Senate Legal and Constitutional Affairs Legislation Committee, , 3:41:44 to 3:47:03
Discussion on the coordinated response to the OpenAI incident and an informal estimate that replacing vulnerable legacy Commonwealth IT systems could cost between $15 billion and $17 billion.
Topics: Artificial intelligence, Government IT systems
Speakers: Hamish Hansford, Hon Jonathon Duniam, LTGEN Michelle McGuinness, Stephanie Foster, Senator Jana Stewart
Thank you for your assistance. Senator Pocock. Senator Dunyan.
Uh thank you very much. Why don't we on the same theme go to the whole of government response to open AI? So we've traversed those deadlines as they applied to home affairs. I presume that applies across government. So uh Mr. Hansford or Major General McGuinness, who's running that program that the whole of government approach?
So, Senator Lieutenant General Michelle McGuinness, National Cybersecurity Coordinator. Um, National Office of Cybersecurity uh did coordinate across government in consultation with affected organisations and other relevant agencies. The Australian Signals Directorate led the technical response and incident investigation. The Australian Federal Police were aware and connected at all times. And the ASD and the Australian AI Safety Institute assisted with digital forensic investigation to ascertain more information, including whether government systems were impacted. So in coordination, we coordinated uh two calls that included our state and territory counterparts as well as federal government organizations. And the second call, we invited OpenAI who were able to speak uh directly with those organizations in order to understand what had happened and the data that they had.
Senator, I think your question might also have been going to who is coordinating the response.
Well, I'm sorry, it was just so I knew who to direct the L attendant general or uh Mr. Hansford within home affairs.
Um General McGuinness was obviously speaking about the response to the incident. It's Mr. Hansford's policy area that um prepares the direction to agencies and then works with agencies on compliance.
Okay. And so uh are there beyond the deadlines that Ms. Foster referenced earlier in response to my questions around home affairs directly, are there other deadlines or specific points in time related to the work plan to have a whole of government response to this issue that we should know about?
Certainly, so I think our whole of government response actually started in 2025, where we put out guidance about the use of AI within Australian government systems. Um we've embedded in the protective security policy framework, the the policy around the deployment of new technology, um, how agencies must evaluate technology risk and that that's embedded in the actual protective security policy framework. So from a policy level, that requirement exists at for every agency. Then there's been a series of directions that have been additive to the PSPF, whether that's uh on the legacy technology piece that the Secretary mentioned, which we're managing and answering questions with agencies and obviously going through that process ourselves. Um that that's the next big piece of work with the two deadlines, as the Secretary said on 31 December for the um systems of government significance and then March next year for other internet-facing systems to get a sense of the legacy um uh of Commonwealth systems. And the reason why we wanted to start there is to effectively look at what are the legacy systems, how can we better protect them, how can we quantify the legacy debt and how do we put in place a program of effort to both prioritise and respond and ultimately update or replace or better protect those systems in the future. Um and we we continue to do a whole range of work on AI generally in a policy context, learning from every incident.
And um it's been put to me, Mr. Hansford, that at a cyber security conference at some point recently, you'd estimated that replacing vulnerable legacy commonwealth IT systems would cost between 15 and 17 billion dollars. Does that ring a bell with you?
Um so the point I was making at the Protective Security in Government Conference is that if you just looked at the cost of legacy technology, that is a very blunt approach and does result in a bill I said such as $14, 15, 16 billion dollars, noting the work that we've got underway to actually quantify the legacy technology. That was clearly an example, not a specifically defined cost that has been picked up by the Canberra Times. Um but but it effectively says that if you approach the policy problem by just saying here's the bill, it doesn't actually reflect um legacy technology, how to quantify it, how to better protect it, and how to stagger its replacement, and that's effectively the point I was trying to make.
Yeah, okay. So but that that was a back of envelope conversab calculation.
I think the uh actual quote is such as.
Such as okay. I should use that more uh in my interviews to get in trouble for. Uh okay, then. Um is is there an estimate though? Uh I know the work is being done, but surely there is some idea, even within home affairs, of what kind of cost we're facing to address some of these issues. Now, sometimes it's going to be a patch, other times it'll be an entirely new program, I gather.