Senate Finance and Public Administration Legislation Committee, , 2:46:26 to 2:52:29
The committee reviews an ANAO report on cyber security, focusing on inaccurate previous self-assessments, funding for the PICKER program, and the segmentation of the parliamentary computer network to improve accountability.
Topics: National security, Government IT systems
Speakers: Nicola Hinder, Hon Jane Hume, Speaker 3, Unknown Speaker
>> Yeah. Okay. Uh, I do want to come back to this issue around the ANAO report. Uh, was the executive committee or the audit and risk committee told that the earlier self assessments couldn't be relied upon at any point in time?
>> Everybody's answering the answer and uh uh yes senator through the process of engagement with um the audit and risk committee as part of this year's um preparation of reports um we advised that we had prepared the reports based openly transparency and backed up by evidence >> and that we felt that previous year's reporting may not have been completely accurate.
>> Okay. So when did that occur? Uh,
Senator, it was not the last meeting of the audit and risk committee. It was the one before and I'll give you that date um on notice or if I remember or somebody prompts me beforehand. Okay.
Thank you. And who now signs off on cyber risks that can't immediately be
>> Uh, Senator, it goes through uh a process. Uh, first of all, it's independently looked at by our chief information security officer who follows the view. Passes that view uh to the chief information officer. the chief information officer confirms that view. Um it then passes to um myself andor the secretary uh to be able to say um whether or not we are satisfied with the information that we've been received.
>> Okay. Uh Miss I know you said that you weren't in the position when um those previous assessments occurred, but I would like to know um on notice when that happened. So perhaps you could go back and search.
>> Yes, Senator, happy to.
>> Thank you. That would be very helpful.
>> If I could just add Senator Hume, as I reported to before, we were reassured in both private meetings and through this committee by the previous secretary that the system was fit for purpose. So I was more than a little disappointed and annoyed. Yeah. to be made aware that that that simply was not true because you've been a minister of the crown and you do rely on your department people giving you accurate information and so the presiding officers were not given accurate information with the value of hindsight and that is very disturbing.
Uh the ANAO report notes that the departments received funding to upgrade the system to upgrade the network um the parliamentary information and cyber resilience project. How much funding has
>> Uh Senator, when the funding was first provided to the department, it was provided on a not for publication basis for commercial sensitivities. Um however, I can advise that we received in the order of um uh $40 million over four years and that is split between departmental expenses and departmental capital expenses.
>> All right. And over what time period was
that? uh commencing in the 2627 budget and completing in the 2930 uh financial year and it's split into three streams. One of which is in relation to information assurance and government. One is in relation to cyber lift and PCN activities and the third stream is in looking at our electronic security systems that underpin Australian Parliament House.
>> Okay. um if you could provide a breakdown of that um funding and in those in those streams and over those time periods that would be very helpful. Thank you. On notice uh the report notes that DPS is a service provider to other parliamentary entities, parliamentarians and their staff. Uh the differing businesses and security requirements of these user groups were not reflected in the department's IT environment. That's on page eight. So will the reform of the parliamentary computing network address that issue in particular?
>> Uh senator at the last hearing I um provided a very brief overview as to the intent of the first stream of the picker program as the ANAO audit references and I believe the secretary would also like to speak to the secretary has responsibility for the operations of the parliamentary computer network but does not have accountability for everybody that operates on the network. The network as it is currently structured has parliamentarians and their staff. >> It has staff of all of the parliamentary departments operating on it. Because we are in deep appreciation of the work that parliamentarians undertake and the need for them to engage broadly and expansively in a variety of media. Um the system controls that have been applied to parliamentarians have led towards the environment where um a range of activities is permitted. But the accountable authorities and staff of the departments that work within those departments have had those same controls applied to them. One of the first streams around the picker program is segmentation of the network so that the DPS secretary has responsibility and accountability for the PCN and the settings that she sets for her staff and the accountable authorities for the parliamentary departments have got responsibilities and accountabilities for the settings that they set for their staff. The work of parliamentarians and their staff is very very important and that work will not be impacted by the segmentation in the initial stages of what we're going through in pickup.
>> All right. I ask this obviously noting that recent events where the department um had issues around that parliamentary privileged or mishandled documents of parliamentarians. I'm wondering if you've consulted the clarks on the design of this system to place parliamentary privilege as a key factor
of the design. Absolutely, Senator. And in fact, we have set up a board, a governing board um that is responsible for overseeing the work of the program. And on that board are senior representatives of the Department of House of Representatives and the Department of the Senate.
>> Okay. All right. Thank you. I might turn over to my colleague here.