Spy agencies face AI legal vacuum as security watchdog review stalls

Australia's spy agencies are operating in a regulatory vacuum on artificial intelligence (AI) because of decades-old legislative secrecy exemptions and a lack of modern ministerial safeguards, a senior intelligence official has warned.

Subscribe now for unlimited access.

or signup to continue reading

The official tasked with auditing national security and counter-terrorism laws says a second set of AI rules may be needed to protect government data and formalise human oversight inside the national intelligence community without compromising its work.

Defnce Minister Richard Marles and Home Affairs Minister Tony Burke have not updated rules for how espionage agencies inside their departments use AI. Pictures by Jonathan Carroll, Keegan Carroll and Canva

But a review into the necessary legal framework has stalled because the government is yet to support a recommendation in a two-year-old security report, and the statutory official who would conduct it is stepping down in November.

Internal rules set by Defence Minister Richard Marles and Home Affairs Minister Tony Burke on how intelligence agencies manage automated decision-making, privacy and data "say nothing about AI specifically," the Independent National Security Legislation Monitor said in its 2025-26 annual report.

Current internal rules also allow agencies to keep data for longer, have "wide exceptions to disclosure and use" of how even incidental data is collected, and do not consider data use to train AI models, the Monitor's report said.

Intelligence agencies are also exempt from the Privacy Act, the Freedom of Information Act, the policy for the responsible use of AI in government, and partly exempt from the Administrative Decisions Judicial Review Act.

The exemptions are designed to prevent the disclosure of vital national security information, but the Monitor warned a "gap" between common law and internal rules has created "uncertainty over reviewability and transparency" of AI use in decision-making by intelligence officials.

"This includes the role AI may have played in building the case for a warrant to be issued," the report said.

The Monitor has done "initial scoping" ahead of a full review to assess "whether a bespoke regulatory framework for the use of AI by [national intelligence] agencies is needed".

But the Monitor's office, which ran with an average staff of eight and a $2.7 million internal budget last financial year, had been unable to complete it while it ran other investigations, the report said.

The current Monitor Jake Blight will also end his three-year term on November 25, leaving the fate of the review in the hands of his successor, who has not yet been announced.

The Monitor is appointed on the recommendation of the Prime Minister, and has similar powers to a royal commission to hold hearings, and compel documents and testimony.

The 2024 Independent Intelligence Review first recommended the Monitor examine AI laws in the intelligence community, but the Monitor's report revealed the government had not backed the finding.

"Undertaking such a review would have required a referral from the Attorney-General or Prime Minister, which did not occur," the report said.

The Albanese government broadened the powers of the Monitor to act without a government referral through "own-motion" review powers in the Strengthening Oversight of the National Intelligence Community Act in 2025.

'A matter for the Monitor'

A government spokesperson did not answer questions about the Independent Intelligence Review's recommendations, but defended oversight and accountability of security and intelligence agencies as "robust".

"Decisions about when to undertake own-motion reviews are a matter for the Monitor," the spokesperson said.

Opposition home affairs spokesman Jonno Duniam said any regulatory changes needed to "recognise the unique operational requirements of our national security agencies".

"Our main priority is to ensure our intelligence and defence agencies can take advantage of these technologies responsibly, without being affected by unnecessary restrictions that could undermine their capacity to protect Australians," Mr Duniam said.

The national intelligence community is made up of 10 of the government's most powerful, secretive and high-tech agencies, including the Australian Security Intelligence Organisation, the Australian Signals Directorate and the Australian Criminal Intelligence Commission.

Other government agencies are required to disclose AI use and automated decision-making, and are subject to strict rules about gathering and sharing data with AI, reporting AI incidents including hallucinations, and the implementation of AI and its impact on staff.

Public service tech overseer the Digital Transformation Agency also encourages all Commonwealth entities to implement the policy for the responsible use of AI in government and the APS AI Plan.

Both the Monitor's report and the Independent Intelligence Review noted the Department of Defence, ASIO and ASD had voluntarily published AI use frameworks, while ASIO had also published an AI transparency statement.

The Independent Intelligence Review praised the voluntary disclosures but noted, "Not all agencies have followed the lead of ASD and ASIO."

"Intelligence agencies will need to do more in the future to show how principles relating to the ethical use of AI are being applied and managed in practice," the review said.

The Monitor's annual report also recommended changes to strip red tape from espionage laws, a new legal definition of "national security", changes to criminal offences to more stringently punish foreign interference, and protections for protesters who disrupt but do not damage critical infrastructure such as maritime ports.

More from Federal politics