www.pwc.com.au Review of the Transport Security (Counter- Terrorism) Act 2008 Final report August 2020 pwc SENSITIVE Disclaimer This report is not intended to be used by anyone other than the Department of Transport and Main Roads (TMR). We prepared this report solely for TMR’s use and benefit in accordance with and for the purpose set out in PricewaterhouseCoopers Consulting Australia’s (PwC) engagement letter dated 22 May 2020. In doing so, we acted exclusively for TMR and considered no-one else’s interests. We accept no responsibility, duty or liability: ● to anyone other than TMR in connection with this report ● to TMR for the consequences of using or relying on it for a purpose other than that referred to above. We have based this report on information provided by TMR, other government agencies and surface transport operators. The Information contained in this Report has not been subject to an audit or audit-standard review. We make no representation concerning the appropriateness of this report for anyone other than TMR. If anyone other than TMR chooses to use or rely on it, they do so at their own risk. This disclaimer applies: ● to the maximum extent permitted by law and, without limitation, to liability arising in negligence or under statute; and ● even if we consent to anyone other than TMR receiving or using this report. Liability limited by a scheme approved under Professional Standards legislation Review of the Transport Security (Counter-Terrorism) Act 2008 PwC 1 SENSITIVE Executive summary Overview In June 2005, all Australian states and the Australian Capital Territory signed the Intergovernmental Agreement on Surface Transport Security (IGA) with the objective of protecting the community and the surface transport system from terrorism. Under the IGA, Australian jurisdictions agreed to adopt a nationally-consistent approach in protective security, planning and preventative measures for their surface transport operations, including through the nomination of security-identified surface transport operators (SISTOs) and ensuring SISTOs develop and implement preventative security measures. The IGA committed states and territories to ensure respective legislation was sufficiently strong to meet the objectives of the Agreement. To give effect to these requirements, the Queensland Government introduced the Transport Security (Counter- Terrorism) Act 2008 (the Act), and committed to review the Act every five years. The first review was undertaken in 2014 and found that the Act was effective in prioritising investment and collaboration in counter-terrorism and raising awareness and preparedness of it. This also had the benefit of improving general transport security. It also found that, given the operation of the Act supports a reduction in the risk of a surface transport-related terrorist attack, the costs of the regulatory requirements are not considered to be significant.1 This review The Department of Transport and Main Roads (TMR) engaged PricewaterhouseCoopers Consulting (Australia) Pty Ltd (PwC) to undertake the second review of the Act, subsequent to the 2014 review, and meeting Parliament's requirement to review the operation of the Act every five years. This review considers the operation of the Act including its effectiveness, appropriateness and costs associated with its regulatory framework. These considerations align with the Office of Best Practice Regulation Post-Implementation Review Guidance which requires assessment of the effectiveness, impact and opportunities with regulation.2 To understand the operation of the Act, SISTOs, TMR, Queensland Police Service (QPS) and the Queensland Department of Premier and Cabinet were consulted to consider the key assessment questions. The review was supplemented by desktop analysis of key policy documents to contextualise and evidence aspects of operation of the Act. Table 1: Assessment domains mapped to key regulatory review questions Question domain Key Assessment Questions Appropriateness: suitability of the 1. Does the Act and its provisions remain appropriate in Act and its requirements to fulfil the supporting your organisation? objectives Effectiveness: achievement of 2. Does the Act provide effective support in planning for the intended outcomes protection and adverse impacts of a terrorist act involving your organisation? Impacts of the regulation: current 3. What are the previous, existing and future costs of regulation costs and impacts of the regulation on businesses and government? Source: PwC Analysis 1 Review of the Transport Security (Counter-Terrorism) Act 2008, report prepared by PricewaterhouseCoopers Australia for the Department of Transport and Main Roads, 2014 2 Queensland Office of Best Practice Regulation, Post-Implementation Review Guidance, accessed at: https://qpc.blob.core.windows.net/wordpress/2018/02/PIR-Guidance-Note.pdf Review of the Transport Security (Counter-Terrorism) Act 2008 PwC 2 SENSITIVE Since the 2014 review, the operating context for surface transport operators and government has shifted. On 12 September 2014, Australia’s National Terrorism Threat Level was raised and remains ‘PROBABLE’ – the mid point - in the five tier scale adopted by the Australian Government. The threats of terrorism continue to require a coordinated response from government to prevent, protect and respond to their potential impact within the community. Crowded places, such as mass passenger transport hubs and operations continue to be a target for future attacks. The use of explosive devices, firearms and other sophisticated weapons remains a significant risk to the surface transport sector. However, the risk of more easily planned lone attacks using basic weapons (such as bladed weapons and use of vehicles as weapons) has increased significantly since 2014 and leads to a more complex security environment. This requires Queensland’s transport operators, which transport over 200 million passengers on bus, rail, ferry and tram trips each year to act with agility and manage these evolving risks proactively. The effectiveness of the Act The review has found that the Act has been effective in ‘raising the bar’ for terrorism risk management across SISTOs. The Act has set a benchmark from which SISTOs must operate and implement risk management practices that consider terrorism risks. This has embedded counter-terrorism practices as part of broader operational security risk management of SISTOs and has influenced their broader operational practices. Notwithstanding that current declarations cover operators only within the South-East Queensland region, the obligations placed on SISTOs have demonstrated an influence on and improvements to risk management practices in operations of transport operators across Queensland and other jurisdictions. The Act has also had the effect of fostering a strong network of collaboration between transport operators and government agencies. In large part, this network has been due to the role of TMR in brokering linkages and building opportunities for SISTOs to build their capability and networks. These informal networks ultimately have the impact of improving the resilience of Queensland’s transport network in the event of a security incident. For these reasons, there is a clear basis for retaining the Act. While SISTOs identified a number of opportunities to streamline or refine the operation of the Act, the Act itself was not considered to present unnecessarily onerous obligations upon SISTOs, fulfilling its objectives of promoting an efficient and cost-effective regulatory framework. The appropriateness of the Act The Act is designed in a way that is consistent with existing operational security practices, making it appropriate to fulfilling the Act’s objective of promoting an efficient and affordable regulatory framework. The design of the Act also means it is flexible to different operational contexts as well as different threat contexts. The application of the requirements to ‘terrorism acts’ and ‘security incidents’ broadens the scope of the Act to encourage SISTOs to consider the broader risks of potential incidents for which to prepare, prevent, respond and recover. This promotes the objectives of both counter-terrorism and security as it can capture incidents which may not be formally classified as a terrorism act, but for which similar measures are effective (for example, a knife attack by a disgruntled individual). The self-review and audit features of the Act’s compliance framework are aligned with the voluntary compliance objective of the Act. While some SISTOs did raise that this challenged their organisational capability or confidence that they were achieving an appropriate standard of management (such as not being confident that they held internal capability to provide rigour to the audit), this arrangement is consistent with the Act’s objectives and good practice regulation. The role of TMR is highly valued by SISTOs and has contributed to the building of their capability. The role of TMR in establishing a Community of Practice and brokering relationships across SISTOs was commonly cited through this review’s consultation process. This facilitative and advisory function appears appropriate to supporting the ongoing operation of the Act. The cost efficiency and effectiveness of the Act Overall, the review found that the impact of the Act’s requirements are cost-effective to meet its objectives. The estimated costs to SISTOs have decreased since the 2014 Review. Costs to business: The Act requires declared