Senate Foreign Affairs, Defence and Trade Legislation Committee [Part 2], , 2:35:50 to 2:55:08
Examination of ASD's procurement reporting exemptions and the timeline of the OpenAI vulnerability disclosure involving the Daybreak model.
Topics: Procurement, Artificial intelligence, National security
Speakers: Abigail Bradshaw, Speaker 20, Dale Furse, Speaker 3, Unknown Speaker, Speaker 1, Stephanie Crowe
on the 22nd of June, um the ASD stopped publishing routine tender notices. Is that correct?
>> Uh that is correct. I'll get the Chief Operating Officer to explain the context.
>> Senator, um that would be correct for the financial year going forward for this current financial year onwards. Um so it was about us actually reviewing uh number of information that we had in the public domain. It began with uh actually the review of our annual report. Um and from the committee, there was advice to look at uh how we had different reporting arrangements. From that, we then did a thorough review about other information, and consistent with the other national intelligence agencies, including ASIO, we commenced the process [clears throat] to uh not report against OzTender.
Um can can you just give a I guess a Sorry, it's so late at night. Can you give a more concise answer as to why there's no public visibility on that anymore? Um You are
>> Senator, I'll I'll help the Chief Operating Officer. So um in the course of um producing our last annual report it was highlighted to us that we were including information that was in addition to and in excess of um standards which which were um or information which was was being released by other intelligence agencies in the context of the present um threat environment and in particular foreign interference, we looked at the sort of material that was being released in um uh in those um OzTender um uh details. It included, for example, um information and specifics around the quanta and type of um uh software or ICT products which we were using and in the context of our function um of at the current um foreign interference um environment of the fact that we are overseen by the PJCS and that information is available to the PJCS and to be consistent with the rest of the intelligence agencies, uh we transitioned to um uh to align with their reporting processes from this new financial year.
>> I understand. Um surely not everything is sensitive though cuz you would have things like cleaning contracts, you know, procurement is one thing but um you know, things like services
>> That's That's right. And so the the um standard we applied, the Chief Operating Officer will help me out if he did the detailed work here, was to align with um the disclosures made by the other intelligence agencies. So, we've aligned ourselves, for example, with those disclosures that are made by ASIO.
>> Okay. So, but does that mean that you will still publish some tenders?
>> Uh Senator, uh in looking at what the other national intelligence agencies did. And we had traditionally exempted a range of different contracts. So we had never always fully published all of our contracts. Actually, the approach that they were taking was to not publish the full range of contracts because even to the point of the cleaning contract, actually there would be information there that to Ms. Bradshaw was commenting about the foreign interference would suggest uh an avenue of information.
Uh just why why didn't you do this from the beginning? Like why I mean if the other agencies have been doing this for so long, why now?
>> Yeah, it's a it's a great question, Senator. I asked myself it hadn't occurred to me that there was a differentiation. ASD didn't become an independent statutory agency until 2018. And because it was was born, if you like, out of the Department of of Defense, at the time that it was part of the Department of Defense and didn't have a separate identity, there was a different risk profile with the detailed um uh uh disclosure um because they were buried in inside of a much larger department. It wasn't looked at at the point at which ASD transitioned out and became a statutory agency. It was the review of the annual report um that brought the matter to our
>> So who reviewed it? Who brought it to your
>> Uh this committee did the uh we this committee's review of the annual of of our annual report in 2025. [laughter]
>> And now we want to know all about it.
>> Uh those annual report reports that we do are fantastic and lead to some wonderful reforms. Um Mr. Malcolm Senator Pocock, mind if I let you go to another committee? You have some questions, Senator Pocock, for ASD?
>> Thank you, Chair. Um thank you very much, Senator Collins. >> Thank you for your [snorts] time this evening. Um, I'm interested to ask about the uh PHP, the hypertext uh preprocessor um issues. What what day did you first learn about the PHP two shell vulnerability?
>> Uh Senator, we had advice, I think earlier uh around mid-October. We were um advised uh by Open AI that their security researcher had identified a vulnerability >> on PHP. Excuse me. Um and uh that a patch to address that vulnerability was being worked on. The normal process in the case of a vulnerability which uh does not have a patch and there is no evidence of that vulnerability being exploited uh either in Australia or globally, which was the case with PHP, is to wait until a patch is available. The alternative um which is to advise people that there's a vulnerability runs the risk of the availability of that vulnerability being discovered by people who would use it for malicious purposes. >> And so, following that process, we were working up to our planned disclosure process when the patch became available. Unfortunately, uh a a a a third party um disclosed the vulnerability early, which is actually um inconsistent with well-understood traffic light procedures.
>> Well, it's only those that they released it 6 hours early, so it wasn't like a huge change in the timeline.
>> I'm not sure that 6 hours is right. Do you recall?
>> When when when What's your understanding of when OpenAI were going to tell the world?
>> I think we were um, do you know for
sure? >> to release that publicly on the 22nd of October. Um, so we um, found out about the unintended disclosure on the 21st, so 24 hours thereabouts beforehand that it was supposed to be released.
>> So, I mean, not a not a huge huge difference. What date did in mid-October did OpenAI tell you that there was an issue?
>> The 12th of October.
>> 12th of October. Okay. Did OpenAI tell you when they were first the vulnerability?
>> Well, I don't know the answer to that to that question.
>> Sure. Maybe take it on notice, if that's
>> what I will take that on notice. What I will say is as a consequence of the OpenAI incident, we have worked with OpenAI on incident reporting protocols to improve the reporting that occurred in the case of the websites that were impacted.
>> Sure.
>> And one of the principles under the revised and agreed incident reporting protocols is for early notification. And in this case, this was early notification in the sense that it was notification of a vulnerability prior to the availability of a patch. So, in the course of a patch being worked out.
Um from from what I can see, OpenAI first found out about this um along with the the Cleary researcher Ryan Austin on August 11th. And so, they took a month to let the Australian government know. Do you think in in the wake of
>> Senator, I'm sorry. I don't have access um to that information. I'm I'm not sure.
>> going on what's what's on the internet.
>> Um can you can you help us out with the name of the report where that's stated?
>> I think it's pub- it's publicly reported in a bunch of news sites. Um but that's why I asked when AI OpenAI first knew because you'd you'd think in in the wake of hacking um Medicare that they'd probably take a bit less time than a month to let ASD know. Um but I understand you probably can't um if you don't know when they actually [clears throat] found out then you can't comment on it, but maybe on on notice when OpenAI told you that they first found this vulnerability, and then your comments on their timeliness in letting you know. you said you're working with OpenAI more closely now. Do you have access to
>> Yes.
>> When did you receive that >> Uh
I'll just see if someone can help us out uh with that.
>> Maybe while you're looking for that, um in response to a question on notice about which government agencies have access to Daybreak, OpenAI said that it was prioritizing access to affected entities. but they also listed that the Vic Department of Government Services had been given access. Uh were they hacked
um Vic Government Services, just hang on a second while tell you the identity of So, it was the Australian Institute of Health and Welfare. Notifiable national notifiable disease surveillance system, Victorian was one of the websites.
>> Sure, that but they said that they've given access to the Vic Department of Government Services. Do you know why they've given them access?
>> Um I don't know why they've given them access. The program as I understand it and have spoken to OpenAI whilst whilst it is right I have read their public apology of the 29th of September to whilst um in that public statement they indicated that they would provide assistance to impacted entities, I'm also aware um that they've suggested that they would would make Daybreak or other assistance available more broadly.
>> Okay. I see that two New South Wales men are facing charges for accessing restricted government data. Uh why is OpenAI not facing the same legal consequences?
>> Oh, um I'm sorry to Senator, that really is a matter for the Attorney General's Department or the Australian Federal Police.
>> Okay, I'll put it to them then. Um do you have any intelligence that suggests that the hack that occurred around the world um at the same time as the Medicare hack were part of a a a deliberate strategy um from OpenAI to identify cybersecurity weaknesses?
>> Um I don't.
>> Have you asked them about that? I mean, they they say that they didn't intend this and the bots kind of were just looking for information, but um do you have intelligence
>> Well, I
>> looking at like whether or not they
>> Yeah, right. I Well, I think I've read OpenAI's open um open apology of the 29th.
>> trusting Sam Altman? I'm I'm interested beyond beyond that is
do you have any >> actually a question that you should put to open AI. Um I think for context, however, I mean I can take their their statement uh the both the public statement and and their advice to us on face value. Their statement to us is consistent with the statement which was which was made on the 29th of September. And and that statement indicates that they were testing a model not publicly available without sufficient guardrails and human oversight. That the model was being tested to answer questions in relation to medical research. Um and that is that is their public statement about what has has happened here. I will add that um these models, the phase that we are going through at the moment in the in relation to AI and these models is that these the present cadre of frontier models happen to be very good at coding and reasoning. And so um the fact of finding vulnerabilities of itself is an is the purpose actually of uh of the models. Um I would be in violent disagreement oh sorry, agreement with you if what you are proposing is that there ought to be stricter controls and greater human oversight over the development and testing of those models.
Yeah, I mean I it just it just seems a bit sus that you've got a company that um finds all these vulnerabilities says oh we didn't mean it, but here's a Here's a solution. And you have the solution to protect yourselves from from us." Um and I think there's a there's a healthy degree of of skepticism um amongst the the public. Just just finally, in in that same response to a question on notice um from Open AI, they said that access to Daybreak can be facilitated through a third-party. >> [clears throat] >> Do you know who these third-parties are?
>> It may be a variety of um hyperscalers or others. Um I just want to answer your question. We got access to um Daybreak on the 11th of August. Uh can I just um explain that Daybreak is in fact more complex than it sounds. Uh it is a model which is not available publicly. Uh and therefore there are various versions that don't have safeguards which are available publicly. uh I can tell you from experience it is a difficult thing to You don't simply just turn on uh Daybreak or these frontier models. There are a variety of um security protocols that you need to go through in order to harness the models um uh securely. Uh and in fact to um set rules around data retention and and other conditions of use both in the to the benefit of the user as well as um uh the provider. So, the process of utilizing Daybreak is not a is not a simple one.
>> Simple one, yeah, sure. And how long will the $10 million in credits last?
>> That in in depends entirely on the usage by um the entity and the and the number of the way the tokens operate. Generally, the more complex the prompt, the more tokens will be used.
>> How many tokens have ASD used so far since the 11th of August?
>> Um uh uh Senator, that that's sort of information um about the rate at which ASD consumes frontier capabilities is really more a matter for the PJCS, I'm
the the public won't know how long the $10 million will last us.
>> Uh well, that is actually a matter the $10 million is provided to the entities not not to ASD to credit for them.
>> If people won't tell us how many tokens they're using, then it's very hard to know how long it's going to last us.
>> But um Senator, that is really a matter for the entities that that enter into a an agreement to have the Daybreak access. That that of its own is a matter for each one of those entities. I just can't tell you what ASD uses.
>> And can you maybe just explain you know, crossbenchers aren't allowed on PJCS. Um only for the major parties. So like what what would you be giving away if you told us how many tokens you're using on Daybreak? I mean I think most Australians would expect you're using as many as you need or as many as many as possible. I don't like what's
>> Uh because the rate of consumption of tokens would give an indication of ASD's capability to use tokens for intelligence purposes.
>> Okay. So yeah, sure. If it's low, then people might think oh dear. You can't do it. Fair enough. Thank you Thank you very much. Appreciate your time. Thanks.
>> All right. Any other questions, Cole?
>> Just a couple of follow-up ones on that topic.