An agent of OpenAI has hacked into Medicare’s systems, sparking alarm across Australia. Photo: Julia Gomina.
American artificial intelligence corporation OpenAI has illegally hacked into Australian Medicare data to access government files, an incident Anthony Albanese has described as extremely concerning.
An OpenAI agent gained access three months ago, but the company has only just informed the Australian Government, and even then only via an email to a Services Australia public inbox.
The Prime Minister has let the AI giant know he is not happy with either the incident or the delay in being told about it.
Mr Albanese said he had a “frank” discussion with OpenAI’s chief executive Sam Altman, saying the company took three months to notify the government of the breach and, when it did, the notification was in an email sent to the Services Australia public inbox.
“Today I spoke with the CEO of OpenAI, Sam Altman, to express Australia’s extreme concern about this incident,” Mr Albanese said from New York on Thursday morning (Australian time).
“And I also expressed my disappointment that it took the company way too long to inform the government what had occurred, and the nature of the way that that notification occurred as well was unacceptable.”
The breach occurred on 18 June, with the OpenAI agent gaining unauthorised access to the Medicare statistics reporting service portal, which is administered by Services Australia.
Public and non-public files were accessed, but the Prime Minister says it appears no one’s personal Medicare details were accessed in the hack.
“A forensic investigation aided by the Australian Signals Directorate (ASD) is now underway to ascertain more information, including what other government systems were affected,” the PM said.
“The Medicare Statistics Reporting Portal is a public-facing statistics portal that contains non-sensitive Medicare information relating to data and statistics such as spending.
“No personal information is believed to have been accessed at this stage, but investigations are ongoing.
“Evidence currently available is that there is no broader compromise to the Services Australia network. Nonetheless, this situation is obviously unacceptable.”
A taskforce has now been set up to undertake an “urgent and immediate review” into this incident and to determine whether existing processes are appropriate to respond to AI-related cyber incidents.
The taskforce will be led by the Department of Prime Minister and Cabinet and involve the National Cybersecurity Coordinator, the Office of AI, the ASD, the Australian AI Safety Institute, and Services Australia.
It will also report on possible law enforcement and legislative responses, with the possibility of the Australian Federal Police being called in.
The incident will also be referred to Federal Parliament’s Joint Select Committee on Artificial Intelligence.
Making matters worse, OpenAI’s vice president of global policy, Ann O’Leary, was in Canberra just last week demanding Australia loosen its copyright laws for her company, but she did not mention the Medicare data breach to anyone.
That was four days after OpenAI quietly emailed Services Australia, but a day before the agency noticed it and alerted the ASD.
Communications Minister Anika Wells said it was “highly concerning” that the company “didn’t feel obliged” to let the Federal Government know about the hack for three months.
“We want big tech to take bigger responsibility for Australians and their safety and their welfare,” she said.
Opposition Leader Angus Taylor, however, says it’s Labor that has some questions to answer over the data breach.
He said the government was not doing enough to protect system security amid new technology developments.
“A lot of our personal information is on those systems,” Mr Taylor said.
“The government needs to explain when it first became aware of the breach, exactly what information was accessed, what vulnerability was exploited, and how they’re closing it.”
Government Services Minister Katy Gallagher fronted the media in Sydney with Acting Prime Minister Richard Marles. She said she’s asking OpenAI detailed questions, including about logged information.
“The first technical exchange between OpenAI and Services Australia happened on Tuesday this week,” Senator Gallagher said.
“There are going to be subsequent meetings of those. They haven’t concluded.”
The Greens have labelled the data breach as “a serious attack on Australia’s sovereign interests” and demand the government call in new US Ambassador Dave Brat for a grilling.
“A US company linked to the Trump Administration hacking what is arguably the most valuable and sensitive database in Australia is a serious attack on Australia’s sovereignty,” acting Greens leader Mehreen Faruqi said.
“The US Ambassador must be summoned to explain what the US Government knew and what policy responses they are taking to this serious attack from a major US corporation.”
ACT independent senator David Pocock described the breach as “very concerning but ultimately unsurprising”.
“It again highlights how slow the Australian Government has been to implement appropriate safeguards for AI in high-risk settings,” he said.
“This begs the question about why the Albanese Government shelved plans for a National AI Safety Act and why they are so slow to develop legislation to implement new standards.”
Original Article published by Chris Johnson on Region Canberra.
