Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Economics Legislation Committee

GRUNHARD, Mr Samuel, First Assistant Secretary, Critical Infrastructure Security, Department of Home Affairs


CHAIR: Welcome. Information on procedural rules governing public hearings has been provided to witnesses and is available from the secretariat. Answers to questions on notice are required by midday on 20 November. Do you wish to make any opening remarks?

Mr Grunhard : The department provided a submission to this inquiry, so I don't propose to make a further opening statement. There is just one thing I should point out about our submission. We noted in the submission some proposed upcoming amendments to the Security of Critical Infrastructure Act which were referred to in the submission. Since the time we prepared that submission, an exposure draft of the proposed bill has been released. That was released last Monday, the ninth. That's out for public consultation right now. That's a development that's referred to but has occurred, in fact, since we prepared that submission. Other than that, I'm happy to take your questions.

CHAIR: Just on that, now that we have an exposure draft in the public domain—and obviously an exposure draft is just that; it can change—can you talk us through the interaction with that and the foreign investment changes that we're talking about here today?

Mr Grunhard : You will see in the Treasury's proposed bill that there is a link to the definition of a national security business, which draws a link to the current Security of Critical Infrastructure Act, which came into force in 2018. That act currently covers the sectors of electricity, gas, water and maritime ports. That's not the extent of what government views to be critical infrastructure, but the provisions of that particular act only apply to those four sectors at present. What that means is, at present, the proposed link from the Foreign Acquisitions and Takeovers Act to the Security of Critical Infrastructure Act would apply to those four sectors. As we noted in our submission, though, the government put out a consultation paper on 16 August this year which detailed the government's desire to expand the sectors that the Security of Critical Infrastructure Act would cover, and the exposure draft that we've now released goes into quite a bit more detail, of course, about what's proposed there. That would expand the sectors that the Security of Critical Infrastructure Act covers, and that means that, should parliament pass both the amendments to the Foreign Acquisitions and Takeovers Act and the proposed amendments to the Security of Critical Infrastructure Act, then the references in the FATA to the Security of Critical Infrastructure Act would apply to an expanded conception of the sectors that are covered as critical infrastructure under that act.

CHAIR: Alright. We'll go to Senator O'Neill.

Senator O'NEILL: Thank you for coming this afternoon, Mr Grunhard. You were in the room for the evidence of our previous participants here, who were talking about many issues—a tax on business and all those sorts of things—but they also explained how ownership of a sugar port now means that their sugar-milling business, which they hope to diversify and include more ethanol as time passes, is now caught up as a matter of national security. I think they indicated to me that that was inexplicable to them—they can't understand why they're caught up in this. Perhaps that's an example you might like to speak to to give us a sense of why that would be the outcome of what's proposed and what is the rationale for that.

Mr Grunhard : I think I should defer to my good colleagues in Treasury about the legal niceties of the way the act will operate in particular circumstances, as I am obviously not across the details of the gentleman's business that he referred to. Certainly the government's made clear in the discussion paper that was released in August that it thinks we need to look at a broader range of sectors under the Security of Critical Infrastructure Act. I would note that ports are already covered by the acts, and there's no change proposed there. Indeed, foreign acquisitions that would involve ports, for example, that are over the monetary thresholds would already be coming to us for review.

Senator O'NEILL: So whether it's a port for trading sugar or whether it's a port of considerable national strategic importance, like Darwin, the net has been cast wide because it's considered a threat to national security, potentially? Is that correct?

Mr Grunhard : In respect of ports, there's no change proposed to the ports that the Security of Critical Infrastructure Act covers. When that act was introduced in 2018, it covered 20 named ports in section 11 of the act, and those ports remained named in that act. It's not proposed in the exposure draft that we expand the number of ports that would be covered by the Security of Critical Infrastructure Act. So there is no change being proposed at the moment to the ports coverage under the Security of Critical Infrastructure Act.

Senator O'NEILL: Okay. Could I go to item 225, which amends the Security of Critical Infrastructure Act. I understand that it directs the Minister for Home Affairs, for the purpose of section 32(3)(d), to ignore division 3 of part 3—the last resort powers—of the act. Section 32 of the Security of Critical Infrastructure Act deals with the direction that can be given by the minister if there's a risk of act or omission that would be prejudicial to security. How am I going so far?

Mr Grunhard : It sounds plausible so far.

Senator O'NEILL: Okay. In layman's terms, what is this? This is a special power for the Minister for Home Affairs to say, 'There's a problem here; I can jump in and do something pretty quickly if required'? Is that what goes on with this?

Mr Grunhard : In layman's terms, that's a good description of it. There are a number of antecedent requirements in the act before the minister could exercise that power, and amongst them is the requirement to consult with the first minister of the relevant state or territory, to consult with the business and to ensure that there's no other reasonable and proportionate means that could be used in the absence of a ministerial direction. It also requires the minister to satisfy himself or herself that there's no other legislative mechanism that would be more appropriate or would achieve the effect—effectively, that the Security of Critical Infrastructure Act would be the last resort.

Senator O'NEILL: So the home affairs minister has to be satisfied that there's no mechanism—you said 'legislative', but it could be a regulatory mechanism—

Mr Grunhard : Indeed.

Senator O'NEILL: of the Commonwealth or the state or territory that could be used to eliminate or reduce a perceived risk?

Mr Grunhard : That's right.

Senator O'NEILL: Once all that's done, item 225 gives the Minister for Home Affairs priority over the act and the ability to issue directions under section 32 of the SOCI Act?

Mr Grunhard : That's right.

Senator O'NEILL: Is that going to come into play if this legislation, as it's drafted, passes the parliament in the coming days?

Mr Grunhard : That's an existing provision in the Security of Critical Infrastructure Act—that ministerial directions power. What's being proposed, in my understanding—and I'm sure, again, that my Treasury colleagues will be able to speak in detail about this—is that we make sure we don't have two last resort powers pointing at each other and effectively declaring each other to be the last resort. Obviously, that would create a circular problem in the legislation. All that's being proposed here, effectively, is that the last resort power in the Foreign Acquisitions and Takeovers Act genuinely would be a last resort power and that the Minister for Home Affairs, when considering a direction under the Security of Critical Infrastructure Act, would need to be satisfied that there's no other mechanism that would be available short of the Foreign Acquisitions and Takeovers Act. So it would retain the Foreign Acquisitions and Takeovers Act as a genuine last resort and, effectively, the Security of Critical Infrastructure Act as the second-last resort, if that makes sense.

Senator O'NEILL: I think I get it. I like to do layman's terms because we're here as the people's representatives.

Mr Grunhard : And I'm not a lawyer, so layman's terms are very good.

Senator O'NEILL: Thank you very much. We have the Treasurer with these powers, and we also have the home affairs minister with these powers. So that they don't basically shoot each other with their powers, one of them has to have ascendancy. Who has it, if the legislation goes through?

Mr Grunhard : If the legislation goes through, then the Treasurer's last resort power would be the last resort, and he would need to be satisfied that no other mechanism could do the job, including the mechanism under the Security of Critical Infrastructure Act.

Senator O'NEILL: So the Treasurer still trumps the home affairs minister?

Mr Grunhard : I don't think it's a matter of 'trumps'; the Treasurer can't use that power unless he's satisfied that no other power would do the job.

Senator O'NEILL: So he could defer to the home affairs minister to do that job instead of doing it himself?

Mr Grunhard : It would be a matter for discussion between ministers about what the most appropriate mechanism would be, depending on the risk that was being discussed.

Senator O'NEILL: Depending on the risk or depending on the politics? Either one could impact the decision-making, couldn't it?

Mr Grunhard : I think the ministers would make decisions according to their—

Senator O'NEILL: A whole range of things?

Mr Grunhard : responsibilities and a whole range of things that would be on their minds, I'm sure.

Senator O'NEILL: If the Treasurer wanted to stay out of it, the home affairs minister could be the one who comes in and says, 'This is for a national security issue and I'm going to say that there's no other power; I'm going to use this and I'm going to shut this down'? He could do that?

Mr Grunhard : In a very extreme circumstance.

Senator O'NEILL: If this legislation goes through, we will have two ministers—the Treasurer and the home affairs minister—that can act as the point of last resort?

Mr Grunhard : Effectively—noting that, as I say, there's effectively a second-last resort and a last resort. I think the other important thing we should point out is that the Security of Critical Infrastructure Act, by its design, applies to critical infrastructure right across the country regardless of ownership; so it's ownership agnostic, effectively. It applies to domestic owned businesses just as much as it applies to foreign owned businesses. It serves quite a different purpose to the Foreign Acquisitions and Takeovers Act, which is only focused on that question of foreign ownership.

Senator O'NEILL: One of the things that all of our participants today have articulated is a love for the country and a determination that things should be done to make sure that Australia remains secure. Then, for the most part, they've gone on to say, 'I've got these concerns about the legislation and I'm advocating for no change, because it's going to cost us money, it's going to upset our current structures and there's going to be red tape.' That's the flavour, I think, of much of what we've heard today. No-one has been able to say that they have been convinced by the government that there is a major national security threat. ASPI gave evidence this morning that they believe that, but I don't think you could say that the participants here today are convinced that there's a massive national security threat—in fact, we had some commentary about perception versus reality. I'm wondering if this threat is mythical. You're from Home Affairs: what is so pressing that this legislation has to happen so quickly—within six weeks—and be implemented by the beginning of the year? What's going on, Mr Grunhard, that means that this has to happen at this pace?

Mr Grunhard : Obviously, I take our threat and intelligence advice from security and intelligence agencies. I don't have my own army of intelligence operatives. We're informed by agencies like ASIO—indeed, on the public record—that they are seeing very significant foreign state sponsored activity within our critical infrastructure sectors. Obviously my particular focus is critical infrastructure. You will see in the ASIO annual reports for the last couple of years that they have called out foreign-state activity targeting our critical infrastructure for the purposes of espionage, for potential coercion of the Australian government and potentially prepositioning for sabotage in times of heightened conflict. That's the advice we're receiving from security and intelligence agencies. My job is to assess those risks, on a case-by-case basis as they come to us, under the Foreign Acquisitions and Takeovers Act.

Senator O'NEILL: Mr Grunhard, perhaps you are one of the very few people who can give us a sense of—without any detail that would compromise anybody—what those critical pieces of infrastructure that you're talking about are, which foreign-state activists have been so engaged with that you believe they're setting up for espionage and prepositioning for perhaps an attack on Australia? Where is this happening?

Mr Grunhard : The sectors that government is particularly concerned about are laid out quite clearly in the consultation paper that was released in October and then the exposure draft of the bill that was released last Monday, on the 9th. Those sectors really include the sectors we've always considered to be critical infrastructure. The particular priority focus is on the telecommunications sector, as has been much discussed over the last couple of years; the energy sector; the banking; and finance sector. Obviously, we've seen the extreme criticality of the health sector at a time like this with all the challenges it's faced this year, and, indeed, we learnt about some of the vulnerabilities, regrettably, of the food and grocery sector during what has been a very challenging year. All of those sectors, amongst others, are sectors that the government's concerned about, and we receive reporting from security and intelligence agencies that those are the sectors that we should be concerned have appropriate measures in place to manage security risks, noting, of course, that foreign investment remains extremely important to Australia, and there will need to be continued foreign investment flows to support our prosperity. Everything we do within my division is designed to ensure that those foreign investment flows can continue to come into the country while we manage any national security risks that might arise.

Senator O'NEILL: We have heard evidence in other inquiries and today on the idea of favoured nations status, even though it's not really part of the formal considerations of the government, to the best of my knowledge. Where we have established liberal democracies that operate under the rule of law, one would assume there would be less risk. This piece of legislation doesn't make any differentiation; it's just all foreign investment. Is there a reason for that when you actually can already identify what you'd consider to be more hostile investors and, presumably, less hostile investors? What's your response to that observation?

Mr Grunhard : We assess all the cases that come to us under the act. On our website, we have a publicly stated methodology, which goes into the sorts of considerations we look at when we're assessing a particular case, and amongst those, of course, is the particular threat posed in a particular circumstance by the proposed buyer of a particular business or asset. That is absolutely one of the things we look at. Amongst other aspects of the transaction, we'll assess the risk that agencies believe is posed by the proposed purchaser of the asset. That's certainly something we look at. We think it's important that we have a country-agnostic approach, whereby all of those applications do come into the country under the act. Again, Treasury may be better placed to speak to Treasury and the government's views on that. But we receive all applications that are referred to us by Treasury under the act, and absolutely the risk profile in a case-by-case assessment is something we look at under our methodology.

Senator O'NEILL: Does it concern you that there is no definition of the national interest in this act?

Mr Grunhard : I think the Treasury and the Treasurer have been operating very effectively under the framework as it's presently designed, as it's presently proposed.

Senator O'NEILL: The factors that are considered are given weighting, if I'm correct, for national security—the extent to which they could affect Australia's ability, competition, other government policies, economy and community—and for the character of the investor. Are they the same sorts of tests that you apply?

Mr Grunhard : Those are the factors in the broad that the Treasurer turns his or her mind to when making a decision under the act. Our role is very much more limited. Within my division, the advice we provide is exclusively on the national security aspects. Our advice then goes to the Foreign Investment Review Board and ultimately to the Treasurer to inform his or her considerations of decisions to be made under the act, but we simply contribute the national security portion. Treasury deals with a range of what they call consult partners, of which we are one, and it would seek advice from other agencies about some of the other aspects. So we, for example, don't look at the taxation implications of a particular case. We only look at the national security aspects. Treasury then puts all of the advice together and presents it to the FIRB and the Treasurer.

Senator O'NEILL: Going back to espionage and prepositioning, what does that look like, Mr Grunhard? What's happening?

Mr Grunhard : The reports we receive from intelligence agencies are that foreign ownership is certainly not the only means by which a foreign state can pursue some of those ends but it is one of the means whereby they may gain access to sensitive information or sensitive assets. You can imagine that ownership of a company, access to all of its systems and data and control over the decisions it makes about who it uses to outsource some of its services—all of those sorts of controlling decisions—are things that can, in rare cases, be used by a foreign state to position for some of those activities we've just been discussing. It's certainly not the only way a foreign state can achieve those aims. Foreign ownership is one of the ways. The intention of the Foreign Acquisitions and Takeovers Act, and the role my division plays in assessing those cases, is to look at the risk of that occurring in a particular transaction. So we absolutely look on a case-by-case basis and give advice to the FIRB and the Treasurer about what the risks are in a particular case and how they could be mitigated in order to allow the transaction to proceed in a way that ensures the national security.

Senator O'NEILL: One of the concerns that I have is from the public report of the purchase of Alinta Energy. This is a classic infrastructure asset that's considered critical and would be one of the things you're looking after. It was given approval by the Treasurer—and the Treasurer at the time, I believe, was Mr Morrison—with conditions that were set and to be monitored by Treasury. Does it concern you that it's now four years later and the company has until the end of this year to actually complete its compliance? It has access over to 1.1 million Australians' data points—identification; even health status, for some of them—for the energy supply? Is that an example of prepositioning to potentially have the opportunity to interrupt service provision in Australia, or more insidious acts, at any point in time? Is that an example of the sorts of things you look at, Mr Grunhard?

Mr Grunhard : In the broad, it is. I won't speak to the detail of a particular asset or—

Senator O'NEILL: I don't know many, so I have to talk about the one that I know and understand. I'm asking you, in the broad: is that the kind of thing we're talking about?

Mr Grunhard : Yes. A large energy company would be a good example of an asset that holds both sensitive information about individuals, which could be used for espionage purposes, but also the availability of the services that that company offers. The continued availability, 24/7, of the electricity that that company provides is absolutely something of national security concern to the government and it's why energy is one of the sectors that's already covered by the Security of Critical Infrastructure Act. So you're right. You're touching there on both the availability of the service and the sensitivity of the data that they hold. We will often recommend that conditions be imposed on sales to deal with either, or both, of those aspects, depending on the particular asset and the particular circumstances. Both the availability of the service and the confidentiality of the information that it holds are of concern to us.

CHAIR: This will need to be your final question, Senator O'Neill.

Senator O'NEILL: Once the ownership is acquired, even if there is a very long period of achieving compliance—as I've indicated in that particular case—there are some suggestions about the way in which this proposed register might work. My understanding is it doesn't go back very far; it's proposed to be limited. It's also proposed that it won't be a public register and not everything will be on it. There are some concerns about that. Can I ask you for a response to that? And, seeing as this is my last question, can I tack on a couple of other bits about your view about the call-in power, the time frame and last resort elements that are in the bill?

Mr Grunhard : In regard to the register, I would say that that's certainly not the only information that's available to government. Particularly in my patch of critical infrastructure, we have a register of critical infrastructure assets which is held under the Security of Critical Infrastructure Act, and that is proposed to be expanded under the exposure draft that's out for consultation right now. So that would be a wealth of additional information that would be available to government specifically about critical infrastructure, not just foreign owned critical infrastructure but critical infrastructure in those sectors, whether Australian or foreign owned. I think you also asked me about the time frame on the call-in power—

Senator O'NEILL: Yes, and the last resort power.

Mr Grunhard : I think those powers are important mechanisms to ensure that the government has the ability to act should circumstances change or should new risks arise that the government wasn't otherwise aware of at the time that a particular transaction occurred. For example, a change in the international geopolitical environment that occasioned a change in the risk profile of a particular owner of an asset is the sort of thing that we're concerned to make sure that government has the ability to act on and not simply to be stuck with the judgement that was made at a particular point in time.

Senator O'NEILL: That's a different perspective of sovereign risk that is much more expanded than the one that many of the businesses are operating under, which is a risk to business practice. This is a risk to the nation.

Mr Grunhard : Indeed.

Senator O'NEILL: Chair, can I prevail on you to ask three really short questions with very short answers? Just give me another two or three minutes.

CHAIR: The trouble is you can never know what the answer's going to be!

Senator O'NEILL: I think these will be pretty quick ones. These aren't complex ones. Could you give me a sense of the role that you play in advising the Foreign Investment Review Board part of Treasury as it prepares to give advice for the Treasurer. And have you ever raised concerns with Treasury and the government about investments that actually aren't captured in the current foreign investment regime that perhaps are the triggers for why this legislation is coming through?

Mr Grunhard : I'll try to be brief. Our role is to provide advice on cases that are referred to us. We have agreed practices in place with Treasury whereby cases about critical infrastructure are referred to us, just as they refer cases on other matters to other parts of the government. We see a small subset of the cases that come in under the FATA, but an important subset that concerns critical infrastructure. Our role is advisory. We provide recommendations that go to the FIRB and the Treasurer, and ultimately decisions sit with the Treasurer. I think your second was about—

Senator O'NEILL: Investments not captured by the current regime. Is it a push from your department actually saying: 'Look, we haven't got the cover that we need. You need to get this legislation done. You need it done by 1 January'?

Mr Grunhard : I certainly don't dictate the government's timelines, but the—

Senator O'NEILL: Do you give them a sense of urgency about these matters, though?

Mr Grunhard : In our submission we noted that the zero-dollar threshold that's been in place through COVID has brought to light cases that we haven't previously seen in the sectors that we're concerned about, and that has increasingly convinced us, as we note in our submission, that there are sensitive assets, regardless of the dollar value, that we might need to take a careful look at. Indeed, some of the ones we've seen during this year are ones that we would have had concerns about had we have—

Senator O'NEILL: Had you known there was cumulative acquisition of different bits and pieces.

Mr Grunhard : Indeed. So in that sense the zero-dollar threshold has exposed some things to us that have been helpful.

Senator O'NEILL: My last one is: what extra resources have Home Affairs agencies been provided with to enact the changes to the regime? Are these going to be sufficient for the purpose? And do we have to do this by 1 January? Thanks, Chair.

Mr Grunhard : Treasury, as part of their budget measure, secured for us an additional nine ASL to deal with the potential increase in case load that might come to us under the act. We believe that will be sufficient to cover the case load that we might need to deal with.

Senator O'NEILL: Nine?

Mr Grunhard : I'm sorry, nine FTE.

Senator O'NEILL: Nine staff.

Mr Grunhard : Yes, nine staff.

Senator O'NEILL: For Treasury or—

Mr Grunhard : For Home Affairs to deal with the additional case load that we'll potentially have to deal with under the changes to the act.

Senator O'NEILL: Do you think this has to happen immediately?

Mr Grunhard : I think the timelines are a matter for government.

Senator O'NEILL: Thank you.

CHAIR: Very quickly, before you depart, I'm interested in this issue of critical infrastructure. Following on from the line of questioning that Senator O'Neill asked earlier, when you were talking about the information held by companies potentially being of concern, would that mean that a small tech company with an app that went viral would fall under critical infrastructure, or would it have to have an infrastructure component to it by definition?

Mr Grunhard : It would have to fall into one of our definitions of infrastructure. I don't think we consider things like app developers, important as they may be—

CHAIR: So information by itself can't stand alone to make something critical infrastructure?

Mr Grunhard : It's not the case that all information is equal; that's right. We're particularly concerned about personally identifiable information—aggregations of information about individuals, for example.

CHAIR: Okay. I'll explore that further with Treasury, but in the interests of time I will let you go. Thank you very much for your time today. We will pause there briefly.

Proceedings suspended from 14:50 to 15:06