Home Affairs to unleash AI on sensitive government data

The Department of Home Affairs has started laying the security groundwork needed to allow federal departments and agencies to use generative AI on sensitive information and records.

In recent months the department has been meeting with companies involved in the government technology supply chains to explain policy directives designed to ensure that departments and agencies use the technology safely.

So far, the briefings – held in the form of 'town halls' that have attracted a wide attendance from industry suppliers – have focused on how government departments and agencies use generative AI with records and information classed as ‘OFFICIAL’.

Home Affairs told iTnews that it is presently engaging with suppliers to discuss the government’s next step for AI: its policies for dealing with the information and records that sit within its next most sensitive security classification, ‘PROTECTED’.

The briefings have been dominated by discussion of an AI policy advisory that Home Affairs released early October.

Home Affairs told iTnews that, to date, the briefings have attracted over 80 suppliers, including Google Australia, Amazon Web Services, IBM Australia, Macquarie Telecom, Oracle Australia, Microsoft and Deloitte.

Home Affairs developed its AI procurement policy in consultation with the Digital Transformation Agency (DTA), the body responsible for coordinating safe adoption of the technology across public services and the Australian Signals Directorate.

Currently, Home Affairs’ policy doesn’t appear to allow generative AI technologies to be used with government information and records deemed more sensitive than those classified as 'OFFICIAL'.

Even then, it requires them to stick to a prescribed list of around 18 AI technology developers and suppliers to avoid additional vetting requirements.

Currently, government entities can use generative AI products to access 'OFFICIAL' information and records as long as its from suppliers approved under its Hosting Certification Framework, OpenAI (ChatGPT), Anthropic (Claude), and others that have already passed Foreign Ownership Control or Influence risk assessments.

It is possible to use generative AI products from other suppliers to handle 'OFFICIAL' information. However, to do so, entities must carry out additional checks to ensure those suppliers are free from foreign controls and influences.

So far, Home Affairs has confirmed to iTnews that, in addition to ChatGPT and Claude, it has approved Google’s Gemini for use with 'OFFICIAL' information – Google Australia being one of the companies approved under its hosting certification security framework.

Home Affairs’ activities around AI procurement coincide with the Labor government’s recent announcement that it wants to see the technology adopted widely across the public service.

Under the whole-of-government policy, announced by Finance Minister Katy Gallagher, the government is aiming for “every public servant to have access to secure generative AI directly from their laptop”.

It will also require all government departments and agencies to appoint a chief AI officer by July next year.