Genome

'We Have “Gifted” Enough: Indigenous Genomic Data Sovereignty in Precision Medicine' by Krystal S Tsosie, Joseph M Yracheta, Jessica A Kolopenuk and Janis Geary in (2021) 21(4) American Journal of Bioethics 72-75 comments 

In “Obligations of the ‘Gift’: Reciprocity and Responsibility in Precision Medicine,” Lee (2021) rightly points out that disparities in health care access also lead to disparities in precision medicine research participation. Lee (2021) adds that an emphasis on individual consent among research ethics fails to adequately address Indigenous expectations for the governance of research specimens. As Lee summarizes in their conclusion, it is important to account for the ways that “group history and structural inequities” (64) continue to shape 21st century advances in medicine. While Lee frames their discussion within the context of clinical practice and the US healthcare system, our commentary extends consideration of the conditions that impact Indigenous participation in precision medicine research and also the potential benefits derived from it. We argue that Lee’s paper (not unlike much of the field of precision medicine) takes for granted the colonial power relations that shape the aforementioned structural inequities as the basis of Indigenous peoples’ relationship to health care systems. We contend that such erasure of the ongoing resistance of Indigenous peoples to protect and exercise their sovereignty, self-determination, and governance leads to the problematic framing of Indigenous participation in research as being a matter of “gifting” and “reciprocity.” Alternatively, and from our perspectives as Indigenous (in genetics—KST and JMY, science and technology—JK) and community-engaged (public health—JG) researchers, we offer the concept of “DNA on Loan” (Arbour and Cook 2006) to open pathways toward Indigenous genomic and data sovereignty in precision medicine. 

 Contemporary biomedical research with and affecting Indigenous peoples must consider the histories and present experiences of research exploitation and harm perpetuated by medical institutions and researchers. Research has too often been done to and about Indigenous peoples, rather than for, with, or by Indigenous peoples (Dalton 2002). The fundamentally colonial and inequitable relationship between Indigenous peoples and the predominantly non-Indigenous research institutions that control access to healthcare and funding is a crucial context for reframing the so-called exchanges of gifts in precision medicine. Current policy structures that fund Indigenous health research do not ensure that funding goes directly to Indigenous communities, nor do policies ensure that those conducting research on behalf of communities follow procedures to prevent their exploitation. Therefore, the idea of “gift” implies a requisite trust by the gifter toward the receiving research institution. However, when “consultation” attempts from funders with Tribal leaders inevitably raise the issue of Indigenous data sovereignty or Tribal control of samples, funders quickly dismiss that as not commensurate with conventional research practices. This lack of trust in the Tribal partners’ ability to grant fair and consistent access is readily apparent not only in funding partnerships but with editors of major journals who recommend removing such phrases as “Tribal control & authority.” Such ability to dismiss the very real concept of tribal control demonstrates the extreme power imbalance of “gifting.” The structural power imbalance left in the wake of this policy gap is also apparent when Indigenous peoples are offered participation in research initiatives after the terms of participation have been predetermined by research institutions or funding authorities. Indigenous communities and scholars must then choose to accept the imposed terms or risk losing out on research opportunities entirely.

'Is there a New Duty to Warn Family Members in English Medical Law? ABC v St George’s Healthcare NHS Trust and Others [2020] EWHC 4551' by Charles Foster and Roy Gilbar in (2021) 29(2) Medical Law Review 359–372 states 

This is a commentary on the third legal chapter in the unfortunate story of ABC (‘the claimant’), a single mother who sued her father’s doctor for his failure to warn her—during her pregnancy—of the risk that she might have, or be a carrier of, an untreatable and invariably fatal genetic disease. When, after the birth of her child, she discovered that she did have the disease, she said that the clinicians’ failure had deprived her of the opportunity (which she said she would have taken) to terminate the pregnancy. She claimed damages for the continuation of her pregnancy, for psychiatric damage, and for consequential losses. 

A brief reminder of the previous two chapters. In the first, the claimant contended that her father’s doctor owed her a duty of care—which meant a duty to inform her of the father’s diagnosis. In the second chapter the High Court struck out the claim, saying that there was no duty. The Court of Appeal disagreed, holding that in principle, doctors—at least in the field of clinical genetics—could owe a duty to a patient’s relatives. 

The third chapter was the trial of the claim before Yip J, who held that the father’s doctor owed the claimant a duty to balance her interest in being informed of her genetic risk against the father’s interest in keeping his diagnosis confidential. It was held that there was no breach of this duty, and that in any event the claimant had failed to prove causation. 

To our knowledge this decision has not been appealed. Though it is only a first instance decision, it raises four widely repercussive questions. First: does the decision create a new duty of care, or merely represent an incremental, non-seismic extension of an existing duty? Second: Should the question of whether there is a breach of duty in such circumstances be determined by reference to the Bolam test? Third: What type and degree of harm justifies the breach of a patient’s confidentiality? In particular, is a compromise of a patient’s reproductive autonomy sufficient ‘harm’ for these purposes? And fourth: how, generally, should the law of tort view patients’ relatives? 

We argue here that the court has created a new legal duty by imposing on clinicians an obligation to consider the relatives’ personal interests (eg the interest in making informed decisions), to weigh those interests against the interests of those who are unambiguously patients, and, where appropriate, to act in accordance with the interests of the relative or relatives. Some of the legal difficulties in this case could have been resolved more easily if the court had acknowledged that truncation of choice (including truncated reproductive autonomy) can/should be an actionable head of damages - creating a new head of damage if necessary. We question the court’s use of the the Bolam test in deciding the question of breach, suggesting that in cases properly viewed as concerned primarily with violations of autonomy the reasonable patient test endorsed in Montgomery is likely to produce a more just result. Finally, we note that the court articulates (haltingly but definitely) a relational view of the human person (or at least those human persons who happen to be the relatives of patients), moving away from the individualistic, atomistic approach adopted for many years. The old approach was that patients were contextless islands, owing nothing to anyone. It is not clear what the new approach is—but it is clearly not quite as simple as the old.

Patents and Pandemics

'Overriding drug and medical technology patents for pandemic recovery: a legitimate move for high-income countries, too' by Katrina Perehudoff, Ellen 't Hoen and Pascale Boulet in (2021) 6(4) BMJ Global Health comments 

Compulsory licenses are legal tools to override patent-protection on medicines and medical technologies. Compulsory licenses can help scale up the production and lower prices of patent-protected medicines while still accounting for the patent holder’s interests. Compulsory licensing is making a comeback in high-income countries as a negotiation strategy and a legal tool to remedy high prices and/or supply shortages of medicines and medical technologies. High-income countries that face potential legal hurdles (in world trade law and/or in the regulation of test data and market exclusivity) to effectively use compulsory licensing in the COVID-19 pandemic should consider taking measures now. 

The authors state 

 Scaling up access to new COVID-19 vaccines and therapies (‘medicines’) and medical technologies is essential to move from pandemic response to recovery. One of the key conditions for governments to produce and/or procure a sufficient supply of COVID-19 medicines is access to their intellectual property (IP). Although the research and development (R&D) of many vaccine and therapeutic candidates has been partially or entirely publicly funded, the resulting products will be owned by the companies that bring them to market. Therefore, intellectual property rights will be a significant determinant of global access to COVID-19 medicines. 

Intellectual property rules aim to compensate inventors for their investments in R&D, while also making innovations available for use by the public. The underlying premises of this system have been called into question for, among other reasons, the disconnect between growing public-funding for drug R&D resulting in privately-owned medicines. In 1995, a set of global trade rules in the World Trade Organization (WTO) Agreement on the Trade-Related Aspects of Intellectual Property (TRIPS Agreement) established the minimum standards for protecting intellectual property worldwide (see box 1). These trade rules drastically impacted human health: introduced near to the 2000s HIV/AIDS global epidemic, owners of patents and other forms of intellectual property hampered access to lifesaving antiretrovirals to people infected with HIV through excessive monopolistic prices. 

Nearly two decades later, the global community faces the all-too-familiar challenge of maximising the supply of affordable, new medicines needed to stave off a pandemic. Generally, there are two courses of action to ensure intellectual property protection does not restrict access to potential pandemic medicines and medical technologies (eg, diagnostics and personal protective equipment). One avenue is for intellectual property owners (eg, companies) to offer affordable prices and adequate supply, to voluntarily license their COVID-19 medicines and share other forms of IP related to these products or to refrain from enforcing their intellectual property rights on their COVID-19 medicines worldwide. Although some companies have taken these steps in response to the COVID-19 pandemic, these decisions remain the exception, not the rule. Only relying on voluntary measures by companies leaves the private sector—and by extension, their shareholders—to decide when and how COVID-19 medicines become widely available and affordable. 

The second course of action is for national governments to use the legal tools—compulsory licenses and public non-commercial use (called ‘government use’)—in their national law to override excessive monopolistic prices while still accounting for the patent holder’s interests. These legal tools allow governments to make and/or import the necessary ingredients or the medicines themselves, in generic form. In return, the patent holder receives a royalty payment for the use of its invention. Their use has been widely promoted in low-income and middle-income countries, often as a means to increase the supply and decrease the prices of HIV-related medicines. Even before the COVID-19 pandemic struck, all of the wealthiest countries already had legislation for compulsory licenses and/or government use on their books. International trade law (the WTO TRIPS Agreement and the Doha Declaration), international human rights law and the 2030 Agenda for Sustainable Development endorse using compulsory licenses and government use to increase universal access to essential medicines. 

Widely acknowledged as important tools for low-income and middle-income countries, compulsory licenses and government use are also legitimate strategies for high-income countries to secure access to new, expensive, essential medicines. In this analysis, we outline how compulsory licenses and government use can effectively be used by high-income countries when needed, some remaining challenges to their full use in the COVID-19 response, and possible action.

Wellfulness

'Against wellbeing: The problem of resources, metrics and care of the self' by Brendon Murphy in Alternative Law Journal states 

This article critically engages with the concept and practice of ‘wellbeing’. Over the last decade, managerial practices have broadly introduced ‘wellbeing’ policies into the workplace, including the legal workplace. While these practices, in principle, can offer important forms of support for staff under professional stress, they can also be counterproductive, and have the effect of escalating stress and isolation. Drawing on Foucault, this article turns wellbeing on its head and identifies the dark side of what has become a widely practised form of control. It concludes by advocating for employee dialogue and genuine care rather than responsibilising employees for systemic failings. 

 Murphy argues 

In August 2020, the Victorian State Coroner published findings into the death of Magistrate Stephen Myall.1 His Honour took his own life by hanging. He was the second Victorian Magistrate to die by suicide in recent years. In 2017, Magistrate Jacinta Dwyer took her own life, as did court clerk Ashleigh Petrie in 2019.3 The Coroner found that Magistrate Myall was a diligent, thoughtful and respected professional who took his work very seriously, and went to great lengths to assist the unrepresented. 

A central finding was that the relentless pressures of work were a major factor in Stephen Myall’s death. It was not uncommon for him to be required to adjudicate on up to 90 matters a day. In the absence of any evidence of clinical depression, drug or alcohol abuse, the implication was that suicide was the result of sustained work pressures: a shocking indictment on the criminal justice system. Regrettably, the lower Courts around Australia, and internationally, are infamous for the volume of work that passes through them. Much of the focus is on the process itself. Rarely is the question raised of the personal impact on legal and judicial officers. 

The inevitable questions arise: why would a highly respected professional take their own life, and what could have been done to prevent sustained work pressures that were evidently key factors. The standard response in this era is to implement ‘wellbeing’ programs, intended to provide psychological support to staff in the performance of their duties. That was the case in the Victorian Courts, which had offered several programs, including counselling and debriefings with trained psychologists. While there is much that is positive in that response, there are aspects of it that require a more thoughtful analysis. As the title of this article suggests, this work is critical of the tendency of organisations that try to deal with employee (dis)stress by individualising the context. Wellbeing, as a concept and strategy, has a dark side that needs to be identified and critiqued. Wellbeing programs and theory are part of a larger social change. Over the last decade, wellbeing has been rolled out as part of a discourse on dealing with stress and an apparent mental health crisis in the legal profession. In Australia, Professor Parker’s synthesis of the literature between 2004 and 2014 confirmed the apparent rise of distress, mental health crises and broad unhappiness in the legal profession, beginning in law school. The solution, inter alia, has been wellbeing programs. Parker argued that while there are distinct merits in offering support to colleagues, staff and students, the conclusion is that the studies informing the literature were largely flawed because of self-selection bias in reporting. Of greater concern was a strong ‘individualising discourse’ evident in the literature. Wellbeing was identified as a response to a ‘moral panic’ disproportionate to the need and had the potential to depoliticise the root causes. 

Following Parker, this article is critical of programs that focus on the individual as the source of the problem. There are three angles of criticism. First, there is a tendency of such programs to deflect back onto individuals, as personal failings, issues linked to poor management and a lack of resources. Second is the managerial use of ‘wellbeing’ as a technology of power in the workplace. Third is the despair that results from being problematised as not coping or recalcitrant. In short, ‘wellbeing’ programs may very well be part of the problem, rather than a solution. Much depends on the context. In some cases, the implementation of ‘wellbeing’ has the opposite effect, undermining the sense of competence and connection of employees, and does nothing to address the material conditions that are the root cause of most employee stress: resources. While the example here is the judicial context, the issue is much broader. Whatever benefits may exist through having a care for colleagues in the employment setting, there is a dark side to ‘wellbeing’ that is overlooked. The implementation of ‘wellbeing’ programs has the tendency to effectively blame individuals for not coping with ‘cultural change’ and obscures the absence of resources as a material source of work-related stress. In addition, such programs creative a normative paradigm through which the individual is measured as ‘well’. For those who are not ‘well’, the category functions to enhance psychological and organisation pressure and reduce esteem and confidence. That individualisation not only obscures the organisational cause, but also the disruption of family and workplace relationships caused by the intensification of work. The net impact is the erosion of the sense of personal competence and workplace relationships that nourish and sustain daily life fundamental to resilience in professional and personal life.

RoboDebt

The anaemic report by the Commonwealth Ombudsman on the Services Australia: Income Compliance Program (aka the RoboDebt disaster) states

The Office of the Commonwealth Ombudsman (the Office) has had an ongoing interest in the Income Compliance Program (IC Program) since its commencement in 2015. At the time of its commencement, the IC Program was administered by the Department of Human Services. On 29 May 2019, the Department of Human Services was renamed ‘Services Australia’ and on 1 February 2020, Services Australia was formally established as an Executive Agency. For ease of reference, this report will refer to Services Australia as the responsible agency for the administration of the IC Program. 

In April 2017, the Ombudsman published the report, Centrelink’s Automated Debt Raising and Recovery System (the 2017 report). The 2017 report highlighted systemic issues with the IC Program, including problems with fairness, transparency and usability of the IC Program’s online system and found that many of these issues could have been avoided by better project management, design, user testing and support for users of the online system. The report made eight recommendations aimed at improving Services Australia’s administration of the IC Program, all of which were accepted by Services Australia. The recommendations focused on: • written and online communication with customers • assistance for customers to gather income information in limited circumstances • service delivery and support for vulnerable customers • review of recovery fee decisions • staff communication and training • complaint information–capturing and using complaint information for continuous improvement • program evaluation (including how to further mitigate the risk of over-recovery of debts) and an incremental approach to any further rollout. 

In April 2019, the Ombudsman published a follow up report, Centrelink’s Automated Debt Raising and Recovery System (the 2019 report). That report reviewed Services Australia’s implementation of the recommendations made in the 2017 report. The 2019 report found that Services Australia had made significant progress in implementing the recommendations, and made further recommendations aimed at improving correspondence and messaging to customers about the application of recovery fees and use of averaged Australian Taxation Office (ATO) income information in raising debts. 

Changes to the Income Compliance Program 

In early 2019, the Department of Human Services was renamed as Services Australia and became part of the Social Services portfolio. On 19 November 2019, the Australian Government announced that Services Australia would no longer use averaged ATO income information without other proof points to raise debts under the IC Program. In an update on its media hub on the same day, Services Australia advised that it would make contact with individuals for whom Services Australia had used ‘only income averaging’ to raise a debt and   would provide advice to those individuals about ‘freezing’ repayment arrangements while it reassessed debts. 

This announcement was closely followed by Federal Court of Australia consent orders on 27 November 2019 in the matter of Amato v The Commonwealth of Australia (VID611/2019) which declared, among other things, that averaged ATO income information was not capable of satisfying a decision-maker that Ms Amato owed a debt within the scope of ss 1222A(a) and 1223(1) of the Social Security Act 1991. 

In light of the changes to the IC Program in November 2019, the Ombudsman decided to commence an own motion investigation, pursuant to s 5(1)(b) of the Ombudsman Act 1976 (Ombudsman Act), into Services Australia’s use of averaged ATO income information in its income compliance program. The Ombudsman formally notified the then-interim Chief Executive Officer of Services Australia of his decision on 19 February 2020. 

On 29 May 2020 the Australian Government announced that it would refund repayments made on debts based wholly or partially on income averaging of ATO data. In addition, Services Australia subsequently announced that any outstanding debts based wholly or partially on income averaging would be reduced to zero. Following that announcement, our investigation focussed on the implementation of the refund process. For ease of reading, this report refers to the ‘refund’ process, recognising this process incorporates both debts that have been paid being refunded, as well as debts which remain outstanding being reduced to zero. 

Objective and scope of our investigation 

The Ombudsman limited the scope of this investigation to the administration of the announced changes to the IC Program, and in particular to seek assurance that Services Australia’s processes for identifying and refunding debts raised using income averaging was, and continues to be, fair and transparent. 

In order to ensure we did not duplicate or prejudice legal proceedings that were underway at the time of our investigation, we determined the question of the lawfulness of the income averaging methodology previously employed by Services Australia would be out of scope of our investigation. 

Rather, the scope of this investigation is fundamentally concerned with the adequacy of the arrangements that Services Australia put in place to ensure that those hundreds of thousands of Australians who were subject to debts on ‘legally insufficient’ grounds have those debts refunded. 

During the course of our investigation, we identified some issues and concerns with the identification process which have now been overtaken by the refund process itself. These matters are described and subject to comment in this report but require no immediate action by Services Australia. 

While the refund process is nearing its completion, we also identified some matters where we consider that more still needs to be done to reasonably complete the task, as well as other  matters relating to the ongoing administration of the IC Program. These matters are subject to recommendations in the report. 

In July 2019, the Senate Community Affairs References Committee (the Senate Committee) commenced an inquiry into the IC Program, which focused on the impact of the IC Program, income averaging methodology and the legality of the debt collection processes. Our Office made a submission to the inquiry in September 2019 and a supplementary submission in September 2020. Our supplementary submission outlined our previous interest in the IC Program and some of the issues we identified during the earlier part of this investigation. A copy of this submission is at Appendix A to this report. 

Methodology 

Our Office engaged with Services Australia a number of times between November 2019 and November 2020 about the IC Program and our investigation. We also sent questions and requests for information to Services Australia under s 8 of the Ombudsman Act. 

In addition, our Office investigated a number of individual complaints about the IC Program which raised issues including communication, availability of records, delays in reassessments and reviews, interest charges, access to advance payments and bankruptcy which also formed the basis of this report. 

The analysis of the investigation and our recommendations and comments are based on our assessment of the material provided by Services Australia and the issues we saw in individual complaints we investigated. 

During the investigation, Services Australia was still developing its identification and refund processes. The Office made a number of inquiries to Services Australia throughout the investigation and we acknowledge that Services Australia undertook a significant amount of work to provide our Office with a high volume of information. 

Our role 

The Office investigates complaints and provides independent oversight of public administration by Australian government agencies and certain private sector businesses. The Ombudsman makes recommendations to improve government administration. 

The Ombudsman cannot be directed to undertake an investigation, to arrive at a certain conclusion or on the scope of an investigation. Rather, the Ombudsman decides what is in or out of scope of his investigations in accordance with his statutory function as set out in the Ombudsman Act. 

The Ombudsman’s role is limited to investigating ‘action that relates to a matter of administration’.  Accordingly, our focus is on the administration or implementation of legislation and policy by officials in government departments and statutory agencies.   

Recommendations and comments 

The Office makes nine recommendations for action to Services Australia. 

Recommendation 1 As soon as it has completed identifying all individuals who are and are not eligible for a refund, and without duplicating communication that may be required as a result of legal proceedings, Services Australia should communicate directly with individuals who have had debts raised under the IC Program and who have not been assessed as eligible for a refund or removal of their debt. That communication should be in writing and include clear advice about the individuals’ review rights. 

Recommendation 2 If it is anticipated that Services Australia may re-raise debts that have been refunded, it should, at the earliest opportunity, publish general information on its website to enable individuals to understand that the Australian Government’s decision to refund eligible debts does not preclude Services Australia from raising another debt for the same debt period without relying solely on income averaged information. 

Recommendation 3 In circumstances where Services Australia decides to revisit and potentially re-raise refunded debts it should, at the earliest opportunity, write to affected individuals and provide information to enable them to understand the impact of its decision. This information should include: a) the basis on which any decision to revisit and re-raise debts will be made b) an assurance that income averaging alone will not be used to re-raise debts c) information about individuals’ review rights. Alternatively, if Services Australia does not intend to revisit and potentially re-raise debts which have been the subject of refunds, it should confirm this publicly at the earliest opportunity.  

Recommendation 4 Services Australia should continue to identify options to resolve the issue of individuals’ debts having been affirmed by the AAT with income averaging in the final decision, ideally with a view to refunding those debts which would otherwise have been eligible for refund as soon as possible.  

Recommendation 5 Services Australia should review its guidance to staff, including all relevant policies, procedures and training materials, to ensure it aligns with Services Australia’s stated position that where an individual requests a formal or ARO review, their request is referred directly to an ARO. ( 

Recommendation 6 In circumstances where Services Australia is unable to obtain income information from the individual or third parties for the purposes of an SME review, it should finalise the review based on evidence other than averaged ATO information on hand and provide a decision to the individual. 

Recommendation 7 Services Australia should only rely on ‘net to gross converted income information’ from bank statements in income compliance activity, in the absence of other proof points, with express confirmation from individuals that the grossed up amount accurately represents their fortnightly earnings for the relevant period. 

Recommendation 8 In circumstances where Services Australia continues an individual’s income compliance in- flight review and where the individual had previously been contacted about an income discrepancy, Services Australia should include in its written communication a correction to any information provided in the initial correspondence that is no longer accurate. At a minimum, the correspondence should note that Services Australia made changes to the IC Program in November 2019, and that it will no longer raise debts relying solely on estimating the person’s income by ‘averaging’ ATO income information over multiple fortnights. ( 

Recommendation 9 Whenever Services Australia is requested by an individual to review a debt raised pre-2015 it should explicitly consider whether income averaging was used, following the same manual process it undertook for the refund process for the IC Program. If it identifies that income averaging was used as the sole basis for any portion of the debt, it should reduce that portion of the debt to zero, regardless of when that debt was raised. If the individual has repaid that debt and has no other debt owing to Services Australia, that payment should be refunded. Services Australia should ensure its website clearly identifies the availability of this process, how a person can request it, and the person’s options for further review should they be dissatisfied with the initial decision. 

The Office also makes a further seven comments to Services Australia about matters that have occurred, but where due to the passage of time, no remedial action is required. These comments sit alongside our formal recommendations. 

Comment 1 In order to mitigate future risks and minimise adverse impact upon affected individuals, Services Australia should have recorded appropriate indicators on individuals’ records to capture the method of calculating debts, allowing timely identification of, as well as reporting on, debts which relied wholly or partially on income averaging. Services Australia should have recorded, for each debt raised on an individual’s file, the basis on which it was raised, including whether it relied wholly or partially on income averaging or whether other ‘proof points’ were relied on, and if so which ones. Services Australia should have recorded, on each debt it considered, the basis on which it categorised the debt as being raised using income averaging or not. 

Comment 2 In light of the 19 November 2019 announcement by Government that averaged ATO income information alone is ‘legally insufficient’ to raise a debt, the more appropriate approach would have been for Services Australia to be able to immediately freeze recovery on all income compliance debts while it conducted its identification process, only re-starting recovery once a debt was determined to have not been raised relying on income averaging. 

Comment 3 In light of the risks associated with accepting an individual’s ‘agreement’ to averaged income amounts, Services Australia should have immediately frozen recovery on ‘agreed to’ debts. 

Comment 4 Services Australia should have taken more proactive steps to ensure that any individual seeking an advance payment was not prohibited from doing so by a debt Services Australia had determined was ‘legally insufficient’. 

Comment 5 Services Australia should have communicated directly with all individuals who had debts raised under the IC Program immediately after the November 2019 announcement. This communication should have informed individuals that Services Australia was reviewing debts, the impact on outstanding debts (ideally, consistent with our earlier comment that debt recovery action had been frozen), that individuals did not need to take any action and would be contacted within an indicative timeframe. 

Comment 6 While we are satisfied with the steps Services Australia has now taken, it should have taken more proactive steps from November 2019 to identify individuals with private payment arrangements relating to a debt which had been frozen, and contact all individuals within the cohort to ensure they were aware of their entitlement to pause the arrangement. 

Comment 7 Following the 29 May 2020 announcement, Services Australia communicated extensively about the Australian Government’s decision to refund debts, including through a wide range of mediums to communicate with affected individuals and with instructional materials for staff. We are satisfied Services Australia took appropriate steps to communicate with individuals eligible to receive a refund during this period. 

Australia, Sovereign Citizens and FOI

The Department of Prime Minister and Cabinet has responded to the following FOI request (FOI/2021/17) from a sovereign citizen by sending a copy of the Constitution . 

1. The Parliament of Australia 

I request the instrument, or otherwise information, that defines the meaning of the word 'Australia' within the term 'The Parliament of Australia', that appeared in 1973, in contradistinction to the term 'The Parliament of the Commonwealth' that appears in section 1 of the Commonwealth Constitution.  

(b) I request the information that defines the term 'The Parliament of Australia' to be an entity, or otherwise a description of an entity. 

(c) I request the instrument, or otherwise information, that provides for recognition of the term 'Parliament of Australia' within the Commonwealth Constitution. 

2. The Government of Australia 

(a) I request the instrument or otherwise information that defines the meaning of the word 'Australia' within the term 'the Government of Australia', that appeared in 1973, in contradistinction to the term 'the Government of the Commonwealth' that appears in section 2 of, and elsewhere within, the Commonwealth Constitution. 

(b) I request the information that defines the term 'the Government of Australia' to be an entity, or otherwise description of an entity. 

(c) I request the instrument, or otherwise information, that provides for recognition of the term 'Government of Australia' within the Commonwealth Constitution

FOI request FOI/2021/13 was

I request the information, documents and instruments held by the department that detail and establish in law or convention, any of the following: 

(a) The name of the Crown(s) that the Sovereign of Australia possesses. 

(b) The creation date of the Crown(s) that the Sovereign of Australia possesses. 

(c) the name of the Crown(s) required by the Commonwealth Constitution to be possessed by the Sovereign of Australia. 

(d) The list of all capacities in which the Crown can have in the Succession to the Crown Act 2015. 

(e) An explanation of exactly what is being succeeded to the Succession to the Crown Act 2015 by the Sovereign of Australia (eg is it a physical Crown, if not what is the Crown being succeeded to). 

(f) The relationship between the Queen of Australia and the Sovereign of Australia (eg where is it established that the Queen of Australia is the Sovereign of Australia.

Commonwealth Government Cybersecurity

You can, of counsel trust your government. The ANAO report Cyber Security Strategies of Non-Corporate Commonwealth Entities (No. 32 OF 2020–21) comments 

 Malicious cyber activity has been identified as one of the most significant threats affecting government entities, businesses and individuals. Previous ANAO audits have identified low levels of compliance with mandatory cyber security requirements under the Protective Security Policy Framework (PSPF). The Joint Committee of Public Accounts and Audit has expressed its concern about entity implementation of these requirements. 

Policy 10 of the revised PSPF outlines the mandatory requirements for entities to safeguard information from cyber threats. Entities assess their maturity under the PSPF against four maturity levels representing their assessed level of implementation of the requirements: Ad hoc, Developing, Managing and Embedded. The Attorney-General’s Department (AGD), the Australian Signals Directorate (ASD) and the Department of Home Affairs have responsibilities in relation to cyber security policy and operational capability. 

The implementation of cyber security risk mitigation strategies by the selected entities was not fully effective, and did not fully meet the mandatory requirements of PSPF Policy 10. Two of three entities did not accurately self-assess implementation of one of the Top Four mitigation strategies for which they reported full implementation. None of these three entities were cyber resilient. 

The majority of the entities examined that had self-assessed a maturity level of ‘Ad hoc’ or ‘Developing’ have established strategies to progress toward a ‘Managing’ maturity level for PSPF Policy 10. AGD, ASD and Home Affairs could do more to improve support for the implementation of cyber security requirements.

24% of non-corporate Commonwealth entities were compliant with the mandatory Top Four mitigation strategies in ANAO performance audits since 2014. 72% of non-corporate Commonwealth entities reported not fully implementing PSPF Policy 10 in 2018–19.  

ANAO accordingly made 

thirteen recommendations aimed at improving entities' cyber security maturity levels, and the support and assurance provided by the three cyber policy and operational entities. 436 cyber security incidents reported by Australian Government entities to ASD in 2019–20. 

The report states

Background 

1. The security of government information communications technology (ICT) systems, networks and data supports Australia’s social, economic and national security interests as well as the privacy of its citizens. Malicious cyber activity has been identified as one of the most significant threats affecting Australians. The frequency, scale and sophistication of malicious cyber activity is reported to be increasing, with cyber threats considered to be an increasing risk across Australian Government entities. The management of cyber security risk within the Australian Government public sector is the responsibility of individual entities. 

2. Three Australian Government entities have responsibilities in relation to whole-of-government cyber security policy and operational support. In relation to cyber security: the Attorney-General’s Department (AGD) is responsible for administering the Protective Security Policy Framework (PSPF), which provides the framework for Australian Government entities to achieve four protective security outcomes — governance, information security, personnel security and physical security; the Australian Signals Directorate (ASD) developed the Top Four mitigation strategies mandated by the PSPF and is a technical operational agency that provides material, advice and other assistance to Australian governments, business, communities and individuals on matters relating to the security and integrity of information that is processed, stored or communicated by electronic or similar means; and the Department of Home Affairs (Home Affairs) is responsible for the development and coordination of the Australian Government’s cyber security policy, and coordinating the implementation of Australia’s Cyber Security Strategy 2020. 

3. In February 2017, ASD re-issued its Strategies to Mitigate Cyber Security Incidents, which outlines 37 prioritised mitigation strategies to help protect entities from cyber threats. ASD has recommended that entities implement eight of these mitigation strategies, known as the Essential Eight, as a cyber security baseline. ASD also developed the Essential Eight Maturity Model to provide guidance to entities on how to implement the Essential Eight mitigation strategies and how to self-assess the maturity of their Essential Eight implementation. There are three maturity levels in the current Essential Eight Maturity Model — ‘Maturity Level One’, ‘Maturity Level Two’ and ‘Maturity Level Three’. ASD recommends that entities should aim to reach ‘Maturity Level Three’ for each mitigation strategy as a baseline. 

4. A revised PSPF commenced on 1 October 2018, outlining 16 core requirements that non-corporate Commonwealth entities must apply to achieve the four protective security outcomes. Non-corporate Commonwealth entities are to apply the revised PSPF using a security risk management approach. Policy 10 of the revised PSPF outlines the mandatory requirements for entities to safeguard information from common and emerging cyber threats. Policy 10 mandates the implementation of the Top Four mitigation strategies and that entities consider the implementation of the other mitigation strategies from ASD’s Strategies to Mitigate Cyber Security Incidents that are relevant to their operational and risk environment. While not mandatory under Policy 10, AGD strongly recommends that entities implement the remaining four strategies that comprise the Essential Eight mitigation strategies. 

5. Nine non-corporate Commonwealth entities were included in this audit:

• Attorney-General’s Department; 

• Australian Signals Directorate; 

• Department of Home Affairs; 

• Department of the Prime Minister and Cabinet (PM&C); 

• Future Fund Management Agency (Future Fund); 

• Australian Trade and Investment Commission (Austrade); 

• Department of Education, Skills and Employment (DESE); 

• Department of Health (Health); and 

• IP Australia. 

Rationale for undertaking the audit 

6. Since 2013, the Australian Government has mandated the implementation of the Top Four mitigation strategies by non-corporate Commonwealth entities under the PSPF. The Australian Government has identified malicious cyber activity as one of the most significant threats affecting government entities, businesses and individuals. Previous ANAO audits have identified low levels of compliance with mandatory cyber security requirements under the PSPF. The Joint Committee of Public Accounts and Audit (JCPAA) has expressed its concern about entity implementation of mandatory cyber security requirements. 

7. This audit seeks to address a recommendation made by the JCPAA in Report 467: Cybersecurity Compliance, for the Auditor-General to consider conducting an audit of the effectiveness of the PSPF self-assessment and reporting requirements for cyber security compliance. The audit also follows up on the recommendation made in Auditor-General Report No.53 2017–18 Cyber Resilience, for the responsible cyber policy and operational entities (AGD, ASD and Home Affairs) to work together to improve entities’ compliance with mandatory cyber security requirements under the PSPF. 

Audit objective and criteria 

8. The objective of the audit was to assess the effectiveness of cyber security risk mitigation strategies implemented by selected non-corporate Commonwealth entities to meet mandatory requirements under the PSPF, and the support provided by the responsible cyber policy and operational entities. 

9. To form a conclusion against the audit objective, the ANAO adopted the following two high-level criteria: Have the selected entities fully implemented the Top Four cyber security risk mitigation strategies or otherwise adopted strategies and actions to progress towards full implementation? Have the entities responsible for cyber policy and operational capability worked together to support accurate self-assessment and reporting by non-corporate Commonwealth entities, and to improve those entities’ implementation of cyber security requirements under the PSPF? 

Engagement with the Australian Signals Directorate 

10. Independent timely reporting on the implementation of the cyber policy framework supports public accountability by providing an evidence base for the Parliament to hold the executive government and individual entities to account. Previous ANAO reports on cyber security have drawn to the attention of Parliament and relevant entities the need for change in entity implementation of mandatory cyber security requirements, at both the individual entity and framework levels. 

11. In preparing audit reports to the Parliament on cyber security in government entities, the interests of accountability and transparency must be balanced with the need to manage cyber security risks. The Australian Signals Directorate has advised the ANAO that adversaries use publicly available information about cyber vulnerabilities to more effectively target their malicious activities. 

12. The extent to which this report details the cyber security vulnerabilities of individual entities was a matter of careful consideration during the course of this audit. To assist in appropriately balancing the interests of accountability and potential risk exposure through transparent audit reporting, the ANAO engaged with the ASD to better understand the evolving nature and extent of risk exposure that may arise through the disclosure of technical information in the audit report. This report therefore focuses on matters material to the audit findings against the objective and criteria and contains less detailed technical information than previous audits. Detailed technical information flowing from the audit was provided to the relevant accountable authorities during the audit process to assist them to gain their own assurance that their remediation plans are focussed on improving cyber resilience as required and support reliable reporting through the existing cyber security framework. 

Conclusion 

13. The implementation of cyber security risk mitigation strategies by selected non-corporate Commonwealth entities under this audit was not fully effective. The selected entities have not met all mandatory requirements of PSPF Policy 10 in safeguarding information from cyber threats. While the three cyber policy and operational entities have provided more support to entities to meet the mandatory PSPF Policy 10 requirements following Auditor-General Report No.53 2017–18 Cyber Resilience, additional ongoing work will be required to assist entities in achieving a more mature and resilient cyber security posture. 

14. None of the seven selected entities examined have fully implemented all the mandatory Top Four mitigation strategies.6 For the three entities that had self-assessed full implementation for one or more of the Top Four mitigation strategies in their 2018–19 PSPF assessment, two had not done so accurately. None of these three entities were cyber resilient. Five of six selected entities that had self-assessed to have not fully implemented any of the Top Four mitigation strategies have established strategies and implemented activities to manage their cyber risks and to progress toward a ‘Managing’ maturity level for PSPF Policy 10. 

15. The cyber policy and operational entities have worked together to provide more guidance following Auditor-General Report No.53 2017–18 Cyber Resilience to support non-corporate Commonwealth entities’ self-assessment of their implementation of cyber security requirements under the PSPF. There is scope to further improve the accuracy of entities’ PSPF Policy 10 assessments and strengthen arrangements to hold entities to account for the implementation of cyber security mandatory requirements. Robust accountability arrangements are particularly important in absence of public accountability through reporting to the Parliament. 

Implementation of cyber security risk mitigation strategies 

16. PM&C and AGD have each not accurately self-assessed their implementation of one of the Top Four mitigation strategies. PM&C has not fully implemented the mitigation strategy for restricting administrative privileges. AGD has not fully implemented the mitigation strategy for patching operating systems. Future Fund has accurately self-assessed the two Top Four mitigation strategies for which it reported full implementation. None of the three entities were assessed as cyber resilient. Under the cyber security framework, PM&C and AGD are categorised as vulnerable to cyber security incidents as they have not fully implemented all the Top Four mitigation strategies and are continuing to strengthen the controls for managing cyber security incidents. Future Fund has not fully implemented all of the Top Four mitigation strategies, but is internally resilient as it has effective controls in place to support its ability to detect and recover from a cyber security incident. 

17. Of the six entities that had reported not fully implementing all the Top Four mitigation strategies, five have established strategies and activities to progress their PSPF Policy 10 maturity level to ‘Managing’. The five entities have also included the implementation of the remaining four strategies that comprise the Essential Eight in their cyber security improvement programs. Three of the six entities had not set a corresponding timeframe to improve their PSPF Policy 10 maturity level to ‘Managing’. There is scope for four of the entities to improve monitoring of the implementation progress of their cyber security program to ensure that the entity is meeting the timeframe to improve its cyber security maturity. 

Support provided by the cyber policy and operational entities 

18. The revised PSPF maturity assessment model has incorporated more guidance to support entities’ self-assessment of their implementation of Policy 10 cyber security requirements. The AGD-developed PSPF Policy 10 guidance cross-references to multiple technical guidance developed by ASD, including guidance on the implementation of the Essential Eight mitigation strategies and the underlying security controls within the Australian Government Information Security Manual. There is scope to further improve the alignment of the maturity models for the PSPF and Essential Eight, and the clarity of the guidance to ensure more accurate PSPF Policy 10 self-assessments. 

19. The cyber policy and operational entities have not developed processes to verify the accuracy of entities’ PSPF Policy 10 self-assessed reporting. ASD has commenced the development of software tools that provide technical reporting to support entities in performing more accurate self-assessments of their Essential Eight implementation. While AGD and ASD have been sharing the results of the PSPF self-assessment reports and the ASD’s ACSC Cyber Security Survey, the sharing of data has not yet resulted in obtaining assurance on the accuracy of the self-assessments and facilitating policy and technical assistance for entities. 

20. With the release of the whole-of-government PSPF assessment reports by AGD and the annual Australian Government’s cyber security posture report by ASD, there has been increased public reporting on non-corporate Commonwealth entities’ implementation and maturity level of the Essential Eight mitigation strategies. However, the status of entities’ cyber security posture is not transparent due to the policy and operational entities’ concerns about increasing security risks following the disclosure of individual entities’ cyber security maturity level. The cyber policy and operational entities have not established processes to improve the accountability of entities’ cyber security posture. The current framework to support responsible Ministers in holding entities accountable within Government is not sufficient to drive improvements in the implementation of mandatory requirements.

ANAO's recommendations are 

Recommendation no.1  The Department of the Prime Minister and Cabinet strengthens its validation of privileged user access, specifically documenting the confirmation of the requirement for access from those that are responsible for approving privileged access. Department of the Prime Minister and Cabinet response: Agreed. 

Recommendation no.2  The Attorney-General’s Department performs and documents risk assessments for any patches not implemented in accordance with the requirements of the Australian Government Information Security Manual and its policies, including defining an action plan for managing the risks associated with not implementing those patches. Attorney-General’s Department response: Agreed. 

Recommendation no.3  The Department of the Prime Minister and Cabinet: improve its risk assessment of security events; and improve testing of security configurations and reviews of user access to ensure that the configurations are operating as intended. Department of the Prime Minister and Cabinet response: Agreed. 

Recommendation no.4  The Attorney-General’s Department improves the processes for documenting risk assessments and monitoring cyber security events, to assure itself that actions taken against cyber security events are performed consistently and appropriately. Attorney-General’s Department response: Agreed. 

Recommendation no.5  The Australian Trade and Investment Commission: sets a timeframe to improve its cyber security maturity to the ‘Managing’ level for PSPF Policy 10; and monitors the progress of the projects within its Cyber Security Work Program against the timeframe set for improving its PSPF Policy 10 maturity level. Australian Trade and Investment Commission response: Agreed. 

Recommendation no.6 Paragraph 2.62 The Department of Education, Skills and Employment: sets a timeframe to improve its cyber security maturity to the ‘Managing’ level for PSPF Policy 10; and monitors the progress of its Cyber Security Essential Eight Work Plan against the timeframe set for improving its PSPF Policy 10 maturity level. Department of Education, Skills and Employment response: Agreed. 

Recommendation no.7  The Attorney-General’s Department: develops a strategy and sets a timeframe to improve its cyber security maturity to the ’Managing’ level for PSPF Policy 10; provides clear reporting to its governance committees to enable oversight on the progress of its work to improve its Essential Eight maturity; and monitors the progress of its work to improve its Essential Eight maturity against the set timeframe and through appropriate governance structures. Attorney-General’s Department response: Agreed. 

Recommendation no.8  The Future Fund Management Agency monitors the progress of its Essential Eight improvement activities against the timeframe set for improving its PSPF Policy 10 maturity level. Future Fund Management Agency response: Agreed. 

Recommendation no.9  The Attorney-General’s Department reviews the existing maturity levels under the PSPF maturity assessment model to determine if the maturity levels are fit-for-purpose and effectively aligned with the Essential Eight Maturity Model, having regard to the Australian Signals Directorate’s proposed update to the Essential Eight Maturity Model. Attorney-General’s Department response: Agreed. 

Recommendation no.10  The Attorney-General’s Department further improves the guidance on PSPF Policy 10 to clarify: the correlation of the maturity levels in the PSPF and Essential Eight maturity models, and their implementation requirements; the scope of the maturity level calculation suggested by the reporting portal and how entities can more accurately determine their selected PSPF maturity level; and the assessment against the requirement to consider the implementation of the remaining 29 mitigation strategies, and the merit of its inclusion in the PSPF Policy 10 maturity level calculation. Attorney-General’s Department response: Agreed. 

Recommendation no.11   The Attorney-General’s Department implements arrangements to obtain an appropriate level of assurance on the accuracy of entities’ PSPF Policy 10 self-assessment results. Attorney-General’s Department response: Agreed in principle. 

Recommendation no.12  As part of its technical advice and assistance to the Attorney-General’s Department, the Australian Signals Directorate draw on its technical tools in addition to its existing capabilities to support the Attorney-General’s Department’s assurance processes on entities’ PSPF Policy 10 self-assessment results. Australian Signals Directorate response: Agreed. 

Recommendation no.13  The Australian Government strengthens arrangements to hold entities to account for the implementation of mandatory cyber security requirements. Attorney-General’s Department response: Noted. Australian Signals Directorate response: Noted. Department of Home Affairs response: Noted.

The institutional enthusiasm is palpable. 

Criminalising Fake News

'Regulatory Responses to ‘Fake News’ and Freedom of Expression: Normative and Empirical Evaluation' by Rebecca K Helm and Hitoshi Nasu in (2021) 21(2) Human Rights Law Review 302–328 comments 

National authorities have responded with different regulatory solutions in attempts to minimise the adverse impact of fake news and associated information disorder. This article reviews three different regulatory approaches that have emerged in recent years—information correction, content removal or blocking, and criminal sanctions—and critically evaluates their normative compliance with the applicable rules of international human rights law and their likely effectiveness based on an evidence-based psychological analysis. It identifies, albeit counter intuitively, criminal sanction as an effective regulatory response that can be justified when it is carefully tailored in a way that addresses legitimate interests to be protected. 

Helm and Nasu argue 

 Early proponents of the internet imagined an information utopia, in which information freely and easily shared would yield tremendous benefits to society. However, the widespread exploitability of information on the internet generally, and social media more specifically, has allowed so called ‘fake news’ to impact individuals’ perception of domestic and international affairs. ‘Fake news’ has been defined as ‘fabricated information that mimics news media content in form but not in organizational process or intent.’ It encompasses misinformation (false or misleading information) and disinformation (false or misleading information disseminated with the specific purpose of deceiving people)—two types of information disorder. 

In response to the rise of fake news through social media, national authorities have responded with different regulatory solutions in attempts to minimise or eliminate the adverse impact of information disorder. The implementation of these measures is fraught with difficulties, with earlier studies raising concerns about their compatibility with freedom of expression and speech. Traditionally, in some parts of the world at least, freedom of speech has been treasured with the ‘marketplace of ideas’ metaphor, which Justice Oliver Wendell Holmes Jr articulated in his cherished dissenting judgment in Abrams v United States. 

However, increased polarization and algorithmically dictated content dissemination and consumption make this metaphor less appropriate in today’s society, where truth may not be emerging from such a ‘marketplace.’ Due to the distorting impact of fake news for democratic decision-making processes, harmful consequences may well be perceived to outweigh the benefit of free speech for society and democratic processes. Normative considerations must therefore be carefully weighed against the need to ensure that regulatory responses effectively combat fake news. There are critical gaps in literature where rigorous analysis is needed for precarious balancing between normative compliance and psychological effectiveness in the crafting of the regulatory response to fake news. 

This article addresses this precarious balancing by critically evaluating different regulatory approaches in terms of their normative compliance with the applicable rules of international human rights law, and their effectiveness to achieve the regulatory goal according to an evidence-based psychological analysis. To that end, it outlines the criteria that regulatory regimes should aim to meet both empirically (Section 2) and normatively (Section 3) and evaluates three different regulatory approaches based on these criteria (Section 4). This article concludes with the finding that some level of restriction on freedom of expression is inevitable due to the need to discourage the creation and distribution of fake news, rather than just preventing its spread. 

In particular, this article identifies, albeit counter-intuitively, criminal sanction as an effective regulatory response. Contrary to broad normative claims worshipping freedom of expression, careful analysis of normative requirements under international law suggests that criminal sanction can be justified when it is tailored in a way that specifically, and with sufficient precision, addresses legitimate interests to be protected with varying degrees of safeguard required under each jurisdiction against abuse, including an opportunity to contest allegations of falsity. However, it is cautioned that the introduction of interventionist measures necessarily involves social cost due to the chilling effect they have on the socially beneficial free flow of information. The extent to which social benefits of free flow of information are perceived to be outweighed by the public interest in the removal of the societal harms generated by fake news may vary depending on how much social cost each society is prepared to accept.