Intelligence Services Act 2001 — Zoe

Commonwealth act

Intelligence Services Act 2001

In ForceCTH

Jurisdiction

Commonwealth

Act Number

152 of 2001

Collection

act

Plain English Summary

4/10 complexity

The Intelligence Services Act 2001 (Cth) is the principal statute governing Australia's three civilian foreign intelligence agencies: the Australian Secret Intelligence Service (ASIS), the Australian Geospatial-Intelligence Organisation (AGO), and the Australian Signals Directorate (ASD). It defines what each agency can do, who they can target, how ministerial authorisations work, and what oversight mechanisms apply.

ASIS collects human intelligence about capabilities, intentions and activities of people and organisations outside Australia. AGO collects geospatial, hydrographic and imagery intelligence. ASD collects signals intelligence and also has a dual role in offensive cyber operations and helping Australian businesses and government agencies protect their systems from cyber threats.

A central feature of the Act is the authorisation framework in Part 2. The agencies are generally prohibited from deliberately collecting intelligence on Australian persons (citizens and permanent residents) without a ministerial authorisation. Before granting one, the responsible Minister must be satisfied that the activity is necessary and proportionate, and in many cases must also obtain the Attorney-General's agreement. Authorisations targeting Australian persons for national security reasons cannot exceed six months.

All three agencies are strictly limited to foreign intelligence work. They cannot perform police functions or enforce the law, though they may pass serious crime intelligence to law enforcement. They cannot act in the interests of Australian political parties.

Parliamentary oversight is provided by the Parliamentary Joint Committee on Intelligence and Security, established under Part 4. The Committee reviews agency administration, expenditure and annual reports, and has a broad mandate to consider referred legislation including counter-terrorism laws. However, the Committee cannot review particular operations, individual warrants, or specific personnel decisions.

JSON API

Deep Dive

3,188 words · generated 05/05/2026

What it does

The Intelligence Services Act 2001 (Cth) is the founding statute for three of Australia's five intelligence agencies: the Australian Secret Intelligence Service (ASIS), the Australian Geospatial-Intelligence Organisation (AGO), and the Australian Signals Directorate (ASD). It defines the statutory functions of each agency, establishes a ministerial authorisation regime that controls when and how agencies may target Australian persons, creates the Parliamentary Joint Committee on Intelligence and Security (PJCIS) as the primary parliamentary oversight mechanism, and imposes serious criminal penalties for secrecy breaches and identity disclosure.

The Act sits at the top of the intelligence governance framework. It does not regulate ASIO (which is covered by the Australian Security Intelligence Organisation Act 1979) or the Office of National Intelligence (which is covered by the Office of National Intelligence Act 2018). However, it intersects with both those Acts frequently: ASIS, AGO and ASD regularly share intelligence with ASIO and ONI, and the Act expressly permits such cooperation under sections 13 and 13A.

The Act has been amended substantially since 2001, most recently to incorporate provisions on ASD's cyber security assistance role following the Cyber Security Act 2024 and to align with the Security of Critical Infrastructure Act 2018. The current version reflects these additions, particularly in Division 1A of Part 6, which creates a protected category of voluntarily provided cyber incident information.

Main concepts

Current sections

Direct links to the current provisions in Intelligence Services Act 2001.

115

Official source available

Zoe has indexed the source text for search and analysis. Use the official register for the original document and download formats.

View on official register

Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.

The three agencies and their collection domains. ASIS collects human intelligence: it sends officers and agents abroad to gather information about the capabilities, intentions and activities of persons and organisations outside Australia (section 6). AGO collects geospatial, hydrographic, meteorological, oceanographic and imagery intelligence from the electromagnetic spectrum and other sources, primarily to support the Defence Force and Government requirements (section 6B). ASD collects signals intelligence: it intercepts and analyses electronic emissions to produce intelligence about targets outside Australia, and it also prevents and disrupts cybercrime abroad and provides cyber security assistance domestically (section 7).

Australian person. This term, defined in section 3, covers Australian citizens and permanent residents, including bodies corporate incorporated in a State or Territory that are not controlled by foreign powers. Targeting an Australian person without an authorisation is prohibited. This is the central protective mechanism in the Act.

Ministerial authorisation. The agencies cannot deliberately undertake activities for the specific purpose of producing intelligence on an Australian person unless a ministerial authorisation exists (section 8). The responsible Minister must be satisfied that the activity is necessary, proportionate, and that satisfactory safeguards are in place before giving an authorisation (section 9). Targeting Australians on national security grounds (section 9(1A)) and targeting classes linked to terrorist organisations (section 9(1AAA)) each attract additional requirements, including Attorney-General agreement.

Incidentally obtained intelligence. Where an agency, while lawfully collecting foreign intelligence, obtains information about an Australian person as a by-product (not as the primary purpose), this is "incidentally obtained intelligence" under section 3. Section 11(2AA) permits this to be communicated to law enforcement and other authorities if it relates to safety threats, foreign power involvement, security threats, WMD proliferation, or serious crime.

Limited cyber security information. A distinct category created by section 41BA. This is information voluntarily provided to ASD about a cyber security incident, or obtained by ASD with the consent of the affected entity. It is subject to strict use-limitation rules under Division 1A of Part 6: ASD may only communicate it for permitted cyber security purposes and cannot use it to investigate or enforce contraventions of law.

Parliamentary Joint Committee on Intelligence and Security. The Committee established under Part 4 is composed of 13 parliamentarians (section 28) and has broad functions set out in section 29, including reviewing agency administration and expenditure, reviewing referred legislation, monitoring the AFP's counter-terrorism functions, and conducting periodic statutory reviews of major national security legislation. It cannot review particular operations, individual warrants, or specific security assessments.

Key obligations

Agencies must operate within stated functions. Under section 12, an agency must not undertake any activity unless it is necessary for the proper performance of its functions, or authorised or required by another Act. This is a blanket limitation: even if an activity seems useful, it is not lawful unless it maps to an enumerated function.

Functions are limited to foreign interests. Section 11(1) confines the agencies' functions to situations affecting Australia's national security, foreign relations, or national economic well-being, and only to the extent those matters are affected by capabilities, intentions or activities of entities outside Australia. Agencies cannot operate in a purely domestic intelligence role.

No police functions. Section 11(2) explicitly excludes police functions and law enforcement responsibilities from the agencies' mandates. Agencies may communicate serious crime intelligence to law enforcement, but they are not permitted to arrest, charge, detain, or prosecute.

No political party work. Section 11(2A) prohibits any activity for the purpose of furthering the interests of an Australian political party or organisation. The Directors-General and Director must take all reasonable steps under section 12A to ensure agencies are kept free from such influences.

Authorisations before targeting Australians. Agency heads must maintain ministerial directions (section 8) that specify when authorisations are required. These include any activity specifically aimed at producing intelligence on an identified Australian person or a class of Australian persons.

Secrecy. Staff members and former staff members must not communicate intelligence obtained through their positions unless authorised by the agency head (section 39). Records of the agencies must not be copied, transcribed, retained, removed or otherwise dealt with without authorisation (section 40C). Breaches carry penalties of up to 10 years imprisonment.

Cyber security information use limitations. ASD must not communicate limited cyber security information except for the purposes listed in section 41BB, and specifically must not communicate it for the purpose of investigating or enforcing contraventions of law.

Interactions with other law

Australian Security Intelligence Organisation Act 1979: The Act intersects with the ASIO Act extensively. Definitions of "permanent resident" and "foreign power" are borrowed from the ASIO Act (section 3). ASIO is one of the bodies with which ASIS, AGO and ASD cooperate under section 13A. The Committee's mandate under section 29 includes reviewing ASIO's retained data activities.

Criminal Code Act 1995: The secrecy offences in sections 39 and 40C incorporate Criminal Code concepts of evidential burden (note references to subsection 13.3(3)). The Committee's oversight mandate covers Parts 5.3 and 5.3A of the Criminal Code (counter-terrorism and related offences). Authorisation preconditions under section 9(1A) import the Criminal Code definition of "listed terrorist organisation."

Inspector-General of Intelligence and Security Act 1986: The IGIS is the key oversight body for the agencies' operational activities. The Act repeatedly requires copies of authorisations and directions to be made available to the IGIS (sections 9, 10, 32B of the IGIS Act). IGIS officials are expressly exempted from certain secrecy obligations (sections 39 and 41).

Public Governance, Performance and Accountability Act 2013: ASIS and ASD are listed entities for PGPA purposes. Directors-General are accountable authorities and must disclose interests under section 29 of the PGPA Act. Failure to comply is a ground for mandatory termination of appointment (section 23(2)(d)).

Cyber Security Act 2024: Division 1A of Part 6 (sections 41BA-41BH) directly references the Cyber Security Act 2024 for definitions of "Commonwealth body," "Commonwealth enforcement body," "entity," "State body," and for the category of information covered by the Cyber Security Act Part 3 mandatory reporting. Information provided under mandatory reporting obligations is excluded from the "limited cyber security information" definition.

Security of Critical Infrastructure Act 2018: The definition of "computer" and the definition of "cyber security incident" both reference the SOCI Act (section 41BA(4)). Information provided under SOCI Act Part 2B mandatory reporting is excluded from the limited cyber security information regime.

Navigation Act 2012: AGO incorporates the Australian Hydrographic Office, which performs functions under section 223 of the Navigation Act 2012. Those functions are also part of AGO's statutory functions under section 6B(1)(h).

Defence Act 1903: The Chief of the Defence Force's role as head of the Defence Force is incorporated by reference for purposes of cover employment determinations (section 41AB(6)).

Gotchas

ASD's dual role creates practical tension. ASD both collects offensive signals intelligence (intercepting communications of targets outside Australia) and provides defensive cyber security assistance to Australian businesses and government. These are fundamentally different activities with different legal rules. The voluntarily provided cyber incident information that ASD receives under its defensive role cannot be used by ASD for its offensive intelligence role, and vice versa (section 41BB(1)). Entities dealing with ASD need to understand which "hat" it is wearing.

"Australian person" scope for bodies corporate. A company is an "Australian person" only if it is incorporated in Australia AND is not controlled by a foreign power or foreign persons (section 3). A foreign-owned subsidiary registered in Australia is not an Australian person. This matters for the authorisation regime: intelligence collection targeted at such a subsidiary would not require a ministerial authorisation under the Act.

Incidentally obtained intelligence vs. deliberate targeting. The distinction between "incidentally obtained intelligence" and deliberately targeted collection is critical. If an agency happens to pick up information about an Australian while lawfully collecting foreign intelligence, that is permissible and can be shared with law enforcement under section 11(2AA). If the activity was specifically designed to produce intelligence on the Australian, an authorisation was required from the outset (section 8). The difference turns on the specific purpose, not on the result.

Cover employment does not create fictitious employment. The cover employment provisions in sections 41AA-41AC allow an ASIS or ASD staff member to identify a Commonwealth authority as their employer. The provision is purely protective for operational security; it does not actually create an employment relationship with that authority. Third parties who assist with cover arrangements are protected from criminal liability only when acting in good faith within their professional capacity (section 41AC).

Section 41 applies even after the agency relationship ends. Revealing the identity of someone who was an ASIS agent is still an offence under section 41(1)(a), even if the relationship ended years ago. The section does not distinguish between current and former agents.

Cyber security information from mandatory reporting is not protected. Only voluntarily provided information (or information obtained with consent) falls within the limited cyber security information regime (section 41BA(2)). Information an entity was legally required to report to government under the Cyber Security Act Part 3, the SOCI Act Part 2B, or the Telecommunications Act is excluded (section 41BA(3)(a)). This means compulsory-reported breach information does not carry the use-limitation protections.

The Committee cannot see operational detail. Section 29(5) explicitly prevents the Committee from reviewing particular operations, particular warrants or authorisations, individual security assessments, or particular personnel matters. Practitioners and parliamentarians regularly misunderstand the Committee's remit: it reviews the administrative and expenditure landscape of the agencies, not the intelligence itself.

Practical examples

Example 1: ASIS collecting intelligence on an Australian travelling abroad. An ASIS officer overseas receives information suggesting an Australian citizen is acting as an agent for a foreign power. Before ASIS may undertake activities specifically aimed at producing intelligence on that person, the responsible Minister must give a written authorisation under section 9, having satisfied himself of the necessity and proportionality preconditions, and (because the ground is national security) having obtained the Attorney-General's agreement. The authorisation cannot exceed six months. Failing to get the authorisation before commencing the targeted activity is unlawful under section 8.

Example 2: ASD responding to a ransomware attack on a critical infrastructure operator. A major energy company suffers a ransomware attack and voluntarily asks ASD for assistance. In responding, ASD acquires technical information about the attack. That information is "limited cyber security information" under section 41BA. ASD can use it to help the company recover and provide advice to other entities at risk, but cannot pass it to a regulator for enforcement proceedings against the company, or use it as intelligence in offensive operations (section 41BB).

Example 3: An ex-ASIS officer writing a memoir. A former ASIS officer wishes to publish an account of their service. Any information obtained through their service relationship is covered by section 39. Publishing intelligence information without Director-General approval is an offence carrying 10 years imprisonment. The fact that the person has left the service is irrelevant. The only exception is for information that has already been publicly released with Commonwealth authority.

Example 4: A journalist identifying an ASIS agent. A journalist who publishes an article naming a person as a current or former ASIS agent commits an offence under section 41, regardless of whether the person is the Director-General (who is expressly excluded from the prohibition). The exception for Parliamentary broadcasts does not cover Committee proceedings, meaning even Parliamentary testimony cannot be reported without risk of prosecution if it would identify an agent.

Example 5: AGO providing imagery to a State emergency agency. During a major flood, AGO provides satellite imagery to a State emergency services agency to assist with search and rescue. This is lawful under paragraph 6B(1)(ea) as emergency response assistance that is incidental to AGO's other functions. AGO can charge a fee for this service under subsection 6B(4), so long as the fee does not amount to taxation.