Actual text of legislation as proposed (relevant areas buried in section 30DJ): https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;db=LEGISLATION;i

Actual text of legislation as proposed (relevant areas buried in section 30DJ): https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;db=LEGISLATION;id=legislation%2Fbills%2Fr6833_first-reps%2F0001;query=Id%3A%22legislation%2Fbills%2Fr6833_first-reps%2F0000%22;rec=0#63b0be7e9b834ed8acca126ab8c2e99c https://parlinfo.aph.gov.au/parlInfo/search/display/display.... This proposed legislation grants much wider powers directly to the Secretary of Home Affairs and allows them to demand the installation of arbitrary software on your systems which reports directly to the ASD (the Australian Signals Directorate - a branch of the Australian military). The choice of this software, and its configuration, is left to the Secretary's prerogative. There doesn't need to be reason to suspect anything - the system only need be related to operating systems of 'national significance'. This declaration of 'national significance' is, of course, the prerogative of the Secretary - for any reason the Secretary desires. I am not a legal professional, so my interpretation is based on my honest opinion and, admittedly relatively inexperienced, reading of the legislation. However, I do believe it to be quite clearly spelled out. Of particular concern to me, as a systems engineer, is the fact that the proposed law does not mandate that the software be compatible with the system in question, nor does it mandate the correctness of the software, nor does it indemnify the organisation against the results of failure, compromise or data loss as a result. Did they forget about the solarwinds incident already?! Further, the law does not appear to provide for the reimbursement of debugging issues related to the software installation or provide for a means of technical advisory or support for this software or a pathway to contest the particular software chosen. You could be stuck with a rootkit for which you have no one to ask for assistance in troubleshooting or for workarounds. This means is that your systems engineers and operations staff could be responsible for months of dealing with kernel panics caused by a mandatory rootkit exfiltrating data from your systems and running arbitrary code in your systems. So much for agility in deployments and systems updates. You can't do anything that might 'break' this software. There isn't even any definition of what it means to maintain the functionality of the software. Theoretically, if you interrupt the connection or the software's operation at all - even for maintenance or accidentally - you could be on the hook for violating the notice. Should those responsible for the system in question fail to install or maintain the software in providing reports directly to the ASD via an Internet connection they are also mandated to supply, 200 penalty units may be levied. That's the equivalent of $44,000 AUD. Multiple notices under the act may be issued and penalties applied for failure to comply with each notice! It could easily bankrupt an operator should the legislation be used as a politically motivated weapon. Remember, it does not appear to be required that the installation of the software and/or system specified in the notice even be possible. As such, if true, it is absolutely possible the secretary could issue a notice which is impossible to comply with fully. Please, if you'd be impacted by this legislation, contact your representative and get your organisation to submit a submission to the committee regarding this legislation via the article link. They've only permitted a few weeks for this feedback! It closes 3 March. They know it's a very short period and they're really trying to get this through under the radar. Don't let them.