BRADSHAW, Ms Abigail, Director-General, Australian Signals Directorate GHOBADI, Mr Andrew, Assistant Director-General, Data and Analytic Service, Australian Signals Directorate GREGORY, Mr Tauri, Deputy Director-General, Intelligence and Effects, Australian Signals Directorate HORLYCK, Mr Chris, First Assistant Director-General, Cyber Security Resilience, Australian Signals Directorate [14:31] CHAIR: Welcome. I understand that information on parliamentary privilege and the protection of witnesses giving evidence to committee has been provided to you. Do any of you have any comments on the capacity in which you appear today? Mr Ghobadi : I'm also the chief AI officer. CHAIR: I'd like to now invite some opening remarks, following which we will move to questions from committee members. Ms Bradshaw : Thank you, Chair. I appreciate the time on a Friday afternoon to be here. ASD is a foreign intelligence agency with a statutory remit that centres on the use and defence of technology systems. Under the Intelligence Services Act, our functions include collecting foreign signals intelligence, conducting offensive cyber operations, providing cybersecurity advice to Australians and Australian system owners and delivering top-secret technology capability for Defence and the national intelligence community. Each of these functions is fundamentally informed by current and future emerging AI capabilities. ASD has worked with large language models for several years and with other AI technologies such as machine learning for decades. ASD now works with the most advanced frontier models available, and we are consequently well postured to understand the significance of AI and of AI to our work. ASD has used frontier and early access to accelerate the cybersecurity uplift of Australia's most important and sensitive networks, to assist private entities to uplift through the release of many technical advisories and to increase the scale of intelligence production and advance our internal AI capabilities in support of the national intelligence community. We are a valued member of the Five Eyes intelligence alliance, and a world-class signals intelligence and cyber agency as a consequence of our mastery and access to frontier technology. ASD operates in direct competition with digital adversaries who are actively seeking and deploying high-end frontier capabilities to compromise Australia's digital environment. Our operators are literally engaged with highly capable malicious cyberactors utilising frontier capabilities on a daily basis. In that environment, capability is relative. If a digital adversary has access to newer, more capable models than we do, they may be able to identify and exploit vulnerabilities in systems and networks before we can identify them and patch them. Defending Australian systems against AI-enabled attacks requires frontier-level tools to test those systems before an attacker does. In the future, AI will enable us to automate our defences to stay ahead of AI-enabled attackers. Reliable and early access to frontier models is essential to ASD's missions, to deterrents and to our interoperability with Five Eyes and AUKUS partners, whose most advanced platforms will increasingly depend on AI. The hosting of training of frontier models in Australia could come with significant benefits for national security. If included as precursors of condition to train in Australia, these benefits could include earliest insight and improved resilience and control over access. ASD cannot effectively assess threats or defend against technology it cannot see or understand. AI companies with a significant local presence and permission to train in Australia could be subject to mandatory early access and technical sharing requirements, which would build on voluntary arrangements which are presently in place. Pre-deployment access, technical briefings and future capability development advice will assist our national preparedness for future models and their potential implications for Australia. Early access and exposure to developing models as they are tested and evaluated could enable the capacity to check for faults and weaknesses before models are released, and would be a unique opportunity to ensure that sufficient safeguards are in place to protect the Australian community from harm. Hosting training capabilities in Australia, in conjunction with early understanding of current and emerging capabilities, would also assist an informed Australian voice in the development of international standards. Hosting model training capabilities in Australia could create substantial first user or mover advantage, including the capacity to attract and retain Australian technical expertise at the frontier. The technology stack that supports training of frontier AI is expensive and in global short supply. Being a location for frontier training would substantially increase Australia's global standing and compute capacity. Assurance of ongoing access will become increasingly important as critical functions, such as defence, intelligence and financial systems, are increasingly dependent on AI. Models trained on infrastructure based in Australia are likely to be more resilient to disruption by foreign export controls, commercial decisions or physical damage to infrastructure. Early access to models will improve our sovereign capacity to understand how models driving national security in defence outcomes are derived and provide improved capacity to demand additional safeguards. Access to frontier models is a matter of urgency. Access is already tiered. The most capable systems are released to a limited set of trusted partners first. Australia is currently among them. We're considered to be a partner worthy of this privileged access by allies and the AI companies developing AI because of the trust we have with them, the reach we have to scale the technology, security benefits across industry and critical infrastructure and the technological excellence to deploy it. Nations without their own capability or a privileged relationship will receive access later, if at all. The fundamental capabilities enabling AI are being secured now. Compute capacity, energy, data centre sites and skilled people are being committed through long-term arrangements. Late entrants may pay more for less and get it later. International standards for safety testing, governance and interoperability are being set now, largely by those with a direct stake in frontier development. Countries that recognise the scale of AI driven disruption and build capability early are more likely to be better placed to shape future technologies and international standards than those that do not. ASD's own history shows that influence follows contribution not consumption. Australia's sovereign cryptologic capability, built over decades by the Defence Signals Directorate and now ASD, is what makes Australia a valued Five Eyes contributing partner, rather than simply a customer of allied intelligence. Our contribution is what secures our seat at the table, and AI is the next evolution to maintaining that status. CHAIR: Thank you very much. That's a pretty powerful opening statement. Following on from those remarks, could you elaborate further for the committee on the importance of having sovereign AI capabilities, from your perspective. How do you understand AI sovereignty with respect to Australia's national interests? Ms Bradshaw : We understand sovereignty has different meanings, depending on context. There is a notion of sovereignty which would be, for example, Australian models built entirely on Australian data, on Australian infrastructure, by Australians. That is certainly a reality, and it's playing out in models that are being trained and built in Australia now. But the frontier is different, and that is because the frontier models that are available today—primarily, those being developed by companies like OpenAI and Anthropic—are truly frontier in the sense that they are built on infrastructure that is not available in Australia, and by enormous datasets, which we do not have the capacity to garner, particularly without that sort of infrastructure. That means there are two types of models. There are very good, capable models that are being developed in a variety of jurisdictions, but there are, in our evaluation, two world-class leaders that are several leagues ahead of those models. We call those frontier models for that reason, and those are presently, as I said, the Anthropic suite and the OpenAI suite. The question is: how do you get the benefits of those capabilities that are built in a foreign jurisdiction and assure, to the full extent, that you have leverage over those capabilities in a way which is respectful of sovereignty? It's our view that, in fact, a better option to improve sovereign outcomes is to train here, because, as I've set out in my opening statement, we think there is the potential for greater control if infrastructure is located in Australia and models are trained in Australia. You have the advantage of setting conditions and standards around the operation and the training of those models—the standards that apply before they are available for market release and conditions like early access, which give us not only first defender advantage in the first instance but also first user advantage. CHAIR: Elaborating further on a powerful statement that you made around influence—that we gain greater influence by being contributors rather than simply customers—can you explain what sort of influence you are referring to there? Ms Bradshaw : Perhaps I'll stay with one inside our jurisdiction, because we're an operational agency rather than a policy agency. For example, in a cybersecurity context, we advance our case for early access and insights from the generators of those models because of the insights that we glean from our own use. So it is a two-directional relationship in which we are not simply consuming a product, but as we are integrating that product and using it in Australia for defensive purposes, we are continuously engaging on, for example: the validation of vulnerabilities that models might throw up, and whether in fact they are priority one vulnerabilities; the insights that we glean when we use models in conjunction with each other; and, in fact, at the moment, the engineering of harnesses that are best capable of integrating those models into systems for cybersecurity purposes. It really is a process of contributing to the further development, integration and use of those models that is contributing to our current early access, given that they're foreign models. CHAIR: I'm quite conscious of the time, so I'll go to you, Deputy Chair. Senator DUNIAM: Just one question—and that was an excellent opening statement that sums up a lot of the thinking that others have put to us as well. In terms of some of the risks that present with this emerging technology, and in that spirit of guardrails and the like, when issues occur as we look to make recommendations around standards and how we manage this unknown world, do you think there is space for mandatory reporting, and is there a system that might work that you've given some thought to? Ms Bradshaw : Yes, we have, and I think, really, as we've engaged with the frontier models, we've done so on the basis of over a decade's worth of experience of dealing with cyberthreats, and, certainly since changes to the Intelligence Services Act in 2028, responsibility for defending digital networks in Australia. What we have found is the importance of public-private partnerships for visibility about what is going on in people's networks, because we're in a context where we do not have visibility of privately owned networks, nor do we build the technology on which many critical systems are built. And the technology is moving fast. I think there is space to enhance our visibility for managing that risk, and that comes from a variety of areas. In the first instance, there's an opportunity to incorporate mandatory requirements into permissions for training or hosting, for example, so that you would make mandatory access prior to release of the models. This has been cast by the CEO of Anthropic, in his public essay, as something for which he has in fact invited independent evaluators into the assessment of models. I think that's a really welcome thing, but we would all feel more comfortable if it became a mandatory requirement, as well as asking for mandatory reporting of technical observations. The second is access to testing results. The third is information held by the labs in relation to unexpected ways in which the models can operate. At the moment, in the absence of those norms, because the technology is so new, we are learning largely through media reporting and voluntary conversations about abnormal behaviour or agentic escapes. There is probably a place for managing expectations on both sides about what would be reported in the timeframes in which that might happen. The fourth category is information regarding the misuse of models. This is in circumstances in which a model may have been released but is being used for purposes which weren't necessarily foreseen or in which a model is breaking out of safeguards which were intended to prevent it. That is part of the quid pro quo relationship. The second is what we ask for from the public. In ASD, through the Australian Cybersecurity Centre, we have a public reporting portal. Really, because we don't own the technology or private entities, we get a lot of information from the public reporting to us their own observations about cybercritical vulnerabilities. Any part of maintaining visibility of the threat landscape or risks associated with AI could be well informed by public, voluntary reporting along those lines of unexpected behaviour, vulnerabilities or misuse. The next category is what's already in place—and, in fact, it was going through my mind as I was thinking about what you might want to do to manage risk. That's the existing SOCI legislation, which already provides for critical infrastructure providers to report to ASD significant incidents. If you took those three layers of reporting—a combination of mandatory for entities, voluntary for the public and mandatory for labs—and put those together, that would give you a really rich picture of the sorts of patterns and potentials for risks and a real advantage in terms of preparing Australian systems to defend against them. Senator DUNIAM: Okay. I have just one other question. You have an understanding of the international landscape and what some of these frontier operators are saying about where they might be looking to go. How long do you think we have as a country to get our act into gear and decide whether we want to be a place for them to come and invest or not? Ms Bradshaw : As I said in my opening statement, I think decisions around training are a matter of urgency because of our need—and we're well placed, given that we engage in the environment on a daily basis—to maintain, at least, capability with adversaries. I think it is inevitable that those providers will look at other places to locate. Whilst, of course, I think Australia is the best place, I think it's clear that providers will want at least a second location. But, given the expense of the infrastructure and how difficult it is to build, I don't think there will be lots of different locations. That is why it would be such an exquisite advantage to be one of a few places to host this world-leading technology. CHAIR: Senator Pocock. Senator DAVID POCOCK: Thank you for your time. Ms Bradshaw, I'm just trying to follow here. You're saying that we are a trusted partner, we get access to frontier models, we're a Five Eyes nation and we've got an AUKUS agreement with the US, but we need training data centres so we get access to the frontier model. But we already get access to the frontier model. Ms Bradshaw : Yes, we get access to the frontier models via infrastructure that is connected to the primary infrastructure in the United States. What I'm suggesting is that, in fact, we would get better, earlier, more detailed access if that infrastructure were located in Australia, and we would maintain the benefit—we've seen this ourselves with the close relationship that we have in ASD with technical experts—of Australians who wish to operate at the frontier staying in Australia because the frontier, or at least a portion of it, is located in Australia. Senator DAVID POCOCK: But surely this should be government to government. We should be talking to the US and saying, 'We need some sort of agreement where US AI companies provide us with that sort of access.' Why are we treating these AI companies like sovereign nations and saying to OpenAI and Anthropic, 'Please come here, set up shop and then provide us with access to your models'? Ms Bradshaw : I'm not quite sure that I'd characterise it that way, because in fact, as I've indicated before—and it's publicly known—the Australian government has secured early access to existing frontier models, including models without safeguards, and we have utilised those for the purposes of defending Australian networks. What I'm suggesting is that actually we will get more assured access, earlier access, more detailed technical access and better integration with technical experts at the frontier if those capabilities are located in Australia, including better resilience because of the physical location of those databases here in Australia. Senator DAVID POCOCK: I just feel that in some way it feels somewhat blackmailish. We're supposedly one of the US's closest allies, we're a Five Eyes nation, we've got an AUKUS agreement, and we're saying that we couldn't, through diplomatic channels, demand that sort of access—all the things you're saying. Instead we're saying, 'We have to host these data centres and find some sort of workaround with copyright to get access.' I get that there may be benefits from having data centres here, particularly if we're actually willing to put in some requirements about having a workforce here, not just being a place where the GPUs are located. But I just find it hard to buy this whole idea that, without them here, we don't get access to these models, given our relationship with the US. If that is the case, I think it really brings into question just how close our relationship with the US is. Ms Bradshaw : Let me clarify: I'm not suggesting that we don't have access or we wouldn't get access. I think what I'm suggesting is that access has greater assurance and we have improved visibility, speed and resilience if the infrastructure is located here. Without going into specifics, as part of the Five Eyes signals intelligence alliance, it is not unusual to create resilient or duplicative capabilities in a secondary location for redundancy purposes. And this, I see, because of its national security applications, is most certainly, as a leading frontier technology which is literally in our estimation going to change our prospects—certainly, in the digital sphere of success in terms of defending protective nations. Why wouldn't we want a second capability hosted and located here in Australia? That is an enormous lift to our sovereign capacity to defend ourselves in the digital domain and beyond. Senator DAVID POCOCK: In terms of national security and sovereignty, given what we're seeing in the US with some of the rhetoric from the President, some of the very concerning things that are happening with Canada and the breakdown in that relationship, how should we be thinking about the huge benefits we're hearing about having hyperscalers owning compute here—US companies versus sovereign Australian data centres—which I don't hear much talk about in the debate. It's all just 'we need these hyperscalers to come in and use their money to build compute'. There doesn't seem to be much distinction. Ms Bradshaw : I'll probably try and stay in my lane because I'm neither an economist nor an expert in the industry. But I would have thought that the prospects for the development of Australian sovereign capability are improved if we have more compute and technical expertise located in Australia. I think in our world, where we leverage, in the top-secret domain— Senator DAVID POCOCK: Sorry, what about Australian sovereign compute? Ms Bradshaw : But that's what I mean. If you have the infrastructure here and you are prioritised in terms of chips and technical capability, which, frankly, are not made in Australia and would take decades to replicate here—you have a choice of importing foreign technology from trusted partners or not having the capability, and I think in our case we would give preference to having the capability. CHAIR: I'm just mindful of the time. Senator DAVID POCOCK: Sure. Finally, on this, what's being put to the committee, to the parliament, is that we need to do something with copyright so we can get huge investment from hyperscalers. So we're going to have, essentially, foreign-owned compute GPUs here. No-one's talking about the difference between them and, say, a CDC, which is sovereign, Australian owned—30 per cent owned by the Future Fund. If you talk to most Aussies, that's a very different proposition. Ms Bradshaw : I'm not sure that there are final decisions being made about the owners of the actual infrastructure. I can see that there would most definitely be interest from hyperscalers, but I'm not sure that there are actually decisions on who might provide that infrastructure. Again, I will confine my comments to the national security environment. We deliberately, at the top-secret level, use a variety of different providers, to provide that resilience. That includes, I'll just say, sovereign providers right up through to hyperscalers. The benefit of hyperscalers, in the Five Eyes alliance, is that they are the best at delivering connectivity. Senator DAVID POCOCK: Thanks. CHAIR: Mr Hastie has his hand up. I'm conscious that we've got a couple of minutes left. Mr HASTIE: I'll try to keep this as succinct as possible. One of the seven co-founders of Anthropic, Jack Clark, talked about what the emergency response would be in situations where AI would maybe have to be shut down. He told the BBC on Wednesday that 'most labs have different ways of being able to pull the plug', including Anthropic, but said lawmakers may need to enforce having one. Where are we at on that sort of approach? Where are we at on answering that question, and what's our potential? We in the ASD are certainly well practised at responding to cyber incidents and at preventing them. We prevent far more than Australians would appreciate. I really think the focus ought to be on developing the mechanisms to prevent the need for those sorts of responses. Rather than responding in that way—a so-called pulling of the plug or a kill switch—I think it is a better question to actually work through what the consequences are of doing that, particularly if you are pulling the plug, so to speak, on a system which is integrated and enabling a whole bunch of vital services. We have in fact practised that. I went to an exercise with secretaries at the government level only a few weeks ago, where we went through a desktop exercise of understanding where our concentration risk is—where it sits in terms of technology—and going through the paces of what decisions you'd make before turning off large systems. That practice scenario is equally applicable in an AI context, and it's good practice for us to have. Then there is the process—you might do this as part of your build and development of safeguards process—of saying, 'Do we need to build in an emergency off switch, and how technically viable is that in a product?' It is not as simple as it sounds. It could require turning off a number of systems. We ought to perhaps consider going through that process before verifying a model for market or public release. CHAIR: Mr Hastie, final question. Mr HASTIE: I will try to be quick. Director General, thanks for your opening statement. You mentioned the importance of ensuring ongoing access to frontier models, which is critical to the ASD's work. You talked a bit about export controls, and we have the example from Anthropic of Mythos Fable 5 being cut by USA export controls back in June. Speaking to the larger geopolitical frame, what would happen to ASD's operations if our connectivity to the United States was cut during the war or if some sort of strategic crisis occurred? Would you have the same level of capability that you have now? Ms Bradshaw : I'm conscious of the context. There would be specific capabilities and insights which would be dramatically minimised. Mr HASTIE: Would that include access to the frontier models that you mentioned? Ms Bradshaw : It would depend on the nature of disruption. If you're talking about a physical disruption, as I said to Senator Pocock, we are entirely reliant on digital connection with the United States for access to those high-end frontier models today. That is why we are suggesting additional resilience with the prospect of actually hosting models in Australia. Mr HASTIE: So if ASD does some of its work, it goes from continental Australia through submarine cables, potentially hits core infrastructure on some of those frontier models and comes back again. If those submarine cables were damaged or connectivity was compromised, then the net effect would be that we'd have less offensive-defensive cyber capabilities, potentially—is that a fair summary? Ms Bradshaw : Yes. Without being black and white about it, it would depend, if was an inference capability we were depending on, on where those data centres were located. But most certainly there is a prospect, without core infrastructure being based here, that that may happen. Mr HASTIE: I'm just building the case for a strategic reason to have sovereign AI capability and access to frontier models here in a play to deal with the worst-case scenarios, which I know you do every day, and I thank you guys and your team for that work. If I can push you a little bit here, and I know this might be sensitive, can we talk about Chinese AI models? Is there a scenario where you might see them being used by the Australian government in our national security apparatus as an alternative to US models? Ms Bradshaw : Perhaps I should talk about models more generally. Mr HASTIE: Sure. Ms Bradshaw : I think there— Mr HASTIE: Can I reframe the question—would your preference be to lean on the trusted relationship with the United States as it stands? Ms Bradshaw : My preference would be to use the best and most trusted models in the world, and today those are the frontier models provided by Anthropic and OpenAI. Mr HASTIE: Okay, for a host of reasons, not least the fact that we share common values, common strategic objectives and so forth? Ms Bradshaw : Yes. Mr HASTIE: Could we make the same argument for critical infrastructure and elements of the private sector that go to national resilience, like the banking sector and telecommunications? And we've got a data point with the 5G debate we had about eight to nine years ago around Huawei. Would the same argument apply for them? Ms Bradshaw : I think what I would say—trying to be vendor agnostic in the same way as we deal with high-risk-vendor hardware—that the same could be said for models. We are presently working on a piece of public advice to set out, in a vendor-agnostic way, what the features of trusted models should be. That'll be consistent with the advice we give about supply chain more generally, about understanding where that product comes from, where it's created and what its contents are. And I would say that, with a lot of the open-weight model, how those training models actually operate is very opaque, to say the least, and includes, in fact, 'Where are your prompts actually going?' As you enter a prompt, where is that being collected, and where is the response being maintained? And, depending on the purpose for which you're using that model, you might have a different risk tolerance for the use of it. As it would get closer to more sensitive functions, including the operation of critical infrastructure in financial institutions, I could see that a policy agency or a regulator might want to seek higher standards for the employment of those models in those sensitive systems. Mr HASTIE: So, with closed-weight models from trusted partners being the preferred option. Ms Bradshaw : I could see how a regulator would want to introduce such a standard. Mr HASTIE: Okay. CHAIR: I'm conscious of time, Mr Hastie. Mr HASTIE: Yes. And I've probably pushed as far as we can go with that. So thank you very much, DG. CHAIR: That concludes today's hearing. Thank you again to representatives from the ASD. We really appreciate your time on this Friday afternoon. I'd like to take the opportunity to also thank all witnesses who appeared today, as well as Hansard and broadcasting for their assistance. Committee adjourned at 15:07