Family court dismissed concerns over India data breach a decade ago

Sensitive Australian court data was accessed in India more than a decade ago, newly surfaced emails have revealed, but the court took no action and years later the offshoring re-occurred.

Concerns were raised with both federal courts and the Australian Federal Police (AFP) by former Auscript national manager, Paul Cutbush, in December 2014, but the court deemed it was not a serious contravention.

Auscript was responsible for transcription services at both courts when the data breach was first raised.

At the time, the family court said Auscript's failure to notify the court about offshoring data was a "technical, minor and inconsequential breach and not one which, when disclosed, would warrant any significant action by the court".

Earlier this year, embattled court transcription company VIQ Solutions, which took over from Auscript, breached its Commonwealth contract after allowing highly sensitive court files to be accessed in India.

Shortly after the ABC reported the data breach, VIQ was put into liquidation and shut down following calls for a forensic audit as well as fears of a potential risk to national security.

Mr Cutbush said the most recent data breach was a "slap in the face" after his concerns were ignored in 2014.

"If they had taken action 10 years ago and questioned the supplier, Auscript — 'what are you doing and why haven't you got authority from us' — then the mess and the disaster that has unravelled now … might not have happened," he said.

Mr Cutbush said he was responsible for overseeing the Auscript project to send data to India but had concerns when he discovered court managers had not been advised of the plan and that the quality of the transcripts being produced in India was very poor.

"I strongly suggested that [the CEO of Auscript] contact the court and gain authorisation … I was concerned about Auscript's reputation, let alone the fact of how that would look if the court found out about something that they weren't authorising," he said.

"I thought that once I made the [public interest] disclosures about the India project to the family court and the Federal Court, I naively thought someone from the court would reach out and comply with their statutory obligation … but there was no response."

It took a further two years before Mr Cutbush received a response to his Public Interest Disclosures (PID).

In 2016, the family court sent him an email stating there was "no express provision in the contract preventing Auscript from performing its work offshore".

But the contract did forbid offshoring, stating that Auscript was "not to transfer such information outside Australia, or allow parties outside Australia to have access to it, without the prior approval of the court".

In the same email, the court confirmed that after questions from the court, Auscript had admitted that, "for approximately seven months [Auscript] established and conducted a controlled pilot/test operation in India".

Auscript told the court the project was, "through a wholly controlled subsidiary with staff operating in accordance with Auscript's policies, including for security, doing mainly private work".

"Auscript also advised the court that all audio transfers during that pilot/trial were encrypted and deleted within 48 hours. The pilot/trial, it was disclosed, was terminated as the required level of quality was not obtained," the email stated.

However, Mr Cutbush said he believed the project went for longer than seven months. He said about 10 staff from Auscript were sent to India along with equipment and he had weekly meetings with an accountant in India who assisted with the operation.

"You can't get much more sensitive from a security point of view. I don't think the expectation of family court users, when they go with sensitive matters to the family court, is that that transcript would be shipped off to a small, chartered accountant in a location in India without the court knowing," he said.

"There has to be accountability."

A spokesperson for the Federal Circuit and Family Court said the current court leadership was unaware of the earlier data offshoring.

"Until the courts received the ABC's recent questions, the current leadership was unaware of the relevant historical correspondence or the matters to which it related," the spokesperson said.

"The courts' leadership at the time, when the historical matters are said to have occurred, is no longer in place.

"The courts' clear and publicly stated position is that they do not permit offshore access to court data related to transcripts, and they prohibit the offshore management of any such data."

Shadow Attorney General Michaelia Cash said the latest revelations were "extremely disturbing".

"I again call on the attorney-general to co-ordinate a proper forensic audit and extend it as far back as necessary," she said.

"This issue requires a whole-of-government response to establish the extent of the problem across various agencies.

"The government needs to provide Australians with a full explanation of the national security implications if unvetted overseas workers have dealt with sensitive content."

Senator David Shoebridge, who sits on the legal and constitutional affairs committee, agrees.

"We clearly need some independent investigation of what senior management staff in the court knew and when they knew it," he said.

"To find out that for more than six months the family court and Auscript were offshoring transcripts with a deliberate pilot project and they've never told the public about this is deeply concerning."

Chief executive officer and principal registrar of the Federal Circuit and Family Court, David Pringle, told estimates a formal complaint about the latest data breach had been lodged with the privacy commissioner in Canada, where VIQ's parent company is based.

A spokesperson for the attorney-general's department said the federal courts were "responsible for their own operation and management".