Cyber regs and rusty pipes: How legal frameworks are (and aren’t) catching up with critical infrastructure risk

Australia’s critical infrastructure is facing a perfect storm: increasing cyber threats, outdated operational technology (OT), and a patchwork of laws that are struggling to catch up. From ageing water treatment systems to hospital infrastructure and public transport, many of our most essential services still rely on legacy systems never designed with cybersecurity in mind. When those “rusty pipes” get hit with a modern attack, the legal and regulatory landscape can feel just as outdated.

This presentation will explore how Australia’s evolving cyber laws are attempting to address these risks, and where they’re falling short. In particular, it will examine the impact of reforms to the Security of Critical Infrastructure (SOCI) Act, including mandatory cyber incident reporting, the introduction of risk management program obligations, and the expansion of critical infrastructure definitions across 11 sectors. While these reforms represent a strong policy shift, they also raise difficult questions for operators managing legacy systems and disconnected OT environments.

What does “reasonable” cybersecurity look like when systems can’t be patched? Who is legally responsible when an OT failure causes cascading consequences across sectors? How do we manage legal risk when IT and OT environments are increasingly converged, but still governed separately? These are some of the complex and important questions that will be explored and encourage the audience to consider further.

The talk will also compare the Australian legal context with global developments, such as:

Real-world case studies, including ransomware attacks on Australian utilities and global incidents like Colonial Pipeline will be used to illustrate legal grey zones around attribution, liability, and post-incident obligations. It will also discuss the increasing role of insurance, directors’ duties, and contractual risk allocation in the OT context.