Senator the Hon Katy Gallagher

SARA TOMEVSKA, HOST: For more, I spoke to Katy Gallagher, the Minister for Government Services, who was the first member of Cabinet to be alerted to the breach. Katy Gallagher, welcome to the programme.

KATY GALLAGHER, MINISTER FOR GOVERNMENT SERVICES: Thanks very much.

TOMEVSKA: Should Australians be frightened today?

GALLAGHER: No, I don't believe so, but it is news that I think people will engage with and should have a look and listen to what's happened and what the information the Government's provided, because it's certainly a novel thing that's occurred, but it's important people realise that no personal information, nothing associated with personal data, nothing about claims or processing or any of those types of areas has been affected by this incident. It's really been a public facing website that has been impacted and we are doing a very thorough forensic examination of it.

TOMEVSKA: Just on the timeline of this, OpenAI's Vice President was in the country earlier this month. Its CEO, Sam Altman met with Richard Marles in early September. The company didn't use either of those opportunities to inform government officials about this breach. How can Australians trust OpenAI to train its frontier models here if they can't even be upfront about a serious breach like this?

GALLAGHER: Yeah and look that's a very legitimate question. I can't answer what levels of employees or the head of OpenAI knew at that point in time. What I do know is that their organisation became aware of the incident in August and they reported it through to the Services Australia email site on 10th of September. Obviously, they're all questions that we have and that we are putting to OpenAI. They are engaging with us, and we're really pleased about that. They are being very open with us. They've come to the table, they've alerted us to this incident, they've done one technical exchange with Services Australia and we've sought more information. So, as that progresses, we'll get more understanding of some of the issues around that timeline. But the PM's been very clear, you know, the nature of how we got alerted to this is not acceptable and the time it took to alert us to this incident is also not acceptable.

TOMEVSKA: Just on that has the government received any explanation from Sam Altman about as to why OpenAI only sent an email about the breach and why the company didn't try to communicate it more directly?

GALLAGHER: Well, we've certainly raised that with OpenAI through the technical exchange. Obviously, the PM met with Mr Altman overnight in New York, and I'm not fully across all of the issues that were raised in that conversation, other than what the PM has spoken about publicly, but they were some of the questions we put, including that it's not acceptable to go to essentially a public email address and send us an email through that. When we had an incident like this occur, we believed it should have been escalated a lot higher and a lot earlier, and we've made that point to OpenAI, and I think it's one they've accepted.

TOMEVSKA. So, the government is considering whether or not to refer this incident to the AFP. What's the bar to do that?

GALLAGHER: Well, that's one of the issues that's been examined through this. Look, this is an unprecedented situation, so, I mean, the first part of it has been trying to get an understanding of exactly what happened and when and making sure that all of our systems are safe, that Services Australia is responding by going through and doing a thorough investigation into what led to this incident being able to occur. So, that's all happening. But further, all of those matters around what happens next, what laws have been impacted. All of those issues will be examined thoroughly in the days and weeks ahead.

TOMEVSKA: Ok. On the rapid review that's been set up, the website says it will inform Australia's new AI standards. What is the timeline on this? Will the review be finalised by the end of the year to keep on track with Labor's timeline to actually legislate standards in early 2027?

GALLAGHER: Yes. So, we want it done as quickly as possible. I should also say we'll also - and the PM alluded to this earlier, referring this to the Select Committee on Artificial Intelligence, which is also examining issues around AI and regulatory arrangements. So, it'll also be referred there so the Parliament can have a look. But, yes, we are - I think this incident actually accelerates or amplifies the need for us to respond in a regulatory sense as soon as we can, and certainly by the end of the year. But we need Parliament's agreement for that as well.

TOMEVSKA: A discussion paper that's been put out on these potential standards includes rules for reportable incidents. I'd assume that's now going to be a must in this legislation?

GALLAGHER: Absolutely. I think everyone who has looked at this incident and seen how it's rolled through, would agree that we're going to have to put some guardrails and requirements around these companies in relation to identifying a problem and also reporting it under what arrangements they report it and how. And I think all of that will be looked at by both the review, but also by this Joint Select Committee which has representatives from across the Parliament because, you know, we can certainly bring draft laws to the Parliament. We actually need the Parliament to pass those laws. So, we need to get support across the board.

TOMEVSKA: In terms of this kind of incident, these breaches, I know that the legislation isn't drafted yet, but have you given consideration to what the penalties might be for companies that fail to notify the government or the public of rogue incidents or breaches in a timely fashion?

GALLAGHER: Well, again, they should all be and will be being considered through both the development of the legislation from our side, but also the Joint Select Committee, which it's on their agenda as well. I mean, we've been looking at these in terms of some of the discussions around the social media ban and some of the penalties around that. In fact, we've just strengthened those in the last couple of sitting weeks. It's also coming up through the digital duty of care. We know that these big tech companies, you know, very wealthy companies, make lots of money and so the penalties and what level those penalties should be is a critical issue to get right.

TOMEVSKA: And we have seen calls today from the ACTU calling this incident a point of no return for AI regulation in Australia, and also calling for the Artificial Intelligence Safety Institute to be given regulatory powers. Is that what's required?

GALLAGHER: Well, I understand, you know, the ACTU and other unions have been very vocal on the issue around AI regulation and for good reason. But so has the government. I mean, it's the Prime Minister that's been leading this discussion. He set out in a landmark speech in back in June, all of the issues that we're facing and some of the principles and guardrails he'd like to see around that artificial intelligence and how it develops across our economy. So, this is something that we've been leading in terms of the public conversation.

TOMEVSKA: Sure, yeah.

GALLAGHER: I think this –

TOMEVSKA: Sorry to interrupt you. Just the AI Safety Institute is a pretty toothless body at the moment though, isn't it?

GALLAGHER: Well, it's just a new - it’s a new body that we've established and it's been given, you know, some early funding to get going. But we've also got our Australian Signals Directorate, we've got the Australian Cyber Security Centre, we've got a whole range of bodies that have responsibilities here. So, it's not just that the AI Safety Institute, it has a very important role, but in relation to this incident, and this incident in particular, it's ASD, who's leading the response to it and providing advice to government. So, yes, we need to make sure that all of our bodies that are funded and who provide support in this area have the right powers to do the job they need to do. And we take advice from all of them on how to do that. And this rapid review will be, no doubt, be looking at all of that as well.

TOMEVSKA: Opposition leader Angus Taylor says the Coalition is willing to work with the Government to strengthen AI guardrails, including on cybersecurity. Is the Government considering strengthening our cybersecurity legislation and framework?

GALLAGHER So, we are, I mean, we're very keen to work with the opposition. In fact, this morning before, really, just as the news broke, I briefed members of the Coalition who have responsibility in this area to make sure they had the information I had. I also briefed members of The Greens. I understand there's further briefings happening this afternoon with our agencies so that everyone has access to the information. That's an important part of this. In terms of cyber security and cyber protections, this is an ongoing, huge area of work. You know, we've put huge amount of resources in, in Services Australia alone in the last budget we allocated $160 million for cyber uplift, because we need to constantly be protecting and upgrading our systems all the time to keep them safe from malicious actors around the world, because our systems get constant attention. So, this is just something that, you know, it's a fact of the world we live In now. We're going to have to constantly be looking at what we're doing and how much we're funding and what systems we are protecting in order to manage some of the risks that come our way through various technologies and various actors with different motivations.

TOMEVSKA: Minister, the Deputy Prime Minister has assured Australians of the security of government information, but we know and we've seen how quickly these AI models are improving. I guess the bottom line is you can't guarantee there won't be more breaches like this or worse in the future, can you?

GALLAGHER: Well, what I can guarantee is we will learn from this and we'll do everything we can to make sure that we are keeping Australian information safe. You know, our systems of national significance, those key important systems, whether it be in personal information or defence, are critical to the safety of this country. They get absolutely high-level protection and they will continue to do so.

TOMEVSKA: The Greens have renewed calls for a moratorium on data centres until those national standards are in place. Is that a sensible proposal?

GALLAGHER: Well, I think I've heard the Greens call for a moratorium. I'm not sure how that would have helped in relation to this issue. You know, what we are trying to do is engage with the Parliament to get good standards and regulation around, well, in that case, data centres. But in the case that we've been talking about today, around standards, around artificial intelligence, around guardrails and protections, we need to do all of that. We don't accept that a moratorium would solve all these issues. We've got to be engaged and working on all of these things and we would encourage the Greens to do so. I don't think this is a world where you can put your head in the sand. The technology is here. We've got a live example here of a situation, an incident that's arisen out of an AI agent and the way it operates. And as a government, we need to be transparent and open about that and also learn from it and make sure we're doing what we can to protect all of our systems and people's important information.

TOMEVSKA: Alright, well, there's plenty for you to work through. Katy Gallagher, thank you for your time.

GALLAGHER: That's alright. Thanks very much for having me on.

TOMEVSKA: And that was Finance and Government Services Minister Katy Gallagher on the OpenAI breach of a Medicare portal and the Federal Government's response.