Julian Hill (Bruce, Australian Labor Party, Assistant Minister for Citizenship and Multicultural Affairs) Share this | Link to this | Hansard source

I present a supplementary explanatory memorandum to the bill, and I ask leave of the chamber to move government amendments (1) to (4) as circulated together.

Leave granted.

I move government amendments (1) to (4) together:

(1) Schedule 1, item 2, page 12 (lines 28 and 29), omit "acquired under subsection 41BB(1) or section 44BC by", substitute "prepared by, as referred to in paragraph 41BA(2)(b), acquired by, as referred to in paragraph 41BA(2)(a) or (b), or acquired, under subsection 41BB(1) or section 41BC, by".

(2) Schedule 1, item 2, page 12 (line 32), before "acquired", insert "prepared or".

(3) Schedule 1, item 2, page 12 (after line 32), after note 1, insert:

Note 2: ASD is a Commonwealth body: see the definition of Commonwealth body in subsection 41BA(5) and section 8 of the Cyber Security Act 2024.

(4) Schedule 1, item 2, page 12 (line 33), omit "Note 2", substitute "Note 3".

The Intelligence Services and Other Legislation Amendment (Cyber Security) Bill is the second bill in the cybersecurity legislative package and seeks to amend the Intelligence Services Act 2001 to legislate a limited use obligation on the Australian Signals Directorate, similar to the provisions relating to the National Cyber Security Coordinator under the Cyber Security Bill. A limited use obligation will protect the information voluntarily provided to or acquired or prepared by the ASD during an impacted entity's engagement in relation to a cybersecurity incident or vulnerability.

On 9 October, Minister Burke referred the package to the Parliamentary Joint Committee on Intelligence and Security. The committee has now handed down its report and recommended that, subject to the implementation of the recommendation in its report, the package be passed by parliament. To address recommendation 7 of the committee's report, these amendments clarify that information voluntarily provided to or required by or prepared by the Australian Signals Directorate in relation to cybersecurity incidents is not admissible against an impacted entity in certain criminal or civil proceedings. These amendments support the purpose of the limited use obligation to promote early and fulsome engagement with the ASD. The limited use obligation will bolster the ASD's abilities to mitigate harms in the early stages of cyber incidents, warn others of potential threats, provide incident management advice and assistance, and maintain a comprehensive national cyber threat picture.

This measure does not create a safe harbour for industry and will not exempt an organisation from complying with their existing legal and regulatory obligations. With this measure, alongside the establishment and clarification of the role of the National Cyber Security Coordinator, we will ensure government and industry can work together to communicate with clarity and confidence, making our responses more efficient and based on real-time insights. Cooperation on a national scale is one of Australia's greatest advantages against malicious cyberactivity, and I commend this bill to the House.

Question agreed to.

Bill, as amended, agreed to.

Ordered that this bill be reported to the House with amendments.