OpenAI won’t be prosecuted over its June Medicare hack, but the Albanese government has called the incident 'unacceptable'.
In July, Prime Minister Anthony Albanese announced he would legislate “world-leading Australian Standards for AI”.
Today, he released 18 recommendations from a rapid review of Australian government arrangements for an AI-driven cyber incident, but exactly what implications for healthcare remain unclear.
“We accept all of the recommendations, and we’ve commenced work to implement them,” Mr Albanese told reporters at a press conference in Canberra today.
Specifically, the government will introduce a new law that would impose criminal penalties for “failure to prevent” an offence, “which could criminalise instance[s] where the company is responsible for developing an AI model that engages in harmful conduct, and the company fails to take reasonable steps to prevent that harm”.
The recommendations also called for Commonwealth agencies to review their cyber incident management procedures, support the timely escalation of unusual or new incidents, and provide clear pathways for reporting matters to Home Affairs and the Australian Signals Directorate.
Mr Albanese said the report from the rapid review would not be released, in the interest of protecting the nation’s security.
“Safety and security have been undermined. Australia is the first [to] move in this space, and we want to make sure that we continue to work so that we can reap the potential benefits from AI – boosting productivity, bolstering economic resilience, revolutionising areas such as healthcare,” he said.
Related
The recommendations follow an incident on 18 June, when OpenAI gained unauthorised access to Services Australia’s Medicare statistics reporting service portal during internet-based research into public medical spending as part of an internal capability evaluation.
The tech giant did not become aware of the breach until August and did not notify Services Australia until 10 September, when it sent an email to a generic inbox. The government did not publicly announce the breach until two weeks later.
The breached portal was a public-facing website that contained aggregate Medicare and PBS statistics, rather than the systems used for Medicare claims, payments or individual records.
Although acting Prime Minister Richard Marles called the impact “relatively minor” and the AIHW found no evidence the agent accessed non-public information, prime minister Anthony Albanese called for a rapid review on 24 September.
The review, which examined whether existing legislative, governance and information-sharing arrangements were fit for purpose to respond to cyber incidents involving AI, set out three priorities.
The first was to develop Australia’s AI standards, followed by engagement on international approaches to AI safety and incident reporting and consideration of further legislative, regulatory and crisis management arrangements.
The rapid review was conducted by the Department of Prime Minister and Cabinet, in collaboration with the National Cyber Security Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute, and Services Australia.
TMR contacted the Department of the Prime Minister and Cabinet for comment, but received no response prior to deadline. We will publish further updates in the coming days should anything concretely health-related arise.
Read the full list of recommendations here.
