BERRY, Dr Rachel, Senior Lecturer, Anatomy and Forensic Anthropology, Institute for Cyber Security, University of New South Wales CROSS, Dr Cassandra, Private capacity [10:02] CHAIR: Welcome. I understand that information on parliamentary privilege and the protection of witnesses giving evidence to Senate committees has been provided to you. Do you have any comments to make on the capacity in which you appear. Dr Cross : I am a professor in the School of Justice at the Queensland University of Technology. CHAIR: Thank you both for giving us your time today. Would either of you like to make an opening statement? Dr Berry : My opening statement and my research involve the intersection of artificial intelligence, child sexual abuse material, digital forensics and child protection. My research specifically investigates the challenges posed by AI generated and AI manipulated child sexual abuse material, or CSAM, as we refer to it—looking at the implications that has for law enforcement in victim identification, detecting this material and policy and framework development. The problem with AI is that it's rapidly changing the child exploitation landscape. Unlike traditional CSAM, it has the ability to create highly realistic images, videos and completely synthetic material at a terrifying speed in vast quantities, and it's a technology highly accessible to anyone. Although it doesn't necessarily always involve direct contact with a child, it still has significant harm. It still can be used to create sexualised content of real children using innocent images and videos, it can be used to manipulate existing CSAM out there and circulating to make more extreme and graphic content and it can be used for grooming and extorting and all those sorts of things. I think from a law enforcement perspective that creates a certain level of uncertainty. When you have that material in front of you, you're not sure whether it's real or completely synthetic or whether there's some element of both of those involved, and that's going to complicate things like case prioritisation, victim identification and where to allocate already limited resources law enforcement has. I think that the scale and sophistication of AI generated CSAM is increasing and that law enforcement is struggling to keep pace with it in detection, investigation and then eventual prosecution of offenders. In terms of what could be given to law enforcement to help them improve their capability, I've identified some changes in legislation. There should be greater cooperation and intelligence sharing between agencies and groups both nationally and internationally, and greater investment in digital forensics and specialist AI training would be one of my recommendations as well. I welcome any questions you have on that opening statement. Dr Cross : Good morning. As noted, I'm a professor in the School of Justice at Queensland University of Technology. I'm before you today as an expert in the field of cybercrime with a primary focus on fraud, scams and the associated issues of identity crime and data breaches. I've been researching this field for 18 years, having first started while working as a research and policy officer in the Queensland Police Service. My statement today, my submission and any answers to your questions are based on that degree of knowledge and expertise across that time. Cybercrime is no longer a niche or technical issue; it's one of the most widespread forms of victimisation affecting Australians today, yet it remains one of the least visible within our justice system. In research I conducted with colleagues a number of years ago more than 80 per cent of adults in our sample had experienced some form of cybercrime but only 17 per cent of incidents were reported to the police. I think that gap matters. It means our policy responses, resources, legislative frameworks and understanding of the problem are built on a fraction of the actual issue out there. But the issue is not only underreporting; it's what happens when victims come forward. For most Australians, as noted by the gentleman before, the first point of contact is not a specialist cyber unit or a national portal; it's their local police station. General duties officers are the front door to the justice system, yet our research found that as few as eight per cent of surveyed officers had received formal cybercrime training. Victims arrive with complex and urgent problems, while frontline officers are expected to respond without always having the training, the tools or the referral pathways they need. From the victim perspective cybercrime is deeply personal. It extends well beyond financial loss and sometimes has serious, devastating and long-lasting psychological consequences. Victims often do not know where to go, who was responsible or what outcomes are realistic for their incident. Some are passed between state police, Federal Police and online reporting portals, with no single agency taking clear ownership. From the policing perspective this is not a lack of commitment. Officers themselves report low confidence in their organisation's capacity to investigate cybercrime, detect offenders and prevent further harm. Cybercrime differs from traditional crime. Offenders can operate anonymously across jurisdictions and at scale, and we know evidence is digital, transient and often held overseas. Police understand these limits, but the public often does not, which creates a damaging gap between community expectations and law enforcement reality, and this mismatch has consequences. Victims may expect money to be recovered, offenders identified and harm reversed quickly, and, when this does not happen, dissatisfaction grows, trust declines and reporting falls further. There is also a risk that cybercrime prevention becomes framed as the responsibility of individuals. Personal cybersecurity does matter, but it must not become victim blaming, particularly in cases of online fraud, harassment or image based abuse. If we are to improve the policing response, I would put forward three things that are critical: first, every general duties officer needs the baseline cybercrime capability to recognise digital evidence, support victims appropriately and affirm matters effectively; second, specialist cybercrime units need to be adequately resourced for complex and technical investigations; and third, investigative responsibility needs to be clarified and made visible to victims so reporting does not become a merry-go-round for victims. Cybercrime is not simply a policing problem; it's a whole-of-system challenge requiring alignment between law enforcement, government and the non-government and private sectors, but policing remains central because it's where victims will go first. I want to close with a simple observation: police do want to do better. Officers who received cybercrime training in our survey recorded that they felt more capable and more effective to respond. But right now frontline officers are being asked to respond to crimes for which systems and trainings do not align. There are millions of Australians who experience cybercrime, most of them in silence and most of them invisible. This inquiry I see as an opportunity to ask whether our systems are fit for purpose and to identify ways to improve them. I look forward to the committee's questions. CHAIR: Thank you both for those opening statements, and we will accept into the committee your tabled statement. Thank you again for your submissions and appearing before us today. I just have a couple of questions before I go to others on the committee. This committee held inquiries previously into child exploitation, and we did find there was very little cooperation from social media platforms in any responsibility. In fact we've now gone to one of the most popular social media platforms, where it has encrypted messaging, which does not help law enforcement to deal with cybercrimes of that nature in particular. I had some confidence restored in relation to the manipulation of child exploitation material by AI when in Tasmania a judge made it very clear in his findings that, whether or not it was AI created, it would and should be dealt with the same as if it were a child. In relation to the extent law enforcement have to deal with this material, what they were dealing with before AI was an inordinate amount of material, and I, along with other members of this committee, am very grateful for the work undertaken in that area. But now with AI and the limited capacity law enforcement have to use AI themselves, I'd be interested in any further evidence you can give to the committee in relation to how you think law enforcement needs to be able to combat the use of AI and what sort of legislative changes need to be made. Dr Berry : I feel like, in terms of legislative changes, at the moment it's quite broad. Like you said, it encompasses any exploitation of a child, any sexual image. In terms of specificity towards AI generated and AI manipulated CSAM, I feel like it needs to be more specific and cover all aspects of the cycle, whether it's possession, creation, distribution, even soliciting someone to create a model that will do this, instructional material or sharing information online about how to get around safeguards and other things. I think that would give investigators more confidence. It would give more confidence in terms of prosecution as well in the court. I think it would stop offenders exploiting the ambiguity to kind of move it in their favour, if you see what I mean. Although the broadness of it is good because it can cover a lot of aspects, in some ways it hinders confidence and prosecution as well. In terms of coordination and sharing, I don't think that law enforcement, as far as I'm aware, actually keeps a record of whether they believe the material in front of them is entirely real, entirely synthetic, or a blend of somewhere in between. I have approached police forces to inquire about doing research in this area, and, as far as I am aware, there were no statistics and no data on how many of these images are in circulation or how they're being created, disseminated and all those sorts of things. In terms of intelligence, rather than focusing on detection of content that's already out there, there needs to be more of a move towards prevention and findings before this content gets created or the models get made to create this sort of content. I think there needs to be a dedicated reporting system as well. At the moment we're kind of working on systems that use AI against AI to detect these images, but at the moment they're relatively primitive, with 60 or 70 per cent accuracy. So I think more funding and more investment in that and training investigators to actually identify this kind of material—although, if it's highly realistic, the human eye can't tell, unfortunately. CHAIR: In relation to the University of New South Wales, what other research has been done around cybercrimes? Dr Berry : In terms of cybercrime, I believe there is research into hacking. There is some dark web research happening as well. Those are the ones that I'm aware of because I have been involved in those. I'm sure there are lots of others being done in terms of cybersecurity and security of the country and that sort of thing. CHAIR: Again, with law enforcement's capacity to deal with the amount of generated or real child exploitation material, the same with the dark web, is it just a matter of training? I know there need to be some legislative changes, as you've already given evidence to, but are there other things? Is it a matter of law enforcement not being resourced enough? They have the JPC3 unit that's operating and dealing with both of these areas and others. Is there anything else that you would like to add? Dr Berry : As I said, for me it's mainly the fact that we are reactive rather than proactive in terms of law enforcement. The content's already out there. We're trying to detect it and we're trying to remove it from the web. I think it would help if we invested more funding into research, trying to understand how it's being created by looking at those conversations on the dark web and the clear web—because it's not just underground; it's happening right in front of our eyes—and gaining some idea of what we're actually dealing with, because at the moment I think law enforcement is flying blind in terms of what it currently knows about how much is out there and how to deal with it. The UK have the Internet Watch Foundation, which is an independent, not-for-profit organisation. Since 2023 it has every year published a report on AI generated CSAM and the trajectory of the scale of the material that's out there and the graphic nature of it. More than two thirds are category A—the worst of the worst kind—and another 30 per cent are category B. So that makes up most of it. Every year they publish the report and show you the updates—what they've worked out, what they know about how to detect it and how to combat it and a kind of frontline report of what they've experienced and how many reports they've had. I think something like that for Australia and law enforcement here would be beyond helpful. As I say, we're flying blind at the moment. We don't really know what we're dealing with. CHAIR: I'll go to the deputy chair. Mr BATT: This is probably a question for both of you. The research that you're both doing on Australia's legal frameworks and wanting that holistic approach, which I think we all agree with—some of this reporting was put forward 12 or 18 months ago. Have there been any amendments made through any of the jurisdictions as a result of your research? And, if not, have you got any ideas on how we move that forward? Is it working with AIC or something like that? How do we get that in? Dr Cross : That's certainly in my area. The research that was the focus of my submission, noting it was a number of years ago, was funded by the Australian Institute of Criminology, so I'm grateful to them. In terms of cybercrime relevant to the spaces with which I'm most familiar, the biggest legislative change in recent times has been the passing of the Scams Prevention Framework, which came into effect in 2025 and is currently being implemented through a number of different accords for the three different sectors—banking and finance, telecommunications and digital platforms. I think that will have a significant impact in terms of fraud and scams and the deception related offences that are captured within cybercrime. It will be interesting to see how that rolls out, because I think one of the challenges in this space is that cybercrime is so broad. There are so many agencies that are relevant and invested in this space. And, if you think about that particular piece of legislation, it focuses on agencies outside of the criminal justice system. I certainly think that's warranted, given that many fraud and scam incidents are based on the money that's going through, obviously, the banking and finance sector and the communication between victims and offenders that is happening on the telecommunications and digital platforms. But I think there is a concern that we haven't seen what the implications are in terms of how those sets of requirements interact with policing agencies at both state and federal levels. I also think we do run the risk in some ways of taking fraud and scams out of the justice system and making it more of a financial issue, which I do think is significant for victims that have lost substantial amounts of money. But I'm not necessarily sure we've thought through the implications for justice. There's a requirement in the Scams Prevention Framework for agencies to be able to share actionable intelligence that they are able to collect from the incidents that are happening. But I'm not sure that there's a clear framework around how that is to be shared or used, and also for the relationship around that actionable intelligence with law enforcement. Again, I think we come back to the fact now that cybercrime is already so overwhelming for agencies. There's a lot of intel out there, but it's about our capability to make sense of that intelligence and to actually be able to action it in a way that is of benefit to the individual victim. Dr Berry : In terms of AI generated and manipulated CSAM: I know there were updates and amendments to the acts in 2024 to make them more broad and to try to cover the scope of AI generated material. But, like I said before, that's a bit of a double-edged sword because it leaves a bit of ambiguity for offenders to exploit loopholes. From reading the literature coming out of Australia, there's very little research being done. The Australian Institute of Criminology, which Cassandra just mentioned she had some funding from— Mr BATT: Good! Dr Berry : They have been doing some research in this area, which they published last year. They, again, could find very little information on the current landscape in Australia. That's the same as for myself: I tried to do a systematic review, looking at what's happening purely in Australia, what we know and what we don't know, and it seems like we know a lot less than we do know. As I said, I believe that the money and funding need to go into looking at the proactive approach rather than the reactive. Some money should go into the reactive approach, because we also want to detect it and work out whether it is completely synthetic or whether there is some element of manipulation in there. But I think that taking a proactive approach would be beneficial at this point to help us understand how to detect it and how to program these models that can detect it. Dr Cross : I'll just come back to the second part of your question, about how we get impacted as researchers in something which we're all striving to do— Mr BATT: Yes. Dr Cross : I think that it's very challenging in a policing context. Policing, as everybody in this room knows, has many tensions and competing priorities. Police have finite budgets and finite personnel who are able to respond. One of the challenges, particularly in cybercrime, is that it's often invisible and it isn't perceived to be as serious as I would argue it to be. Police are always being challenged to have greater numbers of frontline officers on the streets responding to 'traditional' crime, whether that be assaults, domestic violence or those more visible offences. For too long cybercrime has been seen to be a kind of 'niche'-type of crime that perhaps doesn't have the visibility that some of the other types of crime have. We need to have something of a cultural shift across society and policing in this space, to recognise that cybercrime is pervasive. I would argue that there's a digital element to all these offline traditional offences that we're seeing, particularly in domestic violence and in many other offences. It's no longer something that we can just push to the side and move police from that space to other spaces. But we need to recognise that it is an important priority and that we need to allocate training and resources to it—and, I guess, we need to have even just conversations in recognition accordingly. Mr BATT: Yes. To follow up on that: you talked about those three critical things and general-duties officers needing that baseline cybercrime capability. Dr Cross : Yes. Mr BATT: I was 23 years in the QPS and, from my point of view, it's about everyone having their borders. You might only deal with what's in Queensland— Dr Cross : Yes. Mr BATT: or what's in New South Wales. When you're doing a DV or whatever the job is then you're going from job to job. But if you then pop something like this in it's, 'Whose responsibility is it?' That's what we just heard again from Mr Hamilton. Dr Cross : Yes. Mr BATT: That needs some clarification and some sort of overviewing body to make sure of it, because it crosses state borders and also international borders. After me saying all that, is there anything, even in Queensland, that you've seen since you did your report 18 months ago where there is more training for general-duties police? Are there any other jurisdictions with training in cybercrime that you've seen since then? Dr Cross : No, not that I'm aware of. Again, it's recognising—and you'd be well aware of this—that, in training police officers in any state or other jurisdiction, there is a finite period of time in which trainees are at the police academy. It's a very congested agenda that they need to go through. I know that everybody is always arguing for space in that training agenda. We are well beyond the time where cybercrime should be considered an additional nice-to-have in terms of training, and I would argue that we need to be increasing the capacity of officers not to necessarily know the specifics of all of these types of offences but to have a baseline understanding and recognition of the complexities of the types of evidence that they might need to capture at the point in time that a victim comes to them. I honestly don't think this inquiry can overcome this, but, as you mentioned, policing is very much bound in geographical jurisdictional borders, and cybercrime clearly transgresses all of them, both within the country and externally, and we know that. For 20-plus years, we've been talking about this as an issue, yet there is no ability for us to overcome that. I don't see that we will be able to overcome that in the future unless we have a global, significant shift of some sort. But I don't necessarily think that that's just an excuse that we should roll out at every single committee inquiry or every time that this happens. This is the landscape that we're operating in, and this is the landscape in which offenders are operating. So we do need better ways of acknowledging this and of providing information to our frontline officers who are dealing with the victim in front of them—even if it's around language, how they interact, believing them and not humiliating them and laying the blame at their feet but trying to do something constructive, and being far clearer around the responsibilities of the agencies to avoid the merry-go-round of being passed between agencies. I know the previous gentleman called it the ping-pong effect. Because of the nature of this and the nature of having a single reporting portal through ReportCyber, there doesn't seem to be any agency who will openly take responsibility or accountability in a transparent way. Mr BATT: Dr Berry, in the submission from the university, there were some comments about the vulnerability disclosure programs. The submission was suggesting that current laws may leave security researchers vulnerable to criminal charges for participating in a vulnerability disclosure program. Are you aware of that side of what was in the report in the university submission? Has anything changed since then, law-wise or support-wise? Dr Berry : The reason I was invited here on behalf of the institute was that they felt like there were no updates from that particular report. I'm not aware of that. If you would like a response to that question, I can take it on notice and give you a written response. Mr BATT: That'd be great. Thank you. CHAIR:  I wanted to go to the issue of scams and fraud. There is underreporting. We know cybercrime is overwhelming to law enforcement, but there are also only so many hours in the day and resources that are available to them. A view that is perhaps reflected in a small issue with people reporting these crimes is that they will need to focus on crimes, for instance, that are of a greater value. The argument that I'd like to put to you is that, if you have a person from the public who is scammed for $10,000, that $10,000 for that person can equate to $200,000 for a company. How can we overcome that without increasing resources? We've had evidence, as you heard previously, around training. It's pretty evident that it would be an advantage for all law enforcement officers to have more training—preferably on entering their initial training—because that's usually the first place people will go to. What else can we do in terms of ensuring that, as much as humanly possible, we're not just putting a value on the crime rather than considering the impact on the individual? Dr Cross : For me, there are two parts to that question. I think very much that, and the research that I have done supports this, financial losses and the impacts of the financial losses for individuals are not the same. They certainly don't equate to the amount of money. I've spoken to victims that have lost $5,000 or $10,000 or even smaller amounts, and for them it was devastating because that was their life savings. It was all of the potential disposable income they had access to. I've spoken to victims who've lost hundreds of thousands of dollars, and for them, that was perhaps just one less overseas holiday for the year. So I don't think having an arbitrary amount of money to determine the impact is sufficient. The way that I would argue to address that is that we do need to improve the level of support that we give to victims of cybercrime. My experience is very much in that fraud and scam space. There are very limited support mechanisms available in Australia. There is IDCARE, which is a support centre that you may be familiar with, particularly around supporting those who have experienced identity crime, which does extend into the fraud and scam space. But victims of fraud and cybercrime are currently excluded from many of the other victim support mechanisms that are currently available across the country, because fraud and cybercrime are not seen to be violent crimes; they're seen to be property crimes. If I had one suggestion, it would be to rethink how legislation and the categorisation of offences trigger the ability to access supports, whether it's victim assistance, whether it's financial counselling, or some psychological assistance, et cetera. We very much need to improve that level of support because at the moment it's non-existent. We do know—it's very evident from the research—that victims do experience a range of impacts. For some it's a nuisance, and they'll be able to move on quite quickly. For others, it's a life-changing event, which has a long tail of impacts. The second part to that, I think is around education. I want to be very explicit in that I certainly don't want to be promoting that it's individual responsibility in this space. I think we're beyond the ability to blame victims for their gullibility or stupidity or lack of awareness based on the use of AI, the sophistication and the tools that offenders use to deceive people and to gain access to their money. But I do think the prevention, the education space, is really important. It's always been very challenging because there's a wealth of information out there about passwords, about securing accounts, not doing this, not doing that, but, in many ways, is completely overwhelming to the everyday citizen. Also, there's a lot of complexity and confusing messages from banks, from governments, from other agencies and, most importantly, those messages don't connect to the individual. Most people don't think that they will be a victim. In some ways they don't recognise their own vulnerability, or that it could happen to everyone in this room and all of your constituents. I think a lot of the messaging is lost because it doesn't have that point of connection. I have argued previously that, in some ways, we need to take the fraud out of fraud prevention, and that we need to be focusing on areas that perhaps have less baggage and less stigma associated with them. We need to be increasing people's level of digital literacy and cyber literacy around how the internet operates, how messages are presented to you, and how they might not be who they say they are. At this point also they may not be real; they might be AI. Does that matter? We also need to be increasing financial literacy for individuals. We need to be increasing recognition around what constitutes a healthy and functioning relationship, particularly if you think around some of the investment fraud and romance fraud approaches. I think, if we think of cybercrime more from a public health issue perspective, noting the impacts that are out there, we've done some fabulous work as a country around road safety, sunscreen, cancer, and around other kinds of issues, if we took some of the stigma out of cybercrime, and, I would argue out of fraud, and started to try and elevate society's recognition and understanding of some of these adjacent fields, I would argue it would have a direct impact on their vulnerability to fraud approaches. For me, I think that would be worth trying rather than trying to continue the path that we have been going down around telling people to have strong passwords, to secure accounts, which are very important cyber-hygiene processes but also potentially not relevant to the incident that they might be a victim to. CHAIR: The banking sector and the major banks would, I suggest, have more people employed these days in their fraud department than most other areas of the bank. Dr Cross : Yes. CHAIR: Do they also have a responsibility to educate and raise awareness around scams? When it comes to prevention and the money that they would invest, working with researchers but also with law enforcement, it's about breaking down the stigma, as you said. The reality is that, yes, there are some areas in our community that are more vulnerable than others for various cybercrimes, but there are some very intelligent people that are getting scammed, or there are property transactions. There is a whole array of fraud going on. Have you got any comments in relation to whether banks and, again, social media platforms, as part of being able to operate in this country, should take some corporate responsibility and become good citizens themselves? Dr Cross : Yes, absolutely. I think you're 100 per cent accurate in recognising the role that the banking and finance system plays. As I mentioned at the beginning, I've been in this space for 18 years, and I would say that now more than ever banks have a greater recognition and place greater importance on trying to target this problem compared to what they did when I first started in this space. I had some really distressing conversations in earlier years with banks who just felt it was part of their bottom line, and, as long as losses didn't go above a certain percentage, they were comfortable with that, whereas now banks do very much have resources available. They have a focus, and they do have dedicated teams who do spend a lot of time on the phone with customers who have had transactions that are flagged or have not gone through or the customer has contacted them. So they are doing work in this space. I think there are still challenges around that banks as private organisations are still, in some ways, internal facing. I think there is a greater ability of banks to share intelligence amongst themselves. But I would say it still is challenging for some banks to have, perhaps, some of that greater public transparency around some of these issues. It will be interesting to see how the accords happen with the scams prevention framework, because that does elevate the responsibility and place very specific requirements on banks to do particular actions, and I assume there will need to be transparency around that. With the banking and finance system, we're victims of our own success in some ways, because we are now at a point in society where we can transfer funds immediately. As a customer, I now expect that I can just press a button and I can transfer money directly to Rachel within the next few seconds and that she can access that. We've removed all of the friction that used to be within some of our transactions. Offenders know that, and they leverage that and use it to their advantage. So, in some ways, to make an impact in this area we do need to perhaps step back a little bit and introduce maybe a little bit more friction. But the challenge with that is that customer expectations don't allow for that. I think it is a really difficult line that banks have to walk along in terms of some of the red flags that come to them around potentially suspicious transactions. I'm working on a project at the moment with a particular bank. They will stop transactions that they believe are suspicious. They will engage in those difficult conversations. But, just generally, in our practices and in the way that we have moved our lives into the digital sphere, we have expectations about how things now operate. In some ways, that's counterintuitive to how we need to be to try and increase that greater friction to reduce the impact of offenders. CHAIR: What about social media platforms? Do they have a responsibility to be good corporate citizens? Dr Cross : Social media platforms are a really challenging and complex space. My research doesn't specifically engage with social media platforms, so I'm not as familiar in that space. The challenge for the everyday constituent is that we are being presented with a range of different advertisements, text messages or emails, and it's very difficult in many cases to identify whether it's true and legitimate or fake or synthetic, whether it's been created, and whether or not the impact of that matters in that context. Companies have a responsibility in this space. I go to a number of forums where I hear representatives from many of the social media agencies talk about the efforts happening behind the scenes. I have no doubt there is an array of technology being used proactively to try and identify fake dating profiles on the dating websites being used. It's, in some cases, as we know in this whole space, completely overwhelming, and the resources are just not there. Offenders have the motivation to just use technology, to use whatever resource is available to them in whatever way they see fit. It's difficult for companies to respond appropriately and in a timely fashion, based on the volume and the time and resources it takes. But there is a responsibility there, and I'll be interested to see how this plays out with the Scams Prevention Framework. CHAIR: On an area in relation to child exploitation—live streaming, which is on the increase and a major concern, in terms of trying to close them down as soon as possible: has there been any evidence of AI generated live streaming? Dr Berry : Not to my knowledge. When I have approached law enforcement to do some research into this sort of thing, I don't think they keep a record of those sorts of things—so it's difficult to know if it has happened and it just hasn't been reported and logged or whether it just hasn't happened yet. But it is only a matter of time before it starts happening, because the technology is becoming easier and easier to use. We all have seen videos of a certain American president doing things that he hasn't said or done. It is only a matter of time before there is live streaming and that material is manipulated and synthetic. CHAIR: Members of parliament have already had their images and voices used—so it is here; it's not just in the US. Mr Batt? Mr BATT: Both of you might like to answer this one, but it's for Dr Cross. In your reporting you mentioned public training. Everyone is talking about trying to reduce the crime in giving that training out to the public, the cancer councils and all those things we've done over the years. We've talked previously about trying to train people to report; like you've said, 17 per cent of incidents are reported and we want to get that up. As you've said, no single agency has taken clear ownership. We want to tell people to go and report this thing, but, when they do, they're hitting these hurdles—this is what this is all about. Where do we go with that? Do we need to fix that first before we start telling people to report, or is it a two-way street? Dr Cross : I don't think there's a simple answer to that. Generally speaking, we want people to report because we need to recognise the magnitude and scale of this. As our research suggested—I know there are multitudes of other research out there that document the lack of reporting of cybercrime. We want to increase reporting, but there are consequences for that. If we're asking people to report, we then need to match an expectation around what comes with that reporting. As a parliament, but also in thinking about policing agencies, we need to have clear lines of responsibility around reporting. At the moment there is the national portal for ReportCyber. I would say that that is challenging for people who have experienced cybercrime, to be directed from a police agency back to an online portal to report an offence where in most cases they've been deceived through online means—so that's not necessarily a victim-centred approach in many cases. Sending an older person who doesn't necessarily understand to that portal can also be quite distressing. As I said, there are a few things we need to look at. We need to have a clear line of reporting around where people are reporting. Fraud is very unique in particular around what's termed the fraud justice network. For most offences, if I had my wallet stolen today or my house broken into I probably would just go to the police; they would be the primary agency. For fraud, I can go to my bank, I can go to consumer protection, I can go to the police or I can go to a range of other agencies, depending on what's happened, and they don't necessarily all talk to each other and reporting isn't necessarily all combined. We have to try and figure out some clear lines of reporting and responsibility, and we need to make them very clear and visible to police agencies at the front line but also to the public. We need to, as a consequence of that, be very clear in the expectations around whether people can expect individualised responses or whether they are just putting it in there for intelligence. At the moment there's a mismatch, and that drives a lot of frustration and a lot of harm to victims who think they are quite unique in their circumstance. Part of the lack of reporting also speaks to this broader issue that people don't recognise the volume of cybercrime that's currently happening. For one of my projects we interviewed 80 individuals across the country who had lost more than $10,000. When we were talking to them about the project, we were talking about, 'This is 80 people,' and most of them were quite surprised that there were 79 other people in their situation. Police and those of us in the room know there are millions of Australians who have experienced this, but individuals still think their situation is unique and requires an immediate police response— Mr BATT: Taskforce. Dr Cross : Yes, that's it—that is reminiscent of the magnitude to which they are experiencing something. I'm not calling for that to be met, but we know that there is a huge mismatch between expectations and that that drives a lot of harm and frustration. We need to be clear around the expectations once somebody reports. Aligned with that, as I've said previously, we need to improve our victim support services. We need to recognise that, for victims of cybercrime, there are financial costs but that there are far more non-financial harms that we can account for in a much better way than we currently do. Mr BATT: Thank you. Dr Berry : In terms of AI CSAM, yes, the reporting is pretty much nonexistent. The way law enforcement deal with it currently—and I completely understand why, with the limited resources they have—is that no human wants to view the material, so it gets put through an automated system. That automated system categorises it as A, B or C, and the number of images in category A, category B and category C, and they base how they deal with it on the results of that. None of that is helping us understand how much of that is AI generated or AI manipulated. Yes, it's still illegal and, yes, it needs to be dealt with. For me, it's not knowing what we're dealing with, and we are taking that reactive, rather than proactive, approach of trying to understand how offenders are making this material and making instruction manuals. A lot of them are downloading open source models—so models that have their code available that they can tweak, and they can then train themselves on existing CSAM that's out there to create more graphic and more extreme material. Because it's offline—they can download that and do that offline—it's bypassing all the safeguards and the security mechanisms that these companies have put in place. So I do think, as I say, more research and more funding need to be put into the actual understanding of how it's created, how it's disseminated, how these offenders are using these AI models, how they're training them and how they're bypassing the safeguards. That would go a massive way to helping law enforcement. I know that there are hundreds and hundreds of researchers out there clamouring to do this research and help law enforcement with the limited resources and funding that they do have. CHAIR: Thank you very much. As with all our witnesses today, and I'm sure for the rest of the day, we could spend a lot more time talking, but I do really appreciate your contributions this morning. They've been very helpful. For those who took some questions on notice—and I invite you to add anything further that you want to after giving evidence today—you have until 2 July to get that to the secretariat. Thank you very much. We greatly appreciate it..