) another person decided by the chief executive.","sortOrder":28},{"sectionNumber":"sec.30","sectionType":"section","heading":"Appointment conditions and limit on powers","content":"### sec.30 Appointment conditions and limit on powers\n\nAn authorised officer holds office on any conditions stated in—\nthe authorised officer’s instrument of appointment; or\na signed notice given to the authorised officer; or\na regulation.\nThe instrument of appointment, a signed notice given to the authorised officer or a regulation may limit the authorised officer’s powers under this Act.\nIn this section—\nsigned notice means a notice signed by the chief executive.\n(sec.30-ssec.1) An authorised officer holds office on any conditions stated in— the authorised officer’s instrument of appointment; or a signed notice given to the authorised officer; or a regulation.\n(sec.30-ssec.2) The instrument of appointment, a signed notice given to the authorised officer or a regulation may limit the authorised officer’s powers under this Act.\n(sec.30-ssec.3) In this section— signed notice means a notice signed by the chief executive.\n- (a) the authorised officer’s instrument of appointment; or\n- (b) a signed notice given to the authorised officer; or\n- (c) a regulation.","sortOrder":29},{"sectionNumber":"sec.31","sectionType":"section","heading":"Issue of identity card","content":"### sec.31 Issue of identity card\n\nThe chief executive must issue an identity card to each authorised officer.\nThe identity card must—\ncontain a recent photo of the authorised officer; and\ncontain a copy of the authorised officer’s signature; and\nidentify the person as an authorised officer under this Act; and\nstate an expiry date for the card.\nThis section does not prevent the issue of a single identity card to a person for this Act and other purposes.\n(sec.31-ssec.1) The chief executive must issue an identity card to each authorised officer.\n(sec.31-ssec.2) The identity card must— contain a recent photo of the authorised officer; and contain a copy of the authorised officer’s signature; and identify the person as an authorised officer under this Act; and state an expiry date for the card.\n(sec.31-ssec.3) This section does not prevent the issue of a single identity card to a person for this Act and other purposes.\n- (a) contain a recent photo of the authorised officer; and\n- (b) contain a copy of the authorised officer’s signature; and\n- (c) identify the person as an authorised officer under this Act; and\n- (d) state an expiry date for the card.","sortOrder":30},{"sectionNumber":"sec.32","sectionType":"section","heading":"Production or display of identity card","content":"### sec.32 Production or display of identity card\n\nIn exercising a power under this Act in relation to a person, an authorised officer must—\nproduce the authorised officer’s identity card for the person’s inspection before exercising the power; or\nhave the identity card displayed so it is clearly visible to the person when exercising the power.\nHowever, if it is not practicable to comply with subsection (1) , the authorised officer must produce the identity card for the person’s inspection at the first reasonable opportunity.\nFor subsection (1) , an authorised officer does not exercise a power in relation to a person only because the authorised officer has entered a place as mentioned in section 36 (1) (b) or (3) .\n(sec.32-ssec.1) In exercising a power under this Act in relation to a person, an authorised officer must— produce the authorised officer’s identity card for the person’s inspection before exercising the power; or have the identity card displayed so it is clearly visible to the person when exercising the power.\n(sec.32-ssec.2) However, if it is not practicable to comply with subsection (1) , the authorised officer must produce the identity card for the person’s inspection at the first reasonable opportunity.\n(sec.32-ssec.3) For subsection (1) , an authorised officer does not exercise a power in relation to a person only because the authorised officer has entered a place as mentioned in section 36 (1) (b) or (3) .\n- (a) produce the authorised officer’s identity card for the person’s inspection before exercising the power; or\n- (b) have the identity card displayed so it is clearly visible to the person when exercising the power.","sortOrder":31},{"sectionNumber":"sec.33","sectionType":"section","heading":"When authorised officer ceases to hold office","content":"### sec.33 When authorised officer ceases to hold office\n\nAn authorised officer ceases to hold office if any of the following happens—\nthe term of office stated in a condition of office ends;\nunder another condition of office, the authorised officer ceases to hold office;\nthe authorised officer’s resignation under section 34 takes effect.\nSubsection (1) does not limit the ways an authorised officer may cease to hold office.\nIn this section—\ncondition of office means a condition on which the authorised officer holds office.\n(sec.33-ssec.1) An authorised officer ceases to hold office if any of the following happens— the term of office stated in a condition of office ends; under another condition of office, the authorised officer ceases to hold office; the authorised officer’s resignation under section 34 takes effect.\n(sec.33-ssec.2) Subsection (1) does not limit the ways an authorised officer may cease to hold office.\n(sec.33-ssec.3) In this section— condition of office means a condition on which the authorised officer holds office.\n- (a) the term of office stated in a condition of office ends;\n- (b) under another condition of office, the authorised officer ceases to hold office;\n- (c) the authorised officer’s resignation under section 34 takes effect.","sortOrder":32},{"sectionNumber":"sec.34","sectionType":"section","heading":"Resignation","content":"### sec.34 Resignation\n\nAn authorised officer may resign by signed notice given to the chief executive.","sortOrder":33},{"sectionNumber":"sec.35","sectionType":"section","heading":"Return of identity card","content":"### sec.35 Return of identity card\n\nA person who ceases to be an authorised officer must return the person’s identity card to the chief executive within 7 days after ceasing to be an authorised officer, unless the person has a reasonable excuse.\nMaximum penalty—10 penalty units.","sortOrder":34},{"sectionNumber":"ch.4-pt.2","sectionType":"part","heading":"Powers of authorised officers","content":"# Powers of authorised officers","sortOrder":35},{"sectionNumber":"ch.4-pt.2-div.1","sectionType":"division","heading":"Entry of places","content":"## Entry of places","sortOrder":36},{"sectionNumber":"sec.36","sectionType":"section","heading":"Power to enter places","content":"### sec.36 Power to enter places\n\nAn authorised officer may enter a place if—\nan occupier of the place consents to the entry; or\nit is a public place and the entry is made when it is open to the public.\nAlso, an authorised officer may enter a place occupied by a SISTO entity—\nto observe an exercise under section 25 (5) ; or\nsubject to subsection (5) , to check that the risk management plan for the SISTO is being implemented and complied with.\nFor the purpose of asking an occupier of a place for consent to enter, an authorised officer may, without the occupier’s consent—\nenter land around premises at the place to an extent that is reasonable to contact the occupier; or\nenter part of the place the authorised officer reasonably considers members of the public ordinarily are allowed to enter when they wish to contact the occupier.\nFor subsections (2) and (3) , a place does not include a part of the place where a person resides.\nAn authorised officer may enter a place under subsection (2) (b) only if the SISTO entity occupying the place has been given at least 7 days written notice of the intended entry and its purpose.\n(sec.36-ssec.1) An authorised officer may enter a place if— an occupier of the place consents to the entry; or it is a public place and the entry is made when it is open to the public.\n(sec.36-ssec.2) Also, an authorised officer may enter a place occupied by a SISTO entity— to observe an exercise under section 25 (5) ; or subject to subsection (5) , to check that the risk management plan for the SISTO is being implemented and complied with.\n(sec.36-ssec.3) For the purpose of asking an occupier of a place for consent to enter, an authorised officer may, without the occupier’s consent— enter land around premises at the place to an extent that is reasonable to contact the occupier; or enter part of the place the authorised officer reasonably considers members of the public ordinarily are allowed to enter when they wish to contact the occupier.\n(sec.36-ssec.4) For subsections (2) and (3) , a place does not include a part of the place where a person resides.\n(sec.36-ssec.5) An authorised officer may enter a place under subsection (2) (b) only if the SISTO entity occupying the place has been given at least 7 days written notice of the intended entry and its purpose.\n- (a) an occupier of the place consents to the entry; or\n- (b) it is a public place and the entry is made when it is open to the public.\n- (a) to observe an exercise under section 25 (5) ; or\n- (b) subject to subsection (5) , to check that the risk management plan for the SISTO is being implemented and complied with.\n- (a) enter land around premises at the place to an extent that is reasonable to contact the occupier; or\n- (b) enter part of the place the authorised officer reasonably considers members of the public ordinarily are allowed to enter when they wish to contact the occupier.","sortOrder":37},{"sectionNumber":"sec.37","sectionType":"section","heading":"Procedure for entry with consent","content":"### sec.37 Procedure for entry with consent\n\nThis section applies if an authorised officer intends to ask an occupier of a place to consent to the authorised officer or another authorised officer entering the place under section 36 (1) (a) .\nBefore asking for the consent, the authorised officer must tell the occupier—\nthe purpose of the entry; and\nthat the occupier is not required to consent.\nIf the consent is given, the authorised officer may ask the occupier to sign an acknowledgment of the consent.\nThe acknowledgment must state—\nthe occupier has been told—\nthe purpose of the entry; and\nthat the occupier is not required to consent; and\nthe purpose of the entry; and\nthe occupier gives the authorised officer consent to enter the place and exercise powers under this part; and\nthe time and date the consent was given.\nIf the occupier signs the acknowledgment, the authorised officer must immediately give a copy to the occupier.\nIf—\nan issue arises in a proceeding about whether the occupier consented to the entry; and\nan acknowledgment complying with subsection (4) for the entry is not produced in evidence;\nthe onus of proof is on the person relying on the lawfulness of the entry to prove the occupier consented.\n(sec.37-ssec.1) This section applies if an authorised officer intends to ask an occupier of a place to consent to the authorised officer or another authorised officer entering the place under section 36 (1) (a) .\n(sec.37-ssec.2) Before asking for the consent, the authorised officer must tell the occupier— the purpose of the entry; and that the occupier is not required to consent.\n(sec.37-ssec.3) If the consent is given, the authorised officer may ask the occupier to sign an acknowledgment of the consent.\n(sec.37-ssec.4) The acknowledgment must state— the occupier has been told— the purpose of the entry; and that the occupier is not required to consent; and the purpose of the entry; and the occupier gives the authorised officer consent to enter the place and exercise powers under this part; and the time and date the consent was given.\n(sec.37-ssec.5) If the occupier signs the acknowledgment, the authorised officer must immediately give a copy to the occupier.\n(sec.37-ssec.6) If— an issue arises in a proceeding about whether the occupier consented to the entry; and an acknowledgment complying with subsection (4) for the entry is not produced in evidence; the onus of proof is on the person relying on the lawfulness of the entry to prove the occupier consented.\n- (a) the purpose of the entry; and\n- (b) that the occupier is not required to consent.\n- (a) the occupier has been told— (i) the purpose of the entry; and (ii) that the occupier is not required to consent; and\n- (i) the purpose of the entry; and\n- (ii) that the occupier is not required to consent; and\n- (b) the purpose of the entry; and\n- (c) the occupier gives the authorised officer consent to enter the place and exercise powers under this part; and\n- (d) the time and date the consent was given.\n- (i) the purpose of the entry; and\n- (ii) that the occupier is not required to consent; and\n- (a) an issue arises in a proceeding about whether the occupier consented to the entry; and\n- (b) an acknowledgment complying with subsection (4) for the entry is not produced in evidence;","sortOrder":38},{"sectionNumber":"ch.4-pt.2-div.2","sectionType":"division","heading":"Entry of prescribed vehicles","content":"## Entry of prescribed vehicles","sortOrder":39},{"sectionNumber":"sec.38","sectionType":"section","heading":"Power of entry","content":"### sec.38 Power of entry\n\nAn authorised officer may enter a prescribed vehicle if the authorised officer reasonably believes the entry is necessary for the authorised officer—\nto observe an exercise under section 25 (5) ; or\nto check that the risk management plan for a SISTO is being implemented and complied with.\nHowever, before an authorised officer enters a prescribed vehicle under subsection (1) (b) , an authorised officer must have given the owner of the vehicle at least 7 days written notice of the intended entry and its purpose.\n(sec.38-ssec.1) An authorised officer may enter a prescribed vehicle if the authorised officer reasonably believes the entry is necessary for the authorised officer— to observe an exercise under section 25 (5) ; or to check that the risk management plan for a SISTO is being implemented and complied with.\n(sec.38-ssec.2) However, before an authorised officer enters a prescribed vehicle under subsection (1) (b) , an authorised officer must have given the owner of the vehicle at least 7 days written notice of the intended entry and its purpose.\n- (a) to observe an exercise under section 25 (5) ; or\n- (b) to check that the risk management plan for a SISTO is being implemented and complied with.","sortOrder":40},{"sectionNumber":"sec.39","sectionType":"section","heading":"Procedure before entry","content":"### sec.39 Procedure before entry\n\nThis section applies if an authorised officer intends to enter a prescribed vehicle under section 38 .\nIf a person is present at the prescribed vehicle, the authorised officer must, before entering the prescribed vehicle, do or make a reasonable attempt to do the following things—\ncomply with section 32 ;\ntell the person the purpose of the entry;\nask for the person’s consent to the entry;\ntell the person the authorised officer is permitted under this Act to enter the prescribed vehicle without consent.\nIf a person is not present at the prescribed vehicle, the authorised officer must, before entering the prescribed vehicle—\ntake reasonable steps to find the owner of the prescribed vehicle; and\ncomply with subsection (2) (a) to (d) for the owner.\nSubsection (3) does not require the authorised officer to take a step the authorised officer believes may frustrate or otherwise hinder the purpose of the intended entry.\nIn this section—\nowner , of a prescribed vehicle, includes a person who appears to be in control of the prescribed vehicle.\n(sec.39-ssec.1) This section applies if an authorised officer intends to enter a prescribed vehicle under section 38 .\n(sec.39-ssec.2) If a person is present at the prescribed vehicle, the authorised officer must, before entering the prescribed vehicle, do or make a reasonable attempt to do the following things— comply with section 32 ; tell the person the purpose of the entry; ask for the person’s consent to the entry; tell the person the authorised officer is permitted under this Act to enter the prescribed vehicle without consent.\n(sec.39-ssec.3) If a person is not present at the prescribed vehicle, the authorised officer must, before entering the prescribed vehicle— take reasonable steps to find the owner of the prescribed vehicle; and comply with subsection (2) (a) to (d) for the owner.\n(sec.39-ssec.4) Subsection (3) does not require the authorised officer to take a step the authorised officer believes may frustrate or otherwise hinder the purpose of the intended entry.\n(sec.39-ssec.5) In this section— owner , of a prescribed vehicle, includes a person who appears to be in control of the prescribed vehicle.\n- (a) comply with section 32 ;\n- (b) tell the person the purpose of the entry;\n- (c) ask for the person’s consent to the entry;\n- (d) tell the person the authorised officer is permitted under this Act to enter the prescribed vehicle without consent.\n- (a) take reasonable steps to find the owner of the prescribed vehicle; and\n- (b) comply with subsection (2) (a) to (d) for the owner.","sortOrder":41},{"sectionNumber":"ch.4-pt.2-div.3","sectionType":"division","heading":"General enforcement powers","content":"## General enforcement powers","sortOrder":42},{"sectionNumber":"sec.40","sectionType":"section","heading":"Application of div 3","content":"### sec.40 Application of div 3\n\nThis division applies to an authorised officer who may enter, or has entered, a place under division 1 or a prescribed vehicle under division 2 .\nHowever, if an authorised officer, under section 36 (3) , enters a place to ask the occupier’s consent to enter premises, this division applies to the authorised officer only if the consent is given or the entry is otherwise authorised.\n(sec.40-ssec.1) This division applies to an authorised officer who may enter, or has entered, a place under division 1 or a prescribed vehicle under division 2 .\n(sec.40-ssec.2) However, if an authorised officer, under section 36 (3) , enters a place to ask the occupier’s consent to enter premises, this division applies to the authorised officer only if the consent is given or the entry is otherwise authorised.","sortOrder":43},{"sectionNumber":"sec.41","sectionType":"section","heading":"General powers of authorised officer after entering a place or prescribed vehicle","content":"### sec.41 General powers of authorised officer after entering a place or prescribed vehicle\n\nFor monitoring or enforcing compliance with this Act, the authorised officer may do any of the following—\ninspect, film, measure, photograph, videotape or otherwise record an image of anything at the place or in or on the prescribed vehicle;\ntake an extract from, or copy, a document at the place or in the prescribed vehicle;\ntake into the place or prescribed vehicle the equipment, materials or persons the officer reasonably requires for exercising a power under this part;\ntake a necessary step to allow a power under paragraphs (a) to (c) to be exercised.\n- (a) inspect, film, measure, photograph, videotape or otherwise record an image of anything at the place or in or on the prescribed vehicle;\n- (b) take an extract from, or copy, a document at the place or in the prescribed vehicle;\n- (c) take into the place or prescribed vehicle the equipment, materials or persons the officer reasonably requires for exercising a power under this part;\n- (d) take a necessary step to allow a power under paragraphs (a) to (c) to be exercised.","sortOrder":44},{"sectionNumber":"sec.42","sectionType":"section","heading":"Power to require reasonable help or information","content":"### sec.42 Power to require reasonable help or information\n\nAn authorised officer may require a relevant person at a place or prescribed vehicle entered under this part to give the authorised officer—\nreasonable help to exercise a power under section 41 ; or\na requirement to give the authorised officer reasonable help to find and gain access to a particular document required to be kept under this Act\na requirement to operate electronic equipment at the place to enable the authorised officer to copy a document on a disk, tape or other device\ninformation, including electronically stored information, to help the authorised officer ascertain whether this Act is being or has been complied with.\nSee also, section 45 (1) (a) for an authorised officer’s further power to require information.\nWhen making a requirement under subsection (1) , the authorised officer must warn the person that it is an offence to fail to comply with the requirement unless the person has a reasonable excuse.\nA person required to give reasonable help under subsection (1) (a) , or to give information under subsection (1) (b) , must comply with the requirement, unless the person has a reasonable excuse.\nMaximum penalty—60 penalty units.\nIf the person is an individual, it is a reasonable excuse for the person not to comply with a requirement to give information under subsection (1) (b) if complying with the requirement might tend to incriminate the person or make the person liable to a penalty.\nIn this section—\nrelevant person means—\nfor a place—the occupier of, or someone else at, the place; or\nfor a prescribed vehicle—the person in control of, or someone else at, the prescribed vehicle.\n(sec.42-ssec.1) An authorised officer may require a relevant person at a place or prescribed vehicle entered under this part to give the authorised officer— reasonable help to exercise a power under section 41 ; or a requirement to give the authorised officer reasonable help to find and gain access to a particular document required to be kept under this Act a requirement to operate electronic equipment at the place to enable the authorised officer to copy a document on a disk, tape or other device information, including electronically stored information, to help the authorised officer ascertain whether this Act is being or has been complied with. See also, section 45 (1) (a) for an authorised officer’s further power to require information.\n(sec.42-ssec.2) When making a requirement under subsection (1) , the authorised officer must warn the person that it is an offence to fail to comply with the requirement unless the person has a reasonable excuse.\n(sec.42-ssec.3) A person required to give reasonable help under subsection (1) (a) , or to give information under subsection (1) (b) , must comply with the requirement, unless the person has a reasonable excuse. Maximum penalty—60 penalty units.\n(sec.42-ssec.4) If the person is an individual, it is a reasonable excuse for the person not to comply with a requirement to give information under subsection (1) (b) if complying with the requirement might tend to incriminate the person or make the person liable to a penalty.\n(sec.42-ssec.5) In this section— relevant person means— for a place—the occupier of, or someone else at, the place; or for a prescribed vehicle—the person in control of, or someone else at, the prescribed vehicle.\n- (a) reasonable help to exercise a power under section 41 ; or Examples of a requirement for paragraph (a) — • a requirement to give the authorised officer reasonable help to find and gain access to a particular document required to be kept under this Act • a requirement to operate electronic equipment at the place to enable the authorised officer to copy a document on a disk, tape or other device\n- • a requirement to give the authorised officer reasonable help to find and gain access to a particular document required to be kept under this Act\n- • a requirement to operate electronic equipment at the place to enable the authorised officer to copy a document on a disk, tape or other device\n- (b) information, including electronically stored information, to help the authorised officer ascertain whether this Act is being or has been complied with. Note— See also, section 45 (1) (a) for an authorised officer’s further power to require information.\n- • a requirement to give the authorised officer reasonable help to find and gain access to a particular document required to be kept under this Act\n- • a requirement to operate electronic equipment at the place to enable the authorised officer to copy a document on a disk, tape or other device\n- (a) for a place—the occupier of, or someone else at, the place; or\n- (b) for a prescribed vehicle—the person in control of, or someone else at, the prescribed vehicle.","sortOrder":45},{"sectionNumber":"ch.4-pt.2-div.4","sectionType":"division","heading":"Other powers","content":"## Other powers","sortOrder":46},{"sectionNumber":"sec.43","sectionType":"section","heading":"Power to require a name and address","content":"### sec.43 Power to require a name and address\n\nThis section applies if an authorised officer—\nfinds a person committing an offence against this Act; or\nfinds a person in circumstances that lead the authorised officer reasonably to suspect the person has committed an offence against this Act; or\nhas information that leads the authorised officer reasonably to suspect a person has just committed an offence against this Act.\nThe authorised officer may require the person to state the person’s name and residential or business address.\nWhen making the requirement, the authorised officer must warn the person it is an offence to fail to state the person’s name or residential or business address, unless the person has a reasonable excuse.\nThe authorised officer may also require the person to give the authorised officer evidence of the correctness of the stated name or address if the authorised officer reasonably suspects the stated name or address to be false.\n(sec.43-ssec.1) This section applies if an authorised officer— finds a person committing an offence against this Act; or finds a person in circumstances that lead the authorised officer reasonably to suspect the person has committed an offence against this Act; or has information that leads the authorised officer reasonably to suspect a person has just committed an offence against this Act.\n(sec.43-ssec.2) The authorised officer may require the person to state the person’s name and residential or business address.\n(sec.43-ssec.3) When making the requirement, the authorised officer must warn the person it is an offence to fail to state the person’s name or residential or business address, unless the person has a reasonable excuse.\n(sec.43-ssec.4) The authorised officer may also require the person to give the authorised officer evidence of the correctness of the stated name or address if the authorised officer reasonably suspects the stated name or address to be false.\n- (a) finds a person committing an offence against this Act; or\n- (b) finds a person in circumstances that lead the authorised officer reasonably to suspect the person has committed an offence against this Act; or\n- (c) has information that leads the authorised officer reasonably to suspect a person has just committed an offence against this Act.","sortOrder":47},{"sectionNumber":"sec.44","sectionType":"section","heading":"Failure to give a name or address","content":"### sec.44 Failure to give a name or address\n\nA person of whom a requirement is made under section 43 (2) or (4) must comply with the requirement, unless the person has a reasonable excuse.\nMaximum penalty—40 penalty units.\nA person does not commit an offence against subsection (1) if—\nthe person was required to state the person’s name or residential or business address by an authorised officer who suspected the person had committed an offence against this Act; and\nthe person is not proved to have committed the offence.\nIf the person is an individual, it is a reasonable excuse for the person to fail to comply with the requirement that complying with the requirement might tend to incriminate the person or make the person liable to a penalty.\n(sec.44-ssec.1) A person of whom a requirement is made under section 43 (2) or (4) must comply with the requirement, unless the person has a reasonable excuse. Maximum penalty—40 penalty units.\n(sec.44-ssec.2) A person does not commit an offence against subsection (1) if— the person was required to state the person’s name or residential or business address by an authorised officer who suspected the person had committed an offence against this Act; and the person is not proved to have committed the offence.\n(sec.44-ssec.3) If the person is an individual, it is a reasonable excuse for the person to fail to comply with the requirement that complying with the requirement might tend to incriminate the person or make the person liable to a penalty.\n- (a) the person was required to state the person’s name or residential or business address by an authorised officer who suspected the person had committed an offence against this Act; and\n- (b) the person is not proved to have committed the offence.","sortOrder":48},{"sectionNumber":"sec.45","sectionType":"section","heading":"Power to require information or documents","content":"### sec.45 Power to require information or documents\n\nFor monitoring or enforcing compliance with this Act, an authorised officer may require a person to—\ngive to the authorised officer, either orally or in writing, information in the person’s knowledge about a stated matter within a stated reasonable time and in a stated reasonable way; or\ngive to the authorised officer, within a stated reasonable time and in a stated reasonable way, a document about a stated matter in the person’s possession or control.\ninformation or a document about the preparation, implementation, auditing, reviewing or testing of the operation of the risk management plan\nThe authorised officer may keep a document mentioned in subsection (1) (b) to copy it.\nThe authorised officer must return the document to the person as soon as practicable after copying it.\nA person of whom a requirement is made under subsection (1) must comply with the requirement, unless the person has a reasonable excuse.\nMaximum penalty—60 penalty units.\nIf the person is an individual, it is a reasonable excuse for the person to fail to comply with a requirement made under subsection (1) that complying with the requirement might tend to incriminate the person or make the person liable to a penalty.\nIf a court convicts a person of an offence against subsection (4) , the court may also order the person to give to the chief executive or a stated authorised officer, within a stated time and in a stated way, information or a document to which the requirement related.\n(sec.45-ssec.1) For monitoring or enforcing compliance with this Act, an authorised officer may require a person to— give to the authorised officer, either orally or in writing, information in the person’s knowledge about a stated matter within a stated reasonable time and in a stated reasonable way; or give to the authorised officer, within a stated reasonable time and in a stated reasonable way, a document about a stated matter in the person’s possession or control. information or a document about the preparation, implementation, auditing, reviewing or testing of the operation of the risk management plan\n(sec.45-ssec.2) The authorised officer may keep a document mentioned in subsection (1) (b) to copy it.\n(sec.45-ssec.3) The authorised officer must return the document to the person as soon as practicable after copying it.\n(sec.45-ssec.4) A person of whom a requirement is made under subsection (1) must comply with the requirement, unless the person has a reasonable excuse. Maximum penalty—60 penalty units.\n(sec.45-ssec.5) If the person is an individual, it is a reasonable excuse for the person to fail to comply with a requirement made under subsection (1) that complying with the requirement might tend to incriminate the person or make the person liable to a penalty.\n(sec.45-ssec.6) If a court convicts a person of an offence against subsection (4) , the court may also order the person to give to the chief executive or a stated authorised officer, within a stated time and in a stated way, information or a document to which the requirement related.\n- (a) give to the authorised officer, either orally or in writing, information in the person’s knowledge about a stated matter within a stated reasonable time and in a stated reasonable way; or\n- (b) give to the authorised officer, within a stated reasonable time and in a stated reasonable way, a document about a stated matter in the person’s possession or control. Example— information or a document about the preparation, implementation, auditing, reviewing or testing of the operation of the risk management plan","sortOrder":49}],"analysis":{"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":false,"description":"Based solely on the text provided, the Act’s scope is set by its stated purpose (s 3) and the definition of surface transport operation (s 8) plus the chief executive’s declaration power (s 9). The material shows how scope is exercised administratively but contains no text indicating the original statutory scope has been altered."},"complexity_factors":["Defined scope hinges on technical thresholds and an administrative declaration (definition of surface transport operation, ss 8–9; declaration power referenced in s 11 in schedule but implied in s 9 and s 15 timing provisions).","Layered mandatory processes: prepare, implement, audit, review, amend, test exercises, keep records and give annual certificates (ss 15, 16–27).","External standards and instruments incorporated by reference (prescribed AS/NZS counter‑terrorism standard; AS/NZS ISO 31000:2009) create dependency on regulations and changing technical documents (s 16).","Detailed recordkeeping and timing obligations with specific retention periods and notice windows (audit, review and exercise records kept for 3 years; 28‑day and 7‑day notice periods in ss 21, 23, 24, 25, 26, 28).","Enforcement architecture combines administrative oversight and civil penalties with authorised officers whose appointment, conditions and discretion are set by the chief executive (ss 29–31, 30, 41–45).","Entry and inspection rules differentiate public places, consent, prescribed vehicles and residence protections, and impose procedural safeguards (consent procedure, identity production, 7‑day notices) (ss 32, 36–39).","Criminal‑law interaction and evidentiary protections: failure to comply attracts penalty units, but individuals have reasonable‑excuse/incrimination protections; courts can order production after conviction (ss 42, 44–45).","Cross‑reference and overlap with other Acts and emergency frameworks require coordination (Work Health and Safety Act 2011; Disaster Management Act 2003; Public Safety Preservation Act 1986) and create potential implementation complexity (s 6; see also ss 17, 18)."],"plain_english_summary":"This Act lets the chief executive declare particular surface transport operations (SISTOs) and then requires the operators of those declared services to prepare, implement and maintain counter‑terrorism risk management plans. It sets mandatory audits, exercises, records, reporting (annual certificate) and penalties, and gives authorised officers powers to enter places or prescribed vehicles, inspect, copy documents and require information. It affects operators of high‑occupancy passenger services and high‑payload freight services by imposing planning, training, recordkeeping and compliance obligations."},"kimi_summary":{"content_quality":"ok","complexity_score":5,"scope_assessment":{"changed":false,"description":"The legislation appears consistent with its original intent as stated in section 3. The provisions regarding risk management plans, audits, reviews, and exercises align with the stated purpose of providing planning for protection against terrorist acts. No significant scope creep is evident in the provided extract."},"complexity_factors":["Multiple defined terms including 'SISTO', 'SISTO entity', 'surface transport operation', 'high occupancy vehicle', 'high payload vehicle', 'prescribed vehicle', and 'prescribed period'","Extensive cross-referencing between sections (e.g., sections 16-17, 20-27, 36-45)","Conditional logic for entry powers (consent vs. notice requirements vs. public place exceptions)","Nested obligations with multiple triggers (e.g., section 22 review requirements triggered by 5 different events)","Integration with external standards (AS/NZS ISO 31000:2009 and other prescribed counter-terrorism standards) that are not reproduced in the Act","Multiple record-keeping requirements with specific content mandates (sections 21, 23, 26) and 3-year retention periods","Hierarchy of documents for plan preparation (section 16) with complex precedence rules for guidelines (section 18)","Self-incrimination exceptions scattered across enforcement provisions (sections 42, 44, 45)"],"plain_english_summary":"**What this law does:**\n\nThis Act creates a security framework for Queensland's surface transport systems (buses, trucks, trains, ferries) to protect them from terrorist attacks. It requires operators of high-risk transport services to develop, implement, and regularly test formal counter-terrorism plans.\n\n**Who it affects:**\n\n*   **SISTO entities** — businesses or organisations running \"security-identified surface transport operations\" (SISTOs). These are passenger services using vehicles carrying 10+ people, or freight services using vehicles with 20+ tonne payloads, that have been officially declared high-risk by the government.\n*   **Authorised officers** — government inspectors appointed to check compliance.\n*   **Employees** of transport operators who must follow the security plans and participate in training exercises.\n\n**Key requirements:**\n\n*   **Risk management plans:** SISTO entities must prepare detailed plans assessing terrorist risks, outlining prevention measures, and establishing response and recovery procedures. These must follow Australian/New Zealand standards.\n*   **Implementation:** Plans must be put into action immediately after preparation.\n*   **Annual audits:** Internal checks required every year to ensure compliance.\n*   **Regular testing:** At least one security exercise per year to test the plan, with employee participation mandatory.\n*   **Reviews:** Plans must be reviewed after security incidents, significant changes, or at least every 5 years.\n*   **Record keeping:** Detailed records of audits, reviews, exercises, and training must be kept for 3 years.\n*   **Reporting:** Annual certificates must be submitted to the chief executive confirming compliance.\n\n**Enforcement:**\n\nAuthorised officers can enter transport facilities and vehicles (with notice or consent), inspect documents, film activities, and require information. There are penalties (up to 60 penalty units) for failing to prepare plans, conduct exercises, or provide records.\n\n**Why it matters:**\n\nThis law aims to prevent terrorist attacks on Queensland's transport infrastructure by ensuring high-risk operators proactively assess vulnerabilities, train staff, and coordinate with police and neighbouring businesses. It balances security needs against cost burdens and prefers voluntary compliance over punishment."},"summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"The Act appears to remain consistent with its stated main purpose. It is narrowly focused on surface transport counter-terrorism planning and does not appear to have expanded beyond its original intent. The amendments noted (2010 and 2011) updated references to align with the renamed Work Health and Safety Act 2011 and minor procedural adjustments, rather than substantively broadening scope."},"complexity_factors":["Multiple interlocking obligations with different timeframes (3 months, 28 days, annually, 2 business days, 5 years) that operators must track simultaneously","Technical incorporation by reference of external standards (AS/NZS ISO 31000:2009 and other prescribed AS/NZS standards), meaning compliance depends on documents not in the Act itself","Layered regulatory structure — the chief executive can declare SISTOs, issue guidelines, give directions, and vary timeframes, creating variable obligations across different operators","Interaction with multiple other Queensland Acts (Work Health and Safety Act 2011, Disaster Management Act 2003, Police Powers and Responsibilities Act 2000, Public Safety Preservation Act 1986, State Transport Act 1938) requiring plans to coordinate with obligations under those laws","Distinction between exercises conducted by the entity versus participation in exercises conducted by others, with different notice and direction requirements applying to each","Enforcement framework with multiple entry powers (places vs prescribed vehicles) each with distinct procedural requirements and notice obligations","The threshold for being captured (declaration as a SISTO) is discretionary rather than automatic, meaning operators may have uncertainty about whether they are subject to the regime","Self-incrimination protections create nuanced situations where individuals can refuse to provide information but corporate entities generally cannot"],"plain_english_summary":"This Queensland law requires certain transport operations — notably government-declared large bus/coach services (10+ seated adults) and heavy freight vehicles (>20t) — to prepare, implement and regularly test counter‑terrorism risk‑management plans. Affected operators must audit, run exercises, report to the government and cooperate with authorised officers’ inspections; failures attract financial penalties.\n\nWhy it matters: if regulators designate your operation a security‑identified surface transport operation, you face ongoing compliance and recordkeeping obligations alongside other safety and emergency laws."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"issue_detection":{"absurdities":[],"contradictions":[]}},"importantCases":[],"_links":{"self":"/api/acts/transport-security-counter-terrorism-act-2008","history":"/api/acts/transport-security-counter-terrorism-act-2008/history","analysis":"/api/acts/transport-security-counter-terrorism-act-2008/analysis","conflicts":"/api/acts/transport-security-counter-terrorism-act-2008/conflicts","importantCases":"/api/acts/transport-security-counter-terrorism-act-2008/important-cases","documents":"/api/acts/transport-security-counter-terrorism-act-2008/documents"}}