26Application of this Part

26  Application of this Part

 (1) This Part applies if:

 (b) the incident is a cyber security incident; and

 (c) the incident has had, is having, or could reasonably be expected to have, a direct or indirect impact on a reporting business entity; and

 (d) an entity (the extorting entity) makes a demand of the reporting business entity, or any other entity, in order to benefit from the incident or the impact on the reporting business entity; and

 (e) the reporting business entity provides, or is aware that another entity has provided on their behalf, a payment or benefit (a ransomware payment) to the extorting entity that is directly related to the demand.

 (2) An entity is a reporting business entity if, at the time the ransomware payment is made:

 (a) the entity:

 (i) is carrying on a business in Australia with an annual turnover for the previous financial year that exceeds the turnover threshold for that year; and

 (ii) is not a Commonwealth body or a State body; and

 (iii) is not a responsible entity for a critical infrastructure asset; or

 (b) the entity is a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies.

 (3) For the purposes of subparagraph (2)(a)(i), the turnover threshold is:

 (a) if a business has been carried on for only part of the previous financial year—the amount worked out in the manner prescribed by the rules; or

 (b) in any other case—the amount prescribed by, or worked out in the manner prescribed by, the rules.

Presumption

 (4) For the purposes of paragraph (1)(b), an incident (other than an incident covered by paragraph 9(2)(a) or (b)) is presumed to be a cyber security incident if:

 (a) the incident was probably effected, is probably being effected or could reasonably be expected to be effected, by means of a telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution (including, for example, by means of the internet); or

 (b) the incident has probably impeded or impaired, or is probably impeding or impairing or could reasonably be expected to impede or impair, the ability of a computer to connect to such a service; or

 (c) the incident has probably seriously prejudiced, is probably seriously prejudicing, or could reasonably be expected to prejudice:

Note: Paragraphs 9(2)(a) and (b) cover incidents involving critical infrastructure assets or the activities of corporations to which paragraph 51(xx) of the Constitution applies.

 (5) However, subsection (4) does not make an entity liable to a civil penalty under this Part if the incident: