Amid questions around whether OpenAI will face legal consequences for its Medicare hack, a man who faced decades in jail for alleged cybercrimes says Australian law comes down harder on individuals than organisations.
asserted
law → face → organisations
Nic Cubrilovic pleaded guilty to lesser charges after facing more than 50 counts relating to unauthorised access into GoGet's systems about a decade ago.
asserted
Cubrilovic → plead → systems
Experts say Australia faces a challenge ahead in making sure AI will act in accordance with the national rules and values imposed on humans.
asserted
AI → say → humans
When Nik Cubrilovic saw the news of the OpenAI Medicare hack this week, he knew the tech giant was unlikely to suffer any legal consequences.
asserted
giant → see → consequences
Not like the ones he faced.
asserted
he → face → ones
Almost a decade earlier, Mr Cubrilovic was slapped with more than 50 charges — some carrying a possible jail time of up to a decade — related to computer crimes.
asserted
Cubrilovic → slap → crimes
Not for hacking into the federal government's system storing health care data, but for unauthorised access to computer systems belonging to a company — car booking platform GoGet — that he claims he accessed as an "ethical hacker" and gave forewarning about.
uncertain
he → store → forewarning
An ethical hacker is someone who legally breaks into a computer system to find security flaws before nefarious hackers can exploit them.
asserted
hackers → break → them
While some experts and politicians have called for OpenAI to face legal consequences for its agent's hacking into the Medicare statistics portal, other experts and the government worry Australian computer hacking laws may not capture the conduct of OpenAI and its AI agents.
uncertain
laws → call → OpenAI
OpenAI has acknowledged its models "took actions we did not intend", the company would review what happened, and was working with the affected organisations to address security vulnerabilities.
asserted
what → acknowledge → vulnerabilities
But the incident highlights novel questions about who is legally responsible for the conduct of an AI agent: is it the user or the company that trained it?
asserted
that → highlight → it
'All it takes is one executive to feel offended'
asserted
it → take → ?
There was no ambiguity about who was responsible for Mr Cubrilovic's conduct.
asserted
who → be → conduct
Even still, he told the ABC, he was not initially sure which hacking attempt he was being arrested for.
asserted
he → tell → attempt
"It was so funny when I got arrested.
asserted
I → arrest → ?
I had a knee in my back from a SWAT team member when I asked what this was for?
asserted
this → have → what
They said, 'GoGet'," Mr Cubrilovic recalled.
asserted
Cubrilovic → say → ?
After 18 months on bail, he pleaded guilty to some charges in exchange for the majority of them being dropped.
asserted
majority → plead → them
He avoided jail and instead was sentenced to a two-year good behaviour bond, 400 hours of community service, and ordered to pay about $1,600 in compensation.
asserted
He → avoid → compensation
Mr Cubrilovic also had his laptops and phones incinerated by police, who claimed they could still have had user data on them.
uncertain
they → have → them
His legal fees approached $100,000, he said, and he was not allowed to use the internet for the 18 months while on bail.
asserted
he → approach → bail
Mr Cubrilovic, who continues to work as a software engineer today, maintains that all the charges related to activity he undertook as an ethical hacker were to point out flaws in GoGet's system.
asserted
he → continue → system
"I had a 15 to 20-year history of showing well-intentioned cybersecurity flaws that I had reported to 300 companies.
asserted
I → have → companies
But all it takes is one executive to feel offended and to direct the power of the state against you," he said.
asserted
he → take → you
Prior to the GoGet incident, he had discovered and disclosed major exploits in Facebook and MyGov.
asserted
he → discover → Facebook
The court heard Mr Cubrilovic had previously disclosed a number of vulnerabilities in GoGet's systems.
asserted
Cubrilovic → hear → systems
Police alleged, separate to those disclosures, that Mr Cubrilovic used his skills to access GoGet's customer database when his girlfriend's account was suspended and made dozens of bookings that he charged to other people's accounts.
asserted
he → allege → accounts
Ultimately, charges relating to unauthorised access of customer data were dropped, and he pleaded guilty to charges relating to driving a car without permission and dishonestly obtaining financial advantage by deception.
asserted
he → relate → deception
GoGet did not respond to requests for comment by email or phone.
asserted
GoGet → respond → email
'They need to sort their s*** out'
asserted
They → need → *
Mr Cubrilovic cited international legal examples of people being "overcharged" for computer hacking incidents, like the case of American computer programmer Aaron Schwartz, who died by suicide while facing up to 50 years in prison for downloading a large number of academic papers illegally.
asserted
who → cite → papers
"There's a long history of prosecution against individuals but large companies like OpenAI have the resources to make sure that this doesn't happen,"he said.
asserted
this → be → resources
Mr Cubrilovic said he was not frustrated that OpenAI would not face legal ramifications like he did.
asserted
he → say → ramifications
"I don't think they should, but at the same time, they definitely need to sort their shit out," he said.
asserted
he → think → shit
While a lot is not yet known about the details of the OpenAI Medicare incident, Prime Minister Anthony Albanese said the AI agent went beyond just visiting web pages by "writing" to a government server.
asserted
agent → know → server
This distinction takes the AI agent's conduct from typical passive usage into what is often considered hacking, even though the government has repeatedly stressed that it was a "minor" incident.
Mr Albanese said there would "obviously be legal consequences", but senior ministers have subsequently said the government was considering legal frameworks and questioned whether "if that is possible to happen".
asserted
that → take → frameworks
Other politicians such as Greens senators David Shoebridge and Sarah Hanson Young, ACT independent senator David Pocock, as well as experts like UNSW professor Toby Walsh have called for legal consequences, including criminal prosecution.
University of Sydney AI evaluation and governance expert Rebecca Johnson said she believed any human who did what OpenAI's agent did would face legal consequences.
"Any person who broke through to Medicare would be in trouble.
asserted
who → call → trouble
A company that does that needs to be held responsible and accountable,"she said.
asserted
that → do → that
Dr Johnson said one of the challenges now was ensuring that AI acts in accordance — or "aligned", in AI parlance — with our national rules and values.
asserted
AI → say → rules
As an AI user himself, Mr Cubrilovic said he was concerned about more people having access to its cyber-offensive capabilities, comparing it to nuclear proliferation.
asserted
people → say → proliferation
…and 5 more, not listed.
The Aporia
