Australia’s cybersecurity bill should be passed urgently, parliamentary committee says
Australia’s Cyber Security Bill is subject to “urgent” parliamentary approval, provided some small changes are made.
Last month, Cybersecurity Minister Tony Burke proposed Australia’s first standalone cybersecurity legislation, which would introduce mandatory reporting for those who have paid ransom to bad actors, minimum cybersecurity standards for smart devices and the establishment of a Cyber Incident Review Board, all as part of seven sections of the Australian Cyber Security Strategy 2023-2030.
“The creation of a Cybersecurity law This is a long overdue step for our country and reflects the Government’s deep concern and focus on these threats,” Minister Burke told the media last month.
“This legislation ensures we keep pace with emerging threats, putting individuals and businesses in a better position to respond and rebound from cybersecurity threats.
“To achieve Australia’s vision of becoming a global leader in cybersecurity by 2030, we need a unified effort from government, industry and the community.”
Today, the Parliamentary Joint Committee on Intelligence and Security (PJCIS) said it “supports the urgent passage” of the Cybersecurity Bill as the country’s cybersecurity situation improves. and cyber resilience is an “urgent priority”.
“The committee recognizes that strengthening Australia’s cyber resilience and implementing the Australian Cyber Security Strategy 2023-2023 is an urgent priority of the Government and this Parliament,” said Senator Raff Ciccone, Chair. of the PJCIS.
“Noting the extensive consultation process that the Home Office has already carried out – and subject to the implementation of the recommendations in this report – the committee supports the urgent adoption of the legislative package.”
As part of its request for speedy passage of the bill, PJCIS also requested certain changes to the bill, particularly in relation to the proposed ransomware reporting obligations.
“The committee recommends that the Cyber Security Bill 2024 be amended to ensure that the proposed ransomware reporting obligations apply only to the extent that a ransomware incident is linked to the operations of the reporting business entity in Australia “, declared the PJCIS.
It also called for limits on the National Cybersecurity Coordinator’s use and sharing of ransom payment reports to be more clearly defined and for “ransomware reporting mechanisms to be as user-friendly and accessible as possible” to encourage companies to report voluntarily.
Furthermore, the PJCIS requested that the Bill, together with the Intelligence Services and Other Laws (Cybersecurity) Amendment Bill 2024, be amended to ensure that disclosure of ransom payments through of reports “does not constitute a subsequent waiver of legal professional secrecy”. and the provisions do not limit or affect any rights, privileges or immunities available to the reporting entity in respect of any proceeding.”
