Critical infrastructure: reporting starts now

19 December 2018

From 11 January 2019, owners and operators of Australia’s critical infrastructure (ports, electricity, water and gas infrastructure) will have their assets more closely scrutinised by the Commonwealth Government. Entities will be required to disclose information about their corporate structure and asset operations, and may be subject to direction by the Minister.

The Security of Critical Infrastructure Act 2018 (Cth) (Act) seeks to improve the Commonwealth’s understanding of the ownership and operational control of critical infrastructure in Australia.

The Act complements the Critical Infrastructure Centre, which was established in January 2017. The Centre notes that foreign investment can grant access and control to ‘malicious actors’ who would ‘facilitate espionage, sabotage or exert coercive influence’. For example, a foreign actor may seek to disrupt energy supply or obtain confidential data.

The Centre and the Act are apparently responses to an increase in foreign investment, particularly by China. In debating the new law, parliamentarians (including government representatives and members of the Joint Committee on Intelligence and Security) expressed concerns as to the Chinese ownership of the Ports of Darwin [1] and Newcastle.[2] They also noted the ‘deficiencies’ in existing processes, revealed by the proposed sale of electricity distributor Ausgrid to Chinese or Hong Kong buyers.[3]

What is critical infrastructure?

The Act applies to electricity, water and gas assets, and ports, that are ‘critical’ to Australia.

Whether an asset is critical depends on criteria set out in the Act. In addition, the Minister is empowered to declare, in secret, an asset to be critical infrastructure.[4]

By way of example, a gas asset will be critical in the circumstances set out in the table below.[5]

Type of asset	Threshold for ‘critical’
Gas processing facility	Capacity of at least 300 terajoules per day
Gas storage facility	Maximum daily quantity of at least 75 terajoules
Gas distribution network or system	Distributes gas to at least 100,000 customers
Gas transmission pipeline	Tasmanian Gas Pipeline A pipeline with a nameplate rating of: In the eastern gas market, at least 200 terajoules per day In the western gas market, at least 150 terajoules per day In the northern gas market, at least 80 terajoules per day

Who is subject to the reporting obligations?

The Act requires disclosure by a ‘responsible entity’ and a ‘direct interest holder’ in respect of an asset, which are described together as ‘reporting entities’.[6]

A responsible entity is, broadly, the entity that holds the licence, approval or authorisation to operate the asset in order to provide the service delivered by the asset.[7]

A direct interest holder is an entity which:[8]

together with associated entities, owns at least 10% of the asset; or

holds an interest that allows it to directly or indirectly influence or control the asset. Influence or control includes, for example, the ability to materially affect the running of the asset.[9]

What must be reported?

A responsible entity must give the operational information.[10] This includes, for example:[11]

the location of the asset and the area it serves;
information about the each responsible entity or ‘operator’, including their name, business number, head office location and country of incorporation (in this context, an operator is an entity that is authorised to operate the asset or part of the asset, whether or not the entity is a responsible entity);[12]
information about the entity’s chief executive officer, including their name and citizenship details;
details of the asset’s operating arrangements; and
details about the storage of particular data, including information relating to research and development and consumer consumption.[13]

A direct interest holder must give the interest and control information.[14] This includes, for example:[15]

the entity’s name, business number, head office location and country of incorporation;
the type and level of the entity’s interest in the asset;
information about the influence or control that the entity can exercise;
information about the ability of a member of the entity’s governing body to access systems that control the asset; and
information about other entities that can influence or control the direct interest holder.

When must reports be submitted?

Initial reporting must be made to the Secretary of the Department of Home Affairs by 11 January 2019.[16]

Where an event occurs that would render the initial reporting incorrect or incomplete, or if a new entity becomes a reporting entity for the asset, the reporting entity must give updated information within 30 days.[17]

If an entity fails to make the initial report or provide updated information, it faces a penalty of up to 50 penalty units ($10,500).[18]

What else does the Act provide?

The Minister may direct a reporting entity or operator of a critical infrastructure asset to do or refrain from doing something where there is a risk to security.[19] This is a considerable power which can only be exercised after consultation and negotiation, and only where the Minister has been given an adverse security assessment in respect of the entity.[20]

The Secretary may require an entity to give documents that are relevant to powers or obligations under the Act,[21] including the Minister’s power to issue a direction.

Will the Secretary maintain confidentiality of information?

The Secretary must ensure that the Register, which contains the information collected under the Act,[22] is not made public.[23]

However, the Secretary may disclose such information to various Commonwealth and state ministers to assist them to exercise their functions.[24] Information may also be disclosed where authorised by Commonwealth law,[25] but is not required to be disclosed to a court, tribunal or authority except in connection with the Act.[26]

What should owners and operators do next?

Owners and operators of critical infrastructure must investigate their corporate structures and the manner in which their assets operate. Reports are to be submitted to the Secretary by 11 January 2019. At any time, the Minister is empowered to make a direction requiring an entity to do something in order to preserve security.

^{[1] Commonwealth, Parliamentary Debates, House of Representatives, 28 March 2018, 101 (Andrew Wallace); 104 (Andrew Hastie); 106 (Mike Kelly)}

^{[2] Commonwealth, Parliamentary Debates, House of Representatives, 28 March 2018, 101 (Andrew Wallace).}

^{[3] Commonwealth, Parliamentary Debates, House of Representatives, 28 March 2018, 106-7 (Mike Kelly).}

^{[4] Security of Critical Infrastructure Act 2018 (Cth) section 51(1).}

^{[5] Security of Critical Infrastructure Act 2018 (Cth) section 12; Security of Critical Infrastructure Rules 2018 (Cth) sections 7, 8.}

^{[6] Security of Critical Infrastructure Act 2018 (Cth) section 5, definition of reporting entity.}

^{[7] Security of Critical Infrastructure Act 2018 (Cth) section 5, definition of responsible entity.}

^{[8] Security of Critical Infrastructure Act 2018 (Cth) section 8.}

^{[9] Security of Critical Infrastructure Act 2018 (Cth) section 8A.}

^{[10] Security of Critical Infrastructure Act 2018 (Cth) section 23(2)(a).}

^{[11] Security of Critical Infrastructure Act 2018 (Cth) section 7.}

^{[12] Security of Critical Infrastructure Act 2018 (Cth) section 5, definition of operator.}