Senate Legal and Constitutional Affairs Legislation Committee, , 3:24:27 to 3:28:53
The department discusses the response to unauthorized OpenAI access and the ongoing stocktake of legacy IT systems, including deadlines for identifying systems of government significance.
Topics: National security, Government IT systems
Speakers: Hon Jonathon Duniam, Stephanie Foster, Elissa Walker
Yes, indeed. If we could I just confirm that firearm and gun buyback questions are outcome three. Is that a one? One? Okay, so after this, all right, we'll come to that shortly. Um so on the open AI uh unauthorised access matter that we have. Now I know that will be uh uh yes, outcome one. Including in terms of estimates of cost for replacement legacy systems, etcetera.
For the department centre.
Yes.
Um we can certainly ask our um depth sec for technology to join us and talk through how we're approaching this in the department.
Yeah, maybe we'll have a quick chat about that, but we might come back in outcome one to some more substantive questions across. But I will be interested in what is happening in home affairs.
So um the home affairs angle is a cross-portfolio set of questions, so it would be most um sensible to do that now.
Yes.
And then we come when we come to our role more broadly for cybersecurity, that's outcome one.
Perfect. I do have questions for you in that area. So then yes, the review that was undertaken, I presume uncovered databases and IT systems that required updating within home affairs and agencies?
Um Alissa Walker, Deputy Secretary for Technology. Um, in relation to the open AI incident, um, we're not able to comment uh publicly on uh you know our responses to those cyber incidents, um, it creates um information that's available to cyber threat actors that can increase risk.
Uh well, then can so work was undertaken in response to that. I presume I don't uh want to know which databases were perhaps subject of this, but were their databases or IT systems identified? That required some form of remedial action.
Are you is your question specifically in relation to open AI, Senator?
Well, uh that was a point in time, a catalyst event, if you will. It caused most people to sort of reflect and think there are updates required here across government and probably commercial or private entities as well. So uh without it being in response to specifically events that occurred as part of the open AI social uh what is it called Services Australia unauthorised access? There was a body of work undertaken across government around reviews of security and robustness of databases and IT systems. So I'm just wanting to understand has this happened in home affairs? Were systems identified and has work been undertaken and if so, what cost?
So Senator, um the direction was issued by Home Affairs with its whole government hat on, but clearly home affairs, the department was one of the recipients of that direction. Yes. So like all other government departments, we are reviewing all of our systems. We were directed in that um direction to undertake a stock take of legacy systems.
Yes.
That's the work we are currently undertaking.
Okay.
It is in progress. We don't have an estimate of cost yet, unless Ms. Walker wants to correct me. And the very first point that Ms. Walker made is that we will need to assess once we have completed the stock take, um, what can be shared publicly and what will be damaging in terms of doing an advantage to our adversary, but we're not yet at the point where we know the answers and can make that assessment and can therefore answer you, but the process is absolutely underway.
Sure. And so I'll come back to the uh whole of government approach taken or being undertaken by home affairs and then of course through relevant agencies. But in terms of the time frame for the work that you're currently at the stock take that you're currently undertaking, what when do we expect to have that done?
So there were two different um deadlines. One for systems of government significance, which are the most critical systems for government, and my memory is that was end of December. And then I think it was end of March for all other systems.
Okay. All right. I'm not going to ask any more questions in corporate chair.