Division 1ACommunication and use of limited cyber security information

An Act relating to the Australian intelligence services, and for related purposes ## Part 1—Preliminary #### 1 Short title This Act may be cited as the Intelligence Services Act 2001. #### 2 Commencement This Act commences 28 days after the day on which it receives the Royal Assent. #### 3 Definitions (1) In this Act, unless the contrary intention appears: > AFP means the Australian Federal Police. > agency means ASIS, AGO or ASD. > agency head means: (a) in relation to ASIS—the Director‑General of ASIS; and (b) in relation to AGO—the Director of AGO; and (c) in relation to ASD—the Director‑General of ASD. > AGO means that part of the Defence Department known as the Australian Geospatial‑Intelligence Organisation. > APS Agency means an Agency within the meaning of the Public Service Act 1999. > ASD means the Australian Signals Directorate. > ASD contract means a contract, to which ASD is a party, under which services are to be, or were to be, provided to ASD. > ASIO means the Australian Security Intelligence Organisation. > ASIS means the Australian Secret Intelligence Service. > Australia, when used in a geographical sense, includes the external Territories. > Australian person means a person who is: (a) an Australian citizen; or (b) a permanent resident. > authority, of another country, has a meaning affected by subsection (2). > Chair means the Chair of the Committee. > Committee means the Parliamentary Joint Committee on Intelligence and Security. > Commonwealth authority includes: (a) an Agency within the meaning of the Public Service Act 1999; and (b) a Department within the meaning of the Parliamentary Service Act 1999; and (c) the Defence Force; and (d) a body (whether incorporated or not) established, or continued in existence, for a public purpose by or under a law of the Commonwealth; and (e) a body corporate in which the Commonwealth or a body referred to in paragraph (d) has a controlling interest. > Commonwealth body, for the purposes of Division 1A of Part 6, has the meaning given by subsection 41BA(5). > Commonwealth enforcement body, for the purposes of Division 1A of Part 6, has the meaning given by subsection 41BA(5). > computer has the same meaning as in the Security of Critical Infrastructure Act 2018. > contracted service provider, for an ASD contract, means: (a) a person who is a party to the ASD contract and who is responsible for the provision of services to ASD under the ASD contract; or (b) a subcontractor for the ASD contract. > coronial inquiry means a coronial inquiry, coronial investigation or coronial inquest under a law of the Commonwealth, or of a State or Territory. > court includes a tribunal, authority or person that has power to require the production of documents or the answering of questions. > cybercrime means activities that involve committing a serious crime by, or facilitated by, the use of electromagnetic energy, whether guided or unguided or both. > cyber security incident has the meaning given by subsection 41BA(4). > Defence Department means the Department of State that deals with defence and that is administered by the Defence Minister. > Defence Minister means the Minister administering section 1 of the Defence Act 1903. > DIO means that part of the Defence Department known as the Defence Intelligence Organisation. > Director‑General of National Intelligence means the Director‑General of National Intelligence holding office under the Office of National Intelligence Act 2018. > Director‑General of Security means the Director‑General of Security holding office under the Australian Security Intelligence Organisation Act 1979. > emergency response function includes, but is not limited to, a function in relation to: (a) search and rescue; or (b) emergency rescue; or (c) response to natural disasters. > entity, for the purposes of Division 1A of Part 6, has the meaning given by subsection 41BA(5). > Foreign Affairs Minister means the Minister administering the Diplomatic Privileges and Immunities Act 1967. > foreign power has the same meaning as in the Australian Security Intelligence Organisation Act 1979. > IGIS official (short for Inspector‑General of Intelligence and Security official) means: (a) the Inspector‑General of Intelligence and Security; or (b) a person covered by subsection 32(1) of the Inspector‑General of Intelligence and Security Act 1986. > Immigration and Border Protection Department means the Department administered by the Minister administering the Australian Citizenship Act 2007. > incidentally obtained intelligence means intelligence: (a) that is obtained by ASIS in the course of obtaining intelligence under subsection 6(1) (other than intelligence obtained solely in the course of obtaining intelligence under paragraph 6(1)(da)), by AGO in the course of obtaining intelligence under paragraph 6B(1)(a), (b) or (c) or by ASD in the course of obtaining intelligence under paragraph 7(1)(a); and (b) that is not intelligence of a kind referred to in those provisions. > Inspector‑General of Intelligence and Security means the Inspector‑General of Intelligence and Security appointed under the Inspector‑General of Intelligence and Security Act 1986. > intelligence information means the following: (a) intelligence obtained by ASIS under subsection 6(1) (other than intelligence obtained solely under paragraph 6(1)(da)); (b) intelligence obtained by AGO under paragraph 6B(1)(a), (b) or (c); (c) intelligence obtained by ASD under paragraph 7(1)(a); (ca) intelligence obtained or produced by DIO in the performance of its intelligence functions; (d) incidentally obtained intelligence. > involved, with a listed terrorist organisation or a state sponsor of terrorism, has a meaning affected by subsection 9(1AAB). > limited cyber security information has the meaning given by subsection 41BA(1). > listed terrorist organisation has the same meaning as in subsection 100.1(1) of the Criminal Code. > member means a member of the Committee, and includes the Chair. > ONI means the Office of National Intelligence. > operational security of ASIS means the protection of the integrity of operations undertaken by ASIS from: (a) interference by a foreign person or entity; or (b) reliance on inaccurate or false information. > paid work means work for financial gain or reward (whether as an employee, a self‑employed person or otherwise). > paramilitary activities means activities involving the use of an armed unit (or other armed group) that is not part of a country’s official defence or law enforcement forces. > permanent resident means: (a) a natural person who is a permanent resident within the meaning of the Australian Security Intelligence Organisation Act 1979; or (b) a body corporate incorporated under a law in force in a State or Territory, other than a body corporate whose activities one or more of the following controls, or is in a position to control, whether directly or indirectly: (i) a foreign power; (ii) a natural person who is neither an Australian citizen nor a person covered by paragraph (a); (iii) a group of natural persons, none of whom is an Australian citizen or a person covered by paragraph (a). > police functions means: (a) the arrest, charging or detention of suspected offenders; or (b) any other activity undertaken for the purposes of prosecuting, or for determining whether to prosecute, an offence. > prescribed activity has the meaning given by subsection 8(1B). > record means a document, or any other object by which words, images, sounds or signals are recorded or stored or from which information can be obtained, and includes part of a record. > Note: For the definition of document, see section 2B of the Acts Interpretation Act 1901. > responsible Minister means: (a) in relation to ASIO—the Minister responsible for ASIO; and (b) in relation to an agency—the Minister responsible for the agency; and (ba) in relation to DIO—the Minister responsible for DIO; and (c) in relation to ONI—the Minister responsible for ONI. > retained data activity means an activity relating to information, or documents, that a service provider has been required to keep under Part 5‑1A of the Telecommunications (Interception and Access) Act 1979. > serious crime means conduct that, if engaged in within, or in connection with, Australia, would constitute an offence against the law of the Commonwealth, a State or a Territory punishable by imprisonment for a period exceeding 12 months. > service provider has the same meaning as in the Telecommunications (Interception and Access) Act 1979. > signals includes electromagnetic emissions. > staff member, subject to subsection 41AC(3), means: (a) in relation to ASIO—a member of the staff of ASIO (whether an employee of ASIO, a consultant or contractor to ASIO, or a person who is made available by another Commonwealth or State authority or other person to perform services for ASIO); and (b) in relation to an agency—a member of the staff of the agency (whether an employee of the agency, a consultant or contractor to the agency, or a person who is made available by another Commonwealth or State authority or other person to perform services for the agency); and (c) in relation to DIO—a member of the staff of that part of the Defence Department known as the Defence Intelligence Organisation, whether: (i) an employee, a consultant or contractor that works in that part of the Defence Department; or (ii) a person who is made available by another Commonwealth authority, a State authority or other person to perform services for that part of the Defence Department. > State authority includes: (a) a Department of State of a State or Territory or a Department of the Public Service of a State or Territory; and (b) a body (whether incorporated or not) established, or continued in existence, for a public purpose by or under a law of a State or Territory; and (c) a body corporate in which a State, Territory or a body referred to in paragraph (b) has a controlling interest. > State body, for the purposes of Division 1A of Part 6, has the meaning given by subsection 41BA(5). > state sponsor of terrorism has the same meaning as in the Criminal Code. > subcontractor, for an ASD contract, means a person: (a) who is a party to a contract (the subcontract): (i) with a contracted service provider for the ASD contract (within the meaning of paragraph (a) of the definition of contracted service provider); or (ii) with a subcontractor for the ASD contract (under a previous application of this definition); and (b) who is responsible under the subcontract for the provision of services to ASD, or to a contracted service provider for the ASD contract, for the purposes (whether direct or indirect) of the ASD contract. (2) For the purposes of determining whether a body is an authority of another country, it does not matter whether: (a) the body is established by a law of the country; or (b) the body is connected with an internationally recognised government of the country. #### 3A References to Ministers Despite section 19 of the Acts Interpretation Act 1901, in this Act: (a) a reference to the responsible Minister in relation to a relevant agency is a reference only to the most senior responsible Minister in relation to that agency; and (b) a reference to the Prime Minister or the Attorney‑General is a reference only to the Minister with that title; and (c) a reference to the Defence Minister is a reference only to the most senior Defence Minister; and (d) a reference to the Foreign Affairs Minister is a reference only to the most senior Foreign Affairs Minister; and (e) a reference to the Minister responsible for administering the Australian Security Intelligence Organisation Act 1979 is a reference only to the most senior such Minister. > Note: A reference to a Minister mentioned in this section may include a reference to a person acting as that Minister (see subsection 19(4) of the Acts Interpretation Act 1901). #### 4 Extension to external Territories This Act extends to every external Territory. #### 5 Application of Criminal Code (1) Chapter 2 of the Criminal Code applies to all offences against this Act. > Note: Chapter 2 of the Criminal Code sets out the general principles of criminal responsibility. (2) Section 15.4 of the Criminal Code (extended geographical jurisdiction—category D) applies to all offences against this Act. ## Part 2—Functions of the agencies ### Division 1—Functions of the agencies #### 6 Functions of ASIS (1) The functions of ASIS are: (a) to obtain, in accordance with the Government’s requirements, intelligence about the capabilities, intentions or activities of people or organisations outside Australia; and (b) to communicate, in accordance with the Government’s requirements, such intelligence; and (ba) to provide assistance to the Defence Force in support of military operations and to cooperate with the Defence Force on intelligence matters; and (c) to conduct counter‑intelligence activities; and (d) to liaise with intelligence or security services, or other authorities, of other countries; and (da) to cooperate with and assist bodies referred to in section 13A in accordance with that section; and (db) to undertake activities in accordance with section 13B; and (e) to undertake the following other activities relating to the capabilities, intentions or activities of people or organisations outside Australia: (i) such activities of a general or specific nature as the responsible Minister directs; (ii) activities included in such a class or classes of activity or activities as the responsible Minister directs. (1A) Without limiting subparagraph (1)(e)(i), a direction given under that subparagraph may specify the purpose or purposes for which an activity or activities are to be undertaken. (1B) Without limiting subparagraph (1)(e)(ii), a direction given under that subparagraph may specify the purpose or purposes for which a class or classes of activity or activities are to be undertaken. (2) The responsible Minister may give a direction under subparagraph (1)(e)(i) or (ii) only if the Minister: (a) has consulted other Ministers who have related responsibilities; and (b) is satisfied that there are satisfactory arrangements in place to ensure that, in carrying out the direction, nothing will be done beyond what is necessary having regard to the purposes for which the direction is given; and (c) is satisfied that there are satisfactory arrangements in place to ensure that the nature and consequences of acts done in carrying out the direction will be reasonable having regard to the purposes for which the direction is given. (3) A direction under subparagraph (1)(e)(i) or (ii) must be in writing. > Note: If the Minister gives a direction under subparagraph (1)(e)(i) or (ii), the Minister must give a copy of the direction to the Inspector‑General of Intelligence and Security as soon as practicable after the direction is given to the head of ASIS (see section 32B of the Inspector‑General of Intelligence and Security Act 1986). (3A) A direction under subparagraph (1)(e)(i) or (ii) is not a legislative instrument. (4) In performing its functions, ASIS must not plan for, or undertake, activities that involve: (a) paramilitary activities; or (b) violence against the person; or (c) the use of weapons; by staff members or agents of ASIS. > Note 1: This subsection does not prevent ASIS from being involved with the planning or undertaking of activities covered by paragraphs (a) to (c) by other organisations provided that staff members or agents of ASIS do not undertake those activities. > Note 2: For other limits on the agency’s functions and activities see sections 11 and 12. > Note 3: For paramilitary activities see section 3. (5) Subsection (4) does not prevent: (a) the provision of weapons, or training in the use of weapons or in self‑defence techniques, in accordance with Schedule 2; or (b) the use of weapons or self‑defence techniques in accordance with Schedule 2. (5A) Subsection (4) does not prevent: (a) the provision of weapons, or training in the use of force (including in the use of weapons) against a person, in accordance with Schedule 3, for the purposes of activities undertaken by ASIS outside Australia; or (b) the use of force against a person (including the use of weapons), in accordance with Schedule 3, in the course of activities undertaken by ASIS outside Australia; or (c) the threat of the use of force against a person (including the threat of the use of weapons), in accordance with Schedule 3, in the course of activities undertaken by ASIS outside Australia. (5B) Nothing in subsection (5) or (5A) permits conduct by a person (the actor) that: (a) would constitute torture; or (b) would subject a person to cruel, inhuman or degrading treatment; or (c) would involve the commission of a sexual offence against any person; or (d) is likely to cause the death of, or grievous bodily harm to, a person, unless the actor believes on reasonable grounds that the conduct is necessary to protect life or to prevent serious injury to another person (including the actor). (5C) Nothing in subsection (5) or Schedule 2 limits the operation of subsection (5A) or Schedule 3. (5D) Nothing in subsection (5A) or Schedule 3 limits the operation of subsection (5) or Schedule 2. (6) ASIS must not: (a) provide weapons; or (b) provide training in the use of weapons; or (c) provide training in the use of force, or the threat of the use of force, against a person; or (d) provide training in the use of self‑defence techniques; other than in accordance with Schedule 2 or Schedule 3. (7) In performing its functions, ASIS is not prevented from providing assistance to Commonwealth authorities and to State authorities. #### 6A Committee to be advised of other activities If the responsible Minister gives a direction under subparagraph 6(1)(e)(i) or (ii), the Minister must as soon as practicable advise the Committee of the nature of the activity or activities to be undertaken in accordance with the direction. > Note: For Committee see section 3. #### 6B Functions of AGO (1) The functions of AGO are: (a) to obtain geospatial, hydrographic, meteorological, oceanographic and imagery intelligence about the capabilities, intentions or activities of people or organisations outside Australia from the electromagnetic spectrum or other sources, for the purposes of meeting the requirements of the Government for such intelligence; and (b) to obtain geospatial, hydrographic, meteorological, oceanographic and imagery intelligence from the electromagnetic spectrum or other sources for the purposes of meeting the operational, targeting, training and exercise requirements of the Defence Force; and (c) to obtain geospatial, hydrographic, meteorological, oceanographic and imagery intelligence from the electromagnetic spectrum or other sources for the purposes of supporting Commonwealth authorities and State authorities in carrying out national security functions; and (d) to communicate, in accordance with the Government’s requirements, intelligence referred to in paragraph (a), (b) or (c); and (e) to provide the following to persons and bodies mentioned in subsection (2): (i) imagery and other geospatial, hydrographic, meteorological and oceanographic products, not being intelligence obtained under paragraph (a), (b) or (c) of this subsection; (ii) assistance in relation to the production and use of imagery and other geospatial, hydrographic, meteorological and oceanographic products; (iii) assistance in relation to the production and use of imagery technologies and other geospatial, hydrographic, meteorological and oceanographic technologies; and (ea) to provide to any persons or bodies (including Commonwealth authorities and State authorities) assistance in relation to the performance by the persons or bodies of emergency response functions, safety functions, scientific research functions, economic development functions, cultural functions and environmental protection functions, if: (i) the provision of the assistance is incidental to the performance by AGO of its other functions; or (ii) the assistance is capable of being conveniently provided by the use of resources that are not immediately required in performing AGO’s other functions; or (iii) the assistance is capable of being conveniently provided in the course of performing AGO’s other functions; and (f) to cooperate with and assist bodies referred to in section 13A in accordance with that section; and (g) to provide assistance to the Defence Force in support of military operations and to cooperate with the Defence Force on intelligence matters; and (h) the functions mentioned in subsection 223(2) of the Navigation Act 2012 (to the extent they are not covered by another paragraph of this subsection). > Note 1: For limits on the agency’s functions and activities see sections 11 and 12. > Note 2: Subsection 223(2) of the Navigation Act 2012 deals with the functions of the Australian Hydrographic Office, which is part of AGO (see subsection (3) of this section). (2) Paragraph (1)(e) applies to providing imagery and other products, or assistance in relation to imagery and other products or technologies, to the following: (a) a Commonwealth authority; (b) a State authority of a Territory; (c) a foreign person or entity; (d) any other person or body (including a State authority of a State) if: (i) the imagery and other products or technologies are for use in, or incidental to, trade and commerce with other countries, among the States, between Territories or between a Territory and a State, or are for use outside Australia; or (ii) the imagery and other products or assistance are provided by way of postal, telegraphic, telephonic or other like services. > Note: For State authority, see section 3. (3) The Australian Hydrographic Office mentioned in section 223 of the Navigation Act 2012 is part of the AGO. Fees (4) AGO may, on behalf of the Commonwealth, charge a fee in relation to anything done in performing AGO’s functions under paragraph (1)(e), (ea) or (h). (5) A fee must not be such as to amount to taxation. #### 7 Functions of ASD (1) The functions of ASD are: (a) to obtain intelligence about the capabilities, intentions or activities of people or organisations outside Australia in the form of electromagnetic energy, whether guided or unguided or both, or in the form of electrical, magnetic or acoustic energy, for the purposes of meeting the requirements of the Government, and in particular the requirements of the Defence Force, for such intelligence; and (b) to communicate, in accordance with the Government’s requirements, such intelligence; and (c) to prevent and disrupt, by electronic or similar means, cybercrime undertaken by people or organisations outside Australia; and (ca) to provide material, advice and other assistance to any person or body mentioned in subsection (2) on matters relating to the security and integrity of information that is processed, stored or communicated by electronic or similar means; and (d) to provide assistance to the Defence Force in support of military operations and to cooperate with the Defence Force on intelligence matters; and (da) to protect specialised technologies acquired in connection with the performance of any of the preceding functions; and (e) to provide assistance to Commonwealth authorities and State authorities in relation to: (i) cryptography, and communication and computer technologies; and (ii) other specialised technologies acquired in connection with the performance of its other functions; and (iii) the performance by those authorities of search and rescue functions; and (f) to cooperate with and assist bodies referred to in section 13A in accordance with that section. > Note: For limits on the agency’s functions and activities see sections 11 and 12. (2) For the purposes of paragraph (1)(ca), material, advice and other assistance may be provided to the following: (a) a Commonwealth authority; (b) a State authority; (c) a foreign person or entity; (d) any other person or body if: (i) the material, advice and other assistance are provided for the purpose of protecting or facilitating trade and commerce with other countries, among the States, between Territories or between a Territory and a State, or outside Australia; or (ii) the material, advice and other assistance are provided by way of a postal, telegraphic, telephonic or other like service (within the meaning of paragraph 51(v) of the Constitution); or (iii) the information was obtained or generated in the operation of a postal, telegraphic, telephonic or other like service (within the meaning of paragraph 51(v) of the Constitution). > Note: For State authority, see section 3. #### 8 Ministerial directions (1) The responsible Minister in relation to ASIS, the responsible Minister in relation to AGO and the responsible Minister in relation to ASD, must issue a written direction under this subsection to the relevant agency head. The direction must: (a) require the agency to obtain an authorisation under section 9, 9A, 9B or 9D (as the case requires) before: (i) undertaking an activity, or a series of activities, for the specific purpose, or for purposes which include the specific purpose, of producing intelligence on an Australian person; or (iaa) undertaking an activity, or a series of activities, for the specific purpose, or for purposes which include the specific purpose, of producing intelligence on one or more members of a class of Australian persons; or (ia) undertaking, in the course of providing assistance to the Defence Force in support of military operations under paragraph 6(1)(ba), 6B(1)(g) or 7(1)(d), an activity, or a series of activities, for the specific purpose, or for purposes which include the specific purpose, of producing intelligence on one or more members of a class of Australian persons; or (ib) undertaking, in the course of providing assistance to the Defence Force in support of military operations under paragraph 6(1)(ba), an activity, or a series of activities, that will, or is likely to, have a direct effect on one or more members of a class of Australian persons; or (ii) undertaking, in accordance with a direction under subparagraph 6(1)(e)(i) or (ii), an activity, or a series of activities, that will, or is likely to, have a direct effect on an Australian person; or (iii) undertaking, in accordance with paragraph 7(1)(c), an activity, or a series of activities, for the specific purpose, or for purposes which include the specific purpose, of preventing or disrupting cybercrime undertaken by, or enabled by, an Australian person; and (b) specify the circumstances in which the agency must, before undertaking other activities or classes of activities, obtain an authorisation under section 9, 9A or 9B (as the case requires). (1A) For the purposes of subparagraphs (1)(a)(i), (iaa) and (ia), an agency undertakes an activity, or a series of activities, for the specific purpose, or for purposes which include the specific purpose, of producing intelligence on an Australian person, or one or more members of a class of Australian persons, only if: (a) the agency undertakes a prescribed activity to obtain that intelligence; or (b) the agency expressly or impliedly requests an authority referred to in paragraph 13(1)(c) to undertake a prescribed activity to obtain that intelligence. (1B) Prescribed activity means a covert and intrusive activity, or a series of covert and intrusive activities and, to avoid doubt, includes an activity, or a series of activities, that ASIO could not undertake in at least one State or Territory without it being authorised by warrant under: (a) Division 2 of Part III of the Australian Security Intelligence Organisation Act 1979; or (b) Part 2‑2 of the Telecommunications (Interception and Access) Act 1979. (2) The responsible Minister may give written directions to be observed: (a) in the performance by the relevant agency of its functions; or (b) in the case of ASIS—in the exercise of the powers of the Director‑General of ASIS under section 33 or 34. (3) Each agency head must ensure that the agency complies with any direction given by the responsible Minister under this section. (4) Directions under paragraph (2)(b) must not relate to a specific staff member. (5) A direction given under this section is not a legislative instrument. > Note: The Inspector‑General of Intelligence and Security has oversight powers in relation to Ministerial directions and authorisations given under this Act. See in particular section 32B of the Inspector‑General of Intelligence and Security Act 1986 (which requires the Minister to give a copy of a direction under this section to the Inspector‑General of Intelligence and Security as soon as practicable after the direction is given). #### 9 Ministerial authorisation Preconditions for giving authorisation (1) Before a Minister gives an authorisation, the Minister must be satisfied that: (a) any activities which may be done in reliance on the authorisation will be necessary for the proper performance of a function of the agency concerned; and (b) there are satisfactory arrangements in place to ensure that nothing will be done in reliance on the authorisation beyond what is necessary for the proper performance of a function of the agency; and (c) there are satisfactory arrangements in place to ensure that the nature and consequences of acts done in reliance on the authorisation will be reasonable, having regard to the purposes for which they are carried out; and (d) for an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(ia) or (ib)—the Defence Minister has requested the authorisation in writing. (1A) Before a Minister gives an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(i), (ia), (ib) or (ii) (the relevant subparagraph), the Minister must also be satisfied that the Australian person, or the class of Australian persons, mentioned in the relevant subparagraph is, or is likely to be, involved in one or more of the following activities: (a) activities that present a significant risk to the safety of any person (including the Australian person or a member of the class of Australian persons mentioned in the relevant subparagraph); (b) acting for, or on behalf of, a foreign power; (c) activities that are, or are likely to be, a threat to security; (d) activities that pose a risk, or are likely to pose a risk, to the operational security of ASIS; (e) activities related to the proliferation of weapons of mass destruction or the movement of goods listed from time to time in the Defence and Strategic Goods List (within the meaning of regulation 13E of the Customs (Prohibited Exports) Regulations 1958); (f) activities related to a contravention, or an alleged contravention, of a UN sanction enforcement law by any person (including the Australian person or a member of the class of Australian persons mentioned in the relevant subparagraph); (g) committing a serious crime by moving money, goods or people; (h) committing a serious crime by using or transferring intellectual property; (i) committing a serious crime by transmitting data or signals by means of guided and/or unguided electromagnetic energy. > Note 1: For serious crime, see section 3. > Note 2: Certain authorisations referred to in this subsection cannot take effect unless the Minister has obtained the agreement of the Attorney‑General (see subsection (1AAC)). (1AAA) Before a Minister gives an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(iaa), the Minister must also be satisfied that the class of Australian persons mentioned in that subparagraph is, or is likely to be, involved with a listed terrorist organisation or a state sponsor of terrorism. > Note: An authorisation referred to in this subsection cannot take effect unless the Minister has obtained the agreement of the Attorney‑General (see subsection (1AAD)). (1AAB) Without limiting the circumstances in which a person is involved with a listed terrorist organisation or state sponsor of terrorism, a person is taken to be involved with a listed terrorist organisation or state sponsor of terrorism if the person: (a) directs, or participates in, the activities of the listed terrorist organisation or state sponsor of terrorism; or (b) recruits a person to join, or participate in the activities of, the listed terrorist organisation or state sponsor of terrorism; or (c) provides training to, receives training from, or participates in training with, the listed terrorist organisation or state sponsor of terrorism; or (d) is: (i) a member (within the meaning of subsection 102.1(1) of the Criminal Code) of the listed terrorist organisation; or (ii) a member (within the meaning of subsection 110.1(1) of the Criminal Code) of the state sponsor of terrorism; or (e) provides financial or other support to the listed terrorist organisation or state sponsor of terrorism; or (f) advocates for, or on behalf of, the listed terrorist organisation or state sponsor of terrorism. Agreement of the Attorney‑General (1AAC) An authorisation referred to in subsection (1A) for an activity, or a series of activities, in relation to an Australian person, or a class of Australian persons, who is, or is likely to be, involved in activities referred to in paragraph (1A)(c) (whether or not the person, or the class of persons, is, or likely to be, involved in activities covered by another paragraph of subsection (1A)) cannot take effect unless and until the Minister has obtained the agreement (orally or in writing, but subject to subsection (1AA)) of the Attorney‑General. The agreement may be sought before or after the authorisation is given. (1AAD) An authorisation referred to in subsection (1AAA) for an activity, or a series of activities, in relation to a class of Australian persons cannot take effect unless and until the Minister has obtained the agreement (orally or in writing, but subject to subsection (1AA)) of the Attorney‑General. The agreement may be sought before or after the authorisation is given. (1AA) Without limiting subsection (1AAC) or (1AAD), the Attorney‑General may, in writing: (a) specify classes of Australian persons who are, or are likely to be: (i) involved in an activity or activities that are, or are likely to be, a threat to security; or (ii) involved with a listed terrorist organisation or state sponsor of terrorism; and (b) give his or her agreement in relation to any Australian person in that specified class. (1AB) An agreement given in accordance with subsection (1AA) may: (a) relate to an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(i), (iaa), (ia), (ib) or (ii); and (b) specify the period during which the agreement has effect. (1AC) If an agreement relating to a specified class of Australian persons specifies a period in accordance with paragraph (1AB)(b), the agreement of the Attorney‑General is, for authorisations to be given after the period ends, taken not to have been obtained in relation to a person in that class. > Note: The agreement of the Attorney‑General would need to be obtained again in relation to such a person. Content and form of authorisation (2) The Minister may give an authorisation in relation to: (a) an activity, or class of activities, specified in the authorisation; or (b) acts of a staff member or agent, or a class of staff members or agents, specified (whether by name or otherwise) in the authorisation; or (c) activities done for a particular purpose connected with the agency’s functions. (3) An authorisation is subject to any conditions specified in it. (4) An authorisation must specify how long it will have effect. The period of effect specified in an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(i), (iaa), (ia), (ib), (ii) or (iii) must not exceed 6 months. (4A) An authorisation must be in writing. Requirement to keep copies (5) If a Minister gives an authorisation under this section in relation to an agency, the relevant agency head must ensure that copies of the following are kept by the agency and are available for inspection on request by the Inspector‑General of Intelligence and Security: (a) the authorisation; (b) any record or copy of an agreement given under subsection (1AAC) or (1AAD) (including any agreement given in accordance with subsection (1AA)); (c) if the authorisation is for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(ia) or (ib)—the request from the Defence Minister referred to in paragraph (1)(d) of this section. Status of instruments (6) A request under paragraph (1)(d), an agreement under subsection (1AAC) or (1AAD) (if in writing), a request under subsection (5) (if in writing), and an authorisation under this section, are not legislative instruments. Definitions (7) In this section: > security has the same meaning as in the Australian Security Intelligence Organisation Act 1979. > UN sanction enforcement law has the same meaning as in the Charter of the United Nations Act 1945. #### 9A Authorisations in an emergency—Ministerial authorisations (1) This section applies if: (a) an emergency situation arises in which an agency head considers it necessary or desirable to undertake an activity or a series of activities (except an activity or a series of activities of a kind mentioned in subparagraph 8(1)(a)(iaa), (ia) or (ib)); and (b) a direction under subsection 8(1) requires the agency to obtain an authorisation under section 9, 9A or 9B before undertaking that activity or series of activities. Giving oral authorisations (2) A Minister specified in subsection (3) may orally give an authorisation under this section for the activity or series of activities if (subject to section 9C) the conditions in subsections 9(1) and (1A) are met. (3) The Ministers who may orally give an authorisation are: (a) the responsible Minister in relation to the relevant agency; or (b) if the agency head is satisfied that the relevant responsible Minister is not readily available or contactable—any of the following Ministers: (i) the Prime Minister; (ii) the Defence Minister; (iii) the Foreign Affairs Minister; (iv) the Attorney‑General; (v) the Minister responsible for administering the Australian Security Intelligence Organisation Act 1979. > Note: An authorisation may be given by an agency head if none of those Ministers are readily available or contactable (see section 9B). Period of effect of oral authorisation (4) An authorisation given under this section for an activity or series of activities ceases to have effect at the earlier of the following times: (a) when an authorisation for the activity or series of activities is given under section 9; (b) 48 hours from the time the authorisation was given under this section. Record of oral authorisation (5) The agency head must: (a) ensure that a written record of an authorisation given under this section is made as soon as practicable (but no later than 48 hours) after the authorisation is given; and (b) give the Inspector‑General of Intelligence and Security a copy of the record within 3 days after the authorisation is given. #### 9B Authorisations in an emergency—Ministers unavailable (1) This section applies if: (a) an agency head considers it necessary or desirable to undertake an activity or a series of activities; and (b) an authorisation is sought under section 9A; and (c) the agency head is satisfied that none of the Ministers specified in subsection 9A(3) are readily available or contactable. (2) The agency head may give an authorisation under this section for the activity or series of activities if the agency head is satisfied that: (a) the facts of the case would justify the relevant responsible Minister giving an authorisation under section 9 because (subject to section 9C) the agency head is satisfied that the conditions in subsections 9(1) and (1A) are met; and (b) the responsible Minister would have given the authorisation; and (c) if the activity or series of activities is not undertaken before an authorisation is given under section 9 or 9A: (i) security (within the meaning of the Australian Security Intelligence Organisation Act 1979) will be, or is likely to be, seriously prejudiced; or (ii) there will be, or is likely to be, a significant risk to the safety of any person. Content and form of authorisation (3) An authorisation given under this section: (a) may be given in relation to the same matters as an authorisation may be given under subsection 9(2); and (b) is subject to the requirements of subsections 9(3) and (4A). Period of effect of authorisation (4) An authorisation given under this section for an activity or series of activities ceases to have effect at the earliest of the following times: (a) when an authorisation for the activity or series of activities is given under section 9 or 9A; (b) when the authorisation given under this section is cancelled by the relevant responsible Minister under subsection (8) of this section; (c) 48 hours from the time the authorisation was given under this section. Notifying the responsible Minister (4A) An agency head who gives an authorisation under this section for an activity or series of activities must notify the relevant responsible Minister of the authorisation within 8 hours after giving the authorisation. Copies of authorisation and other documents (5) The agency head must also give the following documents to the relevant responsible Minister and the Inspector‑General of Intelligence and Security: (a) a copy of the authorisation; (b) a summary of the facts of the case that the agency head was satisfied justified giving the authorisation; (c) an explanation of the Minister’s obligation under subsection (7). (6) The documents must be given to the responsible Minister and the Inspector‑General of Intelligence and Security as soon as practicable, but no later than the following time: (a) for documents given to the responsible Minister—48 hours after giving the authorisation; (b) for documents given to the Inspector‑General of Intelligence and Security—3 days after giving the authorisation. Responsible Minister must consider cancelling authorisation or giving new authorisation (7) As soon as practicable after the responsible Minister is given the documents, the responsible Minister must consider whether to: (a) cancel the authorisation under subsection (8); or (b) give a new authorisation for the activity or series of activities under section 9 or 9A. Responsible Minister may cancel authorisation (8) For the purposes of paragraph (4)(b), the relevant responsible Minister may, in writing, cancel an authorisation given under this section. Oversight by Inspector‑General of Intelligence and Security (8A) Within 30 days after the Inspector‑General of Intelligence and Security is given the documents, the Inspector‑General must: (a) consider whether the agency head complied with the requirements of this section in giving the authorisation; and (b) provide the responsible Minister with a report on the Inspector‑General’s views of the extent of the agency head’s compliance with the requirements of this section in giving the authorisation; and (c) provide to the Committee a copy of the conclusions in the report. Status of instruments (9) An authorisation, report and a cancellation under this section are not legislative instruments. #### 9C Authorisations in an emergency—Attorney‑General unavailable (1) This section applies if: (a) an agency head considers it necessary or desirable to undertake an activity or a series of activities; and (b) an authorisation is sought under section 9A or 9B; and (c) all of the following apply: (i) the authorisation cannot take effect unless and until the agreement of the Attorney‑General has been obtained under subsection 9(1AAC); (ii) the agreement has not been obtained; (iii) the agency head is satisfied that the Attorney‑General is not readily available or contactable. Giving authorisation (2) Despite subsection 9(1AAC) and subject to subsection (3) of this section, the authorisation: (a) may be given; and (b) may take effect without the agreement of the Attorney‑General having been obtained. Obtaining the agreement of the Director‑General of Security (3) Before an authorisation is given under section 9A or 9B, the agency head must, unless the agency head is satisfied that the Director‑General of Security is not readily available or contactable, obtain the agreement of the Director‑General to the authorisation: (a) being given; and (b) taking effect without the agreement of the Attorney‑General having been obtained. Notifying Attorney‑General, ASIO Minister and Inspector‑General of Intelligence and Security (4) The relevant agency head must notify the following that an authorisation was given under section 9A or 9B (as the case requires) in accordance with this section: (a) the Attorney‑General; (b) the Minister responsible for administering the Australian Security Intelligence Organisation Act 1979 (the ASIO Minister); (c) the Inspector‑General of Intelligence and Security. The notification must state whether the agreement of the Director‑General of Security was obtained. (5) The notification must be given: (a) for a notification given to the Attorney‑General or the ASIO Minister—before the end of 8 hours after the authorisation is given under section 9A or 9B; and (b) for a notification given to the Inspector‑General of Intelligence and Security—as soon as practicable, but no later than 3 days after the authorisation is given under section 9A or 9B. Oversight by Inspector‑General of Intelligence and Security (6) Within 30 days after the Inspector‑General of Intelligence and Security is given the notification, the Inspector‑General must: (a) consider whether the agency head complied with the requirements of this section in giving the authorisation under section 9A or 9B; and (b) provide the responsible Minister with a report on the Inspector‑General’s views of the extent of the agency head’s compliance with the requirements of this section in giving the authorisation under that section; and (c) provide to the Committee a copy of the conclusions in the report. #### 9D Authorisations in an emergency—imminent risk to safety of an Australian person When this section applies (1) This section applies if an agency head is satisfied that: (a) there is, or is likely to be, an imminent risk to the safety of an Australian person who is outside Australia; and (b) it is necessary or desirable to undertake an activity, or a series of activities, for the specific purpose, or for purposes which include the specific purpose, of producing intelligence on the person; and (c) it is not reasonably practicable to obtain the person’s consent to the agency producing that intelligence; and (d) having regard to the nature and gravity of the risk, it is reasonable to believe that the person would consent to the agency producing that intelligence if the person were able to do so. Authorisation (2) The agency head may, orally or in writing, give an authorisation under this section for the activity, or series of activities, if the agency head is satisfied that: (a) the facts of the case would justify the responsible Minister giving an authorisation under section 9 because the agency head is satisfied that the conditions in subsections 9(1) and (1A) are met; and (b) the responsible Minister would have given the authorisation. Conditions on authorisation (3) The authorisation is subject to any conditions specified by the agency head. Agreement of the Attorney‑General not required (3A) Subsection 9(1AAC) does not apply in relation to the authorisation. Agency head to record and notify (4) As soon as practicable after giving the authorisation (but no later than 8 hours after the authorisation is given) the agency head must, orally or in writing, notify the responsible Minister of the authorisation. (5) As soon as practicable after giving the authorisation (but no later than 48 hours after the authorisation is given) the agency head must: (a) if the authorisation is given orally—ensure that the authorisation is recorded in writing; and (b) ensure that a summary of the facts of the case that the agency head was satisfied justified giving the authorisation is recorded in writing; and (c) give to the responsible Minister: (i) a copy of the authorisation; and (ii) a summary of the facts of the case that the agency head was satisfied justified giving the authorisation; and (iii) an explanation of the Minister’s obligation under subsection (6); and (d) give to the Inspector‑General of Intelligence and Security the documents referred to in subparagraphs (c)(i) and (ii); and (e) if the Australian person is, or is likely to be, involved in an activity or activities that are, or are likely to be, a threat to security—give to the Attorney‑General and the Minister responsible for administering the Australian Security Intelligence Organisation Act 1979 (the ASIO Minister) the documents referred to in subparagraphs (c)(i) and (ii). Role of responsible Minister (6) The responsible Minister must, as soon as practicable after being given documents under paragraph (5)(c), consider whether to cancel the authorisation under subsection (10). (7) If the Attorney‑General is required to be given documents under paragraph (5)(e), the responsible Minister must have regard to any advice given by the Attorney‑General when making a decision under subsection (6). Role of Inspector‑General of Intelligence and Security (8) Within 30 days after the Inspector‑General of Intelligence and Security is given documents under paragraph (5)(d), the Inspector‑General must: (a) consider whether the agency head has complied with the requirements of this section; and (b) provide the responsible Minister with a report on the Inspector‑General’s views of the extent of the compliance by the agency head with the requirements of this section; and (c) provide to the Committee a copy of the conclusions in the report. Period of effect of authorisation (9) The authorisation ceases to have effect at the earliest of the following times: (a) the end of 6 months, starting on the day the authorisation is given; (b) if the authorisation specifies a time when the authorisation ceases to have effect—that time; (c) if the responsible Minister cancels the authorisation under subsection (10)—the time of cancellation; (d) if the agency head cancels the authorisation under subsection (12)—the time of cancellation; (e) if an authorisation for the activity, or series of activities, is given under section 9, 9A or 9B—the time the authorisation under section 9, 9A or 9B is given. Cancellation by responsible Minister (10) The responsible Minister may, in writing, cancel the authorisation. (11) If the responsible Minister cancels the authorisation under subsection (10), the Minister must, as soon as practicable, give written notice of the cancellation to: (a) the Inspector‑General of Intelligence and Security; and (b) if the Attorney‑General and the ASIO Minister are required to be given documents under paragraph (5)(e)—those Ministers. Cancellation by agency head (12) The agency head must, in writing, cancel the authorisation if the agency head is satisfied that: (a) there is not; and (b) there is not likely to be; a significant risk to the safety of the Australian person. > Note: The agency head may cancel the authorisation in other circumstances (see subsection 33(3) of the Acts Interpretation Act 1901). (13) If the agency head cancels the authorisation under subsection (12), the agency head must, as soon as practicable, give written notice of the cancellation to: (a) the responsible Minister; and (b) the Inspector‑General of Intelligence and Security; and (c) if the Attorney‑General and the ASIO Minister are required to be given documents under paragraph (5)(e)—those Ministers. Delegation (14) An agency head may, in writing, delegate to a staff member (other than a consultant or contractor) all or any of the powers, functions or duties of the agency head under this section. > Note: See sections 34AA, 34AB and 34A of the Acts Interpretation Act 1901 on delegations. (15) In exercising a power, performing a function or discharging a duty under a delegation under subsection (14), the delegate must comply with any written directions of the agency head. Relationship with the Acts Interpretation Act 1901 (16) To avoid doubt, this section does not limit subsection 33(3) of the Acts Interpretation Act 1901 to the extent that it applies to an authorisation given under this section. Status of instruments (17) The following are not legislative instruments: (a) an authorisation given in writing under subsection (2); (b) a written notice given under subsection (4), (11) or (13); (c) a record made, or a summary or explanation given, under subsection (5); (d) a report under subsection (8); (e) a cancellation under subsection (10) or (12). #### 10 Period during which authorisation given under section 9 has effect etc. Renewing authorisations (1) The Minister may, at any time before the day on which an authorisation given under section 9 would cease to have effect, renew it for the length of time specified in the renewal. However, the authorisation must not be renewed unless the Minister is satisfied that it is necessary, for the purpose for which the authorisation was given, for the authorisation to continue to have effect. (1A) The renewal (or any subsequent renewal) of an authorisation given under section 9 for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(i), (iaa), (ia), (ib), (ii) or (iii), must be for a period not exceeding 6 months. Varying or cancelling authorisations (2) The Minister may vary or cancel an authorisation given under section 9 at any time. (2A) If, before an authorisation is cancelled under subsection (2) or otherwise ceases to have effect, the relevant agency head is satisfied that the grounds on which the authorisation was given under section 9 have ceased to exist: (a) the agency head must inform the Minister accordingly, and must take the steps necessary to ensure that activities under the authorisation are discontinued; and (b) as soon as practicable after being so informed, the Minister must consider cancelling the authorisation under subsection (2). (2B) Without limiting subsection (2A), if an authorisation is given under section 9 for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(ia) or (ib), the grounds on which the authorisation was given cease to exist if: (a) the Defence Force is no longer engaged in any military operations to which the request for the authorisation relates; or (b) the Defence Minister withdraws the request for the authorisation. > Note: For the request for the authorisation, see paragraph 9(1)(d). (2C) For the purposes of subsection (2A), if an authorisation is given in reliance on an agreement that specifies a period in accordance with paragraph 9(1AB)(b), the grounds on which the authorisation was given are taken not to have ceased to exist merely because the period specified in the agreement ends. Renewal, variation or cancellation to be in writing (3) A renewal, variation or cancellation of an authorisation given under section 9 must be in writing. Relationship with the Acts Interpretation Act 1901 (4) To avoid doubt, this section does not limit subsection 33(3) of the Acts Interpretation Act 1901 to the extent that it applies to an authorisation given under section 9A or 9B. #### 10AA Additional requirements for class authorisations (1) This section applies if an authorisation is given to an agency under section 9 for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(iaa), (ia) or (ib) in relation to one or more members of a class of Australian persons. (2) The agency head must ensure that a list is kept that: (a) identifies each Australian person in relation to whom the agency intends to undertake activities, or a series of activities, under the authorisation; and (b) gives an explanation of the reasons why the agency believes the person is a member of the class; and (c) includes any other information that the agency head considers appropriate. > Note: For variation of the list, see subsection 33(3) of the Acts Interpretation Act 1901. (3) If: (a) the Attorney‑General’s agreement under subsection (1AAC) or (1AAD) was obtained in relation to the class of Australian persons mentioned in subsection (1); and (b) an Australian person who is a member of that class is included on the list; then the agency head must ensure that the Director‑General of Security is given, as soon as practicable: (c) a copy of the list; and (d) written notice that the Australian person was included on the list. (4) The agency head must ensure that the list is available for inspection on request by the Inspector‑General of Intelligence and Security. (5) The list and a notice under paragraph (3)(d) are not legislative instruments. #### 10A Agency heads must report on authorised activities (1) An agency head must give to the responsible Minister in relation to the agency a written report in respect of each activity, or series of activities, carried out by the agency in reliance on an authorisation under section 9, 9A, 9B or 9D. (2) The report must (subject to subsections (3) and (4)) be provided to the Minister within 3 months of the day on which the relevant authorisation ceased to have effect. (3) If the report is in respect of an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(iaa), (ia) or (ib), then: (a) the report must be provided to the Minister as soon as practicable, but no later than 3 months, after each of the following days: (i) the day on which the relevant authorisation ceased to have effect; (ii) the day on which the relevant authorisation was renewed; and (b) the report must be accompanied with a statement identifying every Australian person who was included on the list referred to in section 10AA during the period the authorisation was in effect. (4) If the report is in respect of an activity, or series of activities, carried out by the agency in reliance on an authorisation under section 9A, 9B or 9D, the report must be provided to the Minister as soon as practicable, but no later than 1 month, after the day on which the authorisation ceased to have effect. #### 11 Limits on agencies’ functions (1) The functions of the agencies are to be performed only in the interests of Australia’s national security, Australia’s foreign relations or Australia’s national economic well‑being and only to the extent that those matters are affected by the capabilities, intentions or activities of people or organisations outside Australia. (2) The agencies’ functions do not include: (a) the carrying out of police functions; or (b) any other responsibility for the enforcement of the law. However, this does not prevent the agencies from: (c) obtaining intelligence under paragraph 6(1)(a), 6B(1)(a), (b), or (c) or 7(1)(a) and communicating any such intelligence that is relevant to serious crime to the appropriate law enforcement authorities; or (d) in the case of ASIS—performing the function set out in paragraph 6(1)(da) or providing assistance as mentioned in subsection 6(7); or (e) in the case of AGO—performing the functions set out in paragraphs 6B(1)(e), (ea), (f) and (h); or (f) in the case of ASD—performing the functions set out in paragraphs 7(1)(c), (e) and (f). > Note: For police functions and serious crime see section 3. (2AA) An agency may communicate incidentally obtained intelligence to appropriate Commonwealth or State authorities or to authorities of other countries approved under paragraph 13(1)(c) if the intelligence relates to the involvement, or likely involvement, by a person in one or more of the following activities: (a) activities that present a significant risk to the safety of that person or any other person; (b) acting for, or on behalf of, a foreign power; (c) activities that are a threat to security; (d) activities related to the proliferation of weapons of mass destruction or the movement of goods listed from time to time in the Defence and Strategic Goods List (within the meaning of regulation 13E of the Customs (Prohibited Exports) Regulations 1958); (e) committing a serious crime. (2A) The agencies’ functions do not include undertaking any activity for the purpose of furthering the interests of an Australian political party or other Australian political organisation. (3) Subsection (1) does not apply to the functions described in paragraphs 6(1)(da), 6B(1)(b) to (h) and 7(1)(c), (ca), (d), (e) and (f). #### 12 Limits on agencies’ activities An agency must not undertake any activity unless the activity is: (a) necessary for the proper performance of its functions; or (b) authorised or required by or under another Act. #### 12A Special responsibilities of Director and Directors‑General The Director‑General of ASIS, the Director of AGO and the Director‑General of ASD must take all reasonable steps to ensure that: (a) his or her agency is kept free from any influences or considerations not relevant to the undertaking of activities as mentioned in paragraph 12(a) or (b); and (b) nothing is done that might lend colour to any suggestion that his or her agency is concerned to further or protect the interests of any particular section of the community, or with undertaking any activities other than those mentioned in paragraph 12(a) or (b). ### Division 2—Cooperation #### 13 Cooperation with other authorities in connection with performance of agency’s own functions (1) Subject to any arrangements made or directions given by the responsible Minister, an agency may cooperate with: (a) Commonwealth authorities; and (b) State authorities; and (c) authorities of other countries approved by the Minister as being capable of assisting the agency in the performance of its functions; so far as is necessary for the agency to perform its functions, or so far as facilitates the performance by the agency of its functions. > Note: For Commonwealth authority and State authority see section 3. Cooperating with authorities of other countries—with approval (1A) However, an approval under paragraph (1)(c) does not enable ASIS to cooperate with an authority of another country in planning or undertaking: (a) activities covered by paragraphs 6(4)(a) to (c); or (b) training in the use of weapons or in self‑defence techniques; unless, before giving the approval, the Minister consults with the Prime Minister and the Attorney‑General. (2) An approval under paragraph (1)(c) must be in writing. (3) Each agency head must ensure that a copy of any approval given by the relevant responsible Minister is kept by the agency and is available on request by the Inspector‑General of Intelligence and Security. Cooperating with authorities of other countries—AGO (3A) Despite paragraph (1)(c), subject to any arrangements made or directions given by the responsible Minister, AGO may, for the purposes of performing its functions under paragraph 6B(1)(e), (ea) or (h), cooperate with authorities of other countries if they are capable of assisting AGO in the performance of its functions. (3B) The Director of AGO must, as soon as practicable after each year ending on 30 June, give to the responsible Minister and the Inspector‑General of Intelligence and Security a report about any significant cooperation under subsection (3A) by AGO with authorities of other countries referred to in that subsection. Cooperating with authorities of other countries—ASD (4) Despite paragraph (1)(c), subject to any arrangements made or directions given by the responsible Minister, ASD may, for the purposes of performing its function under paragraph 7(1)(ca), cooperate with authorities of other countries if they are capable of assisting ASD in the performance of its functions. (5) The Director‑General of ASD must, as soon as practicable after each year ending on 30 June, give to the responsible Minister and the Inspector‑General of Intelligence and Security a report about any significant cooperation under subsection (4) by ASD with authorities of other countries referred to in that subsection. Reports by AGO and ASD (6) A report under subsection (3B) or (5): (a) must be in writing; and (b) is not a legislative instrument. #### 13A Cooperation with intelligence agencies etc. in connection with performance of their functions (1) An agency may cooperate with and assist the following bodies in the performance of their functions: (a) another agency; (b) ASIO; (ba) ONI; (c) a Commonwealth authority, or a State authority, that is prescribed by the regulations for the purposes of this paragraph. (2) However, the agency may only do so: (a) subject to any arrangements made or directions given by the responsible Minister; and (b) on request by the head (however described) of the body referred to in subsection (1). > Note: The Inspector‑General of Intelligence and Security has oversight powers in relation to Ministerial directions and authorisations given under this Act. See in particular section 32B of the Inspector‑General of Intelligence and Security Act 1986 (which requires the Minister to give a copy of a direction under this section to the Inspector‑General of Intelligence and Security as soon as practicable after the direction is given). (3) Without limiting subsection (1), in cooperating with and assisting a body in accordance with this section, an agency may make the services of staff members, and other resources, of the agency available to the body. ### Division 3—Activities undertaken in relation to ASIO #### 13B Activities undertaken in relation to ASIO When an activity may be undertaken in relation to ASIO (1) Subject to section 13D, ASIS may undertake an activity, or a series of activities, if: (a) the activity or series of activities will be undertaken for the specific purpose, or for purposes which include the specific purpose, of producing intelligence on an Australian person or a class of Australian persons; and (c) the activity or series of activities will be undertaken to support ASIO in the performance of its functions; and (d) either: (i) the Director‑General of Security; or (ii) a person who is authorised under section 13C for the purposes of this subparagraph; has, in writing, notified ASIS that ASIO requires the production of intelligence on the Australian person or class of Australian persons. (2) The undertaking of an activity or series of activities under subsection (1) is subject to any conditions specified in the notice under paragraph (1)(d). When ASIO notice is not required—particular activity outside Australia (3) Paragraph (1)(d) does not apply in relation to the undertaking of a particular activity in relation to a particular Australian person if: (a) the activity will be undertaken outside Australia; and (b) a staff member of ASIS who: (i) is authorised under subsection (7); and (ii) will be undertaking the activity; reasonably believes that it is not practicable in the circumstances for ASIO to notify ASIS in accordance with paragraph (1)(d) before undertaking the activity. (4) If ASIS undertakes an activity in accordance with subsection (3), ASIS must, as soon as practicable, notify ASIO and the Inspector‑General of Intelligence and Security, in writing, of the activity. Effect of this section (5) ASIS may undertake an activity or series of activities under subsection (1) without an authorisation under section 9 for the activity or series of activities. Incidental production of intelligence (6) An activity, or a series of activities, does not cease to be undertaken: (a) in accordance with this section; or (b) for the specific purpose of supporting ASIO in the performance of its functions; only because, in undertaking the activity or series of activities, ASIS also incidentally produces intelligence that relates to the involvement, or likely involvement, of an Australian person in one or more of the activities set out in subsection 9(1A). Authorised staff members (7) The Director‑General of ASIS may authorise, in writing, a staff member of ASIS, or a class of such staff members, for the purposes of paragraph (3)(a). Instruments not legislative instruments (8) The following are not legislative instruments: (a) a notice under paragraph (1)(d); (b) a notice under subsection (4); (c) an authorisation made under subsection (7). #### 13C Authorised persons for activities undertaken in relation to ASIO Authorised persons (1) The Director‑General of Security may authorise, in writing, a senior position‑holder, or a class of senior position‑holders, for the purposes of subparagraph 13B(1)(d)(ii). Authorisation is not a legislative instrument (2) An authorisation made under subsection (1) is not a legislative instrument. Definitions (3) For the purposes of this section, senior position‑holder has the same meaning as in the Australian Security Intelligence Organisation Act 1979. #### 13D Certain acts not permitted If ASIO could not undertake a particular act in at least one State or Territory without it being authorised by warrant under Division 2 of Part III of the Australian Security Intelligence Organisation Act 1979 or under Part 2‑2 of the Telecommunications (Interception and Access) Act 1979, this Division does not allow ASIS to undertake the act. #### 13E Director‑General of ASIS to be satisfied of certain matters The Director‑General of ASIS must be satisfied that: (a) there are satisfactory arrangements in place to ensure that activities will be undertaken in accordance with section 13B only for the specific purpose of supporting ASIO in the performance of its functions; and (b) there are satisfactory arrangements in place to ensure that the nature and consequences of acts done in accordance with section 13B will be reasonable, having regard to the purposes for which they are carried out. #### 13F Other matters relating to activities undertaken in relation to ASIO ASIO to be consulted before communicating intelligence (1) If, in undertaking an activity or series of activities in accordance with section 13B, ASIS produces intelligence, ASIS must not communicate the intelligence outside ASIS (other than in accordance with subsection (2)) unless ASIO has been consulted. Intelligence to be communicated to ASIO (2) If, in undertaking an activity or series of activities in accordance with section 13B, ASIS produces intelligence, ASIS must cause the intelligence to be communicated to ASIO as soon as practicable after the production. Notices to be made available to the Inspector‑General of Intelligence and Security (3) If a notice is given to ASIS under paragraph 13B(1)(d), the Director‑General of ASIS must ensure that a copy of the notice is kept by ASIS and is available for inspection on request by the Inspector‑General of Intelligence and Security. Reports about activities to be given to the responsible Minister (4) As soon as practicable after each year ending on 30 June, the Director‑General of ASIS must give to the responsible Minister in relation to ASIS a written report in respect of activities undertaken by ASIS in accordance with section 13B during the year. #### 13G Guidelines relating to activities undertaken in relation to ASIO (1) The responsible Minister in relation to ASIO and the responsible Minister in relation to ASIS may jointly make written guidelines relating to the undertaking of activities in accordance with section 13B. (1A) Before making guidelines under subsection (1), the responsible Ministers must consult with the Attorney‑General. (2) Guidelines made under subsection (1) are not a legislative instrument. ### Division 4—Other #### 14 Liability for certain acts (1) A staff member or agent of an agency is not subject to any civil or criminal liability for any act done outside Australia if the act is done in the proper performance of a function of the agency. (2) A person is not subject to any civil or criminal liability for any act (whether done inside or outside Australia) if: (a) the act is preparatory to, in support of, or otherwise directly connected with, overseas activities of the agency concerned; and (b) the act: (i) taken together with an act, event, circumstance or result that took place, or was intended to take place, outside Australia, could amount to an offence; but (ii) in the absence of that other act, event, circumstance or result, would not amount to an offence; and (c) the act is done in the proper performance of a function of the agency. (2A) Subsection (2) is not intended to permit any act in relation to premises, persons, computers, things, or telecommunications services in Australia, being: (a) an act that ASIO could not do without a Minister authorising it by warrant issued under Division 2 of Part III of the Australian Security Intelligence Organisation Act 1979 or under Part 2‑2 of the Telecommunications (Interception and Access) Act 1979; or (b) an act to obtain information that ASIO could not obtain other than in accordance with Division 3 of Part 4‑1 of the Telecommunications (Interception and Access) Act 1979. (2AA) Subsections (1) and (2) have effect despite anything in a law of the Commonwealth or of a State or Territory, whether passed or made before or after the commencement of this subsection, unless the law expressly provides otherwise. (2AB) Subsection (2AA) does not affect the operation of subsection (2A). (2B) The Inspector‑General of Intelligence and Security may give a certificate in writing certifying any fact relevant to the question of whether an act was done in the proper performance of a function of an agency. (2C) In any proceedings, a certificate given under subsection (2B) is prima facie evidence of the facts certified. (3) In this section: > act includes omission. > staff member includes the Director‑General of ASIS, the Director of AGO and the Director‑General of ASD. #### 15 Rules to protect privacy of Australians (1) The responsible Minister in relation to ASIS, the responsible Minister in relation to AGO and the responsible Minister in relation to ASD, must make written rules regulating the communication and retention by the relevant agency of intelligence information concerning Australian persons. (1A) The agencies must not communicate intelligence information concerning Australian persons, except in accordance with the rules. (2) In making the rules, the Minister must have regard to the need to ensure that the privacy of Australian persons is preserved as far as is consistent with the proper performance by the agencies of their functions. > Note: For Australian person see section 3. (3) Before making the rules, the Minister must consult with: (a) in the case of ASIS—the Director‑General of ASIS; and (ab) in the case of AGO—the Director of AGO; and (b) in the case of ASD—the Director‑General of ASD; and (c) in any case—the Inspector‑General of Intelligence and Security and the Attorney‑General. (4) For the purpose of consultations under paragraph (3)(c), the Minister must provide a copy of the rules the Minister is proposing to make to the Inspector‑General of Intelligence and Security and to the Attorney‑General. (5) The Minister must ensure that the rules are published on the relevant agency’s website as soon as practicable after the rules are made, except to the extent that the rules contain: (a) operationally sensitive information (within the meaning of Schedule 1); or (b) information that would or might prejudice: (i) Australia’s national security or the conduct of Australia’s foreign relations; or (ii) the performance by the relevant agency of its functions. (6) The Inspector‑General of Intelligence and Security must brief the Committee on the content and effect of the rules if: (a) the Committee requests the Inspector‑General of Intelligence and Security to do so; or (b) the rules change. > Note: For Committee see section 3. (7) Rules made under subsection (1) are not legislative instruments. ## Part 3—Establishment of ASIS and role of Director‑General of ASIS ### Division 1—Establishment and control of ASIS #### 16 Establishment of ASIS on a statutory basis (1) The organisation known as the Australian Secret Intelligence Service is continued in existence in accordance with this Act. (2) For the purposes of the finance law (within the meaning of the Public Governance, Performance and Accountability Act 2013): (a) ASIS is a listed entity; and (b) the Director‑General of ASIS is the accountable authority of ASIS; and (c) the following persons are officials of ASIS: (i) the Director‑General of ASIS; (ii) the staff of ASIS referred to in subsection 33(1); and (d) the purposes of ASIS include the functions of ASIS referred to in section 6. #### 17 Appointment of Director‑General of ASIS (1) There is to be a Director‑General of ASIS. (2) The Director‑General of ASIS is to be appointed by the Governor‑General. (3) Before a recommendation is made to the Governor‑General for the appointment of a person as Director‑General of ASIS, the Prime Minister must consult with the Leader of the Opposition in the House of Representatives. (4) The person who, immediately before the commencement of this Act, held office as the Director‑General of ASIS continues, subject to this Act, to hold the office for the remainder of the term for which he or she was appointed. #### 18 Control of ASIS (1) ASIS is under the control of the Director‑General of ASIS. (2) The Director‑General of ASIS, under the Minister, is responsible for managing ASIS and must advise the Minister in matters relating to ASIS. #### 19 Briefing the Leader of the Opposition about ASIS The Director‑General of ASIS must consult regularly with the Leader of the Opposition in the House of Representatives for the purpose of keeping him or her informed on matters relating to ASIS. ### Division 2—Administrative provisions relating to the Director‑General of ASIS #### 20 Period of appointment (1) The Director‑General of ASIS holds office for the period specified in the instrument of appointment, but is eligible for re‑appointment. (2) The period must not be longer than 5 years. #### 21 Remuneration etc. (1) The remuneration and other conditions of appointment of the Director‑General of ASIS are as determined in writing by the responsible Minister. (2) For each determination, the responsible Minister must seek the advice of the Remuneration Tribunal and take that advice into account. (3) Each determination must be published in the Gazette within 14 days after the determination is made. #### 22 Resignation The Director‑General of ASIS may resign by giving a signed notice of resignation to the Governor‑General. #### 23 Termination of appointment (1) The Governor‑General may terminate the appointment of the Director‑General of ASIS for misbehaviour or physical or mental incapacity. (2) The Governor‑General must terminate the appointment of the Director‑General of ASIS if: (a) the Director‑General: (i) becomes bankrupt; or (ii) applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or (iii) compounds with his or her creditors; or (iv) makes an assignment of his or her remuneration for the benefit of his or her creditors; or (b) the Director‑General is absent, except on leave of absence, for 14 consecutive days or for 28 days in any 12 months; or (c) the Director‑General engages, except with the Minister’s approval, in paid employment outside the duties of his or her office; or (d) the Director‑General fails, without reasonable excuse, to comply with section 29 of the Public Governance, Performance and Accountability Act 2013 (which deals with the duty to disclose interests) or rules made for the purposes of that section. (3) The Governor‑General may, with the Director‑General’s consent, retire the Director‑General of ASIS from office on the ground of incapacity if the Director‑General is: (a) an eligible employee for the purposes of the Superannuation Act 1976; or (b) a member of the superannuation scheme established by deed under the Superannuation Act 1990; or (c) an ordinary employer‑sponsored member of PSSAP, within the meaning of the Superannuation Act 2005. #### 24 Acting Director‑General of ASIS (1) The Minister may appoint a person to act as the Director‑General of ASIS if there is a vacancy in the office of the Director‑General. > Note: For rules that apply to acting appointments, see section 33A of the Acts Interpretation Act 1901. (2) The Minister may appoint a person to act as the Director‑General of ASIS during any period, or during all periods, when the Director‑General is absent from duty or from Australia or is, for any reason, unable to perform the duties of the office. > Note: For rules that apply to acting appointments, see section 33A of the Acts Interpretation Act 1901. #### 25 Outside employment The Director‑General of ASIS must not engage in paid employment that, in the Minister’s opinion, conflicts or may conflict with the proper performance of the Director‑General’s duties. #### 27 Delegation (1) Subject to subsection 41AB(8), the Director‑General of ASIS may delegate to a staff member (other than a consultant or contractor) all or any of the powers of the Director‑General that relate to the management of the staff of ASIS or the financial management of ASIS. > Note: See sections 34AA, 34AB and 34A of the Acts Interpretation Act 1901 on delegations. (2) The delegation must be in writing. ## Part 3A—Establishment of ASD and role of Director‑General of ASD ### Division 1—Establishment and control of ASD #### 27A Establishment of ASD on a statutory basis (1) The organisation known as the Australian Signals Directorate is continued in existence in accordance with this Act. > Note: The Australian Signals Directorate provides assistance to the Defence Force in support of military operations and cooperates with the Defence Force on intelligence matters: see paragraph 7(1)(d). (2) For the purposes of the finance law (within the meaning of the Public Governance, Performance and Accountability Act 2013): (a) ASD is a listed entity; and (b) the Director‑General of ASD is the accountable authority of ASD; and (c) the following persons are officials of ASD: (i) the Director‑General of ASD; (ii) the staff referred to in section 38A; (iii) consultants engaged under section 38B; (iv) employees of contracted service providers engaged under section 38C who are providing services under the relevant ASD contract; (v) persons whose services are made available to ASD under section 38E; and (d) the purposes of ASD include the functions of ASD referred to in section 7. #### 27B Appointment of Director‑General of ASD (1) There is to be a Director‑General of ASD. (2) The Director‑General of ASD is to be appointed by the Governor‑General by written instrument. > Note: The Director‑General of ASD may be reappointed: see section 33AA of the Acts Interpretation Act 1901. (3) Before a recommendation is made to the Governor‑General for the appointment of a person as Director‑General of ASD, the Prime Minister must consult with the Leader of the Opposition in the House of Representatives. #### 27C Control of ASD (1) ASD, and the staff referred to in subsection 38A(1), are under the control of the Director‑General of ASD. (2) The Director‑General of ASD, under the Minister, is responsible for managing ASD and must advise the Minister in matters relating to ASD. #### 27D Briefing the Leader of the Opposition about ASD The Director‑General of ASD must consult regularly with the Leader of the Opposition in the House of Representatives for the purpose of keeping him or her informed on matters relating to ASD. ### Division 2—Administrative provisions relating to the Director‑General of ASD #### 27E Basis and period of appointment (1) The Director‑General of ASD holds office on a full‑time basis. (2) The Director‑General of ASD holds office for the period specified in the instrument of appointment. The period must not exceed 5 years. #### 27F Remuneration (1) The Director‑General of ASD is to be paid the remuneration that is determined by the Remuneration Tribunal. If no determination of that remuneration by the Tribunal is in operation, the Director‑General is to be paid the remuneration that is prescribed by the regulations. (2) The Director‑General of ASD is to be paid the allowances that are prescribed by the regulations. (3) This section has effect subject to the Remuneration Tribunal Act 1973. #### 27G Resignation (1) The Director‑General of ASD may resign his or her appointment by giving the Governor‑General a written resignation. (2) The resignation takes effect on the day it is received by the Governor‑General or, if a later day is specified in the resignation, on that later day. #### 27H Termination of appointment (1) The Governor‑General may terminate the appointment of the Director‑General of ASD: (a) for misbehaviour; or (b) if the Director‑General is unable to perform the duties of his or her office because of physical or mental incapacity. (2) The Governor‑General must terminate the appointment of the Director‑General of ASD if: (a) the Director‑General: (i) becomes bankrupt; or (ii) applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or (iii) compounds with his or her creditors; or (iv) makes an assignment of his or her remuneration for the benefit of his or her creditors; or (b) the Director‑General is absent, except on leave of absence, for 14 consecutive days or for 28 days in any 12 months; or (c) the Director‑General engages in paid work that, in the Minister’s opinion, conflicts or may conflict with the proper performance of the Director‑General’s duties (see section 27L); or (d) the Director‑General lacks, or has lost, an essential qualification for performing the duties of his or her office. > Note: The appointment of the Director‑General of ASD may also be terminated under section 30 of the Public Governance, Performance and Accountability Act 2013 (which deals with terminating the appointment of an accountable authority, or a member of an accountable authority, for contravening general duties of officials). (3) The Governor‑General may, with the Director‑General of ASD’s consent, retire the Director‑General from office on the ground of incapacity if the Director‑General is: (a) an eligible employee for the purposes of the Superannuation Act 1976; or (b) a member of the superannuation scheme established by deed under the Superannuation Act 1990; or (c) an ordinary employer‑sponsored member of PSSAP, within the meaning of the Superannuation Act 2005. #### 27J Acting appointments Appointment generally (1) The Minister may, by written instrument, appoint a person to act as the Director‑General of ASD: (a) during a vacancy in the office of the Director‑General (whether or not an appointment has previously been made to the office); or (b) during any period, or during all periods, when the Director‑General: (i) is absent from duty or from Australia; or (ii) is, for any reason, unable to perform the duties of the office. > Note: For rules that apply to acting appointments, see sections 33AB and 33A of the Acts Interpretation Act 1901. Appointment while under command (2) If: (a) a person is appointed to act as the Director‑General of ASD under subsection (1); and (b) the person is under the command of the Chief of the Defence Force under the Defence Act 1903; then, the person must perform the duties of the office of the Director‑General consistently with this Act during the period of the appointment, even though the person is under the command of the Chief of the Defence Force. #### 27K Leave of absence (1) A Director‑General of ASD has the recreation leave entitlements that are determined by the Remuneration Tribunal. (2) The Minister may grant the Director‑General of ASD leave of absence, other than recreation leave, on the terms and conditions as to remuneration or otherwise that the Minister determines. #### 27L Outside employment The Director‑General of ASD must not engage in paid work that, in the Minister’s opinion, conflicts or may conflict with the proper performance of the Director‑General’s duties. #### 27M Other terms and conditions The Director‑General of ASD holds office on the terms and conditions (if any) in relation to matters not covered by this Act that are determined by the Minister. #### 27N Delegation by Director‑General of ASD (1) The Director‑General of ASD may, in writing, delegate all or any of his or her functions or powers under Part 5A to a staff member who holds, or is acting in, a position that is an Executive Level 1 position, or an equivalent or higher position, in ASD. (2) In performing a delegated function or exercising a delegated power, the delegate must comply with any written directions of the Director‑General of ASD. ## Part 4—Committee on Intelligence and Security #### 28 Committee on Intelligence and Security (1) A Committee to be known as the Parliamentary Joint Committee on Intelligence and Security is to be established after the commencement of the first session of each Parliament. (2) The Committee is to consist of 13 members and must include at least: (a) 2 Senators who are Government members; and (b) 2 members of the House of Representatives who are Government members; and (c) 2 Senators who are non‑Government members; and (d) 2 members of the House of Representatives who are non‑Government members. (3) A majority of the Committee’s members must be Government members. > Note: For more detailed provisions on the appointment of members see Part 3 of Schedule 1. #### 29 Functions of the Committee (1) The functions of the Committee are: (a) to review the administration and expenditure of ASIO, ASIS, AGO, DIO, ASD and ONI, including the annual financial statements of ASIO, ASIS, AGO, DIO, ASD and ONI; and (b) to review any matter in relation to ASIO, ASIS, AGO, DIO, ASD or ONI referred to the Committee by: (i) the responsible Minister; or (ia) the Attorney‑General; or (ii) a resolution of either House of the Parliament; and (baa) to monitor and to review the performance by the AFP of its functions under Part 5.3 of the Criminal Code; and (bab) to report to both Houses of the Parliament, with such comments as it thinks fit, upon any matter appertaining to the AFP or connected with the performance of its functions under Part 5.3 of the Criminal Code to which, in the opinion of the Committee, the attention of the Parliament should be directed; and (bac) to inquire into any question in connection with its functions under paragraph (baa) or (bab) that is referred to it by either House of the Parliament, and to report to that House upon that question; and (bb) to review, by 7 January 2021, the operation, effectiveness and implications of the following: (i) Division 3A of Part IAA of the Crimes Act 1914 (which provides for police powers in relation to terrorism) and any other provision of the Crimes Act 1914 as it relates to that Division; (ii) Divisions 104 and 105 of the Criminal Code (which provide for control orders and preventative detention orders in relation to terrorism) and any other provision of the Criminal Code Act 1995 as it relates to those Divisions; and (bbaaa) to commence a review, within the period of 12 months after the Independent National Security Legislation Monitor completes a review under subsection 6(1C) of the Independent National Security Legislation Monitor Act 2010, into the operation, effectiveness and implications of Division 105A of the Criminal Code (which provides for post‑sentence orders in relation to terrorism) and any other provision of the Criminal Code Act 1995 as it relates to that Division; and (bba) to monitor and review: (i) the performance by the AFP of its functions under Division 3A of Part IAA of the Crimes Act 1914; and (ii) the basis of the Minister’s declarations of prescribed security zones under section 3UJ of that Act; and (bc) to conduct the review under section 187N of the Telecommunications (Interception and Access) Act 1979; and (bcaa) if the Committee resolves to do so—to commence, as soon as practicable after the fourth anniversary of the day the Surveillance Legislation Amendment (Identify and Disrupt) Act 2021 receives the Royal Assent, a review of the operation, effectiveness and implications of the amendments made by Schedules 1, 2 and 3 to that Act; and (bca) to review, by 30 September 2020, the operation of the amendments made by the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 and to give a written report of the review to the Minister administering the Telecommunications (Interception and Access) Act 1979; and (bd) subject to subsection (5), to review any matter that: (i) relates to the retained data activities of ASIO; and (ii) is included, under paragraph 94(2A)(c), (d), (e), (f), (g), (h), (i) or (j) of the Australian Security Intelligence Organisation Act 1979, in a report referred to in subsection 94(1) of that Act; and (be) subject to subsection (5), to review any matter that: (i) relates to the retained data activities of the AFP in relation to offences against Part 5.3 or 5.3A of the Criminal Code; and (ii) is set out, under paragraph 186(1)(e), (f), (g), (h), (i), (j) or (k) of the Telecommunications (Interception and Access) Act 1979, in a report under subsection 186(1) of that Act; and (bf) to commence, by the earlier of the following: (i) the fifth anniversary of the day on which Schedule 1 to the Telecommunications (Interception and Access) Act 1979 commences; (ii) the third anniversary of the day on which the first designated international agreement (within the meaning of that Schedule) enters into force for Australia; a review of the operation, effectiveness and implications of that Schedule; and (ca) to commence, by the third anniversary of the day the Australian Citizenship Amendment (Citizenship Cessation) Act 2020 commenced, a review of the operation, effectiveness and implications of Subdivision C of Division 3 of Part 2 of the Australian Citizenship Act 2007 (citizenship cessation determinations) and any other provision of that Act as far as it relates to that Subdivision; and (cb) if the Committee resolves to do so—to commence a review, after the Independent National Security Legislation Monitor completes the review under subsection 6(1F) of the Independent National Security Legislation Monitor Act 2010, into the operation, effectiveness and implications of: (i) Subdivision C of Division 3 of Part 2 of the Australian Citizenship Act 2007 (which deals with citizenship cessation); and (ii) any other provision of that Act as far as it relates to that Subdivision; and (cc) to review, by the end of the period of 3 years beginning on the day the Counter‑Terrorism (Temporary Exclusion Orders) Act 2019 commenced, the operation, effectiveness and implications of that Act; and (cd) to monitor and review the exercise of powers under the Counter‑Terrorism (Temporary Exclusion Orders) Act 2019 by the Minister administering that Act; and (ce) if the Committee resolves to do so—to commence, by 7 September 2023, a review of the operation, effectiveness and implications of Division 3 of Part III of the Australian Security Intelligence Organisation Act 1979; and (cf) to commence, by the second anniversary of the commencement of the Migration Amendment (Clarifying International Obligations for Removal) Act 2021, a review of the operation, effectiveness and implications of the amendments made by Schedule 1 to that Act; and (cfa) to commence, as soon as practicable after the second anniversary of the day that Part 1 of Schedule 1 to the Combatting Antisemitism, Hate and Extremism (Criminal and Migration Laws) Act 2026 commenced, a review of the operation, effectiveness and implications of the amendments made by that Part, including the following: (i) the operation and interpretation of the expressions “spiritual leader” and “another leader” in the offences in section 80.2DA of the Criminal Code; (ii) whether those offences have operated effectively, proportionately and consistently with their intended purpose; (iii) any impact of those offences on freedom of expression, freedom of religion or freedom of association; (iv) whether any amendments are required to ensure those offences operate appropriately to address antisemitism, hate and extremism while remaining consistent with Australia’s international obligations; (v) a consideration of all relevant data from each agency (within the meaning of clause 1A of Schedule 1 to this Act); and (cfb) to commence, as soon as practicable after the second anniversary of the day that Part 4 of Schedule 1 to the Combatting Antisemitism, Hate and Extremism (Criminal and Migration Laws) Act 2026 commenced, a review of the operation, effectiveness and implications of the amendments made by that Part, including the following: (i) whether the amendments made by that Part are necessary and proportionate to address antisemitism, hate and extremism; (ii) any impact of those amendments on freedom of expression, freedom of religion or freedom of association; (iii) the practical operation of those amendments, including action taken by law enforcement and prosecuting agencies; (iv) whether any amendments are required to ensure the provisions inserted or amended by that Part operate effectively while remaining consistent with Australia’s international obligations; and (cg) to review the privacy rules made under section 15 of this Act; and (ch) to review the privacy rules made under section 41C of this Act; and (ci) to review the privacy rules made under section 53 of the Office of National Intelligence Act 2018; and (c) to report the Committee’s comments and recommendations to each House of the Parliament, to the responsible Minister and to the Attorney‑General. (2) The Committee may, by resolution, request the responsible Minister or the Attorney‑General to refer a matter in relation to the activities of ASIO, ASIS, AGO, DIO, ASD or ONI (as the case may be) to the Committee, and the Minister or the Attorney‑General may, under paragraph (1)(b), refer that matter to the Committee for review. (3) The functions of the Committee do not include: (aa) reviewing anything done by ONI in its leadership of the national intelligence community, to the extent that it involves prioritising national intelligence priorities and requirements, and allocating resources accordingly, in relation to: (i) an intelligence agency (as defined by subsection 4(1) of the Office of National Intelligence Act 2018); or (ii) an agency with an intelligence role or function (as defined by subsection 4(1) of that Act); or (ab) reviewing anything done by ONI in its leadership of the national intelligence community, to the extent that it relates to: (i) an intelligence agency (as defined by subsection 4(1) of the Office of National Intelligence Act 2018) and a matter that would otherwise be covered by any of the following paragraphs of this subsection; or (ii) an agency with an intelligence role or function (as defined by subsection 4(1) of that Act) and a matter that would otherwise be covered by any of the following paragraphs of this subsection if those paragraphs applied to the agency; or (a) reviewing the intelligence gathering and assessment priorities of ASIO, ASIS, AGO, DIO, ASD or ONI; or (b) reviewing the sources of information, other operational assistance or operational methods available to ASIO, ASIS, AGO, DIO, ASD or ONI; or (c) reviewing particular operations that have been, are being or are proposed to be undertaken by ASIO, ASIS, AGO, DIO or ASD; or (d) reviewing information provided by, or by an agency of, a foreign government where that government does not consent to the disclosure of the information; or (e) reviewing an aspect of the activities of ASIO, ASIS, AGO, DIO, ASD or ONI that does not affect an Australian person; or (f) reviewing compliance by ASIS, AGO and ASD with the privacy rules made under section 15 of this Act; or (faa) reviewing compliance by DIO with the privacy rules made under section 41C of this Act; or (fa) reviewing compliance by ONI with the privacy rules made under section 53 of the Office of National Intelligence Act 2018; or (g) conducting inquiries into individual complaints about the activities of ASIO, ASIS, AGO, DIO, ASD, ONI, AFP or the Immigration and Border Protection Department; or (h) reviewing the content of, or conclusions reached in, assessments or reports made by DIO or ONI, or reviewing sources of information on which such assessments or reports are based; or (i) reviewing anything done by ONI in carrying out the evaluation functions mentioned in section 9 of the Office of National Intelligence Act 2018; or (j) reviewing sensitive operational information or operational methods available to the AFP; or (k) reviewing particular operations or investigations that have been, are being or are proposed to be undertaken by the AFP. > Note: For Australian person see section 3. (4) Subject to subsection (5), paragraphs (3)(c) and (k) do not apply to things done in the performance of the Committee’s functions under paragraphs (1)(bd) and (be). (5) The Committee’s functions under paragraphs (1)(bd) and (be): (a) are to be performed for the sole purpose of assessing, and making recommendations on, the overall operation and effectiveness of Part 5‑1A of the Telecommunications (Interception and Access) Act 1979; and (b) do not permit reviewing the retained data activities of service providers; and (c) may not be performed for any purpose other than that set out in paragraph (a). > Note: The performance of the Committee’s functions under paragraphs (1)(bd) and (be) are also subject to the requirements of Schedule 1. #### 30 Agency heads and Inspector‑General of Intelligence and Security to brief the Committee For the purpose of performing its functions, the Committee may request the following people to brief the Committee: (a) the Director‑General of Security; (b) the Director‑General of ASIS; (baa) the Director of AGO; (bab) the Director of DIO; (ba) the Director‑General of ASD; (bb) the Director‑General of National Intelligence; (c) the Inspector‑General of Intelligence and Security; (d) the Commissioner of the AFP; (e) the Secretary of the Immigration and Border Protection Department. > Note: The Committee cannot require anyone briefing the Committee to disclose operationally sensitive information (see clause 1 of Schedule 1). #### 31 Annual report As soon as practicable after each year ending on 30 June, the Committee must give to the Parliament a report on the activities of the Committee during the year. #### 32 Schedule 1 Schedule 1 contains further provisions about the Committee. ## Part 5—Staff of ASIS #### 33 Employment of staff (1) The Director‑General of ASIS may, on behalf of the Commonwealth, employ by written agreement such employees of ASIS as the Director‑General thinks necessary for the purposes of this Act. (2) The Director‑General of ASIS, on behalf of the Commonwealth, has all the rights, duties and powers of an employer in respect of the engagement, and employment, of employees of ASIS. (3) The Director‑General of ASIS may determine the terms and conditions on which employees are to be employed. Before making a determination the Director‑General must consult with the employees who are to be subject to the terms and conditions of the determination. #### 34 Engagement of consultants (1) The Director‑General of ASIS may, on behalf of the Commonwealth, engage as consultants persons having suitable qualifications and experience. (2) The engagement of a consultant must be by written agreement. (3) The terms and conditions of engagement are those determined by the Director‑General of ASIS from time to time. #### 35 Applicability of principles of Public Service Act 1999 Although employees of ASIS are not employed under the Public Service Act 1999, the Director‑General of ASIS must adopt the principles of that Act in relation to employees of ASIS to the extent to which the Director‑General considers they are consistent with the effective performance of the functions of ASIS. #### 36 Special provisions relating to existing staff A person who, immediately before the commencement of this Act, was employed in ASIS under a written agreement continues to be employed on the terms and conditions specified in that agreement, unless he or she agrees to accept other terms and conditions. #### 36A Voluntary moves to APS (1) Section 26 of the Public Service Act 1999 applies in relation to an employee of ASIS as if the employee were an APS employee and ASIS were an APS Agency. (2) An employee of ASIS who moves to an APS Agency under that section is entitled to have his or her employment, as an employee of ASIS, treated as if it were: (a) employment as an APS employee; and (b) at a corresponding classification, as agreed between the Director‑General of ASIS and the Public Service Commissioner. #### 37 Staff grievances (1) The Director‑General of ASIS must: (a) establish procedures relating to the consideration of grievances of employees and former employees of ASIS; and (b) determine the classes of ASIS actions that are to be subject to the grievance procedures. (2) In establishing the procedures and determining the classes of action, the Director‑General of ASIS must: (a) adopt the principles of the Public Service Act 1999 to the extent to which the Director‑General considers they are consistent with the effective performance of the functions of ASIS; and (b) consult with the employees of ASIS. (3) The procedures must include the following matters: (a) initial consideration of grievances by the Director‑General of ASIS or a person authorised in writing by the Director‑General; (b) establishment of Grievance Review Panels chaired by independent Chairs to make determinations reviewing initial considerations of grievances. (4) The Director‑General of ASIS must implement a determination of a Grievance Review Panel to the extent that it is within his or her power to do so. (5) In this section: > action includes a refusal or failure to act. > ASIS action means action taken after the commencement of this Act by the Director‑General of ASIS or an employee of ASIS that relates to an ASIS employee’s employment. #### 38 Application of Crimes Act The Director‑General of ASIS and staff members of ASIS are Commonwealth officers for the purposes of the Crimes Act 1914. ## Part 5A—Staff of ASD #### 38A Employment of staff Employees (1) The Director‑General of ASD may, on behalf of the Commonwealth, employ by written agreement such employees of ASD as the Director‑General thinks necessary for the purposes of this Act. (2) The Director‑General of ASD, on behalf of the Commonwealth, has all the rights, duties and powers of an employer in respect of the engagement, and employment, of employees of ASD. (3) The Director‑General of ASD may determine the terms and conditions on which employees are to be employed. Before making a determination the Director‑General must consult with the employees who are to be subject to the terms and conditions of the determination. Termination of employment (4) The Director‑General of ASD may, at any time, by written notice, terminate the employment of a person employed under subsection (1). > Note: The Fair Work Act 2009 has rules and entitlements that apply to termination of employment. #### 38B Consultants (1) The Director‑General of ASD may, on behalf of the Commonwealth, engage as consultants persons having suitable qualifications and experience to assist in the performance of ASD’s functions. (2) The engagement of a consultant must be by written agreement. (3) The terms and conditions of engagement are those that the Director‑General of ASD determines in writing. #### 38C Contracted service providers (1) The Director‑General of ASD may, on behalf of the Commonwealth, engage a contracted service provider to assist in the performance of the ASD’s functions. (2) The engagement of a contracted service provider must be by written agreement. (3) The terms and conditions of engagement are those that the Director‑General of ASD determines in writing. #### 38D Secondment of employees of ASD Secondment (1) The Director‑General of ASD may, in writing, arrange for an employee of ASD to be seconded for a specified period to a body or organisation whether within or outside Australia. Termination of secondment (2) The Director‑General may at any time, by notice given to the body or organisation to which an employee of ASD is seconded under subsection (1), terminate the secondment. #### 38E Secondment of persons to ASD (1) The Director‑General of ASD may, by written agreement with a body or organisation (whether within or outside Australia), arrange for a person who is an officer, employee or other member of staff of the body or organisation to be made available to ASD to perform services in connection with the performance of its functions or the exercise of its powers. (2) The terms and conditions (including remuneration and allowances) applicable to a person performing services under an agreement are those specified in the agreement. #### 38F Applicability of principles of the Public Service Act 1999 Although employees of ASD are not employed under the Public Service Act 1999, the Director‑General of ASD must adopt the principles of that Act in relation to employees of ASD to the extent to which the Director‑General considers they are consistent with the effective performance of the functions of ASD. #### 38G Voluntary moves to APS (1) Section 26 of the Public Service Act 1999 applies in relation to an employee of ASD as if the employee were an APS employee and ASD were an APS Agency. (2) An employee of ASD who moves to an APS Agency under that section is entitled to have his or her employment, as an employee of ASD, treated as if it were: (a) employment as an APS employee; and (b) at a corresponding classification, as agreed between the Director‑General of ASD and the Public Service Commissioner. #### 38H Staff grievances (1) The Director‑General of ASD must: (a) establish procedures relating to the consideration of grievances of employees and former employees of ASD; and (b) determine the classes of ASD actions that are to be subject to the grievance procedures. (2) In establishing the procedures and determining the classes of action, the Director‑General of ASD must: (a) adopt the principles of the Public Service Act 1999 to the extent to which the Director‑General considers they are consistent with the effective performance of the functions of ASD; and (b) consult with the employees of ASD. (3) In this section: > action includes a refusal or failure to act. > ASD action means action taken after the commencement of this section by the Director‑General of ASD or an employee of ASD that relates to the employment of an employee of ASD. ## Part 6—Miscellaneous ### Division 1—Secrecy #### 39 Communication of certain information—ASIS, AGO, DIO and ASD (1) A person commits an offence if: (a) the person communicates any information or matter that was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency) in connection with its functions, or relates to the performance by the relevant agency of its functions; and (b) the information or matter has come to the knowledge or into the possession of the person by reason of the person: (i) being, or having been, a staff member of the relevant agency or an agent of ASIS; or (ii) having entered into any contract, agreement or arrangement with the relevant agency; or (iii) having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and (c) the communication was not made: (i) to the head of the relevant agency or a staff member of the relevant agency by the person in the course of the person’s duties as a staff member; or (ii) to the head of the relevant agency or a staff member of the relevant agency by the person in accordance with a contract, agreement or arrangement; or (iii) by the person in the course of the person’s duties as a staff member or agent, within the limits of authority conferred on the person by the head of the relevant agency; or (iv) with the approval of the head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency to give such an approval. Penalty: Imprisonment for 10 years. Exception—information or matter lawfully available (2) Subsection (1) does not apply to information or matter that has already been communicated or made available to the public with the authority of the Commonwealth. > Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code. Exception—IGIS officials (3) Subsection (1) does not apply if the person communicates the information or matter to an IGIS official for the purpose of the IGIS official exercising a power, or performing a function or duty, as an IGIS official. > Note: A defendant bears an evidential burden in relation to the matter in subsection (3): see subsection 13.3(3) of the Criminal Code. Definitions (4) In this section: > head of the relevant agency means: (a) in relation to ASIS, AGO or ASD—the agency head of the agency; or (b) in relation to DIO—the Director of DIO. #### 40C Unauthorised dealing with records—ASIS, AGO, DIO and ASD (1) A person commits an offence if: (a) the person engages in any of the following conduct (the relevant conduct): (i) copying a record; (ii) transcribing a record; (iii) retaining a record; (iv) removing a record; (v) dealing with a record in any other manner; and (b) the record was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency) in connection with its functions, or relates to the performance by the relevant agency of its functions; and (c) the record was obtained by the person by reason of the person: (i) being, or having been, a staff member of the relevant agency or an agent of ASIS; or (ii) having entered into any contract, agreement or arrangement with the relevant agency; or (iii) having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and (d) the relevant conduct was not engaged in: (i) in the course of the person’s duties as a staff member or agent; or (ii) in accordance with a contract, agreement or arrangement with the relevant agency; or (iii) by the person acting within the limits of authority conferred on the person by the head of the relevant agency; or (iv) with the approval of the head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency to give such an approval. Penalty: Imprisonment for 3 years. Exception—record lawfully available (2) Subsection (1) does not apply to a record that has already been communicated or made available to the public with the authority of the Commonwealth. > Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code. Exception—IGIS officials (2A) Subsection (1) does not apply if the person deals with the record for the purpose of an IGIS official exercising a power, or performing a function or duty, as an IGIS official. > Note: A defendant bears an evidential burden in relation to the matter in subsection (2A): see subsection 13.3(3) of the Criminal Code. Alternative verdict (3) Subsection (4) applies if, in a prosecution for an offence (the prosecuted offence) against subsection (1), the trier of fact: (a) is not satisfied that the defendant is guilty of the prosecuted offence; but (b) is satisfied beyond reasonable doubt that the defendant is guilty of an offence against subsection 40D(1) (the alternative offence). (4) The trier of fact may find the defendant not guilty of the prosecuted offence but guilty of the alternative offence, so long as the defendant has been accorded procedural fairness in relation to that finding of guilt. Definitions (5) In this section: > head of the relevant agency has the same meaning as in section 39. #### 40D Unauthorised recording of information or matter—ASIS, AGO, DIO and ASD (1) A person commits an offence if: (a) the person makes a record of any information or matter; and (b) the information or matter was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency) in connection with its functions, or relates to the performance by the relevant agency of its functions; and (c) the information or matter has come to the knowledge or into the possession of the person by reason of the person: (i) being, or having been, a staff member of the relevant agency or an agent of ASIS; or (ii) having entered into any contract, agreement or arrangement with the relevant agency; or (iii) having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and (d) the record was not made: (i) in the course of the person’s duties as a staff member or agent; or (ii) in accordance with a contract, agreement or arrangement with the relevant agency; or (iii) by the person acting within the limits of authority conferred on the person by the head of the relevant agency; or (iv) with the approval of the head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency to give such an approval. Penalty: Imprisonment for 3 years. Exception—information or matter lawfully available (2) Subsection (1) does not apply to information or matter that has already been communicated or made available to the public with the authority of the Commonwealth. > Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code. Exception—IGIS officials (2A) Subsection (1) does not apply if the person makes the record for the purpose of an IGIS official exercising a power, or performing a function or duty, as an IGIS official. > Note: A defendant bears an evidential burden in relation to the matter in subsection (2A): see subsection 13.3(3) of the Criminal Code. Alternative verdict (3) Subsection (4) applies if, in a prosecution for an offence (the prosecuted offence) against subsection (1), the trier of fact: (a) is not satisfied that the defendant is guilty of the prosecuted offence; but (b) is satisfied beyond reasonable doubt that the defendant is guilty of an offence against subsection 40C(1) (the alternative offence). (4) The trier of fact may find the defendant not guilty of the prosecuted offence but guilty of the alternative offence, so long as the defendant has been accorded procedural fairness in relation to that finding of guilt. Definitions (5) In this section: > head of the relevant agency has the same meaning as in section 39. #### 41 Publication of identity of staff (1) A person commits an offence: (a) if: (i) the person identifies a person as being, or having been, an agent or staff member of ASIS; and (ii) the identification is not of the Director‑General of ASIS or such other persons as the Director‑General of ASIS determines; or (b) if: (i) the person makes public any information from which the identity of such a person could reasonably be inferred, or any information that could reasonably lead to the identity of such a person being established; and (ii) the Minister or Director‑General of ASIS has not consented in writing to the information being made public; and (iii) the information has not been made public by means of broadcasting or reporting proceedings of the Parliament (other than proceedings of the Committee) as authorised by the Parliament. Penalty: Imprisonment for 10 years. > Note: For staff member see section 3. Exception—IGIS officials (2) Paragraph (1)(a) does not apply if the person identifies the person to an IGIS official, for the purpose of the IGIS official exercising a power, or performing a function or duty, as an IGIS official. > Note: A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code. #### 41AA Cover employment for ASIS and ASD staff members (1) A person who is a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, may identify a Commonwealth authority as that person’s employer or place of work, in relation to a period during which the person is or was a staff member of that agency, in accordance with a determination made by the relevant agency head under subsection 41AB(1). (2) Subsection (1) applies despite any other law of the Commonwealth, a State or a Territory (whether passed or made before, on or after the commencement of this section), including such other law that is expressed to apply despite any other law. #### 41AB Cover employment—determining a specified Commonwealth authority Determining specified Commonwealth authority (1) Subject to subsection (5), the agency head of ASIS or ASD may, in writing, determine one or more specified Commonwealth authorities, within the meaning of paragraphs (a), (b), (c) and (d) of the definition of Commonwealth authority in subsection 3(1), that may be identified as the employer or place of work of staff members or former staff members of that agency. > Note: For variation and revocation of an instrument, see subsection 33(3) of the Acts Interpretation Act 1901. (2) Without limiting subsection (1), a determination under that subsection may do either or both of the following: (a) determine a specified Commonwealth authority in relation to a specified class of staff members or former staff members of the agency; (b) specify limitations or restrictions in relation to the identification of a specified Commonwealth authority as the employer or place of work of staff members or former staff members of the agency. (3) To avoid doubt, and without limiting subsection (1) or (2), if a determination under subsection (1) determines a specified Commonwealth authority in relation to a class of staff members or former staff members of the agency holding, occupying or performing the duties of a specified office or position, the class includes such an office or position that comes into existence after the determination is made. (4) Subsection (3) does not, by implication, affect the interpretation of any other provision of this Act. (5) The agency head must not determine a specified Commonwealth authority under subsection (1) unless the head of that authority has agreed, in writing, to the authority being so determined. (6) To avoid doubt, the Chief of the Defence Force (within the meaning of the Defence Act 1903) is the head of the Defence Force for the purposes of subsection (5). > Note: The Defence Force is a Commonwealth authority: see paragraph (c) of the definition of Commonwealth authority in subsection 3(1). (7) The following are not legislative instruments: (a) a determination under subsection (1); (b) an agreement under subsection (5). Delegation (8) The agency head of ASIS or ASD may, in writing, delegate the agency head’s powers or duties under this section to a staff member of that agency who holds or is acting in a position in the agency that is equivalent to or higher than a position occupied by an SES employee with a classification of SES Band 3. (9) In exercising powers or discharging duties under a delegation under subsection (8), the delegate must comply with any written direction given by the agency head to the delegate. #### 41AC Protection from criminal liability—third parties (1) If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if: (a) the person is a staff member of any Commonwealth authority (see subsection (3)); and (b) the thing is done in the course of the person exercising or performing the person’s powers, functions or duties as such a staff member; and (c) the thing is done to facilitate a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, (the ASIS or ASD person) to identify a Commonwealth authority as the ASIS or ASD person’s employer or place of work in relation to a period for the purposes of subsection 41AA(1), in accordance with a determination under subsection 41AB(1); and (d) doing the thing would not be an offence if the Commonwealth authority referred to in paragraph (c) were the ASIS or ASD person’s employer or place of work for the period mentioned in that paragraph. (2) If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if: (a) the thing is done in the performance of the functions attaching to the person’s professional capacity; and (b) the thing is done to facilitate a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, (the ASIS or ASD person) to identify a Commonwealth authority as the ASIS or ASD person’s employer or place of work in relation to a period for the purposes of subsection 41AA(1), in accordance with a determination under subsection 41AB(1); and (c) doing the thing would not be an offence if the Commonwealth authority referred to in paragraph (b) were the ASIS or ASD person’s employer or place of work for the period mentioned in that paragraph. (3) For the purposes of paragraphs (1)(a) and (b), a staff member of a Commonwealth authority means: (a) the head (however described) of the Commonwealth authority, or another person who holds an office or appointment in relation to the Commonwealth authority; and (b) a person who is otherwise a member of the staff of the Commonwealth authority, whether: (i) an employee of the Commonwealth authority; or (ii) a consultant or contractor to the Commonwealth authority; or (iii) a person who is made available, to perform services for the Commonwealth authority, by another Commonwealth authority, a State authority or other person. > Note: If a person referred to in paragraphs (1)(a) and (b) is a staff member of ASIO or an agency (within the meaning of subsection 3(1)), the definition of staff member in subsection (3) of this section applies for the purposes of those paragraphs rather than the definition of staff member in subsection 3(1). #### 41A Offences against this Division—general rules Extended geographical jurisdiction (1) Section 15.4 of the Criminal Code (extended geographical jurisdiction—category D) applies to an offence against this Division. (2) Subsection (1) does not, by implication, affect the interpretation of any other provision of this Act. Institution of prosecution (3) A prosecution under this Division may be instituted only by, or with the consent of, the Attorney‑General or a person acting under the Attorney‑General’s direction. (4) However: (a) a person charged with an offence against this Division may be arrested, or a warrant for his or her arrest may be issued and executed; and (b) such a person may be remanded in custody or on bail; even if the consent of the Attorney‑General or a person acting under his or her direction has not been obtained, but no further proceedings are to be taken until that consent has been obtained. (5) Nothing in subsection (3) or (4) prevents the discharging of the accused if proceedings are not continued within a reasonable time. #### 41B Offences against this Division—IGIS officials (1) A person does not commit an offence against an information offence provision if: (a) the person is an IGIS official; and (b) the relevant conduct is engaged in by the person for the purpose of exercising powers, or performing functions or duties, as an IGIS official. (2) In a prosecution for an offence against an information offence provision, the defendant does not bear an evidential burden in relation to the matter in subsection (1), despite subsection 13.3(3) of the Criminal Code. (3) In this section: > information offence provision means subsection 39(1), 40C(1) or 40D(1) or paragraph 41(1)(a). ### Division 1A—Communication and use of limited cyber security information #### 41BA Cyber security information for which communication and use is limited by this Division (1) This Division applies to information (limited cyber security information) if: (a) the information relates to: (i) a cyber security incident that has occurred or is occurring; or (ii) a cyber security incident that may potentially occur; and (b) the information has been acquired or prepared by ASD in a circumstance mentioned in subsection (2); and (c) the information is not excepted under subsection (3). (2) This Division only applies to information that ASD has acquired or prepared in one of the following circumstances: (a) the information has been voluntarily provided to ASD, in the performance of its functions, by, or on behalf of, an entity (the impacted entity) that: (i) is, was or could reasonably be expected to be directly or indirectly impacted by the cyber security incident; or (ii) would be or would reasonably be expected to be impacted by the cyber security incident that may potentially occur; (b) the information has been acquired or prepared by ASD, in the performance of its functions, with the consent of the impacted entity; (c) the information has been: (i) acquired by the National Cyber Security Coordinator under subsection 35(2) of the Cyber Security Act 2024 in relation to the cyber security incident; and (ii) disclosed to ASD under subsection 38(1), 39(2) or 40(2) of that Act. (3) This Division does not apply to information if: (a) the information has been provided to the Commonwealth about the cyber security incident to comply with: (i) a requirement in Part 3 of the Cyber Security Act 2024; or (ii) a requirement in Part 2B of the Security of Critical Infrastructure Act 2018; or (iii) a requirement under the Telecommunications Act 1997; or (iv) a requirement under a prescribed law; or (b) the information has already been lawfully made available to the public; or (c) the information is about an entity and has been de‑identified so that it is no longer about an identifiable entity or an entity that is reasonably identifiable. (4) A cyber security incident is: (a) one or more acts, events or circumstances: (i) of a kind covered by the meaning of cyber security incident in the Security of Critical Infrastructure Act 2018; or (ii) involving unauthorised impairment of electronic communication to or from a computer, within the meaning of that phrase in that Act, but as if that phrase did not exclude the mere interception of any such communication; or (b) the discovery of unintended or unexpected vulnerabilities in a computer, computer data or a computer program that, if exploited, would result in a cyber security incident within the meaning of paragraph (a). (5) For the purposes of this Division: (a) Commonwealth body has the same meaning as in the Cyber Security Act 2024; and (b) Commonwealth enforcement body has the same meaning as in the Cyber Security Act 2024; and (c) entity has the same meaning as in the Cyber Security Act 2024; and (d) State body has the same meaning as in the Cyber Security Act 2024. #### 41BB Limited cyber security information can only be communicated by ASD for permitted cyber security purposes (1) The Director‑General of ASD, or a staff member of ASD, may communicate limited cyber security information to a person who is not the Director‑General of ASD, or a staff member of ASD, but only for the purposes of one or more of the following: (a) the performance of any of ASD’s functions under this Act including, for example: (i) assisting, in the performance of ASD’s functions, the impacted entity (referred to in paragraph 41BA(2)(a) or (b)) to respond to, mitigate or resolve the cyber security incident or the cyber security incident that may potentially occur; or (ii) providing technical advice and assistance, in the performance of ASD’s functions, to entities on the prevention of cyber security incidents or cyber security incidents that may potentially occur; (b) informing and advising the Minister, and other Ministers of the Commonwealth, about a cyber security incident or a cyber security incident that may potentially occur; (c) the performance of the functions of a Commonwealth body (to the extent that it is not a Commonwealth enforcement body) relating to responding to, mitigating or resolving a cyber security incident or a cyber security incident that may potentially occur; (d) the performance of the functions of a State body relating to responding to, mitigating or resolving a cyber security incident (within the meaning of the Cyber Security Act 2024); (e) the performance of the functions of the National Cyber Security Coordinator under Part 4 of the Cyber Security Act 2024 in relation to a cyber security incident (within the meaning of that Act); (f) the performance of the functions of ASIS, AGO, the Australian Security Intelligence Organisation, the Defence Intelligence Organisation or the Office of National Intelligence; (g) the performance of the functions of the Inspector‑General of Intelligence and Security; (h) the performance of the functions of the agency known as the Australian Criminal Intelligence Commission established by the Australian Crime Commission Act 2002; (i) the performance of the functions of a Commonwealth enforcement body. > Note: Information must not be communicated to a State body under this Division unless a Minister of the State or Territory has consented to this Division applying to the State body: see subsection 41BD(4). Restriction on use and communication for civil or regulatory action (2) However, the Director‑General of ASD, or a staff member of ASD, must not communicate the information for the purposes of investigating or enforcing, or assisting the investigation or enforcement, of any contravention of a Commonwealth, State or Territory law that: (a) is a contravention by the impacted entity that: (ii) originally voluntarily provided the information to ASD as referred to in paragraph 41BA(2)(a); or (ii) consented to the information being acquired or prepared by ASD as referred to in paragraph 41BA(2)(b); or (iii) originally voluntarily provided the information to the National Cyber Security Coordinator under subsection 35(2), or as referred to in subsection 39(1), of the Cyber Security Act 2024; and (b) is not a contravention by the impacted entity of: (i) this Division; or (ii) a law that imposes a penalty or sanction for a criminal offence. > Note: See also section 41BF in relation to admissibility of the information in proceedings. Interaction with this Act (3) Subsection (1) does not authorise the Director‑General of ASD, or a staff member of ASD, to communicate the information to the extent that it is prohibited or restricted by or under this Act. #### 41BC Limitations on secondary use and communication of limited cyber security information (1) This section applies to limited cyber security information that: (a) has been acquired, under subsection 41BB(1) or this section, by: (i) a Commonwealth body; or (ii) a State body; or (iii) an entity that is a corporation to which paragraph 51(xx) of the Constitution applies; and (b) is held by the Commonwealth body, State body or entity. > Note: This section does not apply to information held by the Commonwealth body, State body or entity, to the extent that it has been otherwise acquired. (2) The Commonwealth body, State body or entity may use or communicate the limited cyber security information but only for the purposes of one or more of the following: (a) informing and advising the Minister, and other Ministers of the Commonwealth, about a cyber security incident or a cyber security incident that may potentially occur; (b) the performance of the functions of a Commonwealth body (to the extent that it is not a Commonwealth enforcement body) relating to responding to, mitigating or resolving a cyber security incident or a cyber security incident that may potentially occur; (c) the performance of the functions of a State body relating to responding to, mitigating or resolving a cyber security incident (within the meaning of the Cyber Security Act 2024); (d) the performance of the functions of the National Cyber Security Coordinator under Part 4 of the Cyber Security Act 2024 in relation to a cyber security incident (within the meaning of that Act); (e) the performance of the functions of ASD, ASIS, AGO, the Australian Security Intelligence Organisation, the Defence Intelligence Organisation or the Office of National Intelligence; (f) the performance of the functions of the Inspector‑General of Intelligence and Security; (g) the performance of the functions of the agency known as the Australian Criminal Intelligence Commission established by the Australian Crime Commission Act 2002; (h) the performance of the functions of a Commonwealth enforcement body. > Note: Information must not be communicated to a State body under this Division unless a Minister of the State or Territory has consented to this Division applying to the State body: see subsection 41BD(4). Restriction on use and communication for civil or regulatory action (3) However, the Commonwealth body, State body or entity must not use or communicate the information for the purposes of investigating or enforcing, or assisting the investigation or enforcement of, any contravention of a Commonwealth, State or Territory law that: (a) is a contravention by the impacted entity that: (i) originally voluntarily provided the information to ASD as referred to in paragraph 41BA(2)(a); or (ii) consented to the information being acquired or prepared by ASD as referred to in paragraph 41BA(2)(b); or (iii) originally voluntarily provided the information to the National Cyber Security Coordinator under subsection 35(2), or as referred to in subsection 39(1), of the Cyber Security Act 2024; and (b) is not a contravention by the impacted entity of: (i) this Division; or (ii) a law that imposes a penalty or sanction for a criminal offence. > Note: See also section 41BF in relation to admissibility of the information in proceedings. Interaction with this Act (4) Subsection (2) does not authorise the Commonwealth body, State body or entity to use or communicate the information to the extent that it is prohibited or restricted by or under this Act. Information not covered by the prohibitions in this section (5) Subsection (2) does not prohibit: (a) use or communication of the limited cyber security information, by the Commonwealth body, State body or entity, with the consent of the impacted entity that: (i) originally voluntarily provided the limited cyber security information to ASD as referred to in paragraph 41BA(2)(a); or (ii) consented to the limited cyber security information being acquired or prepared by ASD as referred to in paragraph 41BA(2)(b); or (iii) originally voluntarily provided the limited cyber security information to the National Cyber Security Coordinator under subsection 35(2), or as referred to in subsection 39(1), of the Cyber Security Act 2024; or (b) use or communication of information for the purposes of carrying out a State’s constitutional functions, powers or duties. Civil penalty for contravention of this section (6) An entity is liable to a civil penalty if: (a) the entity contravenes subsection (2); and (b) the entity is not a Commonwealth officer (within the meaning of Part 5.6 of the Criminal Code); and (c) any of the following applies: (i) the information is sensitive information (within the meaning of the Privacy Act 1988) about an individual and the individual has not consented to the use or communication of the information; (ii) the information is confidential or commercially sensitive; (iii) the use or communication of the information would, or could reasonably be expected to cause, damage to the security, defence or international relations of the Commonwealth. > Note 1: See the Criminal Code for offences for Commonwealth officers. > Note 2: This section does not make the Crown (other than an authority of the Crown) liable to a civil penalty, see section 41BD. > Note 3: For the application of provisions of the Regulatory Powers (Standard Provisions) Act 2014 to this Division, see Part 6 of the Cyber Security Act 2024. Civil penalty: 60 penalty units. #### 41BD Application of section 41BC to the Crown (1) Section 41BC binds the Crown in right of each of its capacities. (2) Subsection (1) does not make the Crown liable to be prosecuted for an offence. > Note: The Crown (other than a Crown authority) is not liable to a pecuniary penalty for the breach of a civil penalty provision or to be given an infringement notice: see subsections 79(8) and 82(7) of the Cyber Security Act 2024. (3) The protection in subsection (2) does not apply to an authority of the Crown. (4) Despite any other provision of this Division, information that may be communicated to a State body under this Division must not be communicated to the State body under this Division unless: (a) a Minister of the State or Territory has informed the responsible Minister for ASD, in writing, that the State or Territory gives consent to the provisions of this Division applying to the State body; and (b) a Minister of the State or Territory has not informed the responsible Minister for ASD, in writing, that the State or Territory withdraws that consent. (5) For the purposes of paragraph (4)(a), a Minister of a State or Territory may give consent in relation to all State bodies, a class of State bodies, or particular State bodies, of that State or Territory. #### 41BE Legal professional privilege (1) The fact that an entity provided information to ASD, as referred to in paragraph 41BA(2)(a), does not otherwise affect a claim of legal professional privilege that anyone may make in relation to that information in any proceedings: (a) under any Commonwealth, State or Territory law (including the common law); or (b) before a tribunal of the Commonwealth, a State or a Territory. (2) Despite subsection (1), this section does not apply to the following: (a) the proceedings of a coronial inquiry or a Royal Commission in Australia; (b) proceedings in a federal court exercising original jurisdiction in which a writ of mandamus or prohibition or an injunction is sought against an officer or officers of the Commonwealth. Note: For federal court, see section 2B of the Acts Interpretation Act 1901. (3) This section does not limit or affect any right, privilege or immunity that the impacted entity has, apart from this section, as a defendant in any proceedings. #### 41BF Admissibility of limited cyber security information voluntarily given by impacted entity (1) This section applies to limited cyber security information that: (a) either: (i) has been voluntarily provided to ASD by, or on behalf of, an entity (the impacted entity), as referred to in paragraph 41BA(2)(a); or (ii) has been acquired or prepared by ASD with the consent of an entity (the impacted entity), as referred to in paragraph 41BA(2)(b); and (b) has been prepared by, as referred to in paragraph 41BA(2)(b), acquired by, as referred to in paragraph 41BA(2)(a) or (b), or acquired, under subsection 41BB(1) or section 41BC, by a Commonwealth body or a State body; and (c) is held by the Commonwealth body or State body. > Note 1: This section does not apply to information held by the Commonwealth body or State body to the extent that it has been otherwise prepared or acquired. > Note 2: ASD is a Commonwealth body: see the definition of Commonwealth body in subsection 41BA(5) and section 8 of the Cyber Security Act 2024. > Note 3: For admissibility of information acquired by ASD as referred to in paragraph 41BA(2)(c), see section 42 of the Cyber Security Act 2024. (2) The limited cyber security information is not admissible in evidence against the impacted entity in any of the following proceedings: (a) criminal proceedings for an offence against a Commonwealth, State or Territory law, other than: (i) proceedings for an offence against section 137.1 or 137.2 of the Criminal Code (which deal with false or misleading information or documents) that relates to this Act; or (ii) proceedings for an offence against section 149.1 of the Criminal Code (which deals with obstruction of Commonwealth public officials) that relates to this Act; (b) civil proceedings for a contravention of a civil penalty provision of a Commonwealth, State or Territory law, other than a civil penalty provision of this Division; (c) proceedings for a breach of any other Commonwealth, State or Territory law (including the common law); (d) proceedings before a tribunal of the Commonwealth, a State or a Territory. (3) Despite subsection (2), subsection (2) does not apply to the following proceedings: (a) the proceedings of a coronial inquiry or a Royal Commission in Australia; (b) proceedings in a federal court exercising original jurisdiction in which a writ of mandamus or prohibition or an injunction is sought against an officer or officers of the Commonwealth. Note: For federal court, see section 2B of the Acts Interpretation Act 1901. (4) This section does not limit or affect any right, privilege or immunity that the impacted entity has, apart from this section, as a defendant in any proceedings. #### 41BG Director‑General of ASD and staff members of ASD not compellable as witnesses in relation to limited cyber security information (1) A person who is, or has been, the Director‑General of ASD or a staff member of ASD: (a) is not obliged to comply with a subpoena or similar direction of a federal court or a court of a State or Territory to attend and answer questions relating to limited cyber security information; and (b) is not compellable to give an expert opinion in any civil or criminal proceedings in a federal court or a court of a State or Territory in relation to limited cyber security information. (2) This section does not apply to a coronial inquiry. #### 41BH How this Division applies in relation to non‑legal persons How permissions and rights are conferred and exercised (1) If this Division purports to confer a permission or right on an entity that is not a legal person, the permission or right: (a) is conferred on each person who is an accountable person for the entity at the time the permission or right may be exercised; and (b) may be exercised by: (i) any person who is an accountable person for the entity at the time the permission or right may be exercised; or (ii) any person who is authorised by a person referred to in subparagraph (i) to exercise the permission or right. How obligations and duties are imposed and discharged (2) If this Division purports to impose an obligation or duty on an entity that is not a legal person, the obligation or duty: (a) is imposed on each person who is an accountable person for the entity at the time the obligation or duty arises or is in operation; and (b) may be discharged by: (i) any person who is an accountable person for the entity at the time the obligation or duty arises or is in operation; or (ii) any person who is authorised by a person referred to in subparagraph (i) to discharge the obligation or duty. How non‑legal persons contravene this Division (3) A provision of this Division (including a civil penalty provision) that is purportedly contravened by an entity that is not a legal person is instead contravened by each accountable person for the entity who: (a) did the relevant act or made the relevant omission; or (b) aided, abetted, counselled or procured the relevant act or omission; or (c) was in any way knowingly concerned in, or party to, the relevant act or omission. Meaning of accountable person (4) For the purposes of this section, a person is an accountable person for an entity at a particular time if: (a) in the case of a partnership in which one or more of the partners is an individual—the individual is a partner in the partnership at that time; or (b) in the case of a partnership in which one or more of the partners is a body corporate—the person is a director of the body corporate at that time; or (c) in the case of a trust in which the trustee, or one or more of the trustees, is an individual—the individual is a trustee of the trust at that time; or (d) in the case of a trust in which the trustee, or one or more of the trustees, is a body corporate—the person is a director of the body corporate at that time; or (e) in the case of an unincorporated association—the person is a member of the governing body of the unincorporated association at that time. #### 41BI Contravening a civil penalty provision of this Division (1) This section applies if a provision of this Division provides that an entity contravening another provision of this Division (the conduct provision) is liable to a civil penalty. (2) For the purposes of this Division, and the Regulatory Powers (Standard Provisions) Act 2014 to the extent that it relates to this Division, a reference to a contravention of a civil penalty provision includes a reference to a contravention of the conduct provision. > Note: For the application of provisions of the Regulatory Powers (Standard Provisions) Act 2014 to this Division, see Part 6 of the Cyber Security Act 2024. ### Division 2—Other matters #### 41C Rules to protect privacy of Australians—DIO (1) The responsible Minister in relation to DIO must make written rules regulating the communication and retention by DIO of intelligence information concerning Australian persons. (2) DIO must not communicate intelligence information concerning Australian persons, except in accordance with the rules. (3) In making the rules, the Minister must have regard to the need to ensure that the privacy of Australian persons is preserved as far as is consistent with the proper performance by DIO of its functions. (4) Before making the rules, the Minister must consult with: (a) the Attorney‑General; and (b) the Inspector‑General of Intelligence and Security; and (c) the Director of DIO. (5) For the purpose of consultations under paragraphs (4)(a) and (b), the Minister must provide a copy of the rules the Minister is proposing to make to the Attorney‑General and to the Inspector‑General of Intelligence and Security. (6) The Minister must ensure that the rules are published on DIO’s website as soon as practicable after the rules are made, except to the extent that the rules contain: (a) operationally sensitive information (within the meaning of Schedule 1); or (b) information that would or might prejudice: (i) Australia’s national security or the conduct of Australia’s foreign relations; or (ii) the performance by DIO of its functions. (7) Rules made under subsection (1) are not legislative instruments. (8) The Inspector‑General of Intelligence and Security must brief the Committee on the content and effect of the rules if: (a) the Committee requests the Inspector‑General of Intelligence and Security to do so; or (b) the rules change. #### 42 Annual report—ASIS (1) As soon as practicable after each year ending on 30 June, the Director‑General of ASIS must give to the Minister a report on the activities of ASIS during the year. (2) The report must include information about any cooperation by ASIS with an authority of another country in planning or undertaking activities covered by paragraphs 6(4)(a) to (c). The report must set out the number of occasions on which such cooperation occurred and the broad nature of each cooperation. (3) The report must include information about: (a) the number of occasions on which force, or the threat of force, against a person by a staff member or agent of ASIS occurred in the course of activities undertaken by ASIS outside Australia during the year; and (b) the broad nature of those occurrences. #### 42A Annual report—ASD As soon as practicable after each year ending on 30 June, the Director‑General of ASD must give to the Minister a report of the activities of ASD during the year. #### 43 Regulations The Governor‑General may make regulations prescribing matters: (a) required or permitted to be prescribed by this Act; or (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.