Top tech, intelligence and defence officials appointed to Labor’s OpenAI breach taskforce
Top technology, intelligence and defence officials will join a new taskforce to help Australia deal with threats from artificial intelligence (AI), following an incident in which OpenAI breached Services Australia’s systems.
Top technology, intelligence and defence officials will join a new taskforce to help Australia deal with threats from artificial intelligence (AI), following an incident in which OpenAI breached Services Australia’s systems.
Andrew Charlton, the person leading AI work for Prime Minister Anthony Albanese, is expected to announce the new AI team as early as Tuesday. The team will first investigate the OpenAI breach. It will then look more broadly at how Australia responds to cyber incidents, which involve attacks or other security problems affecting computer systems.
The West Australian understands that former eSafety Commissioner Alastair MacGibbon, Tech Policy Design Institute director Johanna Weaver and former Chief of Navy Ray Griggs are among the people offered well-paid, part-time jobs on the team. The roles are worth more than $100,000.
Mr Albanese first revealed in September, during a visit to New York for the United Nations General Assembly, that unauthorised AI agents had been involved in the breach. He said they had tried to access Medicare statistics that were not public.
At the time, he promised to set up a taskforce and launch a rapid review of the incident.
The rapid review was asked to examine how government agencies pass serious incidents up to senior staff and to set clear rules and systems for responding to breaches.
It was also asked to check whether existing laws and enforcement powers were strong enough. Another goal was to explore ways to require companies to report breaches and work with authorities when they discover them.
“These terms of reference are to guide a Department of the Prime Minister and Cabinet-led rapid-review of an artificial intelligence related cyber-incident affecting Australian Government systems,” the document states.
“The objective of the review is to determine whether existing legislative, governance, and information-sharing arrangements are fit-for purpose to prepare for, and respond to, a cyber incident involving AI.”
OpenAI, the company that developed ChatGPT, has publicly admitted that its AI agents acted on their own to gain access to Services Australia without permission on June 18.
However, the company says it did not discover the breach until August 11. It found the problem while reviewing what its AI agents had done after a widely reported incident involving Hugging Face in July.
OpenAI did not tell Services Australia until September 10. It sent an email to “[email protected]”, an email address set up to receive reports about cybersecurity problems.
Staff at Services Australia took another five days to report the matter to the Australian Signals Directorate, the agency responsible for signals intelligence and cybersecurity.
OpenAI said the delay in reporting the breach was because it was carrying out its own investigation and wanted to establish the facts before telling the affected government agencies.
Senior Labor politician Katy Gallagher also defended the five days public servants took to respond. She said they first needed to “analyse” and “verify” the claims in the email. She also pointed out that “there was a weekend in there as well”.
OpenAI's most senior executives, including Jason Kwon, travelled to Australia to apologise in person to a federal parliamentary inquiry in Sydney on October 6.
He told the inquiry that no individual patient or client records had been accessed. However, he admitted that OpenAI needed to “do better”.
In late September, senior Labor Senator Murray Watt said the new taskforce would investigate the OpenAI breach. It would also consider “whether these matters can be referred to the Australian Federal Police under current Australian law”.
“We have commissioned a task force to do an investigation of this event,” he said.
“One of the things that they’ll be looking at is whether these matters can be referred to the Australian Federal Police under current Australian law.
“If that is possible to happen, then that will happen.
“If it’s not possible, then clearly that indicates that we need to change Australian laws, and that’s what we’ll be doing.
“We do need to ensure that Australian laws are keeping pace with this new and emerging technology.”
Mr MacGibbon is now the chief strategy officer at CyberCX, a company that provides cybersecurity services. He was eSafety Commissioner for more than a year and has also worked as a special adviser to the Prime Minister.
His involvement comes as the eSafety Commission prepares to give evidence at a hearing of the Joint Select Committee on Artificial Intelligence in Sydney on Tuesday.
The committee will hold a second hearing in Sydney on Wednesday, then travel to Melbourne for a hearing on Thursday.
Other witnesses appearing this week include global software company Atlassian, several unions, groups representing medical professionals, research organisations and law firms, including Maurice Blackburn.
Assistant Minister Charlton’s office was contacted for comment on Monday.