(b) conduct engaged in to obtain information that ASIO could not obtain other than in accordance with Division 3 of Part 4‑1 of the Telecommunications (Interception and Access) Act 1979.
(4) Subsections (1) and (2) have effect despite anything in a law of the Commonwealth or of a State or Territory, whether passed or made before or after the commencement of this subsection, unless the law expressly provides otherwise.
(5) Subsection (4) does not affect the operation of subsection (3).
Requirement to give notice of conduct
(6) If:
(a) a person engages in conduct referred to in subsection (1) or (2); and
(b) the conduct causes material damage, material interference or material obstruction to a computer (within the meaning of section 4 of the Australian Security Intelligence Organisation Act 1979) in Australia; and
(c) apart from this section, the person would commit an offence against this Part;
then the person must, as soon as practicable, give a written notice of that fact to:
(d) the Chief of the Defence Force; and
(e) if the person is not under the command of the Chief of the Defence Force—the Secretary of the Defence Department.
(7) The notice must also provide details about the conduct that caused the damage, interference or obstruction to the computer.
Definitions
(8) In this section:
authorised ADF activity means an activity, or an activity included in a class of activities, of the Australian Defence Force that is:
(a) authorised by the Chief of the Defence Force; and
(b) connected with the defence or security of Australia.
defence official means:
(a) a member of the Australian Defence Force; or
(b) a defence civilian (within the meaning of the Defence Force Discipline Act 1982); or
(c) the Secretary of the Defence Department; or
(d) an APS employee of the Defence Department; or
(e) a consultant or contractor to the Defence Department; or
(f) a person who is made available by another Commonwealth or State authority or other person to perform services for the Defence Department; or
(g) any other person included in a class of persons specified under subsection (9).
(9) The Secretary of the Defence Department or the Chief of the Defence Force may, by legislative instrument, specify one or more classes of persons for the purposes of paragraph (g) of the definition of defence official in subsection (8).
Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.
(10) The Secretary of the Defence Department may, in writing, delegate the Secretary’s power under subsection (9) to an SES employee in the Defence Department.
(11) The Chief of the Defence Force may, in writing, delegate the Chief’s power under subsection (9) to:
(a) an officer of the Australian Navy who holds the rank of Commodore or a higher rank; or
(b) an officer of the Australian Army who holds the rank of Brigadier or a higher rank; or
(c) an officer of the Australian Air Force who holds the rank of Air Commodore or a higher rank.
Division 477—Serious computer offences
477.1 Unauthorised access, modification or impairment with intent to commit a serious offence
Intention to commit a serious Commonwealth, State or Territory offence
(1) A person commits an offence if:
(a) the person causes:
(i) any unauthorised access to data held in a computer; or
(ii) any unauthorised modification of data held in a computer; or
(iii) any unauthorised impairment of electronic communication to or from a computer; and
(c) the person knows the access, modification or impairment is unauthorised; and
(d) the person intends to commit, or facilitate the commission of, a serious offence against a law of the Commonwealth, a State or a Territory (whether by that person or another person) by the access, modification or impairment.
(3) In a prosecution for an offence against subsection (1), it is not necessary to prove that the defendant knew that the offence was:
(a) an offence against a law of the Commonwealth, a State or a Territory; or
(b) a serious offence.
Penalty
(6) A person who commits an offence against this section is punishable, on conviction, by a penalty not exceeding the penalty applicable to the serious offence.
Impossibility
(7) A person may be found guilty of an offence against this section even if committing the serious offence is impossible.
No offence of attempt
(8) It is not an offence to attempt to commit an offence against this section.
Meaning of serious offence
(9) In this section:
serious offence means an offence that is punishable by imprisonment for life or a period of 5 or more years.
477.2 Unauthorised modification of data to cause impairment
(1) A person commits an offence if:
(a) the person causes any unauthorised modification of data held in a computer; and
(b) the person knows the modification is unauthorised; and
(c) the person is reckless as to whether the modification impairs or will impair:
(i) access to that or any other data held in any computer; or
(ii) the reliability, security or operation, of any such data.
Penalty: 10 years imprisonment.
(2) A person is not criminally responsible for an offence against subsection (1) if:
(a) the person is, at the time of the offence, an ASIO officer acting in good faith in the course of the person’s duties; and
(b) the conduct of the person is reasonable in the circumstances for the purpose of performing that duty.
Note: A defendant bears an evidential burden in relation to the matter in this subsection, see subsection 13.3(3).
(3) A person may be guilty of an offence against this section even if there is or will be no actual impairment to:
(a) access to data held in a computer; or
(b) the reliability, security or operation, of any such data.
(4) A conviction for an offence against this section is an alternative verdict to a charge for an offence against section 477.3 (unauthorised impairment of electronic communication).
477.3 Unauthorised impairment of electronic communication
(1) A person commits an offence if:
(a) the person causes any unauthorised impairment of electronic communication to or from a computer; and
(b) the person knows that the impairment is unauthorised.
Penalty: 10 years imprisonment.
(2) A person is not criminally responsible for an offence against subsection (1) if:
(a) the person is, at the time of the offence, an ASIO officer acting in good faith in the course of the person’s duties; and
(b) the conduct of the person is reasonable in the circumstances for the purpose of performing that duty.
Note: A defendant bears an evidential burden in relation to the matter in this subsection, see subsection 13.3(3).
(3) A conviction for an offence against this section is an alternative verdict to a charge for an offence against section 477.2 (unauthorised modification of data to cause impairment).
Division 478—Other computer offences
478.1 Unauthorised access to, or modification of, restricted data
(1) A person commits an offence if:
(a) the person causes any unauthorised access to, or modification of, restricted data; and
(b) the person intends to cause the access or modification; and
(c) the person knows that the access or modification is unauthorised.
Penalty: 2 years imprisonment.
(3) In this section:
restricted data means data:
(a) held in a computer; and
(b) to which access is restricted by an access control system associated with a function of the computer.
478.2 Unauthorised impairment of data held on a computer disk etc.
A person commits an offence if:
(a) the person causes any unauthorised impairment of the reliability, security or operation of data held on:
(i) a computer disk; or
(ii) a credit card; or
(iii) another device used to store data by electronic means; and
(b) the person intends to cause the impairment; and
(c) the person knows that the impairment is unauthorised.
Penalty: 2 years imprisonment.
478.3 Possession or control of data with intent to commit a computer offence
(1) A person commits an offence if:
(a) the person has possession or control of data; and
(b) the person has that possession or control with the intention that the data be used, by the person or another person, in:
(i) committing an offence against Division 477; or
(ii) facilitating the commission of such an offence.
Penalty: 3 years imprisonment.
(2) A person may be found guilty of an offence against this section even if committing the offence against Division 477 is impossible.
No offence of attempt
(3) It is not an offence to attempt to commit an offence against this section.
Meaning of possession or control of data
(4) In this section, a reference to a person having possession or control of data includes a reference to the person:
(a) having possession of a computer or data storage device that holds or contains the data; or
(b) having possession of a document in which the data is recorded; or
(c) having control of data held in a computer that is in the possession of another person (whether inside or outside Australia).
478.4 Producing, supplying or obtaining data with intent to commit a computer offence
(1) A person commits an offence if:
(a) the person produces, supplies or obtains data; and
(b) the person does so with the intention that the data be used, by the person or another person, in:
(i) committing an offence against Division 477; or
(ii) facilitating the commission of such an offence.
Penalty: 3 years imprisonment.
(2) A person may be found guilty of an offence against this section even if committing the offence against Division 477 is impossible.
No offence of attempt
(3) It is not an offence to attempt to commit an offence against this section.
Meaning of producing, supplying or obtaining data
(4) In this section, a reference to a person producing, supplying or obtaining data includes a reference to the person:
(a) producing, supplying or obtaining data held or contained in a computer or data storage device; or
(b) producing, supplying or obtaining a document in which the data is recorded.
Part 10.8—Financial information offences
480.1 Definitions
(1) In this Part:
ADI (authorised deposit‑taking institution) means a corporation that is an ADI for the purposes of the Banking Act 1959.
dealing in personal financial information includes supplying or using financial information.
deception means an intentional or reckless deception, whether by words or other conduct, and whether as to fact or as to law, and includes:
(a) a deception as to the intentions of the person using the deception or any other person; and
(b) conduct by a person that causes a computer, a machine or an electronic device to make a response that the person is not authorised to cause it to do.
dishonest has the meaning given by section 480.2.
obtaining personal financial information includes possessing or making personal financial information.
personal financial information means information relating to a person that may be used (whether alone or in conjunction with other information) to access funds, credit or other financial benefits.
(2) For the purposes of this Part, a person is taken to obtain or deal in personal information without the consent of the person to whom the information relates if the consent of that person is obtained by any deception.
(3) This Part extends to personal information relating to:
(a) an individual; or
(b) a corporation; or
(c) a living or dead person.
480.2 Dishonesty
(1) For the purposes of this Part, dishonest means:
(a) dishonest according to the standards of ordinary people; and
(b) known by the defendant to be dishonest according to the standards of ordinary people.
(2) In a prosecution for an offence against this Part, the determination of dishonesty is a matter for the trier of fact.
480.3 Constitutional application of this Part
This Part applies to personal financial information only if:
(a) the funds concerned represent amounts that have been deposited with or lent to, or are otherwise to be provided or made available by, an ADI or a constitutional corporation; or
(b) the credit or other financial benefits concerned are provided, or made available, by an ADI or a constitutional corporation.
480.4 Dishonestly obtaining or dealing in personal financial information
A person commits an offence if the person:
(a) dishonestly obtains, or deals in, personal financial information; and
(b) obtains, or deals in, that information without the consent of the person to whom the information relates.
Penalty: Imprisonment for 5 years.
480.5 Possession or control of thing with intent to dishonestly obtain or deal in personal financial information
(1) A person commits an offence if:
(a) the person has possession or control of any thing; and
(b) the person has that possession or control with the intention that the thing be used:
(i) by the person; or
(ii) by another person;
to commit an offence against section 480.4 (dishonestly obtaining or dealing in personal financial information) or to facilitate the commission of that offence.
Penalty: Imprisonment for 3 years.
(2) A person may be found guilty of an offence against subsection (1) even if committing the offence against section 480.4 (dishonestly obtaining or dealing in personal financial information) is impossible.
(3) It is not an offence to attempt to commit an offence against subsection (1).
480.6 Importation of thing with intent to dishonestly obtain or deal in personal financial information
A person commits an offence if the person:
(a) imports a thing into Australia; and
(b) does so with the intention that the thing be used:
(i) by the person; or
(ii) by another person;
in committing an offence against section 480.4 (dishonestly obtaining or dealing in personal financial information) or to facilitate the commission of that offence.
Penalty: Imprisonment for 3 years.
Part 10.9—Accounting records
Division 490—False dealing with accounting documents
490.1 Intentional false dealing with accounting documents
(1) A person commits an offence if:
(a) the person:
(i) makes, alters, destroys or conceals an accounting document; or
(ii) fails to make or alter an accounting document that the person is under a duty, under a law of the Commonwealth, a State or Territory or at common law, to make or alter; and
(b) the person intended the making, alteration, destruction or concealment of the document (or the failure to make or alter the document) to facilitate, conceal or disguise the occurrence of one or more of the following:
(i) the person receiving a benefit that is not legitimately due to the person;
(ii) the person giving a benefit that is not legitimately due to the recipient, or intended recipient, of the benefit;
(iii) another person receiving a benefit that is not legitimately due to the other person;
(iv) another person giving a benefit that is not legitimately due to the recipient, or intended recipient, of the benefit (who may be the first‑mentioned person);
(v) loss to another person that is not legitimately incurred by the other person; and
(c) one or more of the circumstances referred to in subsection (2) applies.
(2) For the purposes of paragraph (1)(c) of this section or paragraph 490.2(1)(c), the circumstances are:
(a) the person is:
(i) a constitutional corporation, or a corporation that is incorporated in a Territory; or
(ii) an officer or employee of a constitutional corporation acting in the performance of his or her duties or the carrying out of his or her functions; or
(iii) a person engaged to provide services to a constitutional corporation and acting in the course of providing those services; or
(iv) a Commonwealth public official acting in the performance of his or her duties or the carrying out of his or her functions; or
(b) the person’s act or omission referred to in paragraph (1)(a):
(i) occurs in a Territory; or
(ii) occurs outside Australia; or
(iii) concerns matters or things outside Australia; or
(iv) facilitates or conceals the commission of an offence against a law of the Commonwealth; or
(c) the accounting document:
(i) is outside Australia; or
(ii) is in a Territory; or
(iii) is kept under or for the purposes of a law of the Commonwealth; or
(iv) is kept to record the receipt or use of Australian currency.
(3) Absolute liability applies to paragraph (1)(c).
Note: For absolute liability, see section 6.2.
Penalty for individual
(4) An offence against this section committed by an individual is punishable on conviction by imprisonment for not more than 10 years, a fine not more than 10,000 penalty units, or both.
Penalty for body corporate
(5) An offence against this section committed by a body corporate is punishable on conviction by a fine not more than the greatest of the following:
(a) 100,000 penalty units;
(b) if the court can determine the value of the benefit that the body corporate, and any body corporate related to the body corporate, have obtained directly or indirectly and that is reasonably attributable to the conduct constituting the offence—3 times the value of that benefit;
(c) if the court cannot determine the value of that benefit—10% of the annual turnover of the body corporate during the period (the turnover period) of 12 months ending at the end of the month in which the conduct constituting the offence occurred.
490.2 Reckless false dealing with accounting documents
(1) A person commits an offence if:
(a) the person:
(i) makes, alters, destroys or conceals an accounting document; or
(ii) fails to make or alter an accounting document that the person is under a duty, under a law of the Commonwealth, a State or Territory or at common law, to make or alter; and