Document ID: chunk:federal_register_of_legislation:C2024C00854:section:132apd:p2
Version: federal_register_of_legislation:C2024C00854
Segment Type: section
Provision Reference: s 132APD (pt 2/3)
Character Range: 448420–451198

person (the researcher) to do an act; and
 (c) the act:
 (i) relates to a copy of a work or other subject‑matter that is not an infringing copy and that was lawfully obtained; and
 (ii) will not infringe the copyright in the work or other subject‑matter; and
 (iii) will be done for the sole purpose of identifying and analysing flaws and vulnerabilities of encryption technology; and
 (d) the researcher is:
 (i) engaged in a course of study at an educational institution in the field of encryption technology; or
 (ii) employed, trained or experienced in the field of encryption technology; and
 (e) the researcher:
 (i) has obtained permission from the owner or exclusive licensee of the copyright to do the act; or
 (ii) has made, or will make, a good faith effort to obtain such permission.
In this subsection, encryption technology means the scrambling and descrambling of information using mathematical formulas or algorithms.
Note: A defendant bears an evidential burden in relation to the matter in subsection (4) (see subsection 13.3(3) of the Criminal Code).

Defence—computer security testing
 (5) Subsection (1) does not apply to the person if:
 (a) the technological protection measure is an access control technological protection measure; and
 (b) the circumvention device will be used to circumvent the access control technological protection measure to enable the doing of an act; and
 (c) the act:
 (i) relates to a copy of a computer program that is not an infringing copy; and
 (ii) will not infringe the copyright in the computer program; and
 (iii) will be done for the sole purpose of testing, investigating or correcting the security of a computer, computer system or computer network; and
 (iv) will be done with the permission of the owner of the computer, computer system or computer network.
Note: A defendant bears an evidential burden in relation to the matter in subsection (5) (see subsection 13.3(3) of the Criminal Code).

Defence—law enforcement and national security
 (6) Subsection (1) does not apply in relation to anything lawfully done for the purposes of:
 (a) law enforcement; or
 (b) national security; or
 (c) performing a statutory function, power or duty;
by or on behalf of the Commonwealth, a State or a Territory, or an authority of one of those bodies.
Note: A defendant bears an evidential burden in relation to the matter in subsection (6) (see subsection 13.3(3) of the Criminal Code).

Defence—libraries etc.
 (7) Subsection (1) does not apply in respect of anything lawfully done by the following bodies in performing their functions:
 (a) a library (other than a library that is conducted for the profit, direct or indirect, of an individual or individuals);
 (b) a body mentioned in:
 (i) paragraph (a) of the definition