For months he warned the government, but nobody would listen. Then the attack struck

Federal agencies were warned for months about exposed public databases, only for the government's data regulator to concede that basic data cataloguing was "not the highest priority" for departments grappling with global challenges.

Subscribe now for unlimited access.

or signup to continue reading

Sitting in an empty co-working space in the American midwest thousands of kilometres from Canberra, data governance expert Sam Spencer was beginning to fear that no one in the public service was paying attention to his warnings.

In correspondence shared with The Canberra Times, acting Office of the National Data Commissioner (ONDC) assistant secretary Kristol Pyke told Mr Spencer the office was "keeping our door open" instead of compelling compliance, explaining that "as we have found forcing ourselves at the issue has the opposite effect to our desired outcome".

Since January 2026, Mr Spencer has waged campaign across the public service, firing off monthly audit emails warning department heads that government systems were dangerously exposed to unmapped databases.

All he received in return was radio silence until he refreshed the public register on his laptop beside the space's cafe owner: the Digital Transformation Agency had quietly updated its records on the Australian Government Data Catalogue (AGDC).

The catalogue is a publicly available register with a searchable index of data assets held by federal agencies.

"Almost nobody had actually emailed me back," Mr Spencer said.

"I was like, 'Oh my God, they changed!' The owner was very excited with me. It's little things like that where I could see that people were actually listening."

More like Moneyball

For Mr Spencer, taking on the federal government over its digital vulnerabilities felt less like The Big Short and more like an administrative version of Moneyball, an outsider's fight against the institutional orthodoxy to prove that Canberra will never be able to secure public data unless it properly catalogues it.

It was an uphill battle marked by professional risk and personal anxiety as he challenged his clients.

"It was frustrating, and it was really scary, because I work with a lot of these departments," Mr Spencer said.

"Some are my clients, and some are ranked quite lowly (referring to the scorecard he developed from the catalogue). You're emailing them every month, and you're wondering: are they ever going to call us back? Are they going to renew? But we were stepping away from orthodoxy and saying, just look at what the records show. Like the guy in Moneyball, we were trying to show there is a completely different way to understand data."

The danger of that bureaucratic resistance was thrust into the national spotlight in June 2026 after an autonomous artificial intelligence (AI) agent developed by OpenAI breached Services Australia's uncatalogued Medicare Statistics portal, accessing unreleased health data and altering internal files 84 days before the intrusion was flagged.

Aristotle Metadata chief executive Sam Spencer has repeatedly highlighted the importance of data cataloguing to the public service. Picture by Keegan Carroll

Instead of feeling vindicated, Mr Spencer felt trepidation as he went on national television to share his findings.

"Probably the three scariest moments of my life were going on national television and ranking agencies," he said.

"You're terrified of what's going to happen the next day because you're making these very big statements. But I'm just a guy who looked at a spreadsheet and saw a thing that nobody else wanted to see."

An inter-agency cyber divide

Following the breach, the Home Affairs department under the Protective Security Policy Framework compelled all departments and agencies to conduct a comprehensive stocktake of legacy technology against AI-enabled threats.

However, a split emerged among federal government departments as to the importance of data registration in the process.

The Australian Signals Directorate (ASD) backed the necessity of registers.

The agency's Information Security Manual recommended departments maintain and verify comprehensive data registers, an ASD spokesperson said.

"Maintaining a database register is an important part of understanding your organisation's attack surface. Cyber defenders cannot protect what they aren't aware of."

A Finance spokesperson pushed back at the suggestion that data cataloguing was a key factor in building cyber security capability.

"The proposition that data registration alone can prevent cyber incidents is incorrect," the Finance spokesperson said.

The spokesperson said protection was the responsibility of agency data and security chiefs, calling the catalogue a voluntary directory for public sharing.

Finance had been one of the lowest-ranking agencies on Mr Spencer's scorecard until recent months, when it uploaded 70 new data records to the AGDC.

His wider audit also revealed more vulnerabilities across the federal government. Up to 20 per cent of catalogued data assets were managed in Excel, while more than one in three had completely undocumented or unknown formats.

After the decision to order a whole-of-government review of legacy technology, Mr Spencer felt a quiet sense of progress.

He has written to Prime Minister Anthony Albanese about the national data crisis facing the public service.

"Unlike the private sector where consumers have a choice, Australians don't have a choice when it comes to government data," Mr Spencer said.

"If you want healthcare, if you want your tax return, if you want Centrelink, you have to hand your data over. There is no opt-out process. This is your data, and it is your taxpayer funds paying for the systems that hold it. We have the right to know that it's being managed safely, and right now, the government cannot protect what it hasn't even bothered to write down."

More from Public Service