A Legal Authorisation for ASD Cyberattacks

Under the IS Act, ASD is a statutory authority headed by the Director-General of ASD, a civilian appointment who reports directly to the Minister for Defence.^{Footnote 21} Scrutiny of ASD operations is provided both by the Parliamentary Joint Committee for Intelligence and Security (‘PJCIS’)^{Footnote 22} and the Inspector-General of Intelligence and Security.^{Footnote 23} In addition to these measures, ASD is also subject to Ministerial privacy rules.^{Footnote 24}

The specific priorities of ASD are established by the IS Act.^{Footnote 25} Separate from their function with respect to intelligence gathering, the ASD has several discrete functions that contemplate engaging in cyberattack activity. For example, cyberattacks could be used to:

1. a) Prevent and disrupt cybercrime undertaken by people or organisations outside Australia^{Footnote 26};

2. b) Provide assistance to the ADF in support of military operations^{Footnote 27};

3. c) Provide assistance to the ADF (as a ‘Commonwealth authority’)^{Footnote 28} in relation to cryptography, communication and computer technologies^{Footnote 29};

4. d) Provide assistance to the ADF (as a ‘Commonwealth authority’) consistent with the performance of the functions of the ADF.^{Footnote 30}

With respect to the first of these functions, the IS Act requires that the Minister for Defence issue ASD with written directions to not exercise any of its functions with respect to preventing or disrupting cybercrime undertaken or enabled by an Australian person without a Ministerial authorisation.^{Footnote 31} However, the mandated Ministerial directions in the IS Act do not prevent (and thus authorisations cannot be sought) ASD from participating in any of its ‘provide assistance’ functions. Though these may be subject to other directions,^{Footnote 32} these are not mandatory and do not contemplate further authorisations.

There is the possibility that the Minister could issue an authorisation for activities involving the deployment of ASD cyberoffensive capabilities inside Australia for the purpose of its assistance functions. The use of the word ‘may’ in s 9(2) of the IS Act suggests that a discretionary power exists for an authorisation to be issued ‘in relation to … an activity, or class of activities, specified (whether by name or otherwise) in the authorisation’^{Footnote 33} — in this case, deployment of cyberoffensive capabilities inside Australia. If the Minister chose to do so, they would only need to be satisfied that the authorisation would permit activities necessary for the proper performance of one of ASD’s functions (such as the assistance functions), there are satisfactory control arrangements in place to not exceed the authorisation and those arrangements can ensure that the ‘nature and consequences of acts done in reliance on the authorisation will be reasonable’.^{Footnote 34}

Nor does the general limitations clause of the IS Act prevent that construction. Although the functions of IS Act agencies ought only to extend ‘to the extent that [national security] matters are affected by the capabilities, intentions or activities of people or organisations outside Australia’,^{Footnote 35} this section is specifically subject to a disclaimer if the function relates to inter alia ASD’s function to assist the ADF.^{Footnote 36}

The combined effect of the Ministerial directions and authorisations scheme is that whilst the law enforcement function of ASD (preventing and disrupting cybercrime) is carefully regulated by the IS Act, the provision of assistance by ASD to the ADF is not. The Minister’s issue of directions for ASD’s non-cybercrime functions are not mandated. The recent Richardson Review of Australia’s NIC identified this anomaly and recommended its correction, noting that there was nothing before the Review that indicated there was ever any intention for ASD to be free of Ministerial oversight in its assistance functions.^{Footnote 37}

Furthermore, the criminal and civil immunities that accrue to ASD due to its status as an IS Act agency apply only in respect of acts taken offshore (or those acts taken in Australia to further such offshore acts).^{Footnote 38} As none of the immunities operate to protect ASD if its officers or operatives assist the ADF in a domestic capacity, it is the immunities in the Criminal Code that operate.^{Footnote 39} These immunities in s 476.6 state:

1. (1) A staff member or agent of an agency (within the meaning of subsection (10)) is not subject to any civil or criminal liability for engaging in conduct inside or outside Australia if:

   1. (a) the conduct is engaged in on the reasonable belief that it is likely to cause a computer-related act, event, circumstance or result to take place outside Australia (whether or not it in fact takes place outside Australia); and

   2. (b) the conduct is engaged in the proper performance of a function of the agency.

2. (2) A person is not subject to any civil or criminal liability for engaging in conduct inside or outside Australia if:

   1. (a) the conduct is preparatory to, in support of, or otherwise directly connected with, overseas activities of an agency; and

   2. (b) the conduct:

      1. (i) taken together with a computer-related act, event, circumstance or result that took place, or was intended to take place, outside Australia, could amount to an offence; but

      2. (ii) in the absence of that computer-related act, event, circumstance or result, would not amount to an offence; and

   3. (c) the conduct is engaged in the proper performance of a function of the agency.…

(10) In this section:

agency means ASIS, ASD or AGO.

Though the deployment may well be in proper discharge of a function of ASD in assisting the ADF, both s 476.6(1)(a) and 476.6(2)(b)(i) involve requirements that the conduct have an overseas connection. Without a reasonable belief that a cyberattack in Australia was intended to occur outside Australia — difficult to justify in a call-out situation — the immunities will likely fail to operate in the instance of a domestic deployment of ASD cyberattack capability inside Australia.^{Footnote 40}

Taken together, the operation of the sections in the IS Act and Criminal Code suggest that prima facie a deployment of ASD’s cyberoffensive capability inside Australia’s territory would not be lawful. Though problematic on its face, this may be of little moment given Australia’s unique approach to the pragmatics of ASD deployment. According to the ADF’s Joint Cyber Unit and Joint Operations Command, any deployment of ASD under its ‘assistance’ functions to the ADF would be classified as a military operation, not a civilian one.^{Footnote 41} Additionally, staff of ASD are instructed in, and bound by, the ADF’s Rules of Engagement (‘ROE’), which in turn are informed by laws of armed conflict and Australian domestic law.^{Footnote 42} That position aligns with the concept that a domestic deployment of the ADF would inherently be a military-led engagement.

B Legal Authorisation for ADF Cyberattacks

Turning attention now to the capabilities of the ADF, the deployment of military forces inside Australia is specifically provided for by pt IIIAAA of the Defence Act. This Part, originally inserted in 2000 in response to the Olympics Games in Sydney and then amended again in 2006 and 2018,^{Footnote 43} permits various forms of call-out orders to be made (including contingent or dormant orders, which allow the CDF to deploy only on the occurrence of specified circumstances, triggers or indica).^{Footnote 44}

The suite of amendments has made it clear that the Commonwealth may deploy the ADF either with or without a request from a State, essentially supplementing what would have been an exercise of executive power under s 61 of the Constitution by the Governor-General, with a statutory exercise of power supported by the constitutional defence power in s 51(vi). However, executive power may still be invoked by certain preparatory acts or ex ante engagements by the ADF within the scope of its authority.^{Footnote 45} For example, a call-out order is not necessarily required for the physical disposition of ADF assets inside Australia. There is no legislative requirement for the ADF to be asked to ‘be’ anywhere domestically, only where they are being asked to utilise some capability — as Moore puts it ‘the prerogative for control and disposition of the forces means that the ADF has freedom of movement anyway. Call-out just places forces at the disposal of the civil authority to use force’.^{Footnote 46}

Under the Defence Act, the first type of call-out is a Commonwealth interests order,^{Footnote 47} and the second is a State protection order.^{Footnote 48} Commonwealth interests orders involve the determination of a real, perceived or anticipated threat to Commonwealth interests,^{Footnote 49} whether in Australia or its offshore regions. Alternately, a state of domestic violence that would (or would be likely to) affect Commonwealth interests must be occurring or likely to occur in Australia.^{Footnote 50} Similarly, a State protection order requires a real, perceived or anticipated occurrence of domestic violence occurring in a State or Territory that has requested the Commonwealth’s assistance.^{Footnote 51} Orders are almost always made by the Governor-General,^{Footnote 52} though the Act does permit certain expedited orders to be made Ministerially in serious and urgent emergencies.^{Footnote 53}

It is worth noting that the use of the words ‘domestic violence’ in the Defence Act do not relate to their more contemporary meaning involving intimate partner or family violence — instead, it reflects the language in s 119 of the Australian Constitution which obliges the Commonwealth to ‘protect every State against invasion and, on the application of the Executive Government of the State, against domestic violence’, itself derived from US constitutional law^{Footnote 54} wherein nothing short of an armed insurrection capable of threatening the very existence of a State government would qualify.^{Footnote 55} Consistent with that reasoning, in the Addendum to the Explanatory Memorandum, domestic violence is described as ‘conduct that is marked by great physical force and would include a terrorist attack, hostage situation, and widespread or significant violence’.^{Footnote 56} Alternately, the conduct must be such that it would ‘rupture the social fabric’.^{Footnote 57}

It is important to pause momentarily and observe that the mere involvement of the cyber domain will not matter for determining whether a state of domestic violence exists, as that term is currently contemplated by the Constitution or by reference to the legislative history of the Defence Act. The relevant focus of the authorising Ministers^{Footnote 58} is upon the existence or predicted existence of a set of facts, from which those Ministers will determine that either a state of domestic violence exists, or it does not. Put another way, the mere fact that attacks are launched from cyberspace or only affect online assets is irrelevant for the Ministers’ satisfaction that there exists a form of conduct capable of equating to domestic violence.

White’s exposition on the internal security prerogative in cyberoperations is also telling.^{Footnote 59} Outside the common law doctrine of necessity — which would authorise the Commonwealth to deploy its military forces in the defence of itself against actual and threatened disturbances^{Footnote 60} — he argues the Commonwealth retains a prerogative, derived from s 61 of the Constitiution and endorsed in case law such as Sharkey,^{Footnote 61} to deploy forces as it sees fit. Though the High Court of Australia may have been sceptical about the reach of the prerogative,^{Footnote 62} their reservations are limited in application to the Defence Act on several grounds. Firstly, the Maritime Powers Act 2013 (Cth) in CPCF purported to bind the Commonwealth in all its capacities, something conspicuously absent from the Defence Act. Secondly, the Maritime Powers Act 2013 (Cth) lacked an enabling provision similar to that found in s 51ZD of the Defence Act, which applies statutory clarity to the notion that the call-out order provisions ‘[do] not affect any utilisation of the Defence Force that would be permitted or required, or any powers that the Defence Force would have’ if those powers were disregarded.^{Footnote 63}

In any event, I also consider there is another way for the Ministers to achieve the requisite satisfaction to request the making of a call-out order. Essentially, this involves considering any cyber threat (whether or not attended by real-world acts or actions) as a threat to Commonwealth interests given that the Commonwealth retains legislative primacy under s 51(v) of the Constitution for ‘telegraphic, telephonic, and other like services’, the breadth of which has already been deemed sufficient to capture the cyber domain, the Internet and future forms of telecommunications.^{Footnote 64} Given that White suggests ‘[i]t is difficult to envisage a situation of civil order in the modern, globally connected world where some aspect of a Commonwealth interest would not be threatened or endangered’, any potential for intrusion, damage or disablement of the internet would trigger a Commonwealth interest contemplated by the Defence Act.^{Footnote 65}

Presuming a Commonwealth interests order or State protection order has been made, the CDF is required to comply. In deploying the ADF, the CDF must have regard to the following:

1. • Directions of the Minister as to the way in which the Defence Force is to be utilised^{Footnote 66};

2. • That the ADF may not be used to stop or restrict any protest, dissent, assembly or industrial action, except if there is a reasonable likelihood of death, serious injury or serious damage to property^{Footnote 67};

3. • The order issued to him or her and the purpose it is intended to remedy^{Footnote 68};

4. • The operations of, and the obligation to cooperate with, the Police forces of the State or Territory to which the ADF has deployed^{Footnote 69}; and

5. • That a member of the ADF must not be utilised for a particular task unless a member of the Police force has requested that task be performed.^{Footnote 70}

Once deployed, the ADF may utilise the full range of its capabilities in pursuing the purpose/s of the order issued by the Governor-General. The ADF is vested with a significant suite of powers to pursue that purpose, including the ‘right to shoot to kill someone escaping detention, search premises without warrants, detain people without formally arresting them, seal off areas and issue general orders to civilians’.^{Footnote 71} In areas declared as ‘specified areas’,^{Footnote 72} or containing ‘declared infrastructure’,^{Footnote 73} persons may be compelled to produce documents and answer questions,^{Footnote 74} searched (without limitation as to whether the search is intimate or forensically invasive).^{Footnote 75} Persons may also be arrested without warrant and detained until they are able to be placed in police custody.^{Footnote 76}

Most controversially, members of the ADF may use ‘reasonable and necessary force’,^{Footnote 77} in the exercise of those powers (except for using force to compel production of documents or answers to questions,^{Footnote 78} which would nullify a person’s privilege against self-incrimination). This also includes using lethal force against persons to protect life or prevent serious injury of persons, protect declared infrastructure, prevent a person fleeing detention or to destroy aircraft or vessels.^{Footnote 79}

So, does this framework authorise the ADF to engage in cyberattacks during a domestic deployment? As a threshold question, it would be important to identify who is engaging in the cyberattack — is it the ADF using its own inherent capability? Or is it the ASD operating under ADF command and control?

C ADF Inherent Capability

If the ADF seeks to deploy its own inherent cyberoffensive capability inside Australia pursuant to a call-out order under the Defence Act, this is a decision of the CDF. The CDF would need to be satisfied that the use of the capability, or the engagement in cyberattacks, would be ‘reasonable and necessary’ for the purpose specified in the call-out order.^{Footnote 80} The use of any cyberoffensive capability would also need to be ‘as far as reasonably practicable’ in cooperation with the Police Force of the host State or Territory and pursuant to a request from that Force to perform a task (such as hacking into, disabling or destroying a computer or network).^{Footnote 81} Whilst it is axiomatic that Police Forces have their own computer experts, those personnel are likely to be experts in forensics and not information warfare. The ADF would — in the author’s view — be highly likely to be requested to use cyberattacks given that the Police Force does not possess such a capability.

Those preliminary matters having been settled, the ADF would then be permitted to use its inherent cyberoffensive capability inside Australia for the object of achieving the purposes of the call-out order. The use of electronic equipment by ADF members in particular ways as determined by that ADF member is specifically authorised by the Defence Act under the pt IIIAAA provisions — whether explicitly authorised by the Minister in a general case,^{Footnote 82} in relation to a specified area,^{Footnote 83} or in protection of declared infrastructure.^{Footnote 84} These provisions appear sufficiently elastic to contemplate an ADF cyberoffensive capability being deployed generally in support of a call-out.

Cyberattacks as a methodology could also be explicitly authorised by the Minister for Defence in writing, in which case such attacks could be conducted to capture or recapture a location or thing, to prevent or put an end to acts of violence or threats to safety, free hostages, control the movement of a vehicle or even to destroy an aircraft or vessel.^{Footnote 85} A cyberattack against a thing that causes or could cause death or serious injury — such as shutting down an aircraft’s engines in flight or turning off an electric car’s engine — could also be authorised if the use of force was ‘reasonable and necessary’ in the circumstances.^{Footnote 86} Cyberattacks for similar purposes are also implicitly authorised by the use of ADF powers in either specified areas or in protection of declared infrastructure.^{Footnote 87} Yet the exact legality of the use of a cyberattack to take the life of another person by crashing their plane — outside of the scenario of self-defence or emergency, or in the realm of an armed conflict — is ‘intensely problematic and contentious’.^{Footnote 88}

Curiously, the language in the Defence Act also supports a contention that the cyberoffensive capability could ostensibly be utilised to assist the ADF with the discharge of its search and seizure powers.^{Footnote 89} For example, cyberattacks that bypass encryption or passwords could allow ADF members to remotely search encrypted computers or mobile phones and seize any data of relevance. These attacks could either be authorised as an exercise of the ‘operation of electronic equipment’ provision, authorised under a CDF search determination,^{Footnote 90} or as a consequence of the exercise of ‘incidental powers’ in furtherance of a specific other power (ie the search power).^{Footnote 91}

The only potential limitation of the use of cyberattacks in support of searches are whether cyberattacks involve a ‘use of force’, as force may not be used against a thing to compel the production of documents (ie such as those that might be contained within a computer or network).^{Footnote 92} An in-depth analysis of whether cyberattacks involve use of force is beyond the scope of this paper; however, it is sufficient to note that ‘use of force’ in domestic law is traditionally centred on physical acts or acts with a physical outcome.^{Footnote 93} It is also worth noting that, at least from an ADF perspective, a cyberattack would need to be compliant with whatever extant ROE applied as part of the Defence Act pt IIIAAA deployment (which are standing orders issued by the CDF or his/her delegate, and outline when and under what circumstances ADF members may use force, including lethal force).

It is perhaps more apposite to observe what use of force means in the law enforcement context, given that an ADF call-out would (at least notionally) be focused on restoring law and compliance with the civil power. In law enforcement, ‘use of force’ is analogous to ‘the amount of effort required by police to compel compliance by an unwilling subject’.^{Footnote 94} A person whose phone is being hacked by an ADF cyberattack is also unlikely to be aware of that fact. On those grounds, it is difficult to imagine that a cyberattack would be considered a use of force (at least in the terms contemplated by s 51N of the Defence Act); however, such an interpretation runs counter to a person’s common law privilege against self-incrimination.^{Footnote 95}

Searches of computers or networks facilitated by ADF cyberattacks also may not be lawful in the context of searches that are entitled to be observed, such as those conducted under a CDF search determination,^{Footnote 96} or searches of aircraft or vessels.^{Footnote 97} In those cases, it is difficult to contemplate how an ADF member could remotely search computers or networks covertly and still be observed by the owner of premises or master/captain of an aircraft or vessel, a matter which would render the conduct of the search unlawful.^{Footnote 98}

D ASD Support to ADF Operations

The situation is significantly different if the ASD provides support to the ADF under a call-out order. This is because of two major limitations to the application of the Defence Act. Firstly, a call-out order issued by the Governor-General directs the CDF to ‘call-out the Defence Force’,^{Footnote 99} which means the ADF as constituted by the Royal Australian Navy, Australian Army and the Royal Australian Air Force, but no other forces (such as ASD).^{Footnote 100} Secondly, powers that accrue under pt IIIAAA are vested either in the CDF (such as issuing search determinations) or in ‘Defence members’, being ‘any officer, sailor, soldier or airman’.^{Footnote 101} Members of ASD are civilians and are not subject to the Defence Act.

However, the provisions that permit deployment of electronic equipment under a call-out order also permits an ADF member to ‘direct a person to operate … machinery or equipment (including electronic equipment) in a particular manner’.^{Footnote 102} As there is no limitation on the classes of persons to whom such a direction might be given, an ADF member might direct a civilian member of ASD to engage in a cyberattack or otherwise deploy a cyberoffensive capability, in circumstances where ASD were perhaps taking only an observational role (and not providing assistance). One assumes that the cyberattack is being performed either as an exercise of the electronic equipment direction power or incidental to the exercise of some other power (such as conducting a search or capturing/recapturing a facility or thing). In either case, the ASD civilian is acting under the imprimatur of the ADF member’s powers.

E The Legal Nature of Protections for the ADF and ASD

Despite the somewhat convoluted nature of the interactions between the IS Act and Defence Act, such an analysis remains important. The ADF must ensure that Australian servicemen and women, and the people who may assist them (including ASD but also the State and Territory police), are properly protected from liability where their actions are consistent with Australian law. Conversely, the Australian public has both a vested interest and legal right to ensure that their constitutional and common law privileges are not abrogated arbitrarily, even in a state of domestic emergency.

Part IIIAAA operations will not be protected by combatant immunity, the common law doctrine which shields uniformed Service personnel from criminal liability for their actions when engaging in lawful acts of belligerency.^{Footnote 103} If the ADF deploys to a State or Territory suffering domestic violence, and the use of reasonable and necessary force (including lethal force) is contemplated by the Act in support of that deployment, uniformed ADF members might qualify for that protection.^{Footnote 104} But would armed Australian citizens, against whom the ADF might deploy, be considered an ‘enemy’ against which the forces of the Crown are operating?^{Footnote 105}

A fulsome examination of combatant immunity is not in scope here; however, whether combatant immunity would apply in a call-out situation is a grey area.^{Footnote 106} In any event, as ASD employees are not uniformed personnel nor ‘Defence members’ under any Defence legislation, they receive no benefit of the immunity.

Even in a call-out situation, ADF and ASD activities undertaken within Australia’s domestic confines will be subject to Australian criminal and civil law, particularly the Criminal Code.^{Footnote 107}

The Defence Act makes clear that the Commonwealth criminal law continues to apply, even under a pt IIIAAA order.^{Footnote 108} In such a case, ADF members will likely have some immunity from ordinarily illegal conduct which, in the context of this paper, would include the offences in relation to telecommunication services and computer offences.^{Footnote 109}

The first of the immunities applying to ADF members are the ‘good faith’ provisions. An ADF member exercising a power under a call-out order who fails to comply with any obligation (such as wearing uniform whilst exercising a pt IIIAAA power) is taken to have not exercised the power validly unless the exercise was in ‘good faith’.^{Footnote 110} Though the exercise of the power may be validated by good faith, criminal and/or civil liability may still attach, unless the exercise of the power was also performed under an valid call-out order, infrastructure declaration, specified area declaration or authorisation.^{Footnote 111} If the order or declaration was valid but the power exercised in bad faith, the ADF member would likely face charges under either the Defence Force Discipline Act 1982 (Cth) or even civilian criminal laws.^{Footnote 112}

The second of the immunities applying to ADF members are the ‘superior orders’ provisions. An ADF member will have recourse to such a defence under a pt IIIAAA call-out, unlike the narrower defence in the Criminal Code.^{Footnote 113} An ADF member will be excused from any criminal act if they obeyed an order that was not manifestly unlawful in circumstances where ‘the member had no reason to believe that circumstances had changed in a material respect since the order was given’ and ‘the member had no reason to believe that the order was based on a mistake as to a material fact’.^{Footnote 114} Whilst an ADF member does not have to question orders (and often is not able to do so without exposing themselves to discipline), this defence requires that the ADF member was not deliberately ignorant of the possible existence of contraindicating states of affairs.^{Footnote 115}

Yet neither of these immunities will apply to activities undertaken by ASD on the orders or instructions of an ADF member.^{Footnote 116} Instead, it is highly likely that ASD activities undertaken on the ADF’s orders would be covered by the ASD-specific immunities under either the IS Act or Criminal Code.^{Footnote 117} Ironically, in examining ASD support to ADF operations, the ADF recently told the Richardson Review that there may be ‘circumstances in which the ADF must engage in activity that could give rise to liability under Australian criminal law but cannot access ASD authorities and immunities’.^{Footnote 118}

Again, the Richardson Review observed anomalies with the interaction of immunities between ASD and the ADF, but as the support of agencies covered by the IS Act supporting the ADF was not within the Terms of Reference for the Richardson Review, little more was said.^{Footnote 119} The Richardson Review did however note that any current immunities given to the ADF for intelligence activities cover only their offshore activities, and not those within the boundaries of Australia. Thus, the Richardson Review recommended that the ADF not be immunised at all in respect of the telecommunications offences in the Criminal Code.^{Footnote 120} Despite that recommendation, the Government committed in its response to the Review to examine the immunities applying to joint ASD-ADF operations and ‘to bring forward legislative amendments to address such uncertainty’.^{Footnote 121}

A Effect of a Call-Out Under Canadian Law

Though it has been demonstrated above that neither the CSE nor CSIS will be capable of rendering assistance to the CAF in the conduct of cyberattacks, this does not obviate the cyberoffensive capabilities being developed by the CAF. This is especially the case given the amendments to Canadian national security legislation giving CAF a wider scope for cyber activities.^{Footnote 149} CAF public documents have taken up this mantle, making clear that the forces have embraced ‘conducting active cyber operations against potential adversaries in the context of government-authorized military missions’.^{Footnote 150}

Call-out powers in Canadian law are prima facie far simpler than their Australian counterparts. There exists no unilateral capacity for the CAF to be called out in protection of Canadian interests — a call-out is triggered only by a written request by the Attorney-General of a province, on threat of ‘a riot or disturbance of the peace, beyond the powers of the civil authorities to suppress, prevent or deal with’. That riot or disturbance must also be of such a scope and nature to require the deployment of the CAF.^{Footnote 151} A request must be in writing and must comply in all respects with the proscribed form laid out in the ND Act.^{Footnote 152}

In the event of a call-out from a provincial Attorney-General, it is a matter for the Chief of the Defence Staff (or their delegate) to determine what — if any — elements of the CAF will be deployed in response to the request. This could relevantly include such cyberoffensive capabilities as the Chief of the Defence Staff considers ‘necessary for the purpose of suppressing or preventing any actual riot or disturbance or any riot or disturbance that is considered as likely to occur’.^{Footnote 153}

Once called-out, CAF members are vested with considerable powers, as they are effectively deemed as police constables, bound instead by the Code of Service Discipline and the military chain of command rather than police executive structures.^{Footnote 154} A situation of call-out in Canada is also temporally unlimited, as the decision to end the deployment of the CAF lies entirely at the satisfaction of the Chief of Defence Staff, with no statutory bounds or expiration dates.^{Footnote 155}

Immunities for Defence members are equally concise under Canadian law. A member of the CAF is excused from liability for any act performed that is consistent with the Code of Service Discipline, ‘unless the officer or non-commissioned member acted, or omitted to act, maliciously and without reasonable and probable cause’.^{Footnote 156} To avoid doubt, members of the CAF also remain subject to the jurisdiction of the civil courts of Canada, even during a call-out period.^{Footnote 157}

B Conclusion to S III

The Canadian framework is, it would appear, far more permissive of the concept of domestic cyberattacks being conducted by military pursuant to a call-out than would be the case in Australia; however, there are several critical differences that bear considering.

The threshold to initiating a call-out of the CAF is far higher than Australia, requiring an actual ‘riot or disturbance’ beyond the control of the civil power, rather than the more nebulous ‘domestic violence’. The CAF also cannot be called out prospectively under conditional orders. Unlike Australia, Canada does not possess at all a legislative head of power that contemplates protecting its own interests in the same manner as a Commonwealth interests order.

However, Canada does more clearly delineate the role of its agencies with cyberoffensive capabilities. CSE is statute barred from domestic operations or operations against Canadian citizens, consistent with its mandate as a foreign security intelligence agency. CSIS — whilst it has a clear ‘threat reduction’ mandate to act against threats to Canadian security — cannot perform such activities for or on behalf of the CAF, and the intelligence sharing function between CSIS and CAF would be mutually exclusive of any potential CSIS involvement in CAF cyberoffensive activities.