Intelligence Services Act 2001

The agencies themselves. ASIS, AGO and ASD are directly constituted and governed by the Act. Their Directors-General and Director are the accountable authorities under the Public Governance, Performance and Accountability Act 2013 (section 16, section 27A). Staff, consultants, contractors, and persons made available from other Commonwealth agencies all fall within the definition of "staff member" and are bound by secrecy obligations.

Ministers. The responsible Minister for each agency holds the power to issue authorisations, give directions about functions, and appoint the agency head. The Defence Minister has a specific role in authorising operations that support Defence Force activities. The Attorney-General must agree to certain authorisations targeting Australian persons on national security grounds.

Parliament. The PJCIS is composed of members of both Houses and has significant reporting obligations. Obstruction of the Committee is a criminal offence under Schedule 1.

The private sector, foreign persons, and other entities. ASD's cyber security assistance role under section 7(1)(ca) extends to any person or body (including foreign entities, and the general private sector via specified constitutional heads of power). Entities that voluntarily provide cyber incident information to ASD have protections under Division 1A of Part 6 ensuring that information is not used against them in enforcement proceedings. ASIS and ASD staff operating under cover employment arrangements can lawfully represent a Commonwealth authority as their employer under sections 41AA-41AB, and third parties who assist with such cover are shielded from criminal liability by section 41AC.

Former staff and agents. Secrecy obligations under section 39 bind not only current staff but also former staff members and persons who dealt with the agencies under contract. There is no time limit on the obligation.

Agencies must operate within stated functions. Under section 12, an agency must not undertake any activity unless it is necessary for the proper performance of its functions, or authorised or required by another Act. This is a blanket limitation: even if an activity seems useful, it is not lawful unless it maps to an enumerated function.

Functions are limited to foreign interests. Section 11(1) confines the agencies' functions to situations affecting Australia's national security, foreign relations, or national economic well-being, and only to the extent those matters are affected by capabilities, intentions or activities of entities outside Australia. Agencies cannot operate in a purely domestic intelligence role.

No police functions. Section 11(2) explicitly excludes police functions and law enforcement responsibilities from the agencies' mandates. Agencies may communicate serious crime intelligence to law enforcement, but they are not permitted to arrest, charge, detain, or prosecute.

No political party work. Section 11(2A) prohibits any activity for the purpose of furthering the interests of an Australian political party or organisation. The Directors-General and Director must take all reasonable steps under section 12A to ensure agencies are kept free from such influences.

Authorisations before targeting Australians. Agency heads must maintain ministerial directions (section 8) that specify when authorisations are required. These include any activity specifically aimed at producing intelligence on an identified Australian person or a class of Australian persons.

Secrecy. Staff members and former staff members must not communicate intelligence obtained through their positions unless authorised by the agency head (section 39). Records of the agencies must not be copied, transcribed, retained, removed or otherwise dealt with without authorisation (section 40C). Breaches carry penalties of up to 10 years imprisonment.

Cyber security information use limitations. ASD must not communicate limited cyber security information except for the purposes listed in section 41BB, and specifically must not communicate it for the purpose of investigating or enforcing contraventions of law.

Ministerial directions. The responsible Minister may give written directions to agency heads specifying activities to be undertaken, including directions under section 6(1)(e)(i)/(ii) for ASIS to carry out otherwise unspecified activities. These directions must be reviewed against proportionality and necessity tests before they are given (section 6(2)), must be copied to the IGIS, and their general nature must be disclosed to the Committee (section 6A).

Ministerial authorisations. The responsible Minister has a broad power to give authorisations in writing, which may cover a class of activities, a named class of staff, or a class of purposes connected with agency functions (section 9(2)). Authorisations can include conditions and must specify their duration. For targeting Australian persons, the maximum is six months.

Senior officer urgent authorisations. In urgent cases, a senior ASIS officer may give an authorisation (section 9A); a similar power exists for AGO/ASD under section 9B. These must be confirmed by the Minister within 24 hours and expire within 48 hours.

Agency head powers. Directors-General may delegate management and financial powers to staff (section 27 for ASIS, equivalent sections for ASD). The Director-General of ASD may determine which Commonwealth authorities may serve as cover employers for staff under section 41AB(1), and may delegate this power to officers at SES Band 3 level or above.

AGO fee charging. AGO has an express power to charge fees (not amounting to taxation) for providing imagery products and assistance under paragraphs 6B(1)(e), (ea) and (h).

Information sharing. Under section 13, agencies may communicate intelligence to Commonwealth and State bodies, foreign countries (approved by the responsible Minister), and foreign intelligence services (with Foreign Affairs Minister approval). The breadth of this sharing power is subject to the use-limitation rules elsewhere in the Act.

Section 39 (secrecy -- communication of intelligence information): Imprisonment for 10 years. Applies to any person who was or is connected to ASIS, AGO, DIO or ASD (as staff member, contractor, or contractor's employee) who communicates intelligence information without authorisation. The exception for publicly available information imposes an evidential burden on the defendant.

Section 40C (dealing with records): Imprisonment for 10 years. Applies to any person who copies, transcribes, retains, removes or otherwise deals with records of ASIS, AGO, DIO or ASD obtained through their connection to the agency, without authorisation.

Section 41 (revealing identity of ASIS staff): Imprisonment for 10 years. Any person who identifies, or enables identification of, an ASIS agent or staff member (other than the Director-General or others expressly permitted) without Ministerial or Director-General consent commits an offence. Broadcasting or reporting Parliamentary proceedings (other than Committee proceedings) is excepted.

Schedule 1 offences (Committee obstruction): Schedule 1 to the Act contains offence provisions relating to obstruction of the Committee on Intelligence and Security, false statements to the Committee, and related conduct.

The Act does not create a civil penalty regime; all enforcement mechanisms are criminal. The Inspector-General of Intelligence and Security (under the IGIS Act 1986) provides the primary administrative accountability mechanism.

Ministerial authorisations: Must be in writing (section 9(4A)). The period of effect must be specified; for activities targeting Australian persons, the maximum is six months (section 9(4)). The agency head must maintain copies available for IGIS inspection (section 9(5)).

Urgent authorisations: Senior officer authorisations under sections 9A and 9B last no longer than 48 hours and must be confirmed by the responsible Minister within 24 hours.

Committee establishment: The PJCIS must be established after the commencement of the first session of each Parliament (section 28(1)).

Committee reviews: Various statutory reviews are given fixed deadlines. For example, the review of control orders and preventive detention orders under section 29(bb) was required by 7 January 2021. The review of the Assistance and Access Act 2018 was required by 30 September 2020.

Remuneration determinations: The responsible Minister must seek Remuneration Tribunal advice before determining Director-General remuneration, and must publish each determination in the Gazette within 14 days (section 21(3)).

Ministerial directions for Committee: When a direction is given under section 6(1)(e)(i) or (ii), the Minister must advise the Committee of the nature of the activities as soon as practicable (section 6A). A copy must also be given to the IGIS as soon as practicable (as noted in the section 6 note, referencing section 32B of the IGIS Act 1986).

Australian Security Intelligence Organisation Act 1979: The Act intersects with the ASIO Act extensively. Definitions of "permanent resident" and "foreign power" are borrowed from the ASIO Act (section 3). ASIO is one of the bodies with which ASIS, AGO and ASD cooperate under section 13A. The Committee's mandate under section 29 includes reviewing ASIO's retained data activities.

Criminal Code Act 1995: The secrecy offences in sections 39 and 40C incorporate Criminal Code concepts of evidential burden (note references to subsection 13.3(3)). The Committee's oversight mandate covers Parts 5.3 and 5.3A of the Criminal Code (counter-terrorism and related offences). Authorisation preconditions under section 9(1A) import the Criminal Code definition of "listed terrorist organisation."

Inspector-General of Intelligence and Security Act 1986: The IGIS is the key oversight body for the agencies' operational activities. The Act repeatedly requires copies of authorisations and directions to be made available to the IGIS (sections 9, 10, 32B of the IGIS Act). IGIS officials are expressly exempted from certain secrecy obligations (sections 39 and 41).

Public Governance, Performance and Accountability Act 2013: ASIS and ASD are listed entities for PGPA purposes. Directors-General are accountable authorities and must disclose interests under section 29 of the PGPA Act. Failure to comply is a ground for mandatory termination of appointment (section 23(2)(d)).

Cyber Security Act 2024: Division 1A of Part 6 (sections 41BA-41BH) directly references the Cyber Security Act 2024 for definitions of "Commonwealth body," "Commonwealth enforcement body," "entity," "State body," and for the category of information covered by the Cyber Security Act Part 3 mandatory reporting. Information provided under mandatory reporting obligations is excluded from the "limited cyber security information" definition.

Security of Critical Infrastructure Act 2018: The definition of "computer" and the definition of "cyber security incident" both reference the SOCI Act (section 41BA(4)). Information provided under SOCI Act Part 2B mandatory reporting is excluded from the limited cyber security information regime.

Navigation Act 2012: AGO incorporates the Australian Hydrographic Office, which performs functions under section 223 of the Navigation Act 2012. Those functions are also part of AGO's statutory functions under section 6B(1)(h).

Defence Act 1903: The Chief of the Defence Force's role as head of the Defence Force is incorporated by reference for purposes of cover employment determinations (section 41AB(6)).

ASD's dual role creates practical tension. ASD both collects offensive signals intelligence (intercepting communications of targets outside Australia) and provides defensive cyber security assistance to Australian businesses and government. These are fundamentally different activities with different legal rules. The voluntarily provided cyber incident information that ASD receives under its defensive role cannot be used by ASD for its offensive intelligence role, and vice versa (section 41BB(1)). Entities dealing with ASD need to understand which "hat" it is wearing.

"Australian person" scope for bodies corporate. A company is an "Australian person" only if it is incorporated in Australia AND is not controlled by a foreign power or foreign persons (section 3). A foreign-owned subsidiary registered in Australia is not an Australian person. This matters for the authorisation regime: intelligence collection targeted at such a subsidiary would not require a ministerial authorisation under the Act.

Incidentally obtained intelligence vs. deliberate targeting. The distinction between "incidentally obtained intelligence" and deliberately targeted collection is critical. If an agency happens to pick up information about an Australian while lawfully collecting foreign intelligence, that is permissible and can be shared with law enforcement under section 11(2AA). If the activity was specifically designed to produce intelligence on the Australian, an authorisation was required from the outset (section 8). The difference turns on the specific purpose, not on the result.

Cover employment does not create fictitious employment. The cover employment provisions in sections 41AA-41AC allow an ASIS or ASD staff member to identify a Commonwealth authority as their employer. The provision is purely protective for operational security; it does not actually create an employment relationship with that authority. Third parties who assist with cover arrangements are protected from criminal liability only when acting in good faith within their professional capacity (section 41AC).

Section 41 applies even after the agency relationship ends. Revealing the identity of someone who was an ASIS agent is still an offence under section 41(1)(a), even if the relationship ended years ago. The section does not distinguish between current and former agents.

Cyber security information from mandatory reporting is not protected. Only voluntarily provided information (or information obtained with consent) falls within the limited cyber security information regime (section 41BA(2)). Information an entity was legally required to report to government under the Cyber Security Act Part 3, the SOCI Act Part 2B, or the Telecommunications Act is excluded (section 41BA(3)(a)). This means compulsory-reported breach information does not carry the use-limitation protections.

The Committee cannot see operational detail. Section 29(5) explicitly prevents the Committee from reviewing particular operations, particular warrants or authorisations, individual security assessments, or particular personnel matters. Practitioners and parliamentarians regularly misunderstand the Committee's remit: it reviews the administrative and expenditure landscape of the agencies, not the intelligence itself.

Example 1: ASIS collecting intelligence on an Australian travelling abroad. An ASIS officer overseas receives information suggesting an Australian citizen is acting as an agent for a foreign power. Before ASIS may undertake activities specifically aimed at producing intelligence on that person, the responsible Minister must give a written authorisation under section 9, having satisfied himself of the necessity and proportionality preconditions, and (because the ground is national security) having obtained the Attorney-General's agreement. The authorisation cannot exceed six months. Failing to get the authorisation before commencing the targeted activity is unlawful under section 8.

Example 2: ASD responding to a ransomware attack on a critical infrastructure operator. A major energy company suffers a ransomware attack and voluntarily asks ASD for assistance. In responding, ASD acquires technical information about the attack. That information is "limited cyber security information" under section 41BA. ASD can use it to help the company recover and provide advice to other entities at risk, but cannot pass it to a regulator for enforcement proceedings against the company, or use it as intelligence in offensive operations (section 41BB).

Example 3: An ex-ASIS officer writing a memoir. A former ASIS officer wishes to publish an account of their service. Any information obtained through their service relationship is covered by section 39. Publishing intelligence information without Director-General approval is an offence carrying 10 years imprisonment. The fact that the person has left the service is irrelevant. The only exception is for information that has already been publicly released with Commonwealth authority.

Example 4: A journalist identifying an ASIS agent. A journalist who publishes an article naming a person as a current or former ASIS agent commits an offence under section 41, regardless of whether the person is the Director-General (who is expressly excluded from the prohibition). The exception for Parliamentary broadcasts does not cover Committee proceedings, meaning even Parliamentary testimony cannot be reported without risk of prosecution if it would identify an agent.

Example 5: AGO providing imagery to a State emergency agency. During a major flood, AGO provides satellite imagery to a State emergency services agency to assist with search and rescue. This is lawful under paragraph 6B(1)(ea) as emergency response assistance that is incidental to AGO's other functions. AGO can charge a fee for this service under subsection 6B(4), so long as the fee does not amount to taxation.