No CrossRef data available.
We use cookies to distinguish you from other users and to provide you with a better experience on our websites. Close this message to accept cookies or find out how to manage your cookie settings.
We use cookies to distinguish you from other users and to provide you with a better experience on our websites. Close this message to accept cookies or find out how to manage your cookie settings.
Published online by Cambridge University Press: 01 January 2025
An Australian Offensive Cyberspace Operations (OCO) capability has emerged as an important sub-component of national power. While significant academic literature exists concerning OCO’s place within the international law of armed conflict, and international law in general, literature regarding domestic law is scarce. Nevertheless, an understanding of the domestic law governing the Australian Defence Force’s (ADF’s) authority to conduct OCO is necessary as the gap in the research potentially exposes the Government and individuals to legal risks that are not well understood. The aim of this article is to analyse the proprietary and constitutional implications of ADF OCO to inspire further research at a time when the Comprehensive review of the legal framework governing the National Intelligence Community is underway. The qualitative research analyses statutory and case law authorities to argue that Australian proprietary and constitutional law creates important implications for ADF OCO. The analysis suggests that these implications oblige the Commonwealth to be careful in balancing its legislative and executive power to provide the ADF with the legal authority to conduct OCO. The research finds that OCO impinges upon the proprietary rights of others, requiring legal authority which, if created under statute, generates an obligation to compensate proprietors under just terms. However, if the authority arises under the executive power, then the obligation to compensate may not apply. Further, such executive powers may exist under a royal war prerogative. As a corollary, we suggest that in an escalated conflict environment, the ADF may be able to conduct OCO without any legislative amendments to the criminal law although express immunities would be preferred.
The views expressed in this article are those of the two contributors, and not necessarily those of the Australian Army or the Department of Defence. The article contemplates what is legally possible only and not current ADF capability or future intended capability or policy.
1. Department of Defence, Defence 2000: Our Future Defence Force (Commonwealth Government Publishing Service, 2000) 12 <http://www.defence.gov.au/publications/wpaper2000.pdf>.
2. See Malcolm Turnbull, ‘Launch of Australia’s Cyber Security Strategy’ (Speech, 21 April 2016) <https://www.malcolmturnbull.com.au/media/launch-of-australias-cyber-security-strategy>; Commonwealth, Parliamentary Debates, House of Representatives, 23 November 2016, 4095 (Malcolm Turnbull).
3. See (n 2); see also Department of Foreign Affairs and Trade, Australia’s International Cyber Engagement Strategy: International Security and Cyberspace (4 October 2017) 44–55 <https://dfat.gov.au/international-relations/themes/cyber-affairs/aices/pdf/DFAT%20AICES_AccPDF.pdf>.
4. Fergus Hanson and Tom Uren, ‘Policy Brief: Australia’s Offensive Cyber Capability’ (Policy Brief, Australian Strategic Policy Institute International Cyber Policy Centre, 10 April 2018) <https://www.aspi.org.au/report/australias-offensive-cyber-capability>.
5. Ibid 6.
6. This article will hereafter refer to ‘offensive actions’ as the malicious insertion of code by an individual or organisation. Offensive actions need not rise to the level constituting a use of force.
7. See, eg, Adam Gordon and Steven Hernandez, Official (ISC)2 Guide to the SSCP CBK (John Wiley and Sons Inc, 4th ed, 2016) 547–51.
8. Ibid 590–8.
9. Ibid.
10. See Abraham Silberschatz, Peter Baer Galvin and Greg Gagne, Operating System Concepts (John Wiley and Sons Inc, 9th ed, 2013) 7–16, 106–7 for an explanation of how malicious code may be executed on another’s computer to perform work for the malicious cyber actor.
11. CompuServe Inc v Cyber Promotions Inc, 962 F Supp 1015 (SD Ohio, 1997) (‘CompuServe’); Century 21 Canada LLP v Rogers Communications Inc (2011) 335 DLR (4th) 32.
12. United States Constitution amend V.
13. Constitution of India arts 300A, 31A(1).
14. Constitution of the Independent State of Papua New Guinea s 53(1)–(2).
15. Burmah Oil Co (Burma Trading) Ltd v Lord Advocate [1965] AC 75 (‘Burmah Oil’); War Damage Act 1967 (UK) s 1.
16. Australian Constitution s 51(xxxi).
17. Ibid s 51(vi); Johnston Fear & Kingham & The Offset Printing Company Pty Ltd v Commonwealth (1943) 67 CLR 314 (‘Johnston Fear & Kingham’); Minister of State for the Army v Dalziel (1944) 68 CLR 261 (‘Dalziel’).
18. Johnston Fear & Kingham (1943) 67 CLR 314, 318–19 (Latham CJ); Dalziel (1944) 68 CLR 261, 280 (Latham CJ); Shaw Savill & Albion Co Ltd v Commonwealth (1940) 66 CLR 344, 362–3 (Dixon J).
19. Yanner v Eaton (1999) 201 CLR 351.
20. Dalziel (1944) 68 CLR 261, 285 (Rich J); Yanner v Eaton (1999) 201 CLR 351, 366 (Gleeson CJ, Gaudron, Kirby and Hayne JJ).
21. Penfolds Wines Pty Ltd v Elliot (1946) 74 CLR 204, 226 (Dixon J).
22. Entick v Carrington (1765) 95 ER 807; Perry v Clissold [1907] AC 73; Plenty v Dillon (1991) 171 CLR 635.
23. See, eg, Australian Provincial Assurance Co Ltd v Coroneo (1938) 38 SR (NSW) 700; Holland v Hodgson (1872) LR 7 CP 328; Reid v Smith (1906) 3 CLR 656 and associated cases.
24. CompuServe, 962 F Supp 1015 (SD Ohio, 1997).
25. American Law Institute, Restatement (Second) of Torts (American Law Institute, 1965) vol 1, §§ 217–21.
26. CompuServe, 962 F Supp 1015 (SD Ohio, 1997) 1017 (Graham J).
27. Century 21 Canada LLP v Rogers Communications Inc (2011) 335 DLR (4th) 32 [283]–[299].
28. Ibid [299] (Punnett J).
29. Platt v Nutt (1988) 12 NSWLR 231, 248–9 (Clarke JA, Hope JA agreeing at 243[A], Kirby P disagreeing at 240[C]); Hillier v Leitch [1936] SASR 490; Hutchins v Maughan [1947] VLR 131.
30. American Law Institute (n 25) § 217; Century 21 Canada LLP v Rogers Communications Inc (2011) 335 DLR (4th) 32 [129].
31. Hutchins v Maughan [1947] VLR 131.
32. Reynolds v Clarke (1795) 93 ER 747 (while the case was reported in Strange’s King’s Bench Reports in 1795, it was decided in George I’s 12th regnal year, 1725).
33. Ibid 748.
34. Leame v Bray (1803) 102 ER 724; Scott v Shepherd (1773) 96 ER 525.
35. Hillier v Leitch [1936] SASR 490, 494–5 (Cleland J).
36. Platt v Nutt (1988) 12 NSWLR 231, 245 (Clarke JA, Hope JA agreeing at 243[A]); see also Blacker v Waters (1928) 28 SR (NSW) 406.
37. Scott v Shepherd (1773) 96 ER 525.
38. Ibid 529 (De Grey CJ, Nares and Gould JJ agreeing, Blackstone J dissenting) (emphasis added).
39. Platt v Nutt (1988) 12 NSWLR 231, 245; Hillier v Leitch [1936] SASR 490, 495–6.
40. CompuServe, 962 F Supp 1015 (SD Ohio, 1997) 1021.
41. See William J Lynn III, ‘Defending a New Domain: The Pentagon’s Cyberstrategy’ (2010) 89(5) Foreign Affairs 97, 97–108; Joel Brenner, America the Vulnerable: Inside the New Threat Matrix of Digital Espionage, Crime, and Warfare (Penguin Press, 2011).
42. See Brenner (n 41) 102–5.
43. Where this is in question, a plaintiff would be best advised to follow the rule in Williams v Milotin (1957) 97 CLR 465.
44. (1984) 155 CLR 1.
45. Ibid 7 (Gibbs CJ, Mason, Wilson and Deane JJ).
46. CompuServe, 962 F Supp 1015 (SD Ohio, 1997) 1024.
47. Australian Constitution s 69.
48. Ibid s 68.
49. Ibid s 70.
50. Ibid s 114.
51. Joseph v Colonial Treasurer of NSW (1918) 25 CLR 32.
52. Australian Constitution ss 51(vi), 51(xxxii).
53. Defence Act 1903 (Cth) s 8.
54. Ibid s 9(1).
55. Lane v Morrison (2009) 239 CLR 230; see also CPCF v Minister for Immigration and Border Protection (2015) 255 CLR 514, 536–8, 541–2 (French CJ), 561–3 (Hayne and Bell JJ) for dicta on the chain of command generally (‘CPCF’).
56. A v Hayden (1984) 156 CLR 532; Bill of Rights 1688, 1 Wm & M sess 2, c2, s XII; Case of Captain C (1726) 86 ER 167; see generally Clough v Leahy (1904) 2 CLR 139.
57. Defence Force Discipline Act 1982 (Cth); Re Tracey; ex parte Ryan (1989) 166 CLR 518.
58. Australian Constitution s 51(vi); Clunies-Ross v Commonwealth (1984) 155 CLR 193.
59. (1916) 21 CLR 433.
60. Ibid 453.
61. Ibid 458.
62. Ibid 449.
63. Ibid 442.
64. Australian Communist Party v Commonwealth (1951) 83 CLR 1, 194 (Dixon J).
65. Thomas v Mowbray (2007) 233 CLR 307.
66. Australian Communist Party v Commonwealth (1951) 83 CLR 1.
67. Australian Constitution s 51(xxxi); Johnston Fear & Kingham (1943) 67 CLR 314; Clunies-Ross v Commonwealth (1984) 155 CLR 193.
68. Johnston Fear & Kingham (1943) 67 CLR 314, 325 cf 329 (McTiernan J); Andrews v Howell (1941) 65 CLR 255, 268 (Starke J) (Rich ACJ, Dixon and McTiernan JJ not discussing this point).
69. Dalziel (1944) 68 CLR 261, 290 (Starke J).
70. Ibid 295 (McTiernan J).
71. Bank of New South Wales v Commonwealth (1948) 76 CLR 1, 222 (Latham CJ), 344 (Dixon J) (with respect to shares registered in the UK and NZ, as well as real property situated in these two countries) (‘Bank Nationalisation Case’).
72. See Tran v Commonwealth (2010) 187 FCR 54, 60 (Rares J), 101, 107 (Besanko J); Jeffrey v DPP (Cth) (1995) 79 A Crim R 514, 517–18 (Cole AJA, Handley JA and Giles AJA agreeing).
73. See, eg, Sir Matthew Hale, The History of the Common Law (Henry Butterworth Law Booksellers, 6th ed, 1820) 42–3; Sir William Blackstone, Commentaries on the Laws of England (John Murray Publishers, 4th ed, 1876) vol 1, 381.
74. Petition of Right 1627, 3 Car 1 c 1, ss 7–8.
75. See eg De Keyser’s Royal Hotel v A-G [1920] AC 508 (‘De Keyser’s’).
76. Farey v Burvett (1916) 21 CLR 433, 452 (Isaacs J), see also 440 (Griffith CJ); Australian Communist Party v Commonwealth (1951) 83 CLR 1, 230 (Williams J); Barton v Commonwealth (1974) 131 CLR 477.
77. Cameron Moore, Crown and Sword: Executive Power and the Use of Force by the Australian Defence Force (Australian National University Press, 2017) ch 1; Cheryl Saunders, ‘The scope of Executive Power’ (Research Paper No 59, Parliamentary Library, Parliament of Australia, April 2013) s 4. See also Thomas Pool, ‘The strange death of the prerogative in England’ (2018) 43(2) University of Western Australia Law Review 41 for a discussion on the implications for the UK executive power.
78. Ruddock v Vadarlis (2001) 110 FCR 491, 539.
79. Ibid 540.
80. Ibid 495–6.
81. CPCF (2015) 255 CLR 514.
82. Ibid 538.
83. Ibid 595–601.
84. Ibid 644.
85. Ibid 565–6.
86. Pape v Federal Commissioner of Taxation (2009) 238 CLR 1, 60 (emphasis added).
87. Brown v Tasmania (2017) 261 CLR 328, 450, n 394 (albeit paraphrasing the statutory language of the Police Offences Act 1935 (Tas) s 73(1)).
88. Theodore v Duncan (1919) 26 CLR 276, 282 (in the Privy Council, per curiam), quoted approvingly in the seminal case for constitutional literalism Amalgamated Society for Engineers v Adelaide Steamship Company Ltd (1920) 28 CLR 129, 143 (Knox CJ, Isaacs, Rich and Starke JJ).
89. Australian Constitution s 61; CPCF (2015) 255 CLR 514, 566 (Hayne and Bell JJ).
90. De Keyser’s (1920) AC 508.
91. Barton v Commonwealth (1974) 131 CLR 477, 488 (Barwick CJ), 501 (Mason J), 491 (McTiernan and Menzies JJ), 508 (Jacobs J); see also Ruddock v Vadarlis (2001) 110 FCR 491, 540 (French J, Beaumont J agreeing).
92. Defence Act 1903 (Cth) pt VIA s 72R provides compensation in the event of acquisition of property, but only in respect to security of Defence premises, not generally. Section 72TJ provides a similar requirement with respect to security of the Woomera Training Area. An exception may be airports’ cyberspace infrastructure under the Airports Act 1996 (Cth) ss 250–1.
93. Intelligence Services Act 2001 (Cth) (‘ISA’).
94. De Keyser’s (1920) AC 508, 514; Joseph Chitty, A treatise on the law of prerogatives of the Crown (Joseph Butterworth and Son, 1820) 49–50; R v Hampden (1637) 3 How St Tr 825.
95. Johnston Fear & Kingham (1943) 67 CLR 314, 318–19; Dalziel (1944) 68 CLR 261, 280.
96. Dalziel (1944) 68 CLR 261.
97. Clunies-Ross v Commonwealth (1984) 155 CLR 193, 202.
98. Shaw Savill and Albion Co Ltd v Commonwealth (1940) 66 CLR 344, 362–3.
99. Farey v Burvett (1916) 21 CLR 433, 452 (Isaacs J); CPCF (2015) 255 CLR 514, 538 (French CJ).
100. Burmah Oil (1965) AC 75.
101. Ibid: Lord Reid, Lord Pearce and Lord Upjohn in the majority, Viscount Radcliffe and Lord Hodson in dissent.
102. Burmah Oil (1965) AC 75, 111 (Lord Reid), 134 (Viscount Radcliffe), 141–2 (Lord Hodson), 144 (Lord Pearce), 165–6 (Lord Upjohn).
103. Ibid 133 (Viscount Radcliffe), 139 (Lord Hodson).
104. Ibid 110 (Lord Reid).
105. Parker v The Queen (1961) 111 CLR 610, 632–3 (Dixon CJ, Taylor, Menzies, Windeyer and Owen JJ agreeing); Cook v Cook (1986) 162 CLR 376, 390 (Mason CJ, Wilson, Deane and Dawson JJ); see also CPCF (2015) 255 CLR 514, 538 [42] (French CJ).
106. Clunies-Ross v Commonwealth (1984) 155 CLR 193, 202.
107. (1606) 77 ER 1294 (‘Saltpetre’).
108. Ibid.
109. Ibid 1295.
110. Ibid.
111. Ibid.
112. Ibid.
113. Ibid 1296.
114. Ibid.
115. Ibid 1295–6.
116. Burmah Oil (1965) AC 75, 102[F] (Lord Reid), 120[C] (Viscount Radcliffe), 151[D-E] (Lord Pearce).
117. Chitty (n 94) 213; Blackstone (n 73) 262.
118. Burmah Oil (1965) AC 75, 99.
119. Ibid 122.
120. Criminal Code Act 1995 (Cth) sch 1 (‘Commonwealth Criminal Code’). See also Criminal Code 1899 (Qld) s 408E; Crimes Act 1900 (NSW) pt 6; Crimes Act 1958 (Vic) div 3(6); Criminal Code Act Compilation Act 1913 (WA) app B sch 1 s 440A (‘Criminal Code 2013 (WA)’); Criminal Law Consolidation Act 1935 (SA) pt 4A; Criminal Code Act 1983 (NT) pt VII div 10; Criminal Code Act 1924 (Tas) sch 1 ch XXVIIIA (‘Criminal Code 1924 (Tas)’); Criminal Code 2002 (ACT) pt 4.2. See also the Telecommunications Intercept and Access Act 1979 (Cth).
121. Commonwealth Criminal Code pt 10.7.
122. Ibid pt 10.6.
123. Ibid s 473.1; Telecommunications Act 1997 (Cth) s 7.
124. Telecommunications Act 1997 (Cth) pt 3.
125. Ibid s 22(4).
126. See PCR v The Queen [2013] VSCA 224; R v Giaccio [1997] SASC 6103; Chao v Chao [2008] NSWSC 584.
127. Telecommunications (Interception and Access) Act 1979 (Cth) s 108 (‘TIAA’).
128. Ibid s 5 (emphasis added).
129. Telecommunications Act 1997 (Cth) pt 3.
130. For further state and territory computer offence provisions see (n 120).
131. Commonwealth Criminal Code ss 477.1, 477.2, 477.3.
132. Ibid s 478.1.
133. Ibid s 478.2.
134. Ibid s 478.3.
135. Explanatory Memorandum, Cybercrime Bill 2001 (Cth) sch 1 item 4.
136. See DPP v Boyton [2015] VCC 1341 [113] with respect to equivalent Victorian provisions; the sentence was approved on appeal at Boyton v The Queen [2016] VSCA 13.
137. Commonwealth Criminal Code ss 476.3, 15.1.
138. Specified as Australian Secret Intelligence Service, Australian Signals Directorate and Australian Geospatial-Intelligence Organisation in the Commonwealth Criminal Code s 476.5(3).
139. Ibid s 476.5(1). This provision (and s 476.5(2)) is likely sufficient protection against liability under the State and Territory Acts: see above Part V(A); see also Australian Constitution ss 51(v), 51(vi), 109.
140. See, eg, Commonwealth Criminal Code ss 473.1, 474.6(7), 474.7(3), 474.8(5), 474.9(5).
141. Ibid s 476.5(2).
142. Ibid s 476.5(3).
143. ISA s 7(a)–(c), (e).
144. Ibid s 7(d).
145. Ibid s 11(2).
146. Ibid s 12.
147. Ibid s 7(a). Eg, shaping target behaviours towards using less secure systems.
148. Ibid s 7(c). Eg, by conducting damage assessment or mitigation after cyberspace attacks against Commonwealth, State or Territory government systems.
149. See, eg, Chris Hanna, ‘Cyberspace Operations and the 2009 Defence White Paper: Positioning the Australian Defence Organisation to Be Effective, Transparent and Lawful’ (2009) 5(4) Security Challenges 103, 103–17.
150. ISA s 12.
151. Ibid s 7(d). See Hanna (n 149) 110–11.
152. ISA s 7(d). Hanna (n 149) 111, argues that this broader interpretation is possible but better grounded on an express legislative amendment.
153. Intelligence Services Legislation Amendment Act 2005 (Cth) sch 1 cl 20.
154. Explanatory Memorandum, Intelligence Services Legislation Amendment Bill 2005 (Cth) 7.
155. Ibid 1.
156. Philip Flood AO, Inquiry into Australian Intelligence Agencies (Report, 20 July 2004) 7 (emphasis added).
157. Acts Interpretation Act 1901 (Cth) ss 15AB(2)(b), 15AB(2)(e).
158. ISA s 7(d).
159. Department of Foreign Affairs and Trade (n 3).
160. Lane v Morrison (2009) 239 CLR 230; see also Hayne and Bell JJ’s discussion on chains of command and ‘disciplined and hierarchical forces’ at CPCF (2015) 255 CLR 514, 561–2.
161. A-G (UK) v Heinemann Publishers Australia Pty Ltd (1987) 10 NSWLR 86, 127 (‘Spycatcher case’).
162. Ibid 92, 99 (Street CJ) 140, 146 (Kirby P), 185 (McHugh JA).
163. A v Hayden (1984) 156 CLR 532, 583–4 (Brennan J).
164. Thomas Bayly Howell, A Complete Collection of State Trials and Proceedings for High Treason and Crimes and Misdemeanours from the Earliest Period to the Year 1783 (T.C. Hansard for Longman, 1816) vol 1, 1127–9 (‘State Trials’); Kirby P alluded to these trials in the Spycatcher case (1987) 10 NSWLR 86, 127.
165. Howell, ‘State Trials’ (n 164), referring to the Catholic internationalist Papists at 1140, 1154 and 1161, referring to France at 1145–6, 1178, referring to Spain at 1132, 1152, 1181. Queen Mary herself was a Scottish and possibly French subject.
166. Ibid 1129, 1134, 1137, 1144, 1146, 1174–82.
167. Ibid 1177, 1124.
168. Ibid 1174–81, 1187–94.
169. Although this probably would have been pointless anyway, see Kuruma v The Queen [1955] AC 197, it is still an indicator that a party contested the evidence’s provenance for tort and property reasons.
170. Samuel Weber, ‘“First as Tragedy, Second as Farce”: Executing German Spies at the Tower of London During World War One’ (2013) 5 Voces Novae 149.
171. Rose v The King (1947) 3 DLR 618, 628 (Barclay J), 647 (Bissonnette J), 671–2 (Gagne J), see also 622 (Galipeault and St Jacques JJ agreeing with the majority).
172. Ibid 644, 646 (Bissonnette J).
173. Australian Security Intelligence Organisation Act 1979 (Cth) s 17 (‘ASIO Act’).
174. Ibid s 4.
175. Ibid ss 25(1), 25A(1). See also TIAA pt 3-2 for similar provisions against Australian telecommunications infrastructure targets.
176. ASIO Act ss 25(2), 25A(2).
177. Commonwealth Criminal Code s 476.2(4).
178. ASIO Act s 87.
179. Commonwealth Criminal Code s 476.2(1); Criminal Code (ACT) s 414(1).
180. Commonwealth Criminal Code s 10.5; see also Criminal Code (ACT) s 43.
181. ASIO Act ss 25(1), 25A(1); Commonwealth Criminal Code s 476.2(4).
182. Commonwealth Criminal Code s 473.1.
183. Australian Constitution s 119; Defence Act pt IIIAAA.
184. Defence Act s 51A.
185. Ibid s 51WA; Jervis Bay Territory Acceptance Act 1915 (Cth) s 4A.
186. Defence Act s 51WA(3); Explanatory Memorandum, Defence Legislation (Aid to Civil Authorities) Bill 2005 (Cth), 2.
187. Commonwealth Criminal Code s 476.2(1); Criminal Code (ACT) s 414(1).
188. Defence Force Discipline Act s 4.
189. Defence Act 1903 s 51WB(2).
190. Commonwealth, Government Notices Gazette, No C2018G01001, 13 December 2018, 1.
191. Explanatory Memorandum, Defence Amendment (Call Out of the ADF) Bill 2018 (Cth) [2].
192. Ibid sch 1 s 51D(2)(j).
193. Ibid sch 1 s 51L(3)(h).
194. Ibid sch 1 s 31 definitions.
195. Ibid sch 1 ss 46(7)(e), 51A(2)(b), 51D(2)(h).
196. Barton v Commonwealth (1974) 131 CLR 477, 488 (Barwick CJ), 501 (Mason J), 491 (McTiernan and Menzies JJ), 508 (Jacobs J); see also Ruddock v Vadarlis (2001) 110 FCR 491, 540 (French J, Beaumont J agreeing).
197. Millirrpum v Nabalco (1971) 17 FLR 141, 272 (Blackburn J).
198. Johnston Fear & Kingham (1943) 67 CLR 314, 325; Andrews v Howell (1941) 65 CLR 255, 268.
199. Semayne’s Case (1605) 77 ER 194.
200. State of NSW v Corbett (2007) 230 CLR 606, 628 (Callinan and Crennan JJ).
201. Saltpetre (1606) 77 ER 1294, 1295.
202. Commonwealth Criminal Code s 474.6(7).
203. See, eg, ibid ss 476.2(4), 476.5.