Senate Legal and Constitutional Affairs Legislation Committee, , 1:34:58 to 1:52:34
Officials address reports of data breaches involving transcription service provider VIQ Solutions and discuss the implementation of generative AI within the court system.
Topics: Privacy, Artificial intelligence, Procurement
Speakers: Senator David Shoebridge, Katherine Jones, Tara Inverarity, Chris Collett, Senator Michaelia Cash, Interjection, Leah Blyth, Senator Don Farrell, Senator Jana Stewart
We will now resume and I understand the committee still has further questions in cross portfolio. So I'll return the call to Senator Cash.
>> Uh thank you. Could I just get guidance in relation to questions on the prosecution of Ben Roberts Smith in so far as it relates to departmental knowledge? Is that cross portfolio or is it the next outcome?
>> Um, Senator, I think it'll be in our um integrity and security group which uh is not the next but the one after.
>> Ah, so it's not justices.
>> No, no.
>> Ah, it's integrity and security. Correct. Okay. Thank you very much. Um just very briefly then Minister to wrap up the previous line of questioning does the government stand by the nomination of Ethan Floyd?
Uh Senator nominations made by the Australian Human Rights Commission are the matter for the Australian Human Rights Commission. The AHRC is an independent entity and the attorney general is not consulted on
Uh I understand that but independence uh actually means that the minister does not pick the finalists. It does not mean that the minister has no view, no questions uh and no responsibility for a commission within her own portfolio. um given it is a taxpayerf funded uh body. So I ask again, does the government stand by the nomination of Ethan Floyd?
>> Senator Cash, I've answered your
>> Did you ask your questions? Just three questions and then we'll
>> Senator I will be very very brief. Um thank you. Um just just in following um that up obviously the minister or the attorney general uh can apply discretion here given this is taxpayer funded uh money. What is the government's position on whether the human rights commission um should vet uh um those nominees and and is there a vetting process in place that's which seems to be deficient if there is one um but where a nominee is selected um and their statements conflict with Australian law or government position I guess this is the question again does the government stand by the Human Rights Commission and their nominee of Mr.
>> Who who are you asking that question for?
>> That's of you, Minister.
>> Oh, for me. Okay. Uh, look, I I I have answered this uh on the previous occasion. Uh, uh, Senator, um, if there's any more information that the attorney general can provide, I shall provide it to you in the course of today.
>> Thank you, Senator Bluff. Senator Shoebridge,
>> is the Australian Human Rights Commission an independent statutory >> Uh, that's to the secretary.
>> Uh, yes, Senator. It's a statutory agency established under uh legislation uh um with um an independent accountable authority.
>> Thank you. Um could I return to the questions I was asking about offshoring of data and I think we had some officials here um because it's my understanding that this um first became apparent in 2012 I now know 2012 to 2014 um and it involved the family court the federal court and the Australian federal police who were all agencies inside the attorney general's department um agent agencies and or entities inside the attorney general's department. Um and I asked previously um was the department advised about these data breaches about um uh data from OSCript being offshored um in 2012 to 2014. Was the department advised?
>> Senator um uh we obviously became aware of the matters as they were raised in the media uh over the last week. Um we um made we have done some searches to see if we can identify whether or not uh any notification was made to the department at that time. To date we have not found any indication that we were advised.
the evidence seems to be that a former Ogroup national manager made public interest disclosures to the family court, the federal court and the Australian federal police. Are you saying that there's no records that you've been able to find about any one of those three agencies raising those matters with the
>> So far, we have not found anything uh uh through our electronic searches uh in our file system to indicate that we were advised about it. I I because it's um uh such a long time ago, uh I M there's no corporate knowledge of anyone recalling it but we haven't identified anything in our systems.
>> Have you asked Missia Laros who is of course a I think the principal registister of the federal court. Have you asked for an explanation from Missia Laros? And I note that because um an extract of an email has been published which says um I have notified Miss Skaros and this is from 2016. >> I have notified Miss Skaros who is acting chief executive officer and principal registister of the federal court in Mr. Soden's absence as I'm required to do so of the decisions and determinations I have made under the public interest disclosure act. and that it was an email from the then deputy principal of the registar responding to the public interest disclosures. Um have you sought advice from Miss Skaros in her current position about what if any information she knew and provided to the department?
>> Uh yes senator we have sought advice both from Miss Lagos as the principal registar of the federal court and the federal court entity and from Mr. Pringle as the principal registar of the FCFCA. Um, as you may be aware, Senator, given the timing of this particular historical event, there was the period where there was the family court. There was the period when the family court's corporate services were provided by the entity and then of course subsequently the family court and the federal circuit court were brought together as the FCFCA. So we have sought advice from both principal registars and are continuing to work
with them. And what has um the principal registar Mos advised you about her knowledge of matters in at least 2016 and whether or not she informed the department of these very serious data breaches.
>> Yeah. Thank you, Senator. Um Miss Lagos, a couple things I would say. One, I'm very conscious of the independence of the courts, but the importance of the department having visibility. uh and to I'm conscious Miss Lagos will also be appearing this afternoon but she has uh advised the department that she was um advised of uh the the PID uh in 2016 and it was referred as was appropriate for the arrangements between the courts at the time to the family court of Australia uh at that point for consideration. >> I would suggest then further details that are really matter for Miss Lagos to
that there are at least three agencies that were within the department that have been having data breaches offshore and data breaches through transcription services since it appears at least 2012. We have the then family court, the federal court and the Australian federal police. We've now had a raft of further data breaches involving the privatized transcription service with VIQ that appears to cut across multiple courts and we don't know the full extent of it. will you undertake a full audit of agencies and entities inside your to comprehend the extent of these data breaches and to ensure that Australians data and this is some of the most personal data you could imagine. Transcripts in family courts, transcripts in federal courts, financial, personal, will you undertake an audit so as we know the full extent of these data breaches?
Um, Senator, um, uh, I note that, uh, we, in relation to the VIQ matter, we, uh, engaged with, uh, agencies across the portfolio, uh, that we were aware may have been using VIQ. We've now had this more historical matter come to our attention. uh we will seek to understand which um agencies will u within the portfolio may be affected and we will work with them to identify whether or not there are any breaches relevant to them.
>> Well, which agencies do you now know within your portfolio responsibilities
>> I'll ask Mr. Inverarity to provide the uh specifics on that Mr. Um I'd also note in addition to the secretary's comments, there are a range of organizations within the government that have been involved in supporting the courts with this including the cyber security coordinator. Um and the courts as I believe they would have advised the committee last time have engaged cyber CX as a expert firm uh to undertake analysis and provide advice to them.
Tara Inverarity, first assistant secretary, courts, tribunals and commercial division. I don't have the list of portfolio agencies who may have had contracts with VIQ, but what I can say is that uh we engaged uh with the cyber security coordinator and the national office of cyber security.
>> please continue miss.
>> When it became public that there were a range of Commonwealth entities who had contracts with VIQ, the National Office for Cyber Security then led engagement across the Commonwealth uh to undertake inquiries into the nature of the incidents. The department participated in the inquiries undertaken by the National Office of Cyber Security and that was the context in which engagement with the portfolio occurred. Well, I've
asked I think perhaps one of the most simple and straightforward questions that you could ask of the department in the face of what appear to be widespread damaging data breaches. Which agencies or entities inside the department are at have had contracts with VIQ um and therefore at risk. If you if you're not able to answer that most basic question at Senate Estimates, if you haven't come prepared to answer that basic question, I'm happy to just continue this session until we get some answers about it.
>> So I can speak. So the department itself had a contract with VIQ.
>> The department
>> the department did and that was because of the way that the federal court required transcripts to be obtained. So um some courts if the department as a party to litigation wished to obtain a transcript it would be obtained through the relevant court with the federal court it was necessary for the department to go directly to VIQ and that was the nature of the contractual arrangement that we had was to be able to procure transcripts in matters which uh we were a party to litigation in. And
have you undertaken an audit of those matters to determine whether or not any of those matters involving the Commonwealth had the data offshored in breach of our privacy laws, in breach of basic national security? Have you undertaken an audit of those matters?
>> I understand inquiries have been undertaken and we are not aware of any matters in which an order for a transcript that had been placed by the department was affected by the alleged
breach. Well, I'd ask you to provide on notice full details of the contract between the department and VIQ. Do you know when that contract ran to ran until?
>> I do not have that detail, but I'm happy to take it on notice.
>> Did it run until VIQ went into voluntary administration? Was it current as at that point?
>> Um, I I would need to take it on notice. I It is I I think it has been relatively contemporary. Um, but the exact dates I'll have to
>> relatively contemporary, would you say? So we have the department, we have the federal court, we have the um federal circuit and family court, >> we have the um uh do we have ENCAT? Do they have a contract with VIQ? >> Sorry. Do do we do we have um did the AAT have a contract with V VIQ?
>> The ART um
>> No. Did the AAT
>> Oh, we'd have to to check that, Senator.
Did the art
>> I'm not sure off the top of my head. We can check that for.
>> Well, I'm asking again. I could keep fishing for different agencies and or entities. It is a straightforward question. Which agencies or entities inside the department had contracts with VIQ? >> You must be able to answer this.
>> Um Senator, um I have asked our chief information officer to ensure that I have a list as quickly as possible. I will have it um available today.
>> Sorry, can I just make a correction? As I understand it, we did not have a contract with VQ. We procured transcripts directly from them. I apologize if uh
>> well what we might do is we might press pause here >> because the answers are now more confusing shedding more darkness than light on this matter and we will come back to this um at a later point and I but but what I don't want is I don't want to come back to it at a later point when there are agencies outside the courts for example and be told that we're not in a position to answer questions because there are agencies outside the courts. So could I ask you to retain what officials are necessary >> to deal with this during the court's matter so we can move on to the next part of the session?
>> Yes.
>> Yes, we can do that.
>> Um, thank you. I was going to ask you some questions about the use of generative AI in courts and tribunals more broadly. Um, and I do have an aid memoir to hand to you. Um,
>> um, are we now moving into the justice >> section.
>> I I just want to check whether or not it's best dealt with in cross portfolio or this might be better off dealt with in justice and communities. The questions will go to the fact that pretty much every court in the country and tribunal in the country has wildly different approaches to dealing with generative AI causing significant confusion in the profession and for um uh and particularly for unrepresented litigants. But if you think that's best dealt with in the courts and tribunals session later today, I'm I'm happy to take your guidance on that. Secretary,
>> I think I think that's correct. Um Senator, um is the officials from that group um uh that have been
>> But I'm also happy for you to have the aid memoir to Well, I'll defer my my final question is um in relation to um an FOI in relation to um statements that were made by the minister and the government about the efficiencies that AI would produce to allow FOI backlogs and processing to be developed. Do you remember that exchange at the last estimates? >> I do, Senator. We've since um progressed that FOI and found the only information that's been released to us is a two pages of what are described as talking points. Um um and no evidence of any report substantive body of work to justify the statements that I think both the the attorney and and members of the department made about AI assisting dealing with FOI. Was there ever a report obtained? Was there ever um credible advice obtained before the attorney general made that
>> Senator, um uh the office who officers who can assist with those questions are in the integrity and security group uh that's scheduled to appear later. Um and they they um have uh come prepared to be able to talk to that issue.
>> All right. Well, we'll we'll take that on then. Thank you. Thank you, chair.
>> Thank you very much. I'm now just looking for my next notes. It means that we can uh with the um the caveat that Senator Shoebridge has asked for, we're now in a position to uh release other officers from uh cross portfolio outcome and now move into the justice and communities group and closing the gap outcomes 10, 11, and 15. Thank you. and >> hand the call to Yeah, Senator Cash,