Explanatory Memorandum
(Circulated by authority of the Minister for Home Affairs, the Honourable Clare O'Neil MP)SCHEDULE 4 - Security vetting and security clearance related activities
Part 1 – Security clearance suitability assessments
286. This part would amend the ASIO Act to clarify the definition of terms used in that Act and enable the Director-General of Security to delegate their power or function to furnish non-prejudicial security clearance suitability assessments to an ASIO employee or ASIO affiliate irrespective of what position within ASIO the person holds.
287. These amendments are required to ensure the effective operation of ASIO's security vetting and security clearance related functions, taking into account the anticipated high volume of security clearance suitability assessments, while ensuring delegations remain commensurate with their impact on a clearance subject.
Australian Security Intelligence Organisation Act 1979
Item 1 Section 4 (paragraph (b) of the definition of security clearance suitability assessment )
288. This item would insert the words "(within the meaning of Part IVA)" after the reference to "security vetting agency" in the definition of security clearance suitability assessment. This would clarify that the reference to "security vetting agency" takes its meaning from Part IVA.
Item 2 At the end of paragraph 16(1C)(b)
289. This item would insert the words "that is a prejudicial security clearance suitability assessment (within the meaning of Part IVA)" after paragraph 16(1C)(b).
290. The effect of this amendment would be to maintain that the Director-General of Security can only delegate the power or function under subsection 82D(1) to furnish a prejudicial security clearance suitability assessment under paragraph 82C(1)(d) to ASIO employees or ASIO affiliates who hold, or who are acting, in a position in ASIO that is equivalent to or higher than an Executive Level 1 (EL 1) position.
291. As a consequence of this amendment to subsection 16(1C), subsection 16(1B) would allow the Director-General of Security to delegate their power or function to furnish non-prejudicial security clearance suitability assessments under paragraph 82C(1)(d) to an ASIO employee or affiliate regardless of the substantive level of the position they hold. This could include an ASIO employee or ASIO affiliate who is not in a substantive position that is equivalent to an EL1.
292. The purpose of this item is to ensure ASIO's continued ability to expeditiously complete non-prejudicial security clearance suitability assessments. These changes are to ensure that ASIO is able to meet security clearance demand in a way which is scalable and commensurate to the impact such assessments and decisions could have on a person.
293. ASIO's Annual Report 2022-23 shows ASIO finalised 35,055 personnel security assessment referrals for the year. Requiring every one of these assessments to be approved by an EL1 officer can be expected to cause significant delays in ASIO's personnel security clearance processes.
294. Additionally, the exercise of the power or function to furnish prejudicial security clearance suitability assessment remains with an EL1 officer, noting such an outcome has an adverse impact on the subjects. The subjects' eligibility for certain roles can be curtailed, or their ability to continue to hold their existing role could be jeopardised. Non-prejudicial assessments, on the other hand, represent good news for the subjects — non-prejudicial decisions allow subjects access to certain employment opportunities or job roles they would not otherwise have. Therefore, because non-prejudicial assessments do not have an adverse outcome for the subject, they should not need to be subject to the same higher levels of approval. The Inspector-General of Intelligence and Security will also continue to have oversight of ASIO's security clearance suitability assessments, ensuring the legality and propriety of their conduct.
295. Finally, notwithstanding that under this amendment the delegation to issue non-prejudicial security clearance suitability assessments can be made regardless of the rank held, ASIO can be expected to continue to maintain appropriate internal management oversight and scrutiny of its security assessment processes, including in relation to non-prejudicial decisions. Employees and affiliates exercising the delegated function or power, regardless of substantive position, can be expected to have suitable training and experience to make non-prejudicial decisions, proportionate and appropriate to the significance of the decision being made. Maintaining the requirement for approval of non-prejudicial security assessments at EL1 is therefore both unnecessary and undesirable, and this amendment would ensure that ASIO is able to meet security clearance demand in a way which is scalable and commensurate to the impact such assessments and decisions could have on a person.
Item 3 At the end of subsection 16(1C)
296. This item would insert a note at the end of subsection 16(1C) that the Director-General of Security may under subsection 16(1B) delegate their power or function under subsection 82D(1) to furnish non-prejudicial security clearance suitability assessments. This item would assist with readability of subsection 16(1C) and is consequential to the amendment made by Item 2.
Item 4 Application of amendments
297. This item would provide that the amendments made by this part apply only in relation to security clearance suitability assessments furnished on or after the commencement of this item.
Part 2 – Delayed assessments and security clearance decisions
298. This part would amend the ASIO Act to require ASIO to cause the Inspector-General of Intelligence and Security to be notified of certain security clearance decisions and security clearance suitability assessments not made within 12 months from when ASIO commences consideration of the decision or preparation of the suitability assessment.
299. This part would respond to recommendation 199 of the Comprehensive Review.
Australian Security Intelligence Organisation Act 1979
Item 5 Subsection 82A
300. This item would insert a definition of "delayed security clearance decision" and "delayed security clearance suitability assessment" into section 82A. The effect of this item would to refer the reader to the definitions at subsections 82GA(1) and (2).
Item 6 Subsection 82B (after the paragraph beginning "There are some limitations")
301. This item would insert in the simplified outline of Part IVA, that the Director-General of Security must cause the Inspector-General of Intelligence and Security to be notified of delayed security clearance decisions and delayed security clearance suitability assessments and that the Director-General must make a protocol for dealing with such decisions and suitability assessments.
Item 7 At the end of Division 2 of Part IVA
302. Subsection 82GA(1) would provide that if a security clearance decision is not made under Part IVA within 12 months after ASIO starts to consider making the decision, the Director-General of Security must cause the Inspector-General of Intelligence and Security to be notified of the delayed security clearance decision. These security clearance decisions are defined as "delayed security clearance decisions". The method by which the Director-General may cause the Inspector-General of Intelligence and Security to be notified is not prescriptive, but may include directing an ASIO employee or ASIO affiliate, developing policies and procedures requiring a person holding a particular position to do the notifying, or set up processes (including automated processes) to cause the notification.
303. The note to subsection 82GA(1) would direct the reader to subsection 82GB(1) which provides that a protocol must be made under that subsection, and specify when ASIO is taken to have started to consider making a security clearance decision, which may be specified differently for different classes of security clearance decisions (referencing subsections 82GB(3) and (4)).
304. Subsection 82GA(2) would provide that if a security clearance suitability assessment is not furnished under Part IVA within 12 months after ASIO starts to prepare the suitability assessment, the Director-General of Security must cause the Inspector-General of Intelligence and Security to be notified of the delayed security clearance suitability assessment. These security clearance suitability assessments are defined as "delayed security clearance suitability assessments". The method by which the Director-General may cause the Inspector-General of Intelligence and Security to be notified is not prescriptive, but may include directing an ASIO employee or ASIO affiliate, developing policies and procedures requiring a person holding a particular position to do the notifying, or set up processes (including automated processes) to cause the notification.
305. The Note to subsection 82GA(2) would direct the reader to subsection 82GB(1) which provides that a protocol must be made under that subsection, and specify when ASIO is taken to have started to prepare a security clearance suitability assessment, which may be specified differently for different classes of security clearance suitability assessments (referencing subsections 82GB(3) and (4)).
306. Subsection 82GA(3) would provide that the notification under subsections 82GA(1) and (2) must be made within the period specified, for the purposes of subparagraph 82GB(3)(b)(i), include the information specified in the protocol as required by subparagraph 82GB(3)(b)(ii), and comply with any other requirements specified in the protocol for the purposes of paragraph 82GB(3)(d). The reference to the protocol in subsection 82GA(3) is a reference to the protocol made under subsection 82GB(1) as in force from time to time (i.e. at the time the notification is made).
307. Subsection 82GA(4) would set out exceptions to the requirement to notify. Paragraph 82GA(4)(a) would provide that notification would not be required where ASIO has been notified that a security clearance decision or security clearance suitability assessment is no longer required. For example, a security vetting agency may notify ASIO that an applicant for a role in the Police Service of a State has withdrawn from the recruitment process.
308. Paragraph 82GA(4)(b) would provide an exception to the requirement to notify where ASIO has initiated the making of the decision or preparation of the suitability assessment, without a request for the decision or suitability assessment being made by another Commonwealth agency, a State or an authority of a State. This exception allows for where ASIO, in the course of performing its functions, might self-initiate enquiries to establish whether an existing security clearance holder should continue to hold a security clearance. As this would be done internally by ASIO, without the subject, or another security vetting agency being aware, it may be unnecessary for the decision or assessment to be made or furnished within 12 months and therefore notification to the Inspector-General of Intelligence and Security would not be appropriate in the circumstances.
309. Subsection 82GA(5) would set out the application of section 82GA.
310. It would provide that section 82GA applies to a security clearance decision that ASIO starts to consider making on or after the commencement of section 82GA.
311. It would also provide that section 82GA applies to a security clearance suitability assessment that ASIO starts to prepare on or after the commencement of section 82GA.
312. Subsection 82GB(1) would require the Director-General of Security to make a written protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments.
313. Note 1 to subsection 82GB(1) would alert the reader to subsection 33(3) of the Acts Interpretation Act 1901, which provides that where an Act confers a power to make an instrument, the power includes a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend, or vary any such instrument. This would confirm the power for the Director-General of Security to repeal, rescind, revoke, amend or vary a protocol made under subsection 82GB(1). For the avoidance of doubt, the Director-General of Security would be required to consult with the Inspector-General of Intelligence and Security before repealing, rescinding, revoking, amending or varying the protocol.
314. Note 2 to subsection 82GB(1) would note that such a protocol may be combined with a protocol made under subsection 42(1), which relate to delayed security assessments.
315. Subsection 82GB(2) would provide that the Director-General of Security must consult with the Inspector-General of Intelligence and Security before making a protocol under subsection 82GB(1).
316. Subsection 82GB(3) would set out what can, and must be dealt with in a protocol.
317. Paragraph 82GB(3)(a) provides that the protocol must specify when ASIO is taken to have started to consider making a security clearance decision or prepare a security clearance suitability assessment.
318. The information that is required for ASIO to undertake security vetting and security clearance related activities in accordance with Part IVA can vary considerably depending on a range of factors, including the level of clearance, the person's background and history, and whether the person has previously held a security clearance and at what level. Different circumstances may require more information to be collected before ASIO is able to start to consider the security clearance decision or prepare the security clearance suitability assessment. This paragraph would enable greater flexibility to deal with different classes of security clearance decisions and security clearance suitability assessments, to ensure ASIO is not required to notify the Inspector-General of Intelligence and Security of delays in the furnishing of security clearance decisions and security clearance suitability assessments when the delays are a result of matters that are beyond ASIO's control.
319. Paragraph 82GB(3)(b) would provide that the protocol must specify the period in which notification of a delayed security clearance decision or security clearance suitability assessment must be made, and the information to be included in the notification. These matters will necessarily engage questions of ASIO's internal processes and procedures which are classified. It is therefore necessary they be included in the protocol and not made public or set out in legislation.
320. Paragraph 82GB(3)(c) would provide that the protocol must deal with steps to be taken by ASIO in relation to delayed a security clearance decision or delayed security clearance suitability assessment, after the notification under section 82GA is made. The purpose of the paragraph is to ensure the protocol includes steps to be taken beyond merely notifying the Inspector-General of Intelligence and Security of a delayed security clearance decision or delayed security clearance suitability assessment. Such steps could include providing an explanation to Inspector-General of Intelligence and Security of the reasons for taking longer than 12 months, directions to take steps as set out in relevant policies or procedures, or requiring relevant senior executive officers to be briefed
321. Paragraph 82GB(3)(d) would provide that the protocol may specify other requirements, or deal with any other matters that relate to a delayed security clearance decision or delayed security clearance suitability assessment, or the notification of the decision or suitability assessment under section 82GA, and that the Director-General of Security considers appropriate.
322. Subsection 82GB(4) would provide that the protocol may provide differently for different classes of security clearance decisions or security clearance suitability assessments. For example, the protocol may provide differently for a Baseline clearance than a Positive Vetting clearance, or between a person who is a new applicant for a security clearance and an existing security clearance holder.
323. Subsection 82GB(5) would provide that a protocol made under subsection 82GB(1) is not a legislative instrument. This provision would exempt the protocol from being a legislative instrument under the Legislation Act 2003.
324. ASIO's security vetting and security clearance related activities, including its processes are classified on the basis that it is necessary to keep this information confidential to avoid exploitation by hostile groups. If information pertaining to ASIO's requirements and methodology were made public, entities could study those processes and develop systems and approaches to exploit the security vetting and security clearance process. As such, it would not be appropriate for this information to be included in a legislative instrument, which would make the instrument public.
325. Noting the types of information that are likely to be included in the protocol, including how ASIO manages different classes of security clearance decisions and security clearance suitability assessments, and the types of information ASIO requires to be able to perform its functions, the protocol will need to be classified in order to operate as intended. It therefore would not be suitable for inclusion in a legislative instrument, which would be available to the general public. That the protocol is subject to consultation with the Inspector-General of Intelligence and Security, and its implementation will be monitored by the Inspector-General of Intelligence and Security, provides a safeguard to ensure the protocol is appropriately configured to the underlying purpose of promoting ASIO being accountable in respect of delayed security clearance decisions and delayed security clearance suitability assessments.
326. Subsection 82GB(6) would provide that ASIO must in relation to a delayed security clearance decision or delayed security suitability assessment to which subsections 82GA(1) or (2) applies, comply with a protocol made under subsection 82GB(1) as it force from time to time.