Radio interview – ABC Radio National

E&OE

Subjects: Artificial Intelligence, Copyright.

MELISSA CLARKE, HOST: But first, we're continuing to look at this OpenAI breach that has really garnered the attention of federal politics. We have the Government pushing for mandatory reporting after realising that it took OpenAI three months to inform the Government about a breach. An OpenAI agent breached a Medicare data portal in June, but the Federal Government was only notified in September. Now, a task force has been established to look into the incident. The Federal Attorney-General, Michelle Rowland, joins us now. Welcome back to Radio National Breakfast.

MICHELLE ROWLAND, ATTORNEY-GENERAL: Good morning.

CLARKE: When it comes to this rapid review that the Australian Government has into AI-driven cyber incidents, it is looking at AI agents and how they work in our legal system. If we have an AI agent breach secure Government data, is that a criminal matter or a civil matter or not an infringement at all?

ROWLAND: No, it's a very good question. And I think the fact that this is one of the first times, as far as I can see, that this has actually been reported by a government, the Australian Government, although we know that this now has happened in other countries. I think it's important, we need to look at all the evidence first. There's a lot of forensics that still needs to be gathered and assessments made on that. And that's exactly why we're undertaking this urgent and immediate review, and we'll let that process run. But the short answer is that advice is still forthcoming on whether any offences have occurred, whether that should be referred to the Federal Police as the appropriate authority. But at this point in time, evidence is being gathered on that, and that will help inform how we move forward in terms of whether there are gaps in legislation or whether there are existing structures that could potentially be modified.

CLARKE: Will you need to complete that review before a decision is made about whether or not there's some kind of prosecution that could potentially be proceeded with, or would that investigation be able to take place before this separate review?

ROWLAND: Look, I think it's important that the review be allowed to do its work. Whether the AFP considers that it has other material, they will make that decision. They are independent. But I think it's important to also appreciate that there are already some notification requirements that go to data breaches more generally. So, under privacy law, which comes under my purview, there's currently a 30-day requirement for notifications where there are potentially breaches of personal information. Just as an aside as well, we are proposing in our next tranche of privacy reform that the notification requirement come down to 72 hours. And there's also under the security, the critical infrastructure regime, or the SOCI regime, which comes under Home Affairs, there's reporting requirements of anywhere between 12 and 72 hours, depending on the critical infrastructure involved. So we're looking also at those notification requirements, as well as whether there is any potential breach of the Criminal Code as it stands.

CLARKE: How do you enforce those kind of reporting requirements, the ones that exist or ones that might be developed and implemented in the future, with a question of jurisdiction? Because if this is done by an AI agent, but the company that controls the software or the AI agent or those seeking to use the agent, if they're not in Australia and the company doesn't have a role here, is there actually a way you can enforce those kind of reporting requirements?

ROWLAND: No, indeed, these are novel questions considering the nature of the technology that's being posed. But I guess there's probably two key points to make here. If they are operating in Australia, we can regulate more easily. If they come under our laws and safeguards and we're able to provide service within jurisdiction, then that presents itself as a more straightforward option. We've even seen in terms of the digital platforms, for example, where we've had issues of extra territoriality and certain platforms challenging the jurisdiction of the eSafety Commissioner as a regulator, for example. That complicates it more. But I don't want to overcomplicate this because...

CLARKE: I think it is already pretty complicated.

ROWLAND: It certainly is, but I won't make it any more complicated than it is. But we need to let the taskforce do its work. We need to gather the evidence then make informed assessments. And again, any potential amendments to our laws, they need to be well calibrated. They need to account for the fact that whilst this is a novel technology, Australians are rightly concerned. You know, we've seen, well, I've noted some cyber experts have started to make comments to the effect that this is not a serious breach in cyber security terms. For the Australian public, they understand that this is concerning. Scams and the fact that we've seen breaches in the past of personal information, be it from Optus or Medibank or Qantas. Australians are rightly concerned, but I think also there is something in the fact that we already have structures across government that are dealing with this, that have kicked into place, and they've existed for some time.

CLARKE: Can I come back to the remark you made that if these tech companies are operating in Australia, it does make it easier to regulate them? Is that why the Albanese Government wants to see AI companies invest in data centres or training of AI here? Is that the mechanism by which you see that we can have some control over the use of AI and AI agents?

ROWLAND: Well, it comes back to exactly what the Prime Minister has been saying, which is we want AI in Australia but on Australia's terms. And the way in which we respond to this incident will impact on our broader policy goals, including investment. That is a fact. But again, as the Prime Minister has made clear, we want to make sure that we've got the appropriate guardrails in place. We have structures across Government that are looking at this right now. And this rapid review will help us inform how we take this forward.

CLARKE: We've seen recently OpenAI's Vice President of Global Policy, Ann O'Leary, tell the Australian newspaper that copyright settings were preventing the company from building an AI training centre in Australia. There was some suggestion that amounted to blackmail. Do you think it was blackmail?

ROWLAND: Well, firstly, we stand for Australia's interests. And again, as the Prime Minister very clearly articulated in a wide-ranging but also very powerful speech on this matter, this will be on Australia's terms. And we want to ensure the strongest possible protections for Australian artists and media, irrespective of who they are dealing with. And again, the Prime Minister's clarity in making sure that we have as our parameters, the ownership and control of creatives' works as part of that is very important.

CLARKE: The consultations that your Department's undertaking on that with the industry about copyright, that shows that opt-out provisions for artists are still on the table with AI companies to either strike deals with collecting organisations or a minimum number of companies. The creative sector's been consistently clear that it wants an opt-in process, not opt-out provisions. Aren't you going to be letting them down if you end up with a situation where it is an opt-out?

ROWLAND: Well, we're looking at a very broad range of options that we're consulting on, and we welcome the engagement by both the creatives and the tech sector in this. And I think, there's two points I will make here. The first best option in all of this is for voluntary licencing arrangements to be struck. We've made that very clear. And the second point is countries around the world are grappling with this and have different rules. We ruled out, nearly a year ago now, that we would not have a text and data mining exception here in Australia. But we are looking for workable options to ensure…

CLARKE: But everything else is still on the table. Text and data mining out, but everything else is still on the table, including opt-out provisions.

ROWLAND: Well, the other aspects that are on the table is around making sure that we've got appropriate penalties in place where that has been breached. I think the important thing here is we are looking to strengthen copyright protections for Australian artists, to have audit and transparency requirements. And also, I think that what the Government is doing here is performing a role where we are facilitating these consultations. We want to make sure, exactly as the Prime Minister said, that we have those ownership and control rules being adhered to. But we are not going down the path of a text and data mining exception. And we've seen the number of cases that are on foot in the U.S. right now to the detriment of artists and their works. And the consultation that is being undertaken is on our terms, on behalf of Australian creatives.

CLARKE: The tech industry does seem to be shopping around between Australia, the UK and Canada. Are they playing countries off against each other as they're trying to find somewhere to invest with the most permissive regulations possible?

ROWLAND: Well, again, if they wanted to do that, there's any number of countries they could just go to who already have these text and data mining exceptions. But I think Australia has a lot to offer in terms of investment, not only in terms of energy and space, but our creativity. And also, we are a country of smart people, smart people who want to utilise AI to solve some of the greatest medical problems and make the greatest scientific discoveries. So I think that should not be lost on anyone as well.

CLARKE: Michelle Rowland, just before you go, the Financial Review was reporting the other week that you attended a recent New South Wales Labor Conference and the Transport Workers' Union covered your costs to stay at a hotel in Sydney, the city you live in. Is that reporting correct?

ROWLAND: Well, I am a delegate to the conference, I was a delegate to the conference, and I am a member of the Transport Workers' Union and part of that involves the union staying together for the weekend. I declared everything in accordance with the rules and I'm a proud trade unionist.

CLARKE: Do you need accommodation in the city that you live in?

ROWLAND: Well, considering the fact that this was late night and also, well, for one late night, and also the fact that it was some one hour away from where I live, if anyone wants an explanation of that, again, I'm very happy to say that I'm a proud member of the Transport Workers' Union and being amongst the delegates is something that's very important to me. But above all else this is declared completely in accordance with the rules. And if anyone else would like to join the Transport Workers' Union I'm sure they'd be very happy to have you.

CLARKE: Good to get the plug in there for a member of the union. Michelle Rowland, thank you very much for talking to us about a range of issues this morning. I appreciate it.

[ENDS]