Commonwealth Consolidated Acts

SECURITY OF CRITICAL INFRASTRUCTURE ACT 2018 - SECT 35AK

Scope

  (1)   This section applies if a Ministerial authorisation given under paragraph   35AB(2)(a) or (b) is in force in relation to:

  (a)   a cyber security incident; and

  (b)   an asset.

Direction

  (2)   If:

  (a)   an entity is a relevant entity for the asset; and

  (b)   the Secretary has reason to believe that the entity has information that may assist with determining whether a power under this Act should be exercised in relation to the incident and the asset;

the Secretary may direct the entity to:

  (c)   give any such information to the Secretary; and

  (d)   do so within the period, and in the manner, specified in the direction.

  (3)   The period specified in the direction must end at or before the end of the period for which the Ministerial authorisation is in force.

  (4)   The Secretary must not give the direction unless the Secretary is satisfied that:

  (a)   the direction is a proportionate means of obtaining the information; and

  (b)   compliance with the direction is technically feasible.

  (5)   The Secretary must not give a direction that would require an entity to:

  (a)   do an act or thing that would be prohibited by section   7 of the Telecommunications (Interception and Access) Act 1979 ; or

  (b)   do an act or thing that would be prohibited by section   108 of the Telecommunications (Interception and Access) Act 1979 ; or

  (c)   do an act or thing that would (disregarding this Act) be prohibited by section   276, 277 or 278 of the Telecommunications Act 1997 .

  (6)   Before giving a direction under this section to an entity, the Secretary must consult the entity unless the delay that would occur if the entity were consulted would frustrate the effectiveness of the direction.

Other powers not limited

  (7)   This section does not, by implication, limit a power conferred by another provision of this Act.