175Persons with incident reporting responsibilities

#### 175 Persons with incident reporting responsibilities (1) A person with incident reporting responsibilities commits an offence if: (a) the person becomes aware of a maritime transport or offshore facility security incident (other than a cyber security incident); and (b) the person fails to report the incident as required by section 181 as soon as possible. Penalty: For a person with incident reporting responsibilities who is a maritime industry participant—100 penalty units. For any other person with incident reporting responsibilities—50 penalty units. (2) Subsection (1) does not apply in relation to a report that must be made to a particular person (the person to be notified) if: (a) the person with incident reporting responsibilities believes, on reasonable grounds, that the person to be notified is already aware of the incident; or (b) the person with incident reporting responsibilities has a reasonable excuse. > Note: A defendant bears an evidential burden in relation to the matters in subsection (2) (see subsection 13.3(3) of the Criminal Code). (3) Subsection (1) is an offence of strict liability. Cyber security incidents (3A) A person with incident reporting responsibilities commits an offence if: (a) the person becomes aware of a maritime transport or offshore facility security incident that: (i) is a cyber security incident; and (ii) has had, is having, or is likely to have a significant impact on the availability of a maritime asset; and (b) the person fails to report the incident to: (i) the Secretary; and (ii) the Australian Signals Directorate; as soon as possible, and in any event within 12 hours, after the person becomes so aware. Penalty: (a) for a person with incident reporting responsibilities who is a maritime industry participant—100 penalty units; and (b) for any other person with incident reporting responsibilities—50 penalty units. (3B) A person with incident reporting responsibilities commits an offence if: (a) the person becomes aware of a maritime transport or offshore facility security incident that: (i) is a cyber security incident; and (ii) has had, is having, or is likely to have a relevant impact on a maritime asset; and (b) the person fails to report the incident to: (i) the Secretary; and (ii) the Australian Signals Directorate; as soon as possible, and in any event within 72 hours, after the person becomes so aware. Penalty: (a) for a person with incident reporting responsibilities who is a maritime industry participant—100 penalty units; and (b) for any other person with incident reporting responsibilities—50 penalty units. (3C) Subsections (3A) and (3B) do not apply in relation to a report that must be made to a particular person or body (the person or body to be notified) if: (a) the person with incident reporting responsibilities believes, on reasonable grounds, that the person or body to be notified is already aware of the incident; or (b) the person with incident reporting responsibilities has a reasonable excuse. > Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code). (3D) Subsections (3A) and (3B) are offences of strict liability. (4) Each of the following is a person with incident reporting responsibilities: (a) a maritime security inspector; (b) a duly authorised officer; (c) a maritime security guard; (d) a screening officer; (e) a maritime industry participant other than a participant who is: (i) a port operator; or (ii) a port facility operator; or (iii) a ship operator; or (iiia) an offshore facility operator; or (iv) an employee (within the definition of employee in section 10) of a maritime industry participant.