Senate Legal and Constitutional Affairs Legislation Committee, , 8:14:07 to 9:09:05
The Federal Court details unauthorized overseas access to court recordings in India and reviews historical data privacy incidents involving Oscript.
Topics: Privacy, Procurement, Government IT systems
Speakers: Sia Lagos, Senator David Shoebridge, Leah Blyth, Speaker 39, Senator Jana Stewart, Chris Collett, Interjection, Speaker 40
I'll just wait for you to get your glass of water and then we can start. There's quite a little collection of bottles and things now on the front desk. I feel like we should get cleared All right, we might proceed. Oh, we already we're already going up at hand side. So, thank you very much. Uh we will now resume. I call officers from the Federal Court of Australia. Miss Lagos, would you like to make an opening
>> Yes, I do. Thank you. Thank you, chair. I would like to provide the committee with a brief update on matters relating to the provision of transcript and recording services that support the Federal Court of Australia and the Federal Circuit and Family Court of Australia. >> These matters have previously been raised before this committee and there have been a number of developments since the last hearing. The entity determined not to exercise its 2-year option to extend its contract with VIQ and has now formally terminated the contract once the transition out arrangements under the contract were completed. Following the decision not to extend the VIQ contract, the entity successfully transitioned to an in-house controlled and administered operating model which has been operational from 1 July 2026. This was a significant operational transition both for the entity and the courts. Entity controlled and owned recording equipment has been installed in more than 190 courtrooms across Australia and the entity has control and oversight of all of the court's data including all historical data. The entity has contracted with a panel of five transcription providers to deliver formal transcription services materially reducing reliance on a single external provider. The contracts with these providers expressly prohibit offshore processing and sets requirements for data sovereignty and security. The providers are meeting workload demands for the courts in a timely manner. An in-house recording and transcription team has also been established to triage and allocate all transcript orders and to closely monitor the operation of these panel providers to ensure compliance with the requirements under their respective contracts. Critically, this transition has been achieved without disruption to court operations or to the court's users. At the previous hearing, I advised that the entity had engaged cyber CX as an independent cyber security experts to undertake an independent assurance assessment of the unauthorized access incident involving VIQ, identifying control gaps and making any recommendations to reduce any security risks going forward. That assessment has now been completed. CyberCX determined that the incident arose from a limited and specific access control process failure that resulted in the assignment of court recordings to unauthorized V VIQ resources. CyberCx concluded further that the incident resulted from a highly specific internal VIQ process failure and would have been difficult for the entity to detect beforehand. CyberCX was also engaged to perform a data exposure assessment and as part of that assessment, CyberCX undertook a very detailed search for VIQ sourced court data which involved gathering information from the surface, deep and dark web, third party global intelligence providers, close sources and internally generated data. That assessment did not locate any information consistent with exposure of data related to VIQ's transcription services. Cyber CX found that the contractual privacy and security requirements applying to VIQ were appropriate while also identifying areas in which the entity's third party security assurance arrangements could be strengthened. The entity ac has accepted those findings and is strengthening its approach to third party risk and supplier assurance. These measures include greater controls over supplier data handling practices, strengthening audit rights and explicit data sovereignty and residency requirements. Although the entity was not required to notify the office of the Australian information commissioner under the notifiable data breach scheme as the circumstances fall within an exception under the privacy act. The entity has assisted the commissioner in its consideration of the matter and has provided information to the commissioner in relation to their preliminary inquiries into VIQ. The entity on behalf of the Federal Circuit and Family Court of Australia also notified the office of the privacy commissioner in Canada who subsequently advised that the matter was more appropriately to appropriately to be dealt with by the Australian regulator. The focus now is shifting from stabilization and continuity of these services to the implementation of a sustainable future in-house recording and transcription operating model that enhances resilience, control, security, affordability, and access to justice while positioning each of the courts to take advantage of emerging technologies and evolving user needs. The entity on behalf of the courts is progressing planning and consultation on this future operating model supported by the design review work undertaken by NAS. Data security and confidentiality remain core principles under underpinning the design of the future model as is a system that makes transcription services more accessible and affordable to the court's users. Thank you chair. I would be happy to assist the committee with any questions.
>> Thank you very much for that opening statement. Um just wondering if it's useful to uh table the opening statement just cuz Senator Shu Brid out of the room for the start of it. Uh and I know that he's had questions about this. So to save us going over ground that you've already covered in your opening statement. It might be helpful in the committee if you >> Oh, you've already got it. Oh, sorry.
>> We we covered that. That is on me. I'll
go to questions. Senator Black. Sorry.
>> Thank you. Thank you, chair. Um, and I will be as efficient as possible because we are um running sort of behind schedule. So, thank you for your patience. Um, as the program is sort of kicked out today. Um, I just wanted to ask about a contract that's recorded on Oz Tender under reference CN473831. Um, and it shows the federal court entered into a $36,575 contract with AON Health Proprietary Limited for training services in June 2024. Are you able to confirm uh what training was purchased and why the federal court considered it necessary?
>> I'm just looking for my colleague.
>> It may not be things that you have at hand. So,
>> no, no, unfortunately, they're not, Senator. I'd be happy to take that question on notice.
>> That would be that would assist me a lot. And then what I might do and this will assist the chair, I can move to sort of the next um block is I might table the rest of what I have on notice to go with that um because that'll that'll all tie in. Um so I will move now to a different subject matter um which is around um the uh fair work court consultation. Um and I'm just wondering um if you're able to let the committee know on what exact date was the federal court first informed that the government was consider considering establishing a new um fair work court.
uh the the federal court was notified just immediately prior to the announcement as was outlined by the department.
>> So immediately prior so the day of the same
>> the day of the announcement.
>> The day of the announcement
>> just immediately prior the announcement.
>> Can I ask um who informed the court?
>> Uh the chief justice received that communication and as I understand it was from the attorney's office.
>> Okay. And do you know if that was in writing or whether it was just verbal?
>> I understand it was verbal.
Um Okay. And that announcement, do you have the date that that announcement was made? Just so that I
>> I believe it was on the day of the announcement and I recall that to be the 23rd of July.
>> 3rd of July. So that's the same as what I've got here. Okay. So he was was the federal court asked uh for its views on whether a fair a separate fair work court should be established?
>> No, it wasn't.
So, it's fair to say it was the court was just um advised of a decision that had already been made just before it was announced.
>> Not have not having been privy to the announce to that communication, I'm not in a position to comment on it further other than the fact of that communication.
can I ask um since the 23rd of July when the announcement was made, how many meetings or discussions have occurred between the uh chief justice or federal court officials and the attorney general and the department um or the department of employment and workplace relations. that may be something you have to take
on notice. Uh well I'm I'm happy to outline that the uh court officials um I was on leave and the deputy registar stood in for that role have participated in um a number of meetings and we have constructively provided uh to assist the task force with information regarding technical information regarding the court's jurisdiction the court's workload uh the operations of the practice area um as undertaken by the court currently.
>> Okay. Can I get on notice um on what dates and who attended those meetings if that's I don't expect you to have that have that on you.
>> I will take that on notice.
has the chief justice or the uh court provided any written evidence, feedback or submissions um concerning the new court since the announcement?
I'm sorry I need to understand the premise of your
>> So I guess in terms of the announcement was made it seems with no consultation I'm assuming um the court would probably have a view on there are pros and cons to establishing a new court. So any concerns that were identified any alternative models or
>> the court's position uh senator is to engage constructively and provide as much information regarding the operation of the practice area in the federal court. Okay. >> Uh as I said in relation to its jurisdiction, its workload uh the administrative operation that supports it uh the practice area. So it hasn't
provided any alternative solutions. It's just accepted the model as proposed.
>> Uh I'm not I'm not sure that that could be uh ascertained. It's just we are providing technical and important information to the task force consultation process uh and uh uh wanting to contribute to that process in a constructive way. Can
I ask as part of that technical information that that you've provided as part of that process concerns that have
>> Uh in so at at this point we are literally just providing technical information to support that consultation process.
>> Nothing to say that things you know in terms of workload or the challenges of that that you're not up to that that point in the process yet. We're not
considering any particular proposals uh or any anything that that uh would would support any comment in relation to those issues. We're just simply providing technical information in relation.
>> Can I ask what you mean by technical
information? >> The cost associated with what the number of judges that are currently operating in the practice areas. Um what the workload volumes are in the current uh work of the court. the um practice and procedure that is applied to the jurisdiction of the employment and industrial relations practice area, the administrative support arrangements that support the operation of the court in that practice area end to end >> including the entities operation to support the IT systems, the courtroom infrastructure
uh and the like. And can I just ask um and and this may be something you want to take on notice, the exact date that the Fair Work Court task force first contacted the federal court.
>> I think I would need to take that on not. Thank you.
>> If you can that that would be um very helpful. And if you could also provide who it was from the task force that contacted the court that that would also assist. Um can I also ask if the makeup of the task force whether there is anyone um the chief justice or a federal court official that is a member of that task force?
>> Uh my role as the CEO and principal registar of the court is a member of the steering committee that has been established with the task force. Um
>> so the steering committee but not the task force.
>> No not the task force.
>> So is there anyone from the court who's
part of the task force? No one from the court that is a member of the task force
if I can assist senator. So the task force is made up of staff from out up attorney general's department and the department of employment and workplace relations and as mos says working very closely with senior officials and officials from the courts and from the fair work commission. But the task force itself is a bureaucratic entity between the two departments.
>> Okay. But you don't have anyone from the
task force is a is a group of policy officials from the two departments but working very closely uh with the courts with the entity with the Fairwork
>> You didn't feel as though the federal court had any officials that would be
>> It's a the task force is a bureaucratic connection agreed between the two.
>> There are bureaucrats at the federal court.
No, I take your point, Senator. The So, the task force staff >> Yeah. uh uh officials in the attorney general's department and the department of employment and workplace relations.
>> I it just seems unusual for something that you're trying to set up a court. You need all this technical information. It seems like it would be appropriate. Is that
>> Oh, I I certainly wouldn't say it's unusual. And as Miss Lagos said, the steering committee that oversees the work of the task force includes the principal registars of both courts.
>> Okay. But not for the task force. Okay. Thank you. Um uh has the task force provided the court with any um sort of options, papers, draft proposals, preferred models or it's just
>> it's it's we are just at the moment >> you're just literally a phase of a consultation and engaging constructively to support uh requests for information.
can I ask if if the federal court or um the chief justice or anyone um representing the federal court has discussed dual commissions um or dual appointments with the president of the Fair Work Commission?
I'm not aware of any such communications and any communications undertaken by the chief justice as you would appreciate senator would be subject to public interest considerations. Yeah. >> And would be deemed to be confidential?
>> So you're not aware or you're thinking this is a public immunity? I'm not aware
of any such communications but in any event I think it is an important aspect of the chief justice's communications >> um that they are part of her administrative affairs of the court uh and as the head of the jur jurisdiction uh I think would rely on those communications being confidential. Um
can I ask then that you take on notice whether there is communication with the chief justice and whether that is appropriate to share with the committee whether there have been discussions around any joint commissions. I would
definitely need to take that on
>> Much senator by Senator She
>> um Oh, thanks very much chair and thanks um Miss Lagos for your um opening statement the um um you reference in that the most recent report by Cyber CX. When did you receive that report?
>> Uh late September. Uh
>> the 22nd of September.
>> 22nd of September.
>> Sorry, Senator. We might ask the CIO, Nathan Price, to come up because he's got the detail around the cyber CX
>> Thanks, Senator. Uh Nathan Price, CIO. Uh the cyber CX report was delivered to the entity on the 22nd of September.
>> All right. And um have you determined to provide a copy to the secretary?
>> Are you referring to the cyber CX report? >> Uh the cyber CX report was commissioned by the entity uh in relation to these matters. uh it does contain comp sensitive security related information. So we're happy to release specific aspects of the actual findings but I think we would have to consider um the release of the report and would seek advice from these
>> I think you've jumped ahead.
>> I'll be your
>> I was asking you about whether or not you were going to provide one to the secretary. Now I have you made the same considerations in relation to the secretary of the department. Um are you going to provide a copy of the cyber CX report to the secretary?
>> Would absolutely. We've provided the secretary well uh the deputy secretary um with a summary of the cyber CX findings um but would be happy to provide them with a copy of the report.
>> Um now will you provide a copy of the cyber CX report to this committee?
>> I think I would only only subject to seek subject to advice. um from the various cyber security agencies. That's the only consideration that I think we would have to factor in.
>> The broad sorry Jimmy Masterus executive director of corporate strategy and programs. Um the broad outlines of the findings of the report were outlined in C's statement and there's aspects of the report that a summary of the report that we could release but there are aspects of the report that go to the operational and security matters within the court. Sodeed we wouldn't release those. Well,
I'm I want to be I want to be clear. Um um I'm asking for you to provide a copy of the report um to the committee. You may want to take that on notice in order to consider um A whether or not you may provide it to the committee in a confidential session um subject to undertakings from the committee. B whether or not you may also in addition be able to provide a redacted version for public use. could ask you to take that on notice. >> Absolutely. >> Um you say that the um the assessment has now been completed. Cyber CX determined that the incident arose from a limited and specific access control process failure that resulted in the assignment of court recordings to unauthorized BIQ resources. That's a somewhat obscure sentence and perhaps you could explain it.
um they specifically referred to it as an unauthorized access incident. So it's specifically referring to the access provided by VIQ to the transcription providers that were not authorized to receive access to those recordings.
>> Well, I mean we've known that all we've >> you you you never gave authorization is my understanding at least in this instance. Absolutely. >> For matters to be sent off to India. This is correct.
>> Absolutely not. Yes.
>> So, we've always known it was unauthorized. >> Did we How much did we spend to find out that it wasn't authorized?
>> Well, I think there's an important differentiation there to be made as opposed to an the differentiation between an unauthorized access incident versus a data breach. And I think that's the that's the differentiation that's been made.
>> So, it was an intentional sending of the data overseas. It was in that's is that the difference you're saying? They they intended it to happen. They didn't have authority. It was a breach of the contract, but they intended they it was a deliberate action to send.
>> That is certainly not VIQ's uh assessment of the matter. They communicated that it was done in error uh and unknown to them until it was detected. So,
>> just stopping you there, Miss Zos. That has been VIQ's position, but it seems to >> that this somewhat obscure sentence in your opening statement suggests it was quite different that there was actually a decision made and authority given um within VIQ to send it over albeit they hadn't done what they should have done and ask whether it was good with the court. Is that how do I understand it?
No, it I I what they are referring to at its essence, it's a process failure by VIQ in permitting access to the recording data that would to people that were not permitted to gain that access.
>> Well, well, of of course it's a process failure because that's what led to the data going overseas. What caused the process failure? Did somebody inapprop um incorrectly make the decision?
>> The incorrect decision was to authorize those people to have access. Uh and we're talking about a limited number of people, eight in total. Uh and five were in fact the only ones that out of those eight, five performed the transcription services.
So from a title someone in VIQ a um made the decision to send um uh transcript recordings to India. Is
that right? not send the transcript recording to permit access to
>> I might provide some there's a process within the VIQ man in the management layer that provides what's called privilege access and that person with privileged access can then assign resources. What they found was that privileged access was applied to too many of their staff. So people that shouldn't have had that privileged access who weren't across the specific provisions within the contract with the federal court then incorrectly assigned work to resources which are subcontracted resources.
>> You call that a access control process failure. >> Yes. So in other words, VIQ said to a bunch of middle management, you now have um the authority to work out where this stuff goes or who has access to this stuff
>> exactly.
>> And how many people in BIQ then decided to give access?
>> We're not we don't we don't have the detail on who there's access privileges, but when BIQ were made aware of the issue, they locked down access of those privileges. So were could not be assigned to resources.
>> All right. But someone in VIQ got uh increased privileges and was uh increased capacity to allow people to have access to this what should be incredibly well protected data from the federal court. Is that right? And they made a decision to allow eight people in India as who are either employees or contractors of VIQ to have to to to to be permitted that access. Is that what happened?
>> Yeah. So they assign work. So the work packages the managers who had the privilege access to assign work would then assign 15minute packages of work to resource groups. They shouldn't have assigned it to the resource group which was an overseas contracting company. Um but they did and we that was the instances. So they weren't uh assigning whole transcripts. They weren't passing data across. They were giving overseas contractors access to specific transcript work load >> um in our system which they shouldn't have done.
>> All right. And when you say you've said it, sometimes contractor, sometimes contractors,
>> they're subcontractors in India. The E24 that we've spoken about previously.
>> Sorry.
>> Subcontractors in India.
>> E24. Yeah. >> So these are individuals.
>> No, they're a they're a company that does subcontracting work.
>> Okay. So E24 was given out and was it to eight named individuals within E24?
There was three individuals in India that have been identified in our in the report
>> but you mentioned eight and five
>> some were based in two were based in New Zealand out of the eight and I don't have in front of me uh the balance as three pe as three of those authoriz authorized persons did not actually undertake any of the work
>> so three people in India who were sub who were working for E24 in one manner.
>> Yeah.
>> Two people in New Zealand who were working for E24. Um um now were they the people who actually did the work?
>> Yes.
>> And there were another three people from an unknown place who also had access. Can you
>> but did not perform any of the
>> but were given access. Where were they located?
>> I can't I don't seem to
>> We might take that one on later, Senator. We don't have the details to hand. Um >> but what we are what the cyber CX report details is that there were 101 matters that went to that the ones that were accessed from offshore and they were accessed by three resources that were located in India.
>> All right. So 101 and is that when you say is that 101 15minute packages?
>> Yes.
>> Yes.
>> Is that right? >> From 101 distinct matters. Well, you
see, one matter might have dozens or hundreds of 15inute packages. >> So, it's 101 matters. So, 101 matters, we had party X and Y in the court. Is >> How many packages then of 15minute? >> um data were they given access to?
My notation says it was 101 records relating to 85 separate court files that were accessed by offshore transcribers
>> So I'm now a little confused because Mr. Price as the um um CIO has said 101 matters. Um you now say 85 matters. You're both sitting in front of me like within a meter of each other. Refer to
>> I think it might be the reference to 85 separate court files. There might have been, you know, different aspects of those court files that related to additional records. I'm not certain of
>> Well, you you must have known you would be asked questions about this. And then the most obvious question we would be asking is what data went overseas? Obviously, the first thing we'd be asking is, well, how many matters does that involve? And now I've got two competing numbers.
>> We can take it on notice and clarify
that. Well, well, we we'll be going to dinner at some point and I'd ask you to clarify it over dinner and we'll resolve it after dinner. >> Like, I can't believe that we're here and you still can't tell me how many matters. You only got the report on the You can't tell us how many matters. You can't tell me how how many packages of data have had access to. When I ask you, I get different answers from the principal registar and the chief information officer. It is unsatisfactory, isn't it?
>> We can clarify the matter, Senator.
have each of has has each of the parties in those matters, however many there are, have they been notified that their data was sent off overseas?
>> Uh, 10 matters were referable to federal court proceedings and there was an internal review undertaken in relation to those matters. uh in consultation undertaken with the federal court that satisfied the court that there were no ext existing confidentiality or suppression orders. Uh noting that the proceedings are conducted in open courts and the recording relates to what is articulated in an open court hearing uh and the court was satisfied that there was no need to take further action in respect of those matters. The balance of the matters were proceedings in the FCFCA and I am aware that the FCFCA is dealing with those matters directly in relation to those matters.
>> But Mus is not the first time that you've you you were familiar with court data being sent off overseas to India, is it?
>> I I will take issue Senator with the sent off. They were accessed from overseasbased transcription pro providers but not sent off. They were just allowed access to the data.
>> We we've had this discussion before, haven't we? Because if you're sitting at a computer in India and you're um transcribing um uh a recording, which is what they did, is this what they did?
>> Yes. Yes.
>> Um, you're going to be hearing the sounds in India, aren't you?
>> You'll be listening to the recording.
>> You will be listening to the recording in India. Where is that happening? In India. Where has the sounds been sent? To India. The data was sent to India, wasn't it? Because that's where the sounds were going into their ears so as they could type it out and transcribe it. You can't you can't work your way around that basic fact. Miss Lagos,
>> I will look to a technical um >> Well, it's not my understanding of how the data was being managed.
>> Mr. Mr. Price, >> for them to do their job, they have to hear the sounds in India. to hear the sounds in India the information and data must find its way to India so it can be heard in their ears so as they can transcribe it
>> so the
>> unless there's some other magical way in which E24 you know just morphed this data from Australia into typing in India
>> the the audio would have been played on that local PC in India >> but it would not have been stored physically on it because that was accessed through
>> it was special. >> It was sent to India. You don't know if they recorded it separately. You don't know. >> But it was sent to India, wasn't it?
>> It was played from a
>> How did it get to India? Did it just magically arrive? It was sent to India by VIQ.
It it would have been it would have traversed the the internet and been played through a PC in that person's location. Correct.
>> You say potato, I say potato. You say traversed, I say sent. What is the distinction between traversed and sent?
>> The the distinction here is that it was not stored on that.
>> I wasn't asking about storing. It was sent to India. Can we agree on that? >> I see Mr. Masters making the obvious concession. It was sent to India. Can I ask you to make the obvious concession? It was sent to India. Mr. Price,
>> it was played and accessed from a PC in India. So,
>> but how did to be played and accessed? I feel like I'm in some alternate reality. To be played and accessed in India, it had to be sent to India, >> didn't it?
>> It did. Yeah.
>> Yes. Miss Lagos, can you now agree that the data was sent to India? You've finally got We finally got Mr. Masters Arcus to agree. We've got Mr. Price to agree. Can you now agree this simple fact? The data was sent to India.
>> I could only rely on the technical understanding of of colleagues who are in a better position to state it. The important issue here, Senator, is that none of the independent verification searches undertaken by the cyber CX experts found any data stored in any of their extensive examination on the uh internet. Uh this we are relating to data here that is on open hearing uh proceedings. Um and it is important to characterize the matters as uh the transcription of recordings in open proceedings uh that have thankfully not resulted in a data breach.
you you keep saying data breach. This is worse than that. This was a deliberate decision to send data that should have been protected and and and carefully dealt with onshore subject to security protocols to send it to who knows who as subcontractors to VIQ. Three um three of those happen to be in India. Two of them happen to be in New Zealand but it appears um um uh it was India where the the matters were sent which was >> this is not a this is not some external entity doing it. This is the the the company you contracted with deliberately doing it. That's worse.
>> Which was expressly unauthorized, expressly prohibited, >> contrary to very explicit contractual terms and as cyber CX determined would have been extremely difficult for the duration in that period for the entity to have detected.
>> Yep. Now we've spent the last 15 minutes in this circular engagement with Mr. Masters Arcus and Mr. Price about um how the data was sent by VIQ to India in relation to the most recent one because you took objection to my proposition to you that this wasn't the first time that you knew of court data being sent to India. Do you remember that stepping away point before we went around that circular discussion about the data being sent to India?
>> I'm sorry, Senator. I think you need to be clearer. This wasn't the first time.
This isn't the first time you're aware of court data having been sent overseas and in this case being sent it been sent to India. You're aware of a previous instance where court data was sent overseas, aren't you?
>> Are we referring to matters relevant to VIQ?
But if if you've got multiple instances in your mind, please tell me all of them. But are you aware of any other instances where court data to your except for this VIQ was sent overseas?
>> Are you referring to the PID involving the family court transcription service?
>> I'm asking you a simple question, Miss Lagos, and I'd really appreciate it if you answered it. Are you aware of any previous instances where court data was
sent overseas? uh at the time of dealing with the matters in VIQ I certainly had no awareness at in a recollection and I think what you're referring to Senator is during a period in September October 2016 the federal court of Australia former CEO received a PID um that was dealt with by the deputy registar of the court who was the authorized pit officer that outlined issues regarding the family courts contract as I understand it um with Oscript Australia in relation to their provision of transcription services to that court as I was acting for a matter of weeks in uh the former CEO's role while he was on leave the deputy registar complied with his procedural obligations to formally notify me in an email that he had allocated ated that pit to the family court of Australia to be handled uh through their pit process. So um that was a period of 10 years ago while I was acting for a matter of weeks in the former CEO and principal registars's role. uh and I can assure you I had no further involvement in those matters other than simply noting to the deputy registar that uh I had received his email of that communication.
>> Um Miss Los asked you a very simple question.
>> No, but I I assumed you were referring to those
>> you may have multiple I don't know that you may have multiple instances where you found out about data being sent overseas. I keep finding new things out myself. So I'm asking you I'm going to ask you again the simple question. You found out about data being sent overseas by VIQ.
>> Yes.
>> More recently.
>> Yes.
>> Were you aware of any previous instances where data from a from courts were were you were involved in the management of the courts in some way was sent overseas?
>> Only in the media reporting in in an article that manifested late last week.
only in media reporting in an article that manifested last night.
>> Yes. Well, we were asked questions uh in respect of those matters.
>> Um well, I'm going to show you a >> Um have you seen this document before? It's an email dated the 20th of October 2016. >> from John Mat to um, uh, Mr. Cutbush. Have you seen this?
I believe this is the email that uh was on forwarded to me uh which is the deputy registars's notification to the discloser uh that he had allocated the matter to the family court of Australia to be dealt with.
>> Yeah. So this in 2016 what was your
role? I was the national operations registar of the federal court of Australia supporting significant reforms in in that court uh directly working with the chief justice and the principal registar. I was not involved in any of the recently created entity >> uh administration of corporate services
>> and you would have known John Mat because he was a he was a deputy principal of the court. He was yes
reporting directly to the CE to the former CEO.
>> And did you work in the same office?
>> I worked in Melbourne and he worked in
Sydney. >> But you um you interacted professionally I assume
>> only on matters that directly inter interacted uh
>> and
>> with our work.
>> Mr. Mat sent you sent sent this correspondence on the 20th of October to Mr. cutbush who had put in place a um uh a public interest disclosure which included his concern that and I'll point it to you at the halfway down page one of three your knowledge relevant to this disclosure was um gained in the course of employment with Oscript. The conduct you wish to disclose is that for a number of years up until 2012 Oscript produced family court transcript in India. This may have been without the knowledge of the family court, was in breach of the contract with the family court, and potentially exposed Australian citizens private data. Do you
>> Uh, is it the paragraph s starting? I'm satisfied that since 1 July 2016, is that the one you're referring? Sorry, Senator, the font is a little bit small for me, but
>> So, you'll see halfway down the page.
>> Yes, I do have those paragraphs. Yes.
uh so what the the substance of the pit was that for a number of years up until 2012 Oscript produced family court transcript in India. This may have been without the knowledge of the family court was in breach of the contract with the family court and potentially exposed Australian citizens private data and then do you see that? >> Yes. Um at that stage the federal court entity was was responsible for the Oscript services to family court.
>> Uh the federal court entity had just been created in July 2016. Senator the contract still remained in place as between the respective courts. So the family court had its own contract as I as you will note with Oscript Australia and the federal court had its own separate contract. contract that was entered on behalf of the courts by the entity occurred in 2020 >> and not during this time as I as I understand it.
>> Um this matter was being progressed by Mr. Mat um as the pit officer. because there was an ongoing according to this there was an ongoing connection between the family court and the federal court at this time in relation transcript. Is that one of the reasons why it happened or was it simply an independent pit?
>> It was an independent pit and as I understand it obviously was forwarded to the former CEO and principal registar Mr. Soden. >> Mr. Mat in his role as the authorized pit officer was handling that made inquiries with the family court uh and sought the consent of the family court for them to handle the pit
>> and Mr. Mat set out in detail as you can see in this correspondence the concerns about court data going overseas to India um and the actions he would be taking as a pit officer including to provide this information to the family court. Is that
right? As I understand it, he simply recited the issues that were raised by the discloser.
>> Yeah. And um well and the he he he was making decisions about how this pit would operate going forward. The information would be supplied to the family court. He'd be seeking access to the family court and the nature of that information being the provision of transcripts to India.
>> That's my understanding that he was reciting the matters that would be dealt
October 2016 um you were the acting um chief executive officer and principal registra, weren't you?
>> Uh for a matter of weeks while the then CEO and principal registar was on leave.
>> Yes. Yes. And that is why Mr. Mat said on page three of this correspondence and I invite you to go to page three, the top of page three, >> Mr. Soden is currently on leave. I have notified Miss Cos who is the acting chief executive officer and principal register of the federal court in Mr. Soden's absence as I am required to do of the decisions and ter determinations I've made under the pit act. Do you see
>> Yes.
>> They were decisions about seeking information from the family court about the PID telling them the nature of the PID and those matters that we covered
a decision to refer the PID to the family court for their uh investigation and and that and for it to be undertaken under their PID process.
um you you knew that in 20 well at least according to this >> 2016. Well, you knew in 2016 that there had been a previous incident involving the family court where um transcripts had been provided to India.
Senator, I was provided during a limited period of acting in the CEO and principal registar role with a procedural notification by the authorized pit officer of the federal court >> for him to comply with his uh procedure requirements. uh I did not uh have any direct knowledge in relation to the matters referred to uh in his correspondence to the discloser. Uh and there that was my last interaction with the matter. 10 years later uh I did not retain that information in my mind. I went back to my substantive role. had no further engagement in relation to the matter uh beyond acknowledging that a procedural notification was provided to me while I was acting in a role that required the pit officer to notify the CEO and principal registar of that
>> acting in a role doesn't change your responsibilities you were in the role and you knew at that time >> that there'd been yes 10 years ago you knew that there had been a previous instance where it appears significant amounts of family court transcripts had been provided to India.
>> I can assure you senator that I did not retain that memory of having received that email notification uh beyond interacting with a senior deputy registar you know who was senior in his role who was directly managing that matter. uh I was formally in a role in an acting capacity for a matter of weeks uh and responding to matters that were arising out of the CEO and principal registars's office
>> but being in we've had this discussion before being in an acting role doesn't change your responsibilities you had the responsibilities you saw the communications that came from uh Mr. Mat, it's your it's your position now. um until this? Well, sorry. When did you remember this interaction? I did not
remember until I reviewed the communication and reviewed the single email I have in my records about this which is the deputy registar forwarding to me the communication he has sent to the discloser to satisfy the procedural notification.
>> Do do you have that email with you now?
>> No, I don't. But it is simply him on forwarding that to confirm as he states in the letter that he has formally notified me of uh the allocation of the matter to the family court. beg your pardon senator he actually then also copies the CEO and principal registar into that email communication.
>> Will you provide that communication that email to this committee please?
>> I'm happy to uh take that matter on
notice. Um you see Miss Lagos there's been a lot of discussion about data breaches slash inappropriate access slash illegal access slash sending data to India involving VIQ and you you now recognize that you knew that there had been a previous incident where a whole bunch of data had previously been sent to India um in the leadup to 2012.
>> I'm sorry, Senator. They they are matters or issues that pertain to a contract directly between the Family Court of Australia >> and Oscript that go back to 2012 and 2014 that momentarily were communicated to me by an onforwarding of an email as a procedural notification. So, I'm I'm sorry if uh uh I I do I do not accept the premise of that
>> Well, sorry. I mean, what premise are you rejecting?
>> That that I had direct knowledge in relation to the specifics of these matters and what occurred back in 2012 and 2014.
>> I would have said that. I have been taking you through the information that Mr. Mat had. I've been taking you through the information that he would have been provided um through the PID. I've taken you through this information. I'm not saying you had direct knowledge. This information came to you through Mr. Mat, didn't it?
>> That's exactly right. Yes.
>> Yes. But it was still information you had
>> as a procedural notification, Senator, uh for matters that were handled by Mr. Mat in his role as the as the pit officer for the federal court. uh I did not make any inquiries separate to Mr. Mat's inquiries or or or take an active part in what he had undertaken.
Um, chair, I I am mindful that this witness has said over dinner they will um review the number of matters where there was a data breach for VIQ >> and the number of packages of data that have been sent and may even get us some answers about the mysterious third country um um where people had access to. Um, for my purposes, now would be a useful time to go to dinner, but I could also ask some further questions to take us through to 6:15 if that is another way of assisting us getting there.
>> Uh, can I get an indication of how much longer post dinner?
>> Um, I simply wish to get these answers that we've been waiting for and there may be some questions some that follow
>> Okay. Would it assist senator if I took that question on notice?
No, >> I would like it
>> Okay, we can uh resume uh with the federal court post dinner for a very short block of questions from Senator Schub. Uh if we're able to get that information over the dinner break, uh appreciate that that also might not be possible and might be a even shorter session post dinner. uh noting that we are running substantially overtime now. Uh so there is some tricky questions before the committee about what we're going to do with the remainder of our evening. So we will update uh the committee and witnesses appearing for the rest of the evening, what our time looks like. So thank you very much for your patience.
>> But to be clear, you all have access to the cyber CX report, don't you? >> Yes. So you can get those answers. Good.
>> Thank you, Senator Shoebridge. Uh we will now suspend for dinner and resume at 6:40