Federal Court accused of 'obfuscation' as data breach crisis deepens

An integrity crisis in Australia's court system has deepened, prompting calls from the Coalition and the Greens for the Attorney-General to step in and set up an independent audit.

Revelations that highly sensitive court data was accessed in India on at least two occasions has sparked national security fears.

Now, internal court emails have revealed the Federal Court CEO was notified in 2016 of the first data breach — an incident for which no action was taken.

However, a spokesperson for the Federal Court said its CEO, Sia Lagos, had no recollection of having been notified of the data breach by the then-deputy principal registrar.

Security concerns were first raised in 2014 by former Auscript national manager, Paul Cutbush, who made Public Interest Disclosures (PID) to both the family court and the Federal Court as well as the Australian Federal Police (AFP) about the offshoring of sensitive data.

In an email from then-Deputy Principal Registrar of the Federal Court John Mathieson to Mr Cutbush in 2016 he stated:

"I have notified Ms Sia Lagos, who is Acting Chief Executive Officer and Principal Registrar of the Federal Court, in Mr Soden's absence, as I am required to do so, of the decisions and determinations I have made under the [Public Interest Disclosure] Act."

A spokesperson for the Federal Court of Australia said it was "not accepted that there has been a failure to act" in either the data breach earlier this year or the historical incident.

"Ms Lagos did not have any recollection of a procedural notification she had received almost 10 years earlier concerning the Family Court of Australia and matters pre-dating the present administrative entity," the spokesperson said.

"Beyond that single notification, Ms Lagos had no involvement in the management of this matter."

Neither the Federal Court, nor the family court acted on the disclosures made to them by Mr Cutbush in 2014. The family court responded two years after the disclosures were made, classifying the breach as "minor and inconsequential" in emails seen by the ABC.

The family court has denied any current executives had knowledge of the first breach despite Mr Cutbush's disclosures.

Last week, Mr Cutbush said the most recent data breach was a "slap in the face" after his concerns were ignored in 2014.

Auscript was responsible for court transcription services in 2014 before VIQ Solutions took over around 2020.

A second data breach occurred earlier this year when VIQ was managing transcription services and the company was shutdown shortly after.

Cases heard in the Federal Court include critical human rights matters, industrial relations cases, taxation law and matters involving multi-million-dollar corporations while the Federal Circuit and Family Court hears migration cases, and matters involving child sexual abuse, domestic violence and property settlements.

It is unclear how many files were accessed in India during either of the offshoring incidents.

'Warning signs ignored by court leadership': Greens

A spokesperson for Attorney-General Michelle Rowland said the courts were "responsible for their own operation and management" — a position ridiculed by the Opposition.

Shadow Attorney-General Michaelia Cash said the latest developments strengthened the need for a full independent audit coordinated by the Attorney-General.

"I again call on the Attorney-General to take control of this matter and organise a whole-of-government response," she said.

"We need to know what has occurred and how widespread this issue is. It is not good enough for the Attorney-General to keep her head in the sand."

Greens Leader Senator David Shoebridge took aim at the court's leadership.

"It's almost impossible to believe that we are now facing another round of obfuscation from the Federal Court," he said.

"These data breach issues date back to 2014 and it appears that at least some senior staff members of the court have known this.

"This requires a prompt and public explanation from the court.

"Family court transcripts hold some of the most private and painful moments in people's lives, and twice now that material has gone offshore while the warning signs were ignored by the leadership of the court.

"The Attorney-General keeps saying the responsibility is solely with the court, but the fact is the listed entity is under her administrative authority so she also has a clear role here.

"The Attorney-General should order a forensic audit across every agency in her portfolio that used Auscript and VIQ transcription services to provide people with real certainty about what on earth happened with their sensitive court data."

The Federal Court said it was currently reviewing a report by CyberCX into the latest data breach.

A privacy complaint has also been passed on to the Office of the Australian Information Commissioner (OAIC) regarding the offshoring of Australian citizen's data.

The Federal Court said it had provided information to the OAIC and the family court said it would "fully cooperate" with the OAIC or any other government inquiry.