Senator the Hon Katy Gallagher

MELISSA CLARKE, HOST: Australia made international headlines last week after an OpenAI agent went rogue and breached a Medicare data portal. Now the tech company says the problem is far more widespread. OpenAI says it's now paused training of its latest artificial intelligence models after revealing US government websites were accessed in ways that were not expected. In Australia, we've seen the government launch a task force to investigate the incident. Katy Gallagher is the Minister for Finance and for Government Services and joins me in the studio this morning. Welcome to Radio National Breakfast. 

KATY GALLAGHER, MINISTER FOR FINANCE: Thanks for having me on Mel. 

CLARKE: Minister, do you have any more information about why it took so long for Services Australia to notify the Australian Signals Directorate about this breach? 

GALLAGHER: So, that's currently under investigation. I know that Services Australia saw the email from OpenAI on 11 September, but it took until the 15th to notify the ASD and alert any incident. So, we're working through what that is. They're legitimate questions about why it wasn't escalated.

CLARKE: Was it just not understood to be as serious as it is?

GALLAGHER: Look I haven't finalised my thinking on it. I'm waiting for some additional advice from Services Australia, but this email box gets lots of emails, often they're not true. And we've made some changes to that email address, or Services Australia have now. So, it's going straight to the Cyber Centre, which is a 24/7 centre, not a place where you check it once a day. So, we've strengthened that already. But these things are under investigation. Services Australia are doing their own forensic investigation. Plus, there's the PM's task force, which will look at all matters relating to this incident, how it was escalated, how information was understood and indeed some of the questions we've got about OpenAI and the time it took to let government know this had actually happened.

CLARKE: With Services Australia now making that change to the email address for notifications and having that sent directly to cyber specialists. Is that something that other government agencies and departments need to be doing too? Is that the sort of change that should be in place more broadly?

GALLAGHER: Well, I think this incident gives us the opportunity to have a look at all of that. I mean, this was a public-facing website, so in terms of the cyber protections around it, they weren't as great as obviously those really critical data sets, the systems of government significance that are protected 24/7 with such serious levels of protection. So, this is slightly different. That email address was slightly different in the sense that it was used primarily by academics and researchers. If, when they're in a government data set that's available, they see something they think might be a vulnerability, they would report it through. So, I don't think people expected a significant issue like this to come through that email address. But again, we've got to learn from it. We've got to have a look at how all of our systems work. And it raises the question around data as well. Like, we've already moved the data that was on that website, legacy website system, onto the majority of it, onto data.gov.au because it is free, it is publicly available and it should be available through that platform, not through some of these legacy websites, which is also something that we're going through now.

CLARKE: Do we have the capacity to detect a breach like that on our own or are we reliant on OpenAI and other tech companies letting us know that it's happened?

GALLAGHER: Well, again, that's one of the issues that's under consideration. This was a public-facing website. It wasn't one of our systems of national significance where we are stopping activity all the time. Like, our systems get a lot of attention from malicious actors. And so those systems are dealing with tens of thousands and hundreds of thousands of these types of attacks. And yes, they are seen and they are monitored and they are protected. This is slightly different to that. And I do know that Services Australia, when they went back to have a look to verify what OpenAI were telling them, they were able to identify some unusual activity.

CLARKE: But not enough to raise a red flag because they wouldn't have expected something like this?

GALLAGHER: Yeah, and that website would not have been monitored 24/7 for that. You know, like it's got different cyber protections and they do have cyber protections, including to protect against bots. But it wouldn't necessarily have been under that big cyber centre we have which is monitoring all of our important systems all the time.

CLARKE: Nonetheless, this exposes an unexpected vulnerability. There must be many more unexpected vulnerabilities as OpenAI continues to go through its backlog of what might have unintentionally happened. Are you expecting more breaches to be revealed?

GALLAGHER: Well, I mean, I hope not. I'm not in a position to answer that really. We've dealt with one in Services Australia that OpenAI have been sharing information, including their technical logs and things like that, to let us verify and ascertain that what they tell us is actually true and that, primarily for me, it was making sure that no personal or private information was accessed, which we can say very clearly wasn't the case. But we are in a new world, essentially, and some of this. I think this incident really adds weight to the argument that the PM has been putting forward about needing to legislate to provide some protections, some guardrails, and also have an escalation pathway. I mean, the idea that something happened on June 18, we weren't aware of it until the second week of September, is just not acceptable.

CLARKE: Are mandatory reporting requirements the answer to that problem?

GALLAGHER: Well, I think at a minimum, we certainly, from my point of view, a mandatory reporting requirement is essential. Acknowledging that OpenAI did come to us and report this of their own at their own decision, and have engaged with us in the weeks afterwards to share all the information they can.

CLARKE: The chief executives of OpenAI and Anthropic have been called to face a parliamentary inquiry into AI data centres. Do you want them to come to Australia and appear before the committee?

GALLAGHER: Well, I'm not on that committee and that is a matter for the committee, who they call and how they deal with witnesses. We've got the Joint Select Committee on Artificial Intelligence, which is meeting right now. We want this issue looked at. The PM essentially referred that to them last week. We think it would be helpful for the Parliament to have a look, not just the government looking at how we respond, but how does the Parliament respond, including in informing any legislation.

CLARKE: You're listening to Radio National Breakfast, where Katy Gallagher is my guest. She's the Minister for Finance and Minister for Government Services. The rapid review that's being undertaken is also looking at the question of legal liability for the actions of AI agents. Some of the opposition is suggesting that, look, it really amounts to threatening AI companies with criminal charges, and that's not helpful at a time when you need to be working closely with them. Is that a fair criticism, that there is a balance to be struck here between needing to look at legal liability issues but also needing to be able to work closely with those tech giants?

GALLAGHER: Well, I think it's probably both. We've had an incident now that, you know, we are taking. Services Australia are taking advice both from AGD and others, around whether there are any liabilities under our current legal frameworks.

CLARKE: Do you want to see a prosecution of this breach?

GALLAGHER: I think there should be consequences. But I also have been briefed very clearly that OpenAI have been helping us and helping us not just in relation to kind of making sure that this vulnerable issue has been dealt with. But I know that some of these companies and the frontier technology they have, you know, we're thinking about it from getting ahead of some of these vulnerabilities. So, I think we have to have a look at this incident and deal with it on its merits. But the broader question of how we deal with these in the future, we've got to be looking at legislation, but also engagement with these companies.

CLARKE: Moving to some finance issues. If we can change hats from government services to finance, there is broad expectation that the Reserve Bank will hike interest rates tomorrow and quite possibly, possibly a further hike again in November. Do you accept that there's been a failure by the government to keep inflation under control?

GALLAGHER: Well, we take responsibility for the decisions we make in our budget. We've found savings, including savings in an ongoing sense, to make sure that where government investment is happening, that it's not adding to the inflation challenge in our economy. But there is a war in the Middle East and that war is having impacts not just at the petrol bowser, but across the board. The sooner that war ends, the better.

CLARKE: Does that put more onus on the government to do more to reduce government spending because of those inflation pressures from overseas that you can't influence?

GALLAGHER: We look at all of these issues around the budget at every budget update. You know, how can we find savings? How can we pay down debt? How can we reduce the interest burden on that debt? We've done that in every budget. We'll continue to do it. But I also have to be upfront and honest to say that the pressures coming to the budget are increasing, not decreasing. We get a lot of calls from the parliament to increase spending in a whole range of areas. We know that areas like aged care, like health care, disability, in terms of managing our debt burden, all of those, our defence spending, all of that is increasing, not decreasing. So, the decisions we have to take are what are the right and sensible decisions to be making about investments? But how do we also find savings and get the budget in better shape? And we'll continue to do that.

CLARKE: And you're announcing today the final budget outcome for the financial year that's just ended. It was forecast to be a deficit of $28 billion. Where has it landed?

GALLAGHER: So, that'll come in about with about a $6 billion improvement since budget. And what that says is that, it's about a $20 billion improvement from the forecast. We inherited it when we came to government. So, again, we do everything we can to make sure that the budget is in as good a shape as it can, acknowledging that we are having to find room to invest in all these areas that the Australian people care about deeply and want to see improved services in.

CLARKE: Katy Gallagher, thanks very much for speaking to us on Radio National Breakfast this morning.

GALLAGHER: Thanks very much, Mel.