# 26 Application of this Part

- (1) This Part applies if:
- (a) an incident has occurred, is occurring or is imminent; and
- (b) the incident is a cyber security incident; and
- (c) the incident has had, is having, or could reasonably be expected to have, a direct or indirect impact on a reporting business entity; and
- (d) an entity (the ***extorting entity***) makes a demand of the reporting business entity, or any other entity, in order to benefit from the incident or the impact on the reporting business entity; and
- (e) the reporting business entity provides, or is aware that another entity has provided on their behalf, a payment or benefit (a ***ransomware payment***) to the extorting entity that is directly related to the demand.
- (2) An entity is a ***reporting business entity*** if, at the time the ransomware payment is made:
- (a) the entity:
  - (i) is carrying on a business in Australia with an annual turnover for the previous financial year that exceeds the turnover threshold for that year; and
  - (ii) is not a Commonwealth body or a State body; and
  - (iii) is not a responsible entity for a critical infrastructure asset; or
- (b) the entity is a responsible entity for a critical infrastructure asset to which Part 2B of the *Security of Critical Infrastructure Act 2018* applies.
- (3) For the purposes of subparagraph (2)(a)(i), the ***turnover threshold*** is:
- (a) if a business has been carried on for only part of the previous financial year—the amount worked out in the manner prescribed by the rules; or
- (b) in any other case—the amount prescribed by, or worked out in the manner prescribed by, the rules.

Presumption

- (4) For the purposes of paragraph (1)(b), an incident (other than an incident covered by paragraph 9(2)(a) or (b)) is presumed to be a cyber security incident if:
- (a) the incident was probably effected, is probably being effected or could reasonably be expected to be effected, by means of a telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution (including, for example, by means of the internet); or
- (b) the incident has probably impeded or impaired, or is probably impeding or impairing or could reasonably be expected to impede or impair, the ability of a computer to connect to such a service; or
- (c) the incident has probably seriously prejudiced, is probably seriously prejudicing, or could reasonably be expected to prejudice:
  - (i) the social or economic stability of Australia or its people; or
  - (ii) the defence of Australia; or
  - (iii) national security.

Note: Paragraphs 9(2)(a) and (b) cover incidents involving critical infrastructure assets or the activities of corporations to which paragraph 51(xx) of the Constitution applies.

- (5) However, subsection (4) does not make an entity liable to a civil penalty under this Part if the incident:
- (a) was not in fact effected by means of a telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution (including, for example, by means of the internet); or
- (b) did not in fact impede or impair the ability of a computer to connect to such a service; or
- (c) did not in fact seriously prejudice:
  - (i) the social or economic stability of Australia or its people; or
  - (ii) the defence of Australia; or
  - (iii) national security.