'I find it perplexing': agency chief on overseas junket as cyber breach shock unfolded

We've all been there: you step away from the office, and the boss throws you under the bus.

Subscribe now for unlimited access.

or signup to continue reading

Except in this case you're responsible for about 30 million people's personal data, and your boss is the Prime Minister.

Services Australia chief executive David Hazlehurst was overseas for a conference on September 24, when Prime Minister Anthony Albanese announced that an artificial intelligence (AI) agent had hacked the agency's data portal.

Services Australia chief executive David Hazlehurst and Prime Minister Anthony Albanese. Pictures by Gary Ramage, Darren Howe

Mr Hazlehurst represented Services Australia at the Windsor conference in Canada on his trip, an agency spokesperson said.

"(It's an) international forum for social security and service delivery agencies involving Australia, Ireland, New Zealand, United Kingdom, the United States, and the host nation," the spokesperson said.

"He also visited the US to meet with technology companies and experts about how emerging technology could be safely used to improve government service delivery in the future.

"The decision about public disclosure was made after Mr Hazlehurst's departure.

"He did not meet OpenAI while in the US."

Mr Albanese was the first government representative to announce that a rogue OpenAI agent hacked a Medicare statistics portal with non-sensitive data, run by Services Australia, in June.

He made the announcement on the sidelines of the United Nations General Assembly in New York, where AI featured prominently in discussions among world leaders, three or more days after he was first notified of the hack.

The full timeline of events around the hack has shown up delays in escalating key information at most levels of government involved.

Services Australia staff read an email from OpenAI informing them of the hack on September 11, four days before Mr Hazlehurst was personally notified.

Two more days passed before news of the breach reached the minister responsible for Services Australia, Katy Gallagher, and another two or three days passed before it reached the Prime Minister.

Independent ACT senator David Pocock said Mr Hazlehurst's leave added to existing concerns with how the incident had been handled and the seriousness with which it was addressed.

"This was a time for leadership, and I find it perplexing that having proceeded with the travel, including to the US to meet with tech companies, that the CEO did not meet with OpenAI while there," he said.

Two deputies acted in Mr Hazlehurst's role in the two weeks he was away: Jonathan Thorpe to September 26 then Chris Birrer to October 3.

Mr Hazlehurst only went ahead with the travel when evidence indicated the breach was contained and there was no loss of personal information, the Services Australia spokesperson said.

"Acting CEOs were delegated oversight of the remaining incident response while he was away, with Mr Hazlehurst keeping contact with the agency over the period," they said.

It's different up north

"Bliss."

That's how one secretary described the loose estimates hearings back in his home state.

No prizes for guessing it's Queensland, where there's no Senate to hold departments to account, and the government has an integrity crisis every two or three years.

"There's a question about Senate estimates (from the audience)," Mr Cook said, on stage with the Department of Climate Change, Energy, the Environment and Water chief.

"But just to be clear, not only was Queensland estimates once a year, it was generally no more than two and a half or three hours."

"Bliss," said Mr Kaiser, who also led state agencies before moving to the Commonwealth.

His counterpart at the Department of Education went on: "And not only that, it was also a 15-minute block with the opposition and then a 15-minute block with the government.

"So of the 3 hours you only had to pay attention - not pay attention, you had to pay attention the entire time - but the questions would only come to you, potentially, for an hour and a half."

Earlier in the event, Mr Kaiser said that "having estimates three times a year rather than once is a joy that I'm still learning to appreciate."

The Secretaries Board wrote to the parliamentary standards committee earlier in September, asking politicians to show public servants more respect in Senate estimates hearings.

Mr Cook's and Mr Kaiser's comments were tongue-in-cheek, but if there's any truth to them, the secretaries could soon ask for fewer sessions, easier questions or even to drop the whole parliamentary oversight thing.

APS leaders get a lesson in the obvious

It's a sign of the times that APS leaders need a crash course on how to talk to their staff.

The Australian Public Service Commission published an updated memo on its website on September 11 called "genuine and effective consultation in Commonwealth agencies".

In laypeople's terms that means how to talk and listen, but the memo went beyond broad statements to offer leaders practical tips.

"Genuine and effective consultation involves: providing employees and relevant union(s) with a genuine opportunity to influence the decision prior to a decision being made," the memo read.

"(It also involves) providing all relevant information to employees and the relevant union(s) in a timely manner to support consideration of the issues.

"(And it involves) considering feedback from employees and the relevant union(s) in the decision-making process."

This may be common sense, but the memo is a timely reminder given the current upheaval in the public sector, between redundancy rounds, bargaining over pay and conditions, and fears chatbots will replace humans.

An APSC spokesperson said the memo was updated to provide clear guidance on the adoption of AI, and to align with consultation arrangements agreed through the previous round of APS-wide bargaining and reflected in enterprise agreements.

"It supports implementation of the government's AI plan for the Australian Public Service by providing guidance on consultation when workplace changes involve the use of AI," the spokesperson said.

"The (memo) provides practical guidance to assist agencies in meeting consultation obligations and supports a consistent approach to consultation across agencies."

It sure does.

A curious place to celebrate failure

One blemish caught the eye on the Australian Transport Safety Bureau's (ATSB) otherwise pretty decent APS Employee Census results, published in early October.

Fifty-three per cent of the agency's 110 staff gave a positive response when asked whether the ATSB recognised and supported the notion that failure is a part of innovation.

You have to wonder whether supporting an "it's OK to fail" mentality is a good thing in an agency that investigates the causes of major accidents.

ATSB chief commissioner Angus Mitchell was forthcoming.

"The ATSB, like most APS agencies, fosters a culture of innovation and continuous improvement," Mr Mitchell said.

"Recent examples of ATSB innovations include: the use of LIDAR and drones to map and analyse accident sites; three-dimensional modelling of aircraft cockpits to understand pilot visibility in accident sequences; (and, among others) in-house production of animations to describe accident sequence of investigations.

"The ATSB takes an iterative approach to the development and implementation of innovations, and acknowledges that a willingness to try new technologies and approaches means sometimes improvements and changes take time to bed down and perfect.

"But we also have a mature and robust investigation methodology that ensures there is no adverse impact on the quality and timeliness of our investigation outputs."

Let's hope so!

- with Dana Daniel

More from Public Service