Senate Finance and Public Administration Legislation Committee [Part 2], , 2:24:27 to 2:54:41
Services Australia addresses a security incident involving an OpenAI agent accessing a statistical portal. The agency explains the failure to detect the unauthorized access and the technical validation process that followed.
Topics: Artificial intelligence, Government IT systems, Privacy
Speakers: Claire Roennfeldt, Senator The Hon Jane Hume, Senator Karen Grogan, Speaker 12, Unknown Speaker, Anna Harmer, David Hazlehurst, Marisa Purvis-Smith, Senator The Hon Katy Gallagher
>> Excellent. Um, now finance. I know this is going to really upset you, but we're going to let you go. um, we will, um, rather than moving on to services Australia for 3 minutes.
>> Hang on. Hang on. We just got a correction.
>> Oh, okay.
A small correction to the evidence of my colleague earlier in answer to a question from Senator Hume. Senator Hume asked about uh charging by the department of finance. Uh finance does do only a very small amount of charging. We do however accept credit cards in doing so. However, we have not applied a search charge and so accordingly there is no change to our policies. But I did just want to confirm we do accept credit card but it's very small number of payments given the nature of our responsibilities. That's correct.
>> Thank you very much for that correction. Yes,
>> chair. Yes, just one more. Um, not so much a correction perhaps as a clarification. So earlier, um, Sen Senator McDonald was asking questions about Brett Cattle matter. So I wanted to provide a little bit of clarity on our earlier answers regarding that. Former Minister Leigh is a respondent in the Brett Cattle matter. The Commonwealth controls the defense, including on behalf of Mr. Lewig. The Commonwealth does not and has not in the past taken instructions from Mr. Lewig. The Attorney General's Department meets the costs of the defense of the proceedings against him, the defense of which the Commonwealth controls, and we'll take the remainder of the questions. There was a number from Senator McDonald. We'll take the remainder on notice.
>> Thank you very much. Any more? No. Excellent. Well, thank you so much for your time. Um and we will now break for uh for evening uh for for an evening break and we will return at 9:30 with services Australia >> Mr. David Hazlehurst, chief executive officer of services Australia. Uh, welcome. Would you care to make an opening statement?
>> No. Thank you, Chair.
>> Excellent. We will go directly to questions and we'll start with Senator Hume.
>> Thank you, Chair. Thank you, Mr. Hazlehurst. I will try and make this as quick as possible so that we can get you out of here at a reasonable time. I wanted to ask obviously about the AI breach that occurred on June the 18th. I wanted to understand about um uh why there was no internal notifications that um alerted you to the unauthorized access to services Australia service in June when the breach actually occurred.
>> Thank you Senator. I'll invite two colleagues um the chief information and digital officer and the chief information security officer and I'll let them introduce themselves.
Thank you Senator Cla Renfeld acting chief information and digital officer. Just one moment and I'll be able to >> So your question, Senator, was regarding how
>> could state your name and your capacity. >> Did you Oh, I missed that. I'm terribly sorry. My apologies.
>> No problems at all. Thank you. Um your question was related to related to how the agency didn't get a notification uh when the open AI agent uh incident occurred back in June. >> So at the time when the incident occurred even open AAI was not aware of that incident and
>> No, sorry. I think we're I'm not clear. Why didn't your systems pick up on the breach immediately?
>> Uh yes, sorry senator. Um that was also because during the open AI when that incident occurred, this is a public facing website. So the Medicare statistics reporting portal, the reporting service portal is a public facing website that has aggregate data in there that has no personal information. Um there is no accredititation or uh authentication that's required during to access that system. No password is required and it's generally uh accessed by um vendors or researchers. And so the information that's in there while we have protocols that sit on our websites that provide security uh at the back end it is an open resource uh for for as I said researchers and vendors to access. So there wasn't a prompt at that point when the incident occurred. Then when we received the notification once openai also went through the process uh in understanding that they had had a misaligned agent that accessed the website in that way and moved beyond the front part of the portal into the back end. Uh should that agent have had um say while it was misaligned and had mal say it had malicious intent we would have seen a different response if it had tried to use um credentials uh to access the backend and try to move laterally through the system and that did not occur. Should it have done that we would have absolutely received a uh a prompt because of the cyber security protocols that sit within that environment.
>> Okay. Okay. So, the way it was described, I think at the time, was that uh this AI agent had gone through the back door, but it found the back door open. Is that an accurate description?
>> No, I'm sorry, Senator. I wouldn't I would not uh explain it in that way. I would say that because it had it it accessed it had a misaligned action that actually moved beyond the uh the front-facing system into the back end of
the system. But you didn't pick up on that entrance through the back end of the system.
>> Uh, no, not at that time, Senator Senator.
>> Right. So, does that suggest that the security at the back end of the system was inadequate because the only way it was picked up was because Open AI notified you after the fact.
>> Senator, can I provide a little bit of context? I think it's important to understand the nature of the affected system or the site. Uh again as we mentioned this incident related to that public facing statistical reporting service the activity didn't involve access to customer records and while the agency maintains intensive and extensive monitoring logging and security controls across its environment uh with our highest level protection focused on the systems that hold sensitive information and data. So yes it did misaligned activity. Yes it accessed part of the system that it should not have been allowed to access. Um, but it didn't move further than that.
>> So, it didn't need credentials. It didn't need passwords. That to me sounds like a lack of security at the back end. You said that if it had have had malicious intent, you would have picked up on it, but it doesn't really matter what the malicious intent is or whether it had or didn't have malicious intent. There was it didn't need to breach security to get that data.
>> Uh, the data was publicly available. It didn't need to try to access the back end to access the data. What it did was it had activity where it was trying to seek further information and it did move into part of the system that it should not have moved into. And uh we focus where our focus on monitoring matters is where um you know we apply the greatest scrutiny to systems that deliver critical services.
>> I understand that. But can we be really clear? This was unauthorized. An unauthorized entity that accessed your system and you weren't aware. Is that correct?
>> We weren't aware at that time.
>> Yes. But you were made aware by Open AI. Can I ask what Services Australia did after it was made aware because my understanding is it took 5 days before you notified the Australian Signals
>> Uh thank you Senator for that question. Um following receipt of the notification the agency commenced technical validation activities. Now just to set a little bit of context on that as well uh this was a um this was a very unusual uh disclosure. Um and so when we received the notification through that uh public disclosure mailbox >> we then had to assess if it was
>> the veracity of the disclosure. >> Exactly. So why couldn't you inform ASD at the same time as testing the veracity of the disclosure?
>> We had not seen an incident like this occur in this way. We hadn't seen and and I will say with hindsight and certainly we've implemented processes now that make this a a situation like this look different. Um but we referred the matter for technical assessment. We needed to know was the report credible? What system or site was affected because they their email referenced um a vulnerability. It also spoke to uh an AI model. We weren't aware that it was an agent. We weren't aware that there was misaligned activity at the time with the notification that came through. And we needed to understand whether a vulnerability actually existed and whether any unauthorized access had occurred. And so during that time we the matter was referred for technical assessment on the 11th of September. It was escalated to the cyber security operations center on the 14th. And I'll just mention that that time frame in there is also because at the time uh this type of disclosure mailbox isn't the way that normal cyber incidents would be reported to us. And if they had have been escalated or come through in a different environment, we would have immediately been into our 24/7 cyber operations center. But that wasn't the case. So this mailbox was not monitored on a 24/7 basis. It was monitored 9 to5 um during the week. And uh so once we were once it was um confirmed and escalated to the cyber security operations center on the 14th, the vulnerability was then confirmed on the 15th and once confirmed we immediately took the service offline. We declared a cyber security incident and we notified the Australian signals directorate. Um and again from that we saw that there was the forensic analysis found no evidence that customer information, Medicare records, payment information, identity information or anything personal um was or sensitive personal data had been accessed, altered or disclosed and so our existing security controls also prevented access to the other agency systems and data sets. So that's the process that occurred to that point.
>> Okay. What time did the email arrive?
>> Just let me move to my timeline. So, uh, the email from Open AAI center. >> Okay. So, on at 2:42 Australian Eastern Standard Time, uh, the agency received an email from OpenAI in the agency's public.
>> You said it was monitored between 9 and >> 2:42 is within within 9 and 5. And yet, it took 5 days.
>> AM. 2:42 a.m. on the 10th of September.
>> So, A.M. >> Yes. On the Friday or on the Saturday?
>> On the Thursday, the 10th of September?
Thursday the 10th of September. All right.
>> So then it was uh the reviewed
>> I think on the Friday, wasn't it?
>> Yes. And then on the Friday uh the email was picked up at that time and uh
>> so it's picked up first thing Friday morning.
>> Uh it was picked up at 2:04 in the afternoon.
>> So it took 12 hours but the inbox is monitored 9 till 5.
>> Uh no the inbox is monitored once a day uh 9 during business hours.
>> Right. Okay. Um, can can I just confirm that had OpenAI not informed you of this breach, you wouldn't have picked it up?
>> We may not have picked it up at ex at not at that time, but Senator, if I can just clarify, uh, there is frequent uh, testing undertaken like pen testing, penetration testing that runs across our network and systems. Um and during that time uh sorry across all of the that work um we're able to uh review and and assess various cyber incidents or activity that's occurring across networks and systems. Okay. >> So there would have come a time where we would have reviewed we may have picked it up. I can't say that now. I can tell you that in uh OpenAI was also not aware that it occurred when it happened and they also had to do a review. You said
earlier that if it had have had malicious intent, you would have picked it up immediately.
>> If it had have tried to access the back end of the system and used the uh uh try to move laterally, we would have picked it up because our
>> When you say move laterally, I'm not entirely sure what you mean. My understanding is there is non-public Medicare files that were accessed, but it was u advised that they didn't contain personal information, but there was non-public information. How do you how do you discern public information from non-public information and know if there's you know malicious intent as opposed to non-malicious intent?
>> So Senator the the when we say non-public uh what the agent did at the back end of the system that was non-public. It was accessing public data at the front. It then was seeking further data. It moved into the back end of the system. there isn't other data back there but it tried to find and so it was looking for uh credentials and it was also looking for um uh it wrote a file uh to the back which it did not use any credentials and it didn't move anywhere. So when I mentioned laterally I mean I mean it trying to then access the back end of that already into that site trying to move past into firewalls and other protocols. So it looked
around, couldn't see anything that it wanted without having to breach further firewalls. So it left. If there was another unauthorized access to any of your servers today, AI or not, would you be aware?
>> Absolutely, Senator. Uh particularly, but again, as I mentioned before, it's about where the monitoring focus is. Um and so any of our master systems, all of our core systems, Medicare, my gov, child support, you know, Centerlink, all of those systems have very strong cyber security protocols and security uh frameworks around them. Um and in this circumstance, again, it was aggregate data, no personal information. So our focus and intention goes where the critical um uh sensitive Australian data