Tech companies could face criminal prosecution over future cybersecurity breaches committed by AI agents gone rogue and a new industry regulator would have the power to impose “significant penalties” for violations, under a proposal to beef up the country’s digital security.
The recommendations are among the findings of a rapid review into a June cybersecurity incident in which an autonomous OpenAI agent hacked into sensitive Medicare data.
Prime Minister Anthony Albanese said the Government had accepted all 18 of the review’s recommendations.
Mr Albanese first revealed the Medicare hack while attending the United Nations General Assembly in New York in September, where he confronted OpenAI founder Sam Altman.
But the breach had occured months earlier, when a rogue AI agent autonomously accessed non-public Medicare statistics while researching health data.
The US tech giant took months to identify the incident. It was not until September 10 that OpenAI staff alerted Australia to the breach — by sending an email to a generic Services Australia mailbox designed to receive reports of potential cybersecurity risks from the public.
It then took five days for Services Australia public servants to escalate the matter to the Australian Signals Directorate. The Coalition at the time had raised concern that the email inbox was only checked once a day.
At the time, Mr Albanese said that he would consider referring the matter to the Australian Federal Police to determine whether criminal charges were possible.
On Tuesday, he said Australia needed to ensure its laws “catches up with what is a very fast-changing world”.
“This incident was completely unacceptable, as I outlined to OpenAI’s CEO at the time, and it can’t be allowed to happen again,” Mr Albanese said.
“AI offers Australia and the world generational opportunities if we seize and shape them properly, and that is exactly what we’re doing here.
“We want to take advantages while mitigating the risks which are there. We have the opportunity to position Australia as a global leader in this space and to influence how the world tackles this challenge, but also this opportunity.”
One recommendation proposes a standalone “failure to prevent” offence, which could criminalise the failure by tech companies to take reasonable steps to prevent their AI model they develop from engaging in harmful conduct.
But introducing such an offence could take time, with just one parliamentary sitting week remaining before the summer break.
Under the proposed changes, AI companies would face six mandatory safety and security requirements.
They include reporting serious AI misalignment and cyber incidents, strengthening incident response procedures, independent model evaluations, publishing safety and security frameworks, and adapting to updated standards as technology evolves.
The requirements would be overseen by a new dedicated AI safety regulator, with powers to impose significant penalties on companies that breach the rules.
The Attorney-General’s Department is consulting the Australian Federal Police and Department of Home Affairs on criminal law reform.
The recommendations include several directed at government agencies to improve their own reporting channels and toughen up their cyber security protections.
Among those recommendations were a push for improved AI literacy among public servants and a direction to “reduce the size of the government digital estate” by consolidating some systems and disconnecting others from the internet altogether.
Deputy Prime Minister Richard Marles said Australia could not afford to opt out of engagement with artificial intelligence.
“This is not a technology that we can run away from,” Mr Marles said.
“AI is part of our lives today. It will only grow as a part of our lives going forward.”
Get the latest news from thewest.com.au in your inbox.
Sign up for our emails