HARRIS, Ms Whitney, Acting Assistant Secretary, Technology Security Policy Branch, Department of Home Affairs NEAL, Mr Timothy, Acting First Assistant Secretary, Personnel and Protective Security, Department of Home Affairs SPENCER, Ms Ciara, Deputy Secretary, Law Enforcement and Domestic Security, Department of Home Affairs [10:50] CHAIR: Welcome. I understand that information around parliamentary privilege and the protections of witnesses has been provided to you. I now invite you to make a short opening statement, and at the conclusion of remarks I'll invite committee members to ask questions. Ms Spencer : Thank you. I wasn't intending to make an opening statement, but what I would say is Home Affairs leads whole-of-government cyber and technology security policy, including on the national security implications of artificial intelligence, making sure emerging risks are understood and considered across government and critical infrastructure and providing guidance and mitigations to build the resilience ahead of emerging technology. What we see with AI is there is incredible opportunity that comes with AI; there are also national security implications. In the simplest terminology, it makes some of the national security threats quicker, easier and cheaper. What that means is the basic cybersecurity mitigations that we communicate from government, we have in our protective security policy framework and we have on our 'Act Now. Stay Secure.' website all are really good means of resilience against some of those threats and work quite well. We're happy to take questions around any of the aspects you're interested in, including protective security policy frameworks, how we provide security to government as well as critical infrastructure, and hosting certification frameworks, which go to data centres holding government information. CHAIR: Can I get you to explain a bit further about the mandatory cyber incident reporting framework and how that might interact with AI. Ms Harris : Under the Security of Critical Infrastructure Act—the SOCI Act, as we like to call it—there is a mandatory requirement on infrastructure organisations to report cybersecurity incidents. At the moment, the cybersecurity definition is about unauthorised access, modification or impairment involving computer data, computer programs, electronic communications or a computer. There are certain thresholds around what a cybersecurity incident is and what organisations need to report. It doesn't exclude incidents that involve AI, but the government is currently considering some amendments to the SOCI Act to make it really clear that, if there were an autonomous cybersecurity incident involving an AI enabled tool or the like, that would be captured under that act as well and organisations would need to report it. It's not excluded at this point in time, but we want to make it really clear that that's what will be expected. Senator CADELL: Can I ask a quick follow-up on that? That goes to everything I was doing, those modifications on the 12 hours to report. Like with the Melbourne gym membership, they've all been voluntary where AI is being used. But you're just looking to expand—though they've all been reported—to make it mandatory. Is that right? Ms Harris : It's currently mandatory for critical infrastructure but not for organisations that aren't critical infrastructure. Senator CADELL: But they've been telling you anyway, haven't they? Ms Harris : Some do, and that goes to the Australian Signals Directorate, but it's certainly not mandatory at this point in time. Mr Neal : There's a higher bar for government imposing a certification framework where they are required to report. It's called a relevant change. That would only be for those that are hosting security classified information, which is the vast majority of hyperscale cloud providers, data centre providers and a lot of the other service providers. Under that relevant change provision, they would be required to notify the Commonwealth government if it affected the Commonwealth government's information and services. And there are extremely significant penalties for them, including financial penalties and the inability to host classified information moving forward. CHAIR: On the flip side, I think you referred in some of your opening remarks to how our application of AI can actually increase our capacity to deal with additional threats. Can you expand on that a little bit. Ms Spencer : If you take the cyber example, we see how quickly vulnerabilities can be identified by AI, but what that also means is AI is much faster at patching those vulnerabilities, so we've seen the time difference come down a lot. There's a huge reduction in the time it takes to patch and mitigate some of those risks. Another good example is on the biological and chemical side of things. There's potential for novel biological threats to come, but take vaccine development as an example. It used to take up to six years. We can now do that within six months because of the expertise of AI, so there's some real opportunity for the mitigation piece as well. What we are really focused on is making sure that we're aware of the opportunities but also the threats that come alongside those, so that we can mitigate those threats and allow Australia to take advantage of the opportunity that it provides. CHAIR: Expanding on that and on some of the particular threats around cyber or bio, if we have non-state actors wanting to use AI to cause us harm, what are the cooperations and partnerships that can assist our agencies in keeping us safe? Ms Spencer : We work really closely across government and, beyond that, with our international partners. The Five Eyes have put out a statement on cybersecurity in response to the AI threat and opportunity. Also, what we've been focused on in Australia is really close interaction with the AI companies themselves so that we understand. We talk about access, assessment, advice and action. We want those really close relationships with the companies so we understand how their models work, so that we—the AI Safety Institute and the ASD—can provide advice based on the technical and get that out to industry, critical infrastructure and government quickly and be clear about what steps we need to take. There's also influence work in that, in the discussion with companies and with other countries about the importance of having guardrails, of having cybersecurity standards, and the work that we need to do to have that resilience. CHAIR: On that, I think a theme of the evidence that we've received thus far today has been around the ability to have these companies come here and for AI training on our shores—that that provides that leverage or that ability to influence. Would that be your assessment as well, from the work that you're doing? Ms Spencer : There's definitely benefit. What I would say is we already have quite close relationships and we can continue that engagement, and sovereignty doesn't necessarily mean within Australia. There are some incredible opportunities with having these models in Australia, but, from a security perspective, there are other ways we can mitigate the risks as well. CHAIR: I appreciate that. I'm glad to hear that. But would there be an assessment that we would be better off having the ability to have them here, do you think? In terms of talking about some of the leverage opportunities and the connections and relationships, would that be expanded upon or have a different flavour, do you think? Mr Neal : I think it's a careful balance. For security, the two most important things are transparency and accountability. With the relationship with them, obviously, presence leads to a more nuanced relationship. I think what I mean by balance is the relationship is the most important part and presence is an important way to make that stronger but it shouldn't be at the expense of having that relationship. So, from our view, security is not necessarily based around location. It's around access, transparency and that accountability, and if it helps that, great. If not, we can still make that work. CHAIR: I appreciate that. Thanks, Mr Neal. Deputy Chair. Senator DUNIAM: You've already answered a lot of our questions on the SOCI legislation. You mentioned the amendments, and I know you won't be able to give me an exact timeframe, but given the body of work we're doing here and, obviously, what the government is more broadly doing when it comes to standards et cetera, is that work—the amendments, the changes to the act you mentioned before—going to tie in somehow with what we're talking about with regard to AI and any relevant legislation? Ms Spencer : We're working really closely with the other agencies to make sure that there's no duplication, because, obviously, we cover some of this work, and there are elements that may be considered as part of the AI standards. Those discussions are ongoing, but what we would say is that we have a really SOCI framework and a regulatory framework for critical infrastructure similarly on the government side, so there isn't a need to duplicate that. Ms Harris : Certainly, we don't want to duplicate and, while looking at different tracts of legislation, we're certainly engaging very closely with the Office of AI and other departments to ensure we're as aligned as possible. Senator DUNIAM: Do you mean by way of timing? Ms Harris : By way of timing. But those reforms are still subject to government consideration. Senator DUNIAM: So they are before government. You've done your work and government are considering what to do. Ms Harris : Yes. There's been a public consultation on those. That's now closed and it's currently before government, which is considering next steps. Senator DUNIAM: Okay; any further questions on that go to government. I want to go to the foreign ownership of the frontier labs. Ms Spencer, you talked before about having relationships with, communicating with and working with those companies. Do we have a proper assessment or a capacity to properly assess the control of these companies—what they're doing, what they might be doing if they come here? Is that something you have under the current framework? Ms Spencer : That's more of a question for the AI Safety Institute and others in that portfolio. What I would say is that we have good relationships with some of the companies and we have access and the ability to have discussions about how their models operate and what the guardrails are. Obviously, with some other models, we don't have that access, so then we're basing it on work with international partners and understanding from our technical advisory agencies. Senator DUNIAM: You refer to the AI Safety Institute. I want to understand what the delineation is between the AI Safety Institute and Home Affairs when it comes to matters of national security and cyber matters. Ms Spencer : Absolutely. The AI Safety Institute looks at the safety of the models. We're concerned with the national security implications, and we provide advice on that. So we work closely with and, in providing that policy advice, we take guidance from the AI Safety Institute and from the Australian Signals Directorate as technical advisory agencies. That is how I would put it. They understand much better than us how the models work and what the risks are. They provide that advice to us, and, from a policy perspective, we develop that into guidance. Technical guidance would come from those agencies, but we can provide broader guidance on the uplift and can support the understanding of critical infrastructure in government agencies on how to best implement and what additional mitigations may need to be put in place. Mr Neal : I'd probably add that the mechanisms to do foreign ownership control investigations exist. It depends on the level of risk that you have in the space across SOCI and our work with the FIRB. The highest level would be the hosting certification framework, which goes through hyperscale cloud providers, where we do a lot of foreign ownership control investigations. Senator DUNIAM: You, Home Affairs, do that? Mr Neal : Home Affairs does that through our critical infrastructure regulator and then, also, my division for government. So those kinds of mechanisms exist, and then it's really just about the risk and how they would fit in if they were to be in Australia. Senator DUNIAM: Okay. Ms Harris : I'll just add, in terms of the relationship with the ASC and ASD, particularly at the moment, if it's not daily, it's almost daily that we're talking to them in terms of what they're seeing and the testing and evaluation that they're doing. Senator DUNIAM: Okay. Do any of the reforms that we talked about before relate to the work that Nr Neal just mentioned? Do they cover powers related to the work he just mentioned? Ms Harris : Yes. There are a number of reforms. A risk management program has been enhanced for a number of critical sectors, and that looks specifically at how the organisations need to strengthen their risk management processes and programs around foreign ownership, control and influence risk. It's also looking at how they use emerging technology such as AI and how it could be used against them. That's one track of the reforms that are currently in place. Some that are still subject to government's consideration include looking at particular vendors and having a potential power for the minister to make directions around what critical infrastructure can do in relation to certain vendors and products. Senator DUNIAM: That's down to the specific entity. Okay. There may be further questions on notice around that. In terms of use of AI within Home Affairs, what sort of deployment is there at present? Ms Spencer : The way we use AI within the department is really focused on taking a really deliberate and risk based approach and on reducing manual effort, improving decision-making and accelerating delivery. At a very basic level, we have Copilot, which is used in policy work and for administrative work. There are some pilots we're looking at to use AI more broadly, but we have a really robust framework to look at privacy matters, legal matters, security and cybersecurity. We probably haven't picked it up as quickly as some other agencies because, given the breadth of information and personal information that we deal with, we want to be doing that in a really careful, considered way and always ensure that decision-making stays with humans. It's about support to our human workforce rather than anything more than that. Senator DUNIAM: I have one more question—and I noticed Senator Pocock was interested in that one, so you'll probably come back to that—on foreign interference. There has been a lot of talk in recent times around the proliferation of, you might say, propaganda on social media traced back to certain jurisdictions. All of it is AI generated, often with a particular aim to engage in the political debate in Australia. As part of everything we're talking about here, is dealing with that something on Home Affairs's radar? If so, what response is being considered? Ms Spencer : One of the key risks we're seeing from AI is information operations. Again, it's quicker, easier and nastier, and it also enables it to be much realistic. The language is better. If you're looking at targeted foreign interference, they scroll all your parliamentary speeches, your social media profiles and everything about you so they can find a really targeted way to engage with you and make it more likely that you'll engage back. So it is a key national security risk we are looking at. There's work being done to consider how to work with AI companies to help manage that threat. We've seen a couple of AI companies come out quite publicly and say they've been able to track a certain number of inauthentic communications coming from particular state actors. That's incredibly useful, and we don't have the kinds of tools to do that at scale the same way that AI does. Senator DUNIAM: To close out, I might provide you, offline, evidence we've been provided around particular entities that are engaging in that way and, effectively, a family tree of online actors that are not real but are purporting to be individuals engaging in the way you say that seem to influence the debate. I'll provide that to you. Ms Spencer : That would be incredibly useful, and we'll share that with our law enforcement and intel agencies. CHAIR: Senator Pocock. Senator DAVID POCOCK: In terms of the pilots that you mentioned to Senator Duniam, are any of those with Australian companies? Ms Spencer : Sorry, pilots? Senator DAVID POCOCK: You said that you use Copilot and then you're engaging in a number of pilots to see where else you can use AI. Ms Spencer : Yes. Sorry. That's internally. Within the department, we're looking at how we can better use AI tools. Senator DAVID POCOCK: And that's just Copilot? Ms Spencer : At the moment, it's Copilot. There's also access to GovAI. We're looking at how we can use those. It's really about how we do it internally rather than engaging with other companies. Senator DAVID POCOCK: Are there any Australian companies that have been engaged? Mr Neal : There was one part with a company called xAmplify, a Canberra company, where we looked at getting their insights from the Protective Security Policy Framework's annual reporting mechanism. That was an early use case with an Australian firm. Senator DAVID POCOCK: That was piloted and then not continued? Mr Neal : That was done last year. We're coming to the next one, so we're looking at that at the moment. Senator DAVID POCOCK: Is there a national security risk created from relying heavily on tech owned and operated by foreign companies? Ms Spencer : It's something we look at very regularly in the cybersecurity space, around supply chain and concentration risk. There is definitely risk in that. A key part is to be aware of that supply chain and that concentration risk and understand how to best mitigate it. It is definitely something we're focused on. Senator DAVID POCOCK: We've seen European and Nordic countries moving away from the Microsoft ecosystem. Is that a risk here in Australia, that we're so reliant on a US tech company for all of our government communications? Mr Neal : It's certainly something that we have been working on with our digital resiliency program that the Department of Home Affairs has been working on. That is broadly in two categories. One is how we manage the risk with the providers themselves to ensure that we can have better relationships. The other is to actually map what those dependencies are for government. We're starting with the systems of government significance program. Those are systems that the government provides citizens. Mapping what that supply chain looks like will give us a true picture of how our dependencies work on those really core services. From there, we can start to look at how we manage that risk. Senator DAVID POCOCK: What stops US intelligence from having access to all of the data that is going through Microsoft systems? Ms Spencer : We wouldn't have the answer to that. Senator DAVID POCOCK: So all of our communications as parliamentarians, as the government, could in theory be being accessed by the US intelligence agencies without our knowing? Mr Neal : It depends on the classification of what you're talking about. With security classified information, there are a range of controls that we can't go through in this forum but do give substantial amounts of transparency around the use of government data. There's obviously an agreement also under the US CLOUD Act with the US government around our warrant based information, which is a critical component that the— Senator DAVID POCOCK: Hasn't Trump scrapped that? Mr Neal : We have a range of relationships around the components though. Senator DAVID POCOCK: Yes, but you just cited the US CLOUD Act, which Trump has basically pushed aside. Mr Neal : I believe the underpinning agreements around it—we have had long, ongoing warrant based agreements between us and the US Department of Justice. Senator DAVID POCOCK: So it's kind of a gentleman's agreement? Mr Neal : I'll take it on notice Ms Spencer : It's a formal international agreement between us and the US. Senator DAVID POCOCK: Like our free trade agreement, where we've been tariffed. How concrete is this? There are a number of experts, and it's concerning when you see European countries and Nordic countries saying that they no longer trust something like Microsoft, and we're just so wedded to it and we're just throwing money at Copilot without actually testing the waters. I hear from so many Australian companies that it's incredibly hard, even when you have really bespoke offline, sovereign, secure capability, to actually get a foot in the door with government. What assurances can you give us today around ecosystems like Microsoft? Ms Spencer : I would say there's an espionage risk with any technology that you use. That's something we work closely with our intelligence community and others on. As Mr Neal said, we have digital resilience agreements, where we set out our expectations for how the relationship should work and how they can support us in our digital resilience. There are a lot of safeguards and work done by government to ensure the security of the systems that are used by government, and also to a degree by critical infrastructure alongside the additional with support we provide them. Senator DAVID POCOCK: In your submission you talk about strengthening preparedness for AI related incidents by assessing the suitability of existing crisis management frameworks in responding to major artificial intelligence incidents. How do you rate our current suitability to deal with such a crisis? Ms Spencer : Ms Harris spoken a little bit already about how our crisis management frameworks don't exclude AI or autonomous incidents. We have good frameworks in place to respond to those threats. What is also important are the trusted relationships we have with industry, particularly critical infrastructure. Looking at the release of Mythos and the concern around that, we were able to very, very quickly get information about what the risk was, get technical advice from the safety institute and from ASD, and bring critical infrastructure and government agencies together, to be able to share that advice and talk about what steps in mitigation we need to take. Our cybersecurity framework is very strong. But there's obviously more work to do, as we're seeing the new risks emerge as well as the new technology, for us to be able to keep up and make sure that we have access to that information. But the frameworks and the relationships we have in place mean that we're able to get that guidance out quite quickly. Ms Harris : I'll just add to that. For a number of years, we've been working collaboratively and exercising with critical infrastructure—that is, government and critical infrastructure in a room together doing these cybersecurity exercises. I know it has occurred at least twice in the last couple of years with our systems of national significance, and that's who we categorise as our most nationally significant critical infrastructure organisations. We also have the National Office of Cyber Security, which is doing a number of exercises on a regular basis with industry as well. Senator DAVID POCOCK: We're currently having this debate about making changes to copyright to enable an expansion of compute and training capabilities for these hyperscalers. In terms of national security, should we be speeding up the development of a technology when it's very unclear if we have a real handle on it—in terms of safety? Ms Spencer : Our focus is on the national security risk and the resilience. We talk a lot about security by design—that is, making sure that these companies are actually thinking about security, thinking about the guardrails and ensuring that that is the case. That's where our focus is. There is a way to balance the two things, and what we don't want to do is be saying no to everything when there are really huge opportunities, even from a national security perspective, in the development of some of this technology. What we want is an evidence based, considered approach to how we mitigate the risks and how we ensure that there are appropriate guidelines and cybersecurity in place around them. Senator DAVID POCOCK: Have you had discussions about how you mitigate the 10 per cent existential risk? Ms Spencer : There's a lot of different commentary on those risks. What I would say is that a lot of the incidents we've seen to date come down to a lack of cybersecurity as opposed to AI innovation. So, if we can get that cybersecurity right and we can encourage people to have security by design, a lot of that risk is better able to be managed. But there is risk involved with this technology, as there has been with every technology we see come through. Senator DAVID POCOCK: That's a bit of a stretch though. We're talking about existential risk here. A lot of experts are saying that previous technology hasn't had that level of risk. So what is the thinking here? Are you providing advice to government saying, 'If you can slow this down, it should be slowed down'? How does that actually work, given you are in charge of national security? Ms Spencer : We talk about the clear national security risks, and, as I said, we have a lot of information coming in from the technical agencies and from our engagements with companies. But our role is to provide advice on what the implications and mitigations may be. Senator DAVID POCOCK: Thanks. CHAIR: Senator Sheldon. Senator SHELDON: In a slightly similar vein to Senator Pocock's questions, I'm not sure if you saw the evidence from the previous three witnesses today— Ms Spencer : I haven't been able to catch all of it. Senator SHELDON: That's okay. One of the things that became clear in the conversations was that, if data centres are brought to Australia in an appropriate way, in a safe way, and also to benefit national sovereignty, there's a stickiness that attracts people with talent to Australia—in addition to the talent we have. And it brings some Australians back, which was one of the other comments. The intent of the government, picking up on Senator Pocock's comments, is also to get Australian know-how and capability expanded. That's part of the product piece of data centres coming here. Does that also give us more national sovereignty, potentially, on security matters as well if we have more people, more capability and more businesses here that will share capacity and share knowledge, rather than being subject to somewhere over there? Mr Neal : I think from a capability perspective, of course. The more people in Australia, the bigger the industry, the more complexity and capacity within that industry—I think the thing I would balance that with, just to be clear, is that that works for industry. It doesn't work from a traditional security perspective, though, because the location of data ultimately isn't a security control; it's the location of the people who can access it in a modern internet. Data in Australia is not inherently safer than data in the US, but, from a capacity of industry and capability perspective, yes, of course. Senator SHELDON: That's interesting. Banks, for example—without mentioning a particular bank—would be spending a lot of time on looking at security matters and capacity matters, not relying heavily on elsewhere. If you expand that expertise because there are more experts within the country doing that work, does that lend some advantage to security questions as well more generally? The issue is not just the department; it's what you're trying to protect, which is the banks, infrastructure and everything else in Australia. Mr Neal : I think, by default, yes. Having more capability in Australia is a good thing. We have a great relationship already with banks and critical infrastructure providers. It really is a two-way street on sharing around capacity and learning around security. The more people in Australia that can do that, obviously, the stronger our networks are. Senator SHELDON: Then, logically, the next step is that that means it potentially reduces supply chain risk. Mr Neal : Supply chain risk is a very complicated component. On the insider threat and personnel component, I would assume yes; there is a reduction. Supply chains, and particularly technical supply chains, are heavily integrated across the world. It depends on what parts of the supply chain people are doing in a location. From a personnel perspective, yes. I think that's right. Senator SHELDON: I want to go to the existing risks AI exacerbates for critical infrastructure. What is the potential risk there? What new risks does it create that you're able to share with the committee? Is there anything you could give to us? Ms Harris : I think it really goes back to the point that it is amplifying the risks and making it easier, faster and cheaper for a malicious actor to threaten our critical infrastructure. Cybersecurity is a really key one there. At the same time, it allows—I think ASD, Australian Signals Directorate, will be here later and will very much talk about some of the advice that they give out, particularly for critical infrastructure. That includes utilising AI as well as for defensive purposes. Certainly, cybersecurity is a big one, but it's not new; it's something we've been talking to these organisations about for a number of years. Ms Spencer : Quite often it's actually the volume of attacks or the vulnerabilities. It's being able to identify them much quicker. I would say that at a high level we're not really seeing different threats. It really is just amplifying them. Senator SHELDON: What measures have already been enacted in relation to high-risk AI on government devices, for example? Mr Neal : The first and most public was the government banning the use of DeepSeek technology on government devices for all 104 non-corporate Commonwealth entities, where it's mandatory, plus the remaining 70-ish corporate entities. We also saw every state and territory follow through and then a high intake within critical infrastructure. Then followed two pieces of work: a public advisory on frontier AI and a policy advisory on generative AI. They're not mandatory, but it was about uplifting capability across the Commonwealth. And then last year another direction was implemented which created a Commonwealth denial list, which allows us to, in a more nuanced way, manage particularly risk-possible technologies. CHAIR: Senator Cadell. Senator CADELL: While we're talking about searching interaction, we can talk about cybersecurity and other risks to critical infrastructure—and that's all bad-actor use of AI to create these things. Given Hugging Face and stuff like that, do we ever look at loss at control in critical infrastructure, given the kill switch tends to be something that can't be done—from talking to a lot of these people—once it gets there? Are we starting to assess loss of control in AI systems that are embedded? Is that something you do? Ms Harris : Yes, absolutely. Under that risk management program that I mentioned earlier, many critical infrastructure organisations have that requirement—a risk management program—and they need to essentially assess, understand and have plans in place to mitigate critical risks or material risk to their organisations, particularly in the enhanced risk-management program that was recently introduced for some sectors. That specifically talks about emerging novel new technologies, particularly AI. So we expect these organisations to be assessing the risks related to their use of AI and the deployment of AI against them as well. Senator CADELL: Thank you. CHAIR: I understand Mr Hastie has a question. Mr HASTIE: I want to go to the point about ethical primacy remaining with people rather than machines when we integrate AI into government, but particularly in national security work, which I think is the basis of some of the fear that people have around AI being deployed on the part of the government. I'll just give you an example of how wanting Microsoft Copilot is. Back in July, I had an email from a constituent who had a terminal illness and was letting me know that he planned on ending his life using voluntary assisted dying. Copilot suggested three responses for me: 'Congratulations!', 'Great to hear from you', and 'That is wonderful news!' Will building a sovereign capability here allow us to input our ethical and moral frameworks and ensure that AI is, in the end, governed by people? Ms Spencer : That's a really good question. I spoke before about the very deliberate risk-based way we rolled out AI within the department. A lot of that was focused on making sure that people had that critical thinking to understand what AI is and what it is not, to understand how to use it, to understand that there are hallucinations, and that people are actually using it from a critical thinking perspective and using their own judgement in rolling it out. Part of what we did was make sure that the senior leaders in the organisation had it first so we could see what kinds of results were coming and what we needed to look for, and so we could support more junior-level workers in understanding how they're doing it and that it's not just 'plug it in and hit go'—that you need to apply that critical thinking to it. There is an element for adding that into models, but the key part is that you actually need workers there doing that from a human perspective as well. Ms Harris : I'll just add we're engaging with the Office of AI and the standards process really closely in terms of, if we are to attract AI companies to trade in Australia, what some of the standards and guardrails are that we would want from a national security perspective. Mr HASTIE: Thank you. I trust you will be working on that, but I just want to underscore the importance of getting that right on behalf of the Australian people from a national security perspective. CHAIR: Excellent. Are there any final comments? Mr Neal : I committed to Senator Pocock to confirm this. The US CLOUD Act remains in force for Australia and the UK. There are no further negotiations, but the negotiated agreement that we had stands. CHAIR: That is excellent to know. We'll make sure Senator Pocock sees that. Ms Spencer : And that is a very regularly used arrangement in terms of getting law enforcement information. CHAIR: Great. Thank you very much for your contribution and the evidence you provided to the committee today. I think there have been a couple of questions taken on notice. Could you please provide them back to the committee by Friday 25 September. Thank you very much..