Terrorism (Surface Transport Security) Act 2011

Security identified surface transport operation. This is a place, activity or system associated with the movement of people or goods by road, rail or water that the Minister identifies by notice under s 5(1). The Minister must form the opinion that the operation has a "significant risk of being the target of a terrorist act", taking into account a non-exhaustive list of factors: information from security intelligence or law enforcement agencies, passenger numbers, nature of goods carried, geographical location, iconic status, size, and "any other factor considered relevant" (s 5(2)(a)-(g)). The last factor gives the Minister virtually unbounded discretion. The operation is not defined in the abstract; it is whatever the Minister says it is in each notice. There is no minimum threshold for passenger numbers or cargo volume.

Operator. The operator is the person declared by the Minister in the notice (s 3). This may not be the legal owner or the entity that holds a transport licence; the Minister can designate any person. This gives the Minister power to pick who bears the compliance burden.

Terrorist act. Defined by cross-reference to Part 5.3 of the Commonwealth Criminal Code (s 3). That definition is broad: it covers actions or threats that cause serious harm, damage, or interference with an electronic system, done with the intention of advancing a political, religious or ideological cause and with the intention of coercing a government or intimidating the public. The Act does not add or modify that definition.

Counter terrorism plan. A mandatory document with five statutory objectives: preventing a terrorist act, mitigating its effects, recovering from it, ensuring continuity, and coordinating with other operators (s 6(4)). The plan must contain: a vulnerability assessment; a risk assessment arrangement that includes review intervals and procedures for obtaining information from the Commonwealth and State; a series of measures graded by likelihood (including preventing unauthorised access, recognising suspicious incidents, and evacuation); response measures (communication with police, emergency services, public, and coordination); a training exercise scheme; a staff information and training scheme; specification of responsible persons; and a review and updating scheme (s 6(5)(a)-(i)). The regulations may prescribe standards for the risk assessment scale, training exercise intervals, and review intervals (s 6(6)). The operator may amend or substitute the plan at any time (s 6(7)), but there is no requirement for the Minister to approve the plan. The Minister can request a copy and information about implementation (s 7), and failure to provide it is an offence.

Compliance notice. A written notice from the Minister specifying action needed to ensure compliance (s 9(1)). It is a procedural tool that can stop prosecution if complied with (s 9(3)), but its contents are admissible in any subsequent prosecution if the operator did not comply (s 9(2)). It is not an offence to ignore the notice, but the evidence can be used against the operator.

Confidentiality. A person engaged in administering the Act must not disclose information obtained in official duties, except as authorised by the Act or other law, with the operator's consent, in connection with administration, or to an agency of the State, Commonwealth, or another State or Territory for the proper performance of its functions (s 10(1)). Information disclosed under those exceptions must not be used for any other purpose by the recipient or anyone who gains access to it (s 10(2)). Breach carries a $10,000 penalty.

Evidentiary provision. In proceedings for an offence, an allegation in a complaint that a specified place, activity or system is a security identified surface transport operation, that a person is the operator, or that a person is an authorised person under s 7, is taken as proved in the absence of proof to the contrary (s 13). This reverses the usual criminal evidentiary burden: the defendant must disprove the allegation.

The Act directly affects persons declared by the Minister to be operators of a security identified surface transport operation. These will typically be businesses or government agencies that operate surface transport infrastructure or services in South Australia: bus terminals, railway stations, ferry wharves, freight hubs, major road tunnels, or any place, activity or system the Minister decides poses a significant terrorism risk. The operator may be a private company (e.g. a bus operator, a port authority, a rail infrastructure manager) or a state-owned entity. The Act also indirectly affects employees of the operator, who must be trained on the counter terrorism plan (s 6(5)(f)), and contractors who have access to the operation. The general public is not directly regulated but may be affected if the plan includes access restrictions, evacuation procedures or other security measures that change how they use the transport service.

The Act expressly does not apply to "maritime industry participants" who are required to prepare a maritime security plan under the Commonwealth Maritime Transport and Offshore Facilities Security Act 2003 (s 5(3)). This avoids duplication with Commonwealth regulation. However, it leaves room for the Minister to designate a maritime operation that is not covered by the Commonwealth Act - for example, a small ferry service not captured by the Commonwealth scheme.

For rail operators subject to the Rail Safety National Law (South Australia) Act 2012, the counter terrorism plan is deemed part of the security management plan already required under that Act (s 6(8)). But the note clarifies that the counter terrorism plan is expected to be more detailed. This means an entity already complying with rail safety law faces additional content and possibly higher standards, and the two regimes will need to be read together. The amendment history shows s 6(8) was inserted in 2013 to align the two Acts.

The Minister and authorised persons are also affected: they must maintain confidentiality, and the Minister must follow procedural fairness (giving 14 days for submissions before issuing a notice). The Act binds the Crown? It does not say so explicitly, but as a State Act, the Crown is likely bound unless otherwise provided - though the Minister is the decision maker.

Compliance costs fall entirely on the designated operator. There are no government grants, subsidies or offsets mentioned in the Act. The operator must internalise the costs of drafting the plan (possibly hiring security consultants), conducting vulnerability assessments, running training exercises, updating the plan at intervals, and providing information on request. Given the Minister's broad discretion, an operator cannot know in advance whether it will be designated, and cannot plan for the compliance burden until after the notice is issued. The 14-day submission period is before the notice; the plan must be prepared within a period specified in the notice (s 5(1)(c)), which may be short.

Duty to prepare a counter terrorism plan (s 6(1)). Once designated, the operator must prepare a plan within the period specified in the ministerial notice. The plan must meet the objectives and contents set out in s 6(4)-(5). Breach is an offence punishable by up to $50,000.

Duty to implement the plan (s 6(2)). The operator must implement the plan in accordance with its terms, unless there is a reasonable excuse. This is a separate offence from the duty to prepare. The note to s 6(8) suggests that for rail operators, the plan will be part of the security management plan; implementing that plan would satisfy both regimes.

Duty to provide plan and information on request (s 7). The operator must give a copy of the plan (or any amendment) and written information about its implementation or review to a person authorised by the Minister. Failure carries a $10,000 penalty.

Duty not to provide false or misleading information (s 8). This applies to any statement in information provided under the Act. The penalty is higher if the person knew it was false or misleading: $10,000 or 2 years imprisonment; otherwise $5,000.

Duty of confidentiality (s 10). Persons engaged in administering the Act (including the Minister, authorised persons, and anyone who handles the information) must not disclose information obtained in official duties except in limited circumstances. Breach: $10,000. Recipients of disclosed information must not use it for another purpose.

Right to make submissions before designation (s 5(4)). The Minister must inform the proposed operator of the details of the proposed notice and allow at least 14 days to make submissions. This is a procedural right, not a right to veto the designation. The Minister is not required to accept the submissions.

Right to vary or revoke a designation (s 5(5)). The operator has no express right to request variation or revocation, but the Minister may do so by subsequent notice.

Right to amend or substitute the plan (s 6(7)). The operator may update the plan at any time without seeking approval. However, the plan must still comply with the statutory requirements; an amendment does not relieve the operator of the duty to implement the plan as amended.

Right to avoid prosecution by complying with a compliance notice (s 9(3)). If the Minister issues a compliance notice and the operator complies, the operator cannot be prosecuted for the contravention to which the notice relates. This is a limited safe harbour: it only applies to that particular contravention, and only if the operator complies fully within the period allowed. The notice is at the Minister's discretion.

Civil remedies not affected (s 4). The Act does not limit any civil right or remedy. An operator or third party can still sue for negligence or breach of contract. Conversely, compliance with the Act does not guarantee that a common law duty of care has been met - the operator might still be liable in tort even if it has a perfect plan.

The Act creates five specific criminal offences, all of which are strict liability? The source does not say strict liability, but no mental element is stated except in s 8 which distinguishes knowing from non-knowing false statements. For s 6(1) and (2), the phrase "without reasonable excuse" appears only in s 6(2) - the preparation duty has no such defence, so it is effectively strict liability with no exception except if the operator can show impossibility? The evidentiary provision s 13 would assist the prosecution.

Offences and penalties:

• Operator fails to prepare counter terrorism plan within period: $50,000 (s 6(1)). For a corporation, this is a significant sum; for a small operator it could be crippling.
• Operator fails to implement plan without reasonable excuse: $50,000 (s 6(2)).
• Operator fails to provide copy of plan or implementation information on request: $10,000 (s 7).
• False or misleading information - knowing: $10,000 or 2 years imprisonment; not knowing: $5,000 (s 8).
• Breach of confidentiality - by administrator: $10,000; by recipient misusing information: $10,000 (s 10).

Enforcement mechanisms:

Compliance notice (s 9). The Minister may give a notice specifying remedial action before commencing prosecution. If the operator complies, prosecution is barred for that contravention. This gives the Minister a flexible tool: a notice can require plan preparation, implementation steps, training, etc. The notice is not a formal charge and does not require court involvement. However, if the operator does not comply, the Minister can still prosecute, and the notice is admissible as evidence of the contravention. The notice period is not specified; the Minister sets it. This creates uncertainty - the operator must comply within the Minister's timeframe or risk prosecution.

Prosecution. Proceedings are likely in the Magistrates Court. The standard criminal burden applies except for the evidentiary provision in s 13, which reverses the onus for the foundational facts: in a complaint, the prosecution alleges the operation is a security identified surface transport operation, that the accused is the operator, and that the person requesting information was authorised. The accused must prove the contrary. This makes it harder to contest the Minister's designation in court.

Penalty amounts. The $50,000 maximum for plan offences is fixed; no daily penalty for continuing breach is provided. So if the operator fails to prepare a plan for a year, a court can impose only one $50,000 penalty per conviction, unless the prosecution brings separate charges for each day? The Act does not say the offence is continuing. This may limit the deterrent effect for prolonged non-compliance.

Imprisonment. Only available for knowing false or misleading statements (up to 2 years). All other offences are monetary.

Confidentiality enforcement. The $10,000 penalty for disclosure by administrators is relatively low given the sensitivity of counter terrorism plans. There are no provisions for removal of an administrator who breaches confidentiality.

Commonwealth Criminal Code. The definition of "terrorist act" is imported from Part 5.3 of the Code (s 3). This means any assessment of vulnerability and likelihood under the plan must use the same definition. Changes to the Commonwealth definition will automatically affect the operation of the Act without amendment.

Maritime Transport and Offshore Facilities Security Act 2003 (Cth). Section 5(3) prohibits the Minister from declaring a maritime industry participant who is required to prepare a security plan under the Commonwealth Act as an operator under this Act. This avoids dual regulation for large ports and offshore facilities. However, a maritime operation not covered by the Commonwealth Act (e.g. a small ferry or a river cruise) could still be designated under the State Act.

Rail Safety National Law (South Australia) Act 2012. Section 6(8) deems the counter terrorism plan to be incorporated into the operator's security management plan and to satisfy the requirement that the security management plan include measures to protect people from terrorism. However, the note indicates the counter terrorism plan is intended to be "more detailed and more extensive" than that aspect. Practically, a rail operator must either expand its existing security management plan or maintain a separate document that is treated as part of the plan. Compliance with the Rail Safety National Law does not automatically mean compliance with this Act; the operator must still meet the s 6(4)-(5) content requirements.

Freedom of Information Act 1991 (SA). Section 11 exempts all information obtained under this Act from FOI disclosure. This means the public cannot access a counter terrorism plan, the Minister's risk assessment, or any compliance correspondence. This limits transparency but is typical for security-sensitive information. The exemption is absolute - no public interest override.

General civil law. Section 4 preserves common law claims. An operator cannot defend a negligence claim by saying it complied with the Act. Conversely, a third party cannot argue that the Act creates a statutory duty of care; the Act explicitly says compliance does not necessarily satisfy the common law duty.

Regulations. Section 14 empowers the Governor to make regulations that can impose standards for plan contents (e.g. risk assessment scale, training intervals, review intervals), incorporate codes or standards by reference, and delegate matters to the Minister's discretion. As of the source text, no regulations are shown, but they could add significant compliance detail.

Criminal Code (SA)? The Act does not create a separate regime for legal persons; the Criminal Law Consolidation Act 1935 (SA) would apply to questions of corporate criminal responsibility, penalties for imprisonment (not applicable to corporations), and summary procedure.

Surveillance and privacy laws. The Act does not mention any interaction with privacy legislation (e.g. Privacy Act 1988 (Cth) or SA’s Information Privacy Principles). The plan may include surveillance measures (preventing unauthorised access, reporting suspicious incidents) but the Act does not authorise any otherwise unlawful surveillance. Operators would still need to comply with privacy laws.

The Act was assented to on 31 March 2011 and commenced on 5 May 2011 (Gazette 5.5.2011 p1330). The only substantive amendment recorded is the insertion of s 6(8) by the Rail Safety National Law (South Australia) Act 2012 (No 14/2012), which came into operation on 20 January 2013. That amendment added the provision deeming the counter terrorism plan to be incorporated into a rail operator’s security management plan under the Rail Safety National Law, and also amended s 6. The legislative history also notes that s 2 (the old definition section, which probably defined "rail operator") was omitted under the Legislation Revision and Publication Act 2002 on 20 January 2013, likely as a consequence of the new definitional cross-reference. No other amendments have been made. The Act has been in force unchanged since 2013 except for any regulations that may have been made but are not part of the source text. The infrequency of amendment suggests limited use or limited perceived need for change. However, it also means the Act has not been updated to reflect changes in transport technology, security practices, or lessons from incidents. The broad ministerial discretion and reliance on regulations mean that much of the operational detail can be updated without amending the primary Act.

The source text does not refer to any litigation arising under the Act. The legislative history shows no judicial consideration or amendment in response to court decisions. Given the short span of the Act and its limited application (only to a small number of designated operators), it is plausible that no prosecutions have been brought or that any disputes have been resolved through the compliance notice mechanism without reaching court. The evidentiary provision s 13 may discourage operators from challenging the factual basis of a prosecution, as they bear the burden of proof on the threshold questions. The Act’s narrow scope - it does not apply automatically across a sector but only by ministerial notice - means the potential pool of defendants is small. No cases have been reported in South Australian law reports or noted in the source. The Act has not been tested on questions such as the reasonableness of the Minister's opinion that there is a "significant risk", or what constitutes a "reasonable excuse" for failing to implement a plan. The lack of litigation history is itself a notable feature: either compliance has been voluntary, or the enforcement provisions have been used sparingly, or operators have little incentive to litigate given the cost and the reverse onus.

Ministerial discretion is extraordinarily broad. The Minister can identify a "security identified surface transport operation" based on "any other factor considered relevant" (s 5(2)(g)). This is not a closed list. The operator has no right of appeal against the designation - only a right to make submissions before it is made. There is no merit review or tribunal avenue. The only way to challenge the designation in court would be by judicial review (e.g. unreasonableness or bad faith), but the broad discretion makes that difficult.

The operator may not be the business owner. The Minister declares the operator. This could be a natural person (e.g. the director of a company) rather than the corporate entity. If so, that individual bears personal criminal liability for failing to prepare or implement the plan, with penalties up to $50,000. The Act does not require the Minister to consider the person's capacity to comply.

No approval requirement for the plan. The operator must prepare and implement the plan, but the Minister does not need to approve it. This creates legal risk: the operator might draft a plan that the Minister later considers inadequate. If the Minister issues a compliance notice requiring changes, the operator must comply or face prosecution. There is no "safe harbour" for a plan that the operator reasonably believes meets the objectives.

Reasonable excuse only for implementation, not preparation. Section 6(2) creates a defence of "reasonable excuse" for failing to implement the plan, but s 6(1) (failure to prepare) has no such defence. If the operator cannot prepare the plan within the period (e.g. due to illness, lack of resources, or force majeure), they are still liable.

Reverse evidentiary onus. Under s 13, the basics (that the place is a security identified surface transport operation, that the accused is the operator, that the person requesting information is authorised) are presumed true unless the accused proves otherwise. This shifts the burden to the defendant on facts that might be disputed. A defendant would need to produce evidence that the Minister's designation was not validly made (e.g. no notice given). In practice, this makes it risky to contest the factual basis of a charge.

FOI exemption prevents access to plans and risk assessments. Operators cannot use FOI to see what other operators have done, or to understand the Minister's assessment of risk. This increases compliance cost because each operator must start from scratch. It also means the public cannot scrutinise the adequacy of plans.

Compliance notice is not mandatory. The Minister may issue a compliance notice but is not required to. An operator who is in breach could be prosecuted without receiving a prior warning. The notice is a shield, not a sword for the operator.

Confidentiality exception for "any other Act or law". Section 10(1)(a) allows disclosure as required or authorised by any other Act or law. This could include a court order, a subpoena, or a request from a parliamentary committee. The operator has no right to be notified if the government discloses its plan under another law.

No grandfathering or transitional period. When a designation notice is issued, the operator must prepare the plan within the period specified in the notice. That period can be short. There is no provision for an appeal or extension.

Regulations can impose standards without further parliamentary scrutiny. The Governor may make regulations that specify detailed standards for risk assessment scales, training intervals, review intervals (s 6(6)). These regulations are delegated legislation; they become law without amendment to the Act. Operators must monitor changes in regulations.

The Act does not limit liability for negligence of staff. The plan may delegate responsibilities to named persons or classes. But the operator remains liable for any failure to implement the plan, and also for any torts committed by employees in carrying out the plan. The Act provides no immunity.

If you receive a notice under s 5(1) declaring you the operator of a security identified surface transport operation, you must do the following within the period specified in the notice (which may be as short as the Minister decides):

1. Prepare a counter terrorism plan that meets the five objectives (prevention, mitigation, recovery, continuity, coordination) and contains all eight elements listed in s 6(5). This includes:

   • A vulnerability assessment.
   • Arrangements for assessing likelihood of a terrorist act, with review intervals and procedures to obtain information from Commonwealth and State sources.
   • Measures graded by assessed likelihood: prevent unauthorised access, facilitate recognition and reporting of suspicious incidents, and facilitate evacuation.
   • Response measures for a terrorist act: communication with police and emergency services, recovery procedures, and continued safe operation.
   • A scheme for training exercises to test the plan.
   • A scheme for providing information and training to staff.
   • Specification of persons or classes responsible for taking action.
   • A scheme for review and updating.

2. Implement the plan in accordance with its terms. You must train staff, conduct exercises, and update the plan as required by its own terms and by any regulations.

3. Keep records of implementation, including training records, exercise results, and reviews. You must be able to provide this information in writing when an authorised person requests it under s 7.

4. Designate someone to handle requests from the Minister or authorised persons. That person must be ready to produce a copy of the plan and implementation information promptly.

5. Ensure no false or misleading statements in any information provided. This includes the plan itself, responses to requests, and submissions. If you include information you later discover is false, you should correct it promptly.

6. Monitor ministerial notices for any variation or revocation (s 5(5)). If the Minister varies the designation (e.g. adding new activities), you must amend the plan accordingly.

7. If you are a rail transport operator, ensure your counter terrorism plan is consistent with your security management plan under the Rail Safety National Law (South Australia) Act 2012. The counter terrorism plan is deemed incorporated into the security management plan, but must be more detailed than the terrorism component of that plan. You may need to treat the two documents as one, or maintain the counter terrorism plan as an appendix.

8. If you receive a compliance notice under s 9, take the specified action within the period allowed. Do not assume you can ignore it: failure to comply does not create an offence, but the notice becomes admissible in a later prosecution and you lose the safe harbour. If you comply, you cannot be prosecuted for the underlying contravention.

9. Keep the plan and all related information confidential within your organisation. The Act does not impose a duty of confidentiality on the operator, but the plan is exempt from FOI and the Minister's handlers are bound by confidentiality. However, you should treat the plan as sensitive information to avoid unintended disclosure.

10. Prepare for regulations. The Act contemplates regulations that may impose binding standards on risk assessment scales, training intervals, and review intervals. If regulations are made, you must update the plan to comply.

11. Seek legal advice if the Minister gives any notice. The 14-day submission period before designation is your only chance to argue against the designation on facts or merits. Consult a lawyer with experience in administrative law and security regulation.

The compliance burden will depend on the complexity of your operation. A large rail network will need a detailed plan with multiple exercise scenarios. A small bus terminal may require less, but the statutory requirements are the same. The cost of consultants, staff time, training and exercises must be factored into the business budget. There is no government compensation for these costs.