Senate Finance and Public Administration Legislation Committee [Part 2], , 3:16:54 to 3:26:07
Services Australia outlines improvements in scam notification processes and the implementation of the Identity Theft Resolution Service. The agency discusses the evolving threat environment and the use of technical terminology like 'hack' versus 'breach'.
Topics: Public safety, Social services, Privacy
Speakers: David Hazlehurst, Senator The Hon Jane Hume, Senator The Hon Katy Gallagher, Chris Birrer, Unknown Speaker, Interjection, Speaker 17
>> So, how many breaches have you had in the last 12 months?
>> None.
>> None. Okay. How many has um uh how many have you been notified about
>> need to get a third party data breach information? Senator,
>> Senator, just while um Mr. bureau finds that the we're of course aware of um evidence given yesterday during the hearing from uh the ANAO and just just as a point of clarification there there was reference to the speed with which notifications were occurring from us uh to the um to the commissioner and uh we definitely had a problem with that several years ago. But I did want to clarify um uh for the committee today that uh we've now been processing uh in the last uh financial year uh 80% within the 30-day period and this financial year so far 100% within the 30day period. So we've put in place uh in the last two or three years uh new processes, additional resourcing to address that. Uh and we've also been seeking to address this issue at source. Going to your point about are people at risk out in the community from these spills of other systems, not ours but others like a medical practice or scam activity, similar kind of thing where people get sent the text message and they click on it. >> We've put in a range of measures now to in effect harden our systems and protect people more. So for example uh in 2425 we had uh 88 notifiable data breaches of this type where there's scam activity out in the in in the broader public or spills of information and as a result of the measures that we've put in place and potentially other environmental factors people becoming more aware less amenable to those scams. We've only had 30 uh in the next financial year in 2526. >> So I'm not declaring victory over scammers, but we've done quite a lot to improve our processes of notification and quite a lot to try and address this at source. And finally, we are in the process now of implementing uh what we've referred to as the identity theft resolution service. So that people who are victims of this activity from these malicious third parties, we now have a more endtoend process of supporting those people to make sure their records are corrected in our systems.
>> Good. that I was going to ask about that whether there was additional protection for the records of customers that you have determined are at risk of having their details exposed. That's the service you provide now.
>> Yes. And that that commenced from the 1st of July, albeit that it's scaling up. We have already had a help desk for people but this is turning it into if you like a more industrialized service that supports people and we are also pro proactively engaging with people where we think their records might have been affected uh by scam activity for
>> So do you believe that the IT systems which store this data are now adequately
Well, Senator, they're not they're not the agency's IT systems that are involved in the third party data breaches, but uh other entities are
>> Sorry, let me rephrase the question then. Is the data that Services Australia stores in your opinion adequately protected?
Uh Senator uh we have done everything we can so far and we are continuing to add additional protections. You will have heard and no doubt you'll there'll be other evidence given by other agencies in the course of this week about how rapidly the threat environment is changing. [clears throat] There's a distinction between the malicious actors doing things that are sort of scam related that kind of activity and the cyber side of things. um uh it will be a neverending task for us to continue to keep up with uh the evolving threat that we're seeing uh particularly in the cyber world. So I don't want to suggest to the Senate that we are we feel comfortable and relaxed about that environment. we don't uh and uh the examples of the kind of agentic AI and other forms of um AI that are being deployed now uh in the cyber context are ones that are of significant concern to us. uh and that is why we're engaging um heavily with um the Australian Signals Directorate uh including uh being able to deploy additional capabilities that they've got to test the vulnerability of our systems and then apply additional uh protections and patching to those systems. So uh as the CEO I feel restless and concerned that we need continue it continuously to be improving in order to continue to protect Australians data and that is what we're doing.
>> Okay. The open AI data breach. I'd really like to get the vernacular right on this. Was it a breach or was it a
>> Not sure those are technical terms. uh
>> they seem to be used interchangeably but when convenient. [snorts] So I just want
to understand >> a hack is normally something that's done with intention would be my understanding just using general uh street definitions of things as opposed to technical language whereas a breach can occur unintentionally. Uh when you look at the notification that was provided and that letter's been um published that's not a secret. uh it doesn't actually talk about agentic AI. It doesn't talk about autonomous. It talks about a model. Uh so what a what um open AI has made clear is that this is something that happened unintentionally. Um and now well in in the days even immediately after the notification it became very clear that it was so I'm not sure what the distinct what value there is in the distinction of hack versus breach. Um the reality with is that [clears throat] the as we've already discussed um their agent did something that was unexpected to them. Uh and uh it did move past the perimeter of that particular website into its back end. As we've discussed earlier,
>> these are all matters as a answer to the earlier question that rapid review PMNC is exploring.
>> Well, Minister, you've used both phrases, hack and breach.
>> I don't have I
>> Yeah, I I I I'm interested in your perception on this one, too. Can a hack be
>> It's not really language I use a hack, but maybe I have, but I
>> I wonder if the if the data is publicly available, is it a hack? >> I don't know. If you don't need a password, if you don't need to get past a firewall, is it a hack?
>> I don't know that it really matters at this point. Um, we're trying to get to the bottom of what happened and we'll follow any recommendations that come out of the review. I've certainly asked questions about whether it was a hack and I may have been responding in that. It's not really language I use like this was, you know, a breach of our systems. We've been as transparent as we can about it. There's a review going in. Open AI have worked very closely with us uh to try and you know understand fully the technical kind of data around it. Um and you know I I think with the frontier AI models um we have much to learn from them and you know this is maybe the first publicly reported one of a government system but I would you know all of the signs including from the companies themselves are that we have to
I can uh my colleagues have confirmed for me that our technical language for it was that it was declared an incident, a cyber security incident.
>> Declared a cyber security incident, neither hack nor breach.
>> Consistent with our standard operating procedures uh and def and declaring it an incident means that other things follow from that. Uh we can go into the detail of that if you wish or we're happy to provide more information.