AUSTRALIA Law and Practice Contributed by: Dennis Miralis, Jack Dennis, Henry Yu and Phillip Salakas, Nyman Gibson Miralis
• the reporting entity (or a third party on their behalf) makes the ransomware payment. Such a report must be given with 72 hours of the reporting business entity becoming aware of the pay - ment and must contain certain information. A “cyber security incident” for these purposes is broader than under the SOCI Act. Under the Cyber Security Act, a “cyber security incident” is an act, event or circumstance covered by the SOCI Act but can also be an act, event, or circumstance if it involves “unauthorised impairment of electronic communica - tion to or from a computer” (even mere interception). However, in the case of the latter, the incident must involve a critical infrastructure asset; involve an Aus - tralian corporation (attracting paragraph 51 (xx) of the Constitution); (actually or is reasonably expected to be) effected by means of “telegraphic, telephonic or other like service”; (actually, probably, or it is reason - able to expect it) impeded or impaired “the ability of a computer to connect to such a service”; or (probably or is reasonably expected to have) prejudiced Aus - tralia’s social/economic stability, defence or national security. Voluntary Incident Reporting Obligations The ACSC has a cyber-incident reporting portal through which critical asset owners are encouraged to voluntarily report cybersecurity incidents. Any impacted entity carrying or a business in Aus - tralia or otherwise a responsible entity for critical infra - structure is now being statutorily encouraged to make voluntary reports to the NCS Coordinator under the Cyber Security Act, even where it is unclear if an inci - dent is a cybersecurity incident. Other Mandatory Reporting Obligations Other reporting obligations under the SOCI Act for critical infrastructure assets include: • taking reasonable steps to notify a third-party entity if that third party is processing or storing “business critical data” on a commercial basis; • an ongoing obligation on a “reporting entity” to report a “notifiable event” in relation to an asset
usually within 30 days after the event occurs, which relates to changes in the operational infor - mation and interest/control information in relation to “director interest holders”, or the status of an entity as a reporting entity; and • reporting if a hazard had significant relevant impacts on a critical infrastructure asset. See additionally relevant obligations in 6.1 Cyberse- curity and Data Protection . Criminal Offences Related to infrastructure, Part 10.6 of the Criminal Code places obligations on providers of content or hosting services to notify the AFP as to the existence of material displaying “abhorrent violent conduct” (if occurring in Australia) and, in any event, to expedi - tiously remove or cease to host such material. Relevantly, this reporting obligation is supplemented by the OSA, which empowers the eSafety Commis - sioner to issue removal notices requiring hosting ser - vice providers to remove cyberbullying, cyber-abuse, and other harmful material within strict statutory time - frames. 2.4 State Responsibilities and Obligations The Australian government considers “the respon - sibility for ensuring the continuity of operations and the provision of essential services to the Australian economy and community” as being shared “between owners and operators of critical infrastructure, state and territory governments and the Australian govern - ment”. Generally speaking, government bodies may also be captured within the scope of legislative regimes such as the Privacy Act and therefore have the same (or similar) obligations as their private-sphere coun - terparts. However, the SOCI Act does not apply to the Commonwealth or a body corporate established under Commonwealth law unless so declared or pre - scribed. The Australian government is responsible for the “final defence” of Australian infrastructure and cybersecu - rity. To this end, the SOCI Act grants the Minister last resort “government assistance measures” and powers
17 CHAMBERS.COM
Powered by FlippingBook