Addendum to Submission 137

Joint Standing Committee on the National Disability Insurance Scheme

Senate Inquiry - Capability and Culture of the NDIA

Addendum to Submission 137

~ RoboDebt + RoboNDIS ~ Culture That Automated Harm

Marie Johnson CEO Centre for Digital Business Pty Limited ABN: 16 162 122 072

Marie Johnson 1

Addendum to Submission 137

BACKGROUND

I would like to thank the Committee for the opportunity to meet the Committee and make a statement.

I am the former Head of the NDIA Technology Authority, a specialist appointment reporting directly to the NDIA CEO. I led the business case for the NDIS ICT systems, and for this to be based on co-design and the principles of the UN Convention on the Rights of Persons with Disabilities. I was responsible for establishing co-design, a capability which would later be abandoned by the bureaucracy. A disastrous action of significant consequence. Everything I predicted would happen, has happened because of this.

In providing this testimony, I draw on my lived experience of family with disability interacting with the NDIA. I was honoured to receive the ACT Mental Health Carer Award for 2022.

This supplementary statement tabled in full is lengthy, describing in detail with evidence my detailed internal knowledge of the NDIA and evidence of systemic defects; systemic breaches of the NDIS Act and other unlawful practices; and extreme cyber security risks.

I am also often asked about the ‘new’ PACE Salesforce system – and will it fix things. My answer to this is no. The same errors are being repeated, with risk compounded by dangerous predictive algorithms and algorithmic processes modelled on RoboDebt. I explain in detail throughout this written supplementary statement.

In this testimony I will highlight key issues that warrant exposition, starting with my professional background and my family’s horrific experience with the NDIA.

My professional background and expertise are relevant to the comments I am making. I am the CEO of the Centre for Digital Business, a digital services AI company. I am a recognised global digital authority; author and commentator on artificial intelligence; human rights; technology; ehealth; cyber; identity; and ethics.

I have been at the forefront of digital transformation for decades, with a track record across the public and private sector in Australia and internationally, covering health and human services; disability services; visa systems; tax; identity; and payments.

I was awarded the prestigious US Government O-1 Visa for Individuals with Extraordinary Ability or Achievement, many years ago, to take up the role leading Microsoft’s Worldwide Public Services and eGovernment business based in Seattle.

For many years, I was the Chief Technology Architect for the Australian Department of Human Services, with responsibilities including the architecture and technology business cases bringing together the massive systems of Centrelink, Medicare Australia, and the Child Support Agency.

I was previously the Chief Technology Architect for the Australian Health and Human Services Access Card.

I have an exceptionally deep knowledge of the NDIA processes, and the NDIS ICT system built and delivered by DHS. I also have extensive knowledge and operational experience of the cross-government capability, systems, and architecture on which the NDIA is dependent.

I was an Inaugural member of the ANU Cyber Institute Advisory Board. In my early career, I led an intelligence team on an organised crime investigation run by the National Crime Authority. For many years I was the Independent Member on the AFP Spectrum Board.

From my experience I believe that the NDIA systems and processes are the most defective and dangerous in government. The defective NDIA systems which I have been writing about for years, not only directly cause harm but present risk to life.

Marie Johnson 2

Addendum to Submission 137

The many hundreds of submissions to this inquiry and to previous inquiries including the inquiry into Independent Assessments, all of which I have read in preparation for this statement, present irrefutable evidence of this. Every submission is like ours. That is not a coincidence.

I was working at the NDIA as the Head of the Technology Authority during the period when RoboDebt was being devised and rolled out, under what would become whole-of-government digital and automation strategies.

As the former Chief Technology Architect of DHS and with extensive whole-of-government and global experience, I well understand whole-of-government strategies and what automation involved and the implications.

I knew too much and had too much experience to be dazzled by the technology hubris across government, pushed by tech companies and consulting firms – with hundreds of millions of dollars at stake - that would cause so much harm.

My perspective has long been the fundamental need for co-design, not only to ‘improve the client experience’ but more importantly as an essential governance and ethics mechanism to protect human rights.

My role with the NDIA involved amongst other things, the establishment of an end-to-end co-design capability, staffed by NDIA staff with disability.

As I explain in detail in this statement, end-to-end co-design is necessary in order to map the life cycle of data.

Co-design would eventually be dumped by the bureaucracy, with significant consequence.

The culture across the bureaucracy was brutal and toxic.

I was criticised by powerful personalities within the broader bureaucracy, outside the NDIA, for taking co-design ‘to the extreme’. That this gave the NDIA perspective that did not accord with the DHS direction.

I was personally vilified and accused of a lack of loyalty for ‘not supporting DHS’. I had to choose between NDIA and DHS, and I chose NDIA.

As RoboDebt was starting to blow up, it was said to me that for ‘not supporting DHS’, I could not be saved from the consequences of this choice.

I was yelled at. Book slamming in meetings. Equipment slammed. I was dis-invited to meetings. Senior DHS bureaucrats would simply not show up at critical meetings, long planned, involving interstate, and international attendees.

The treatment of disabled and neurodivergent staff was disgraceful – and in fact, unlawful. Moved around – ‘where could we park them’. Spoken about in the most offensive, disparaging and hurtful language.

Accommodations and adjustments were difficult and had to be justified, ridiculously – including assistive technology, and from evidence at Senate Estimates, this is still the case.

Meetings would be cancelled without notice, and this happened not only with the DHS but also the Digital Transformation Office (now DTA). The DTO cancelled at least 6 meetings, the last cancellation just one hour before the meeting was to take place. With no care or consideration for disabled attendees, for the length of time and effort involved including with support workers, in preparing for and travel to meetings.

According to DTO, DHS would be representing the needs of the NDIA in ‘whole-of-government’ digital transformation. No need to meet with disabled people. Well, one size fits all, fits no one.

Addendum to Submission 137

The IT bureaucrats would determine what people with disability would and would not get – and then put the ‘offerings’ in front of people with disability for testing, and dress this up as co-design. This is still happening. Clearly, digital government is not meant for people with disabilities and their families. And because I was taking a divergent approach – which was absolutely needed, endorsed, and funded in the business case - it was said to me quite menacingly, that taking a stand on co-design at the same time that RoboDebt was blowing up in the media, for ‘not supporting DHS’, I would not work for government in Canberra again. I was not the only one to be threatened in this way. This was and is a common practice. At the end of my contract, I left to take up opportunities overseas in AI. And I will say, that my work in AI has continued to be acknowledged globally. I did not deserve this treatment. Nor did the many disabled people who were undertaking extraordinarily important work. And nor did my daughter and family deserve to suffer the consequences of all this – defective harmful technology born of supreme arrogance and incompetence. I feel that I am able to say these things now, given what is now on the public record through the RoboDebt Royal Commission. Whilst I was not involved in RoboDebt, given my previous role as the DHS Chief Technology Architect, my expert presence inside the bureaucracy with NDIA, was perhaps seen as inconvenient. And it is no surprise that Robo practices have become embedded in the NDIA, with the same horrific results. RoboDept and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government digital and automation strategies driven by DHS, now Services Australia. There is a duty in law and ethics to understand the ‘why’ and ‘how’, including the distorting and destructive power of defective systems and algorithms used at scale by the state. It is the purpose of my expert testimony with evidence to expose these questions. Without doing so, further harm cannot be prevented. In my family’s experience, I did not have a crystal ball. I did not need a crystal ball. I knew ahead of time exactly what my daughter and our family were in for.

FAMILY EXPERIENCE

The continuing telling of our family’s experience is immensely traumatising. But we feel we have no option. Telling our story in the hope that it will help change things, and suffer in the telling. Or shut up and suffer anyway. My daughter’s initial NDIS application was REFUSED because the NDIA LOST her entire application, including the 400+ pages lever arch folder and documents. It had taken her more than TWELVE MONTHS to assemble almost TWENTY years of medical evidence, including having made additional specialist appointments for reports and assessments to be written at very considerable cost. In anticipation of the torture that my daughter went on to actually experience, I took photographs of her at the NDIA offices lodging her application; which was stamped and receipted by the NDIA officer at my insistence. Marie Johnson 4

Addendum to Submission 137

The reason why I took the photos, is that I knew ahead of time the gross deficiencies in the Agency culture, capability and processes and anticipated the very difficult time my daughter would have. I knew exactly what would happen. This haunts me.

And we fought a bitter battle for two years to have that perverted refusal decision over-turned.

Throughout the application and appeal period, I maintained a detailed chronology and analysis of the various interactions with the NDIA.

The chronology shows that on TWELVE times, information was provided/re-sent/re-requested. The Agency admitted to not having all the documents, even though we had receipts showing inconsistencies on the part of the Agency as to what they had and when they received it.

And yet with all my detailed internal knowledge and ability to engage solicitors, I could not prevent the damaging impact on my daughter of the interaction with the NDIA.

UNLAWFUL ALGORITHMS ~ ABSENCE OF ETHICS ~ RISK TO LIFE

In previous evidence, I have described the over-reach of the actuarial function, and the system and systemic risks this creates. These risks are catastrophic, not understood and not documented.

The NDIS actuary function operated as a closed loop that created the algorithms without governance or ethics framework; designed assessment interventions opposed by the medical and health community; determined services based on a fiction; designed the so-called digital experience; and then reported the outcomes.

Effectively, participants have been subject to a perverse form of human experimentation.

This must never be allowed to happen again.

But mere changes to the org chart and reporting lines won’t fix this.

The role of the actuary needs to be legislatively limited and legislatively counter-balanced by co-design and ethics. I will talk more about co-design later in this testimony.

Throughout this testimony, I will raise questions of lawfulness and unlawfulness of the construction and operation of these algorithms and systems; and whether misfeasance or malfeasance in public office has occurred.

Similar questions were raised during RoboDebt Royal Commission1 hearings, with the examination of legal advice regarding misfeasance in public office, that if established, could be a basis for a class action.

This was of course, the RoboDebt class action. Some of the elements of misfeasance in public office covered in that legal advice, include:

• the defendant must be the holder of a public office…
• the defendant must have been recklessly indifferent to whether the act was beyond power and recklessly indifferent to the likelihood of harm being caused to the plaintiff;
• the defendant must have acted with reckless indifference to whether the act was beyond power and there must have been, objectively, a foreseeable risk of harm to the plaintiff.

Legal advice regarding malfeasance in public office was also exhibited. RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government automation strategies driven by DHS, now Services Australia.

The first question of lawfulness goes to the very foundation of the NDIS.

Addendum to Submission 137

Given that the NDIS legislation specifically allows for MULTIPLE DISABILITIES, questions need to be asked about the origins and evidence basis of the actuarial fiction of ‘primary disability’. And question whether the fictional device of ‘primary disability’ arose because the systems built by DHS could not be configured for multiple disabilities. Was this design fiction of ‘primary disability’ ever examined as to its LAWFULLNESS or UNLAWFULNESS? So fundamental is this question, that its status simply cannot be ignored, assumed or accepted unchallenged. This might very well be a catastrophic multi-billion-dollar design defect: one that has caused untold human harm, including for my family. Putting in bluntly and simply, the NDIA system can only cater for one disability - the ‘primary disability’. People have to pick one. Let that sink in. And the consequences are catastrophic. This is in breach of Section 24 of the NDIS Act ‘Disability Requirements’, which legislatively specifies one or more disabilities and ‘impairment or impairments’. As if anybody – including health professionals - would actually be able to do this, or even understand the consequences of such a decision to ‘pick one’. This is a human rights, ethics and legal minefield. The whole operating model panders to the complexity of this actuarial fiction. There are so many processes, systems, appeals, reviews, rules, administrative loops, turgid language, asessment reports, and human harm because of it. Horrific system-wide costs and yet people still do not get the supports they need. And as demonstrated throughout the whole INDEPENDENT ASSESSMENT debacle, notwithstanding the risk to life, the NDIA recklessly pursued the use of systems, algorithms and methods that have been shown in other jurisdictions to harm people leading to death. In fact, and against the advice of health professionals, the AMA and others, the Agency ruthlessly and recklessly used these systems, algorithms, and methods in trials of Independent Assessments. Did the NDIA have any knowledge or evidence that the application of algorithms results in harm and death? An answer either way - yes or no - is damning. The NDIA either had this knowledge and recklessly ignored it. Or did not have this knowledge - which is readily publicly obtained - and recklessly decided not to acquire and investigate this knowledge.

Specifically, what is the process and governance by which the algorithms and methods were/are developed: including the governance regarding safety, risk and ethics?

And in evidence at the JSCNDIS inquiry into Independent Assessments, NDIA executive shockingly stumbled over whether or not there was even an ethics framework (there is none), and appeared to not even understand the question. How could IA trials – effectively human research – progress so far, in the absence of the necessary ethics governance as outlined in the National Statement on Ethical Conduct in Human Research 2007 (Updated 2018).2 Other notable health and research experts also documented concerns in submissions.3

2 https://www.nhmrc.gov.au/about-us/publications/national-statement-ethical-conduct-human-research-2007-updated-2018#block-views-block-file-attachments-content-block-1

3 Royal Commission into Violence, Abuse, Neglect and Exploitation of People with Disabilities. Submission by Muriel Cummins, AHPRA-registered Mental Health Occupational Therapist, page 9] Marie Johnson 6

Addendum to Submission 137

‘Should an external body seek to complete a study using the same methodology as outlined in the IA pilot, researching NDIS participants, they would be required to adhere to the National Statement on Ethical Conduct in Human Research (NMHRC, 2018), and the study would be oversighted by an independent Human Research Ethics Committee (HREC) [9]. Human Research Ethics Committees oversee ethical conduct in research practice, including, but not limited to: ethical research process; evaluation of risk of participants; informed consent; data and record management; publication of findings; conflict of interest; and the handling of allegations of research misconduct. Why do these research standards not apply to research undertaken by the NDIA?’ [Emphases added]

The message here is that rigorous training is needed for any profession whether it is health work or qualitative research in order to conduct the work in a careful, appropriate and scientific manner. Assumptions, biases, methods and researchers behaviours must be subject to scrutiny and ethics. The lack of fundamental ethics governance in the core operations of the Agency, is a most reckless capability failure.

One of the most alarming consequences of this, is that there remains no documented risk to life, arising from the Agency’s own operations.

And notwithstanding this, the widespread implementation of RoboPlanning and NDIS RoboDebt compliance practices was occurring at the same time the RoboDebt Royal Commission was hearing of harms resulting from the same practices and methods.

Later in this submission, the NDIA is shown to be recklessly confused and conflicted over privacy, data protection and risk.

Furthermore, in my submission to the JSCNDIS Inquiry into Independent Assessments, I detailed cyber security concerns about systems and applications being used by the NDIA in Independent Assessment trials that would see personal sensitive data processed by uncleared contractors and transmitted unprotected offshore.

Built on the actuarial fiction of ‘primary disability’ are roboplanning algorithms, based on the equally flawed concept of statistical averages.

‘Mathematically this is wrong because an average for a fluctuating variable never speaks to its constituent parts.’4

The community has come to understand the horrific impact of ‘averaging’ in the unlawful RoboDebt catastrophe, happening in the very same portfolio as NDIS.

Algorithms based on ‘behavioural insights’ create a fiction, a persona comprised of assumed or typecast features whose fictional behaviours are used as a proxy in order to predict behaviours of real people, and for this prediction to be treated as fact. It makes huge generalisations, reductions and determinations on complex human conditions, experiences and disparate factors.

This perverts power and access to justice in a number of ways. The state, with all its power, is automating decisions relating to individuals, based on ‘insights’ and fiction. Not evidence. By contrast, the individual, must produce extraordinary evidence to prove otherwise in order to overturn the fiction-based automated decision of the state (the NDIA) - evidence which the state ignores.

Addendum to Submission 137

The problem with algorithms based on personas and behavioural insights, is in its application to administrative decision making by the state – not some marketing function. And we see the catastrophic result of this in both RoboDebt and RoboNDIS.

The NDIS legislation specifies that PLANS are INDIVIDUALISED and directed by the participant. That facilitate tailored and flexible responses to the individual goals and needs of the participant.

The application of statistical averages in automated roboplanning eliminates the individual person and their needs, transmuted instead to a fictional average, a fictional ‘persona’.

Roboplans are incompatible with the legislation and therefore UNLAWFUL. And this is happening systematically at scale.

This is in breach of Part 2 Section 31 (a) of the NDIS Act ‘Participants’ Plans’: the first principle, that plans be INDIVIDUALISED.

These algorithmic roboplans eliminate the stated legislative rights of the participant… …and they also over-ride the CEO’s legislated responsibilities, breaching Section 33 (5) of the NDIS Act which states: that the CEO MUST have REGARD for the individual participant stated goals, reports and assessment.

This is not an isolated, one-off or mistaken breach. It is happening at scale to all participants.

A fictional ‘persona’ does not exist; does not have goals; does not have rights. And nor does the algorithm, which is also not a person, have the human capacity to exercise REGARD - that is, the legislated responsibility of the CEO, a defined person. So here we see two UNLAWFUL devices at the very core of the NDIS: One. The actuarial fiction of ‘primary disability’. And two. The algorithmic elimination of the legally defined rights of the participants as individuals and the annulment of the CEO’s responsibilities to exercise REGARD. My daughter’s plan was cut by 75% creating a situation of extreme safety and health risk. Her current situation is not an isolated or one-off circumstance. The harm she is continuing to suffer is the only outcome - the only possible and inevitable outcome - of a system that is recklessly driven by dangerous algorithms. The depth of the cuts across the different categories of my daughter’s plan is extreme and has created significant safety risks. Critical areas have been completely de-funded. This is a reckless withdrawal of funding so as to make the whole plan unworkable, unsafe, and a risk to life. This is in contravention of many areas of the NDIS Act; contravention of other Commonwealth legislation including the Public Service Act; and contravention of international conventions.

My daughter’s treatment was and is UNLAWFUL. We asked what was the basis for the 75% cut, and there was no explanation given. We could appeal. Or go to the AAT. We appealed on safety and hazard grounds. An urgent communication IGNORED by the Agency for a MONTH.

Marie Johnson 8

Addendum to Submission 137

While the government has now abolished the AAT, as an instrument of justice, the AAT was never an option for us and for many thousands of people. We are deeply traumatised, we knew the AAT process would be destructive, as was the original access appeal. We could not face the unthinkable.

ALGORITHMS AND THE DENIAL OF ACCESS TO JUSTICE

But this is far more than culture. This is a large-scale orchestrated denial of human rights and denial of access to justice – orchestrated either by intent or recklessness or defective systems – most likely all of these. Not only are these algorithms incompatible with the NDIS legislation, perverting individuals’ access to life supports and services, but these algorithms continue to have a catastrophic impact on the broader operation of access to justice. That a judicial body such as the AAT and advocacy groups could be so overwhelmed by the scale and network effects of an algorithm, signals a completely different risk that central government is either choosing to ignore or inexcusably ignorant of. In my opinion, perhaps the most concerning aspect of algorithmic decision making is that any human who might be in the loop, will defer to the algorithm because they are simply overwhelmed by contracted volumes and KPIs.

• Local Area Coordinators.
• Planners.
• Decision makers.
• Appeals officers.
• Health professionals.
• Legal representatives for the agency.
• Legal representatives for participants.
• Members of the AAT - and its successor. Across all these parties making decisions regarding the lives of people with disabilities, there is not a common – or any – understanding as to the construction and effect of the algorithms. How exactly is the AAT or its successor or a temporary taskforce, ever to understand the black box algorithms and determine if these are just, safe, and lawfully applied? Indeed, do they have the expertise and authority to make such a determination? At the core of the NDIS, are unlawful opaque algorithms that cannot be explained. We were not given an answer to our question about the basis of the 75% cut. I intentionally asked this question because I knew that the LAC couldn’t or wouldn’t give an answer. And on the evidence of a great many submissions, the standard operating practice of the NDIA is ‘no explanation of how plans are constructed and cut.’ UNLAWFUL on so many levels, and in breach of the NDIS Act, Public Service Act, and AD(JR) Act. Submission 120 from People with Disabilities WA (PWDWA), provides extraordinary insight into the widespread the practice of ‘no explanation’.

Most Planners believe they don’t need to respond to a request for reasons about a planning decision made by the NDIA despite s 13(2) of the AD(JR) Act making administrative provision for requests.’ The submission from PWDWA, also provides evidence of the harmful impact of KPIs: The LAC Planner stated that they do not get any time to read or review any of the reports submitted, and they go into these planning meetings without any knowledge of the case or the person. The LAC Planner further stated that there is a pressure to conduct 8 planning meetings per day, giving them an hour maximum for each meeting.’ This is the most serious perfect storm of risk.

Addendum to Submission 137

That LACs are incented and driven by KPI’s to drive throughput by not reading reports; not providing explanations; not discussing goals; incented to reduce budget load over their participant caseloads using dangerous and opaque algorithms that they cannot explain, notwithstanding the medical evidence regarding the health and safety of the participant. Targets driven by NDIA practices such as the ‘Hour of Power’ to finalise roboplans, explains a lot of our experience. And the experience described by a great many people. Worryingly, the RoboDebt Royal Commission has also heard evidence of a similar practice – the ‘Boost Board’ – introduced to drive targets in RoboDebt notices. It is no coincidence that opaque algorithms, robo-decisions and KPI’s are common to both RoboDebt and RoboNDIS. Further evidence at the RoboDebt Royal Commission, heard that: ‘The online compliance interaction through myGov is a key component of this measure that enables the significant increase in compliance activity and cost savings by removing the need for staff decision making.’ [Emphasis added]. This is Robo administration at scale, where humans – both the decision-makers and applicants (whatever their situation or condition) are automated out. What is directly witnessed is that the algorithm has taken over, causing systemic defective administrative decision making, which is then sent into the cycle of plan review. The interplay of algorithms and KPIs also dangerously perverts ‘complaint resolution’ actions. We made an urgent serious safety complaint, which was ignored. My daughter supported her 2022 plan review and appeal with ELEVEN reports – this in addition to the THIRTY medical reports submitted in her initial NDIS application and in addition to the countless additional reports in the just TWO years she has been a participant in the NDIS. So all up, in just TWO short years as many as FIFTY reports have been provided to the NDIA. The financial cost of this is extraordinary and the human toll of this on my daughter is sickening. In this one and only plan review, my daughter was informed that the recording of her disabilities in the system was CHANGED singularly to bipolar disorder – an arbitrary and dangerous splitting out of one element of the cluster of complex conditions that constitute her psychosocial disabilities. All the THIRTY medical reports provided to the NDIA on her initial application – and as many as FIFTY reports all up – describe the interplay and compounding impact of these complex conditions. My daughter has provided several detailed personal statements describing the severity and life impact of these conditions. Her husband, father and I have all provided detailed personal statements. The NDIA has ignored the advice of all these reports, arbitrarily, aggressively and punitively withdrawing funding to a dangerous level - driven by roboplanning algorithms - in contravention of the medical advice and my daughter’s own stated goals, leaving her deeply vulnerable, at risk and unsupported. And far worse. A person who my daughter has not met before and who by their own admission had not read or had lost my daughter’s documents - more documents lost yet again - informs her that her disability has been CHANGED in the system. This arbitrary action not only ignores the TWENTY years of medical diagnosis but CHANGES it – by a person not qualified to do so. This is INTERFERENCE with medical evidence. And it is UNLAWFUL.

Addendum to Submission 137

Furthermore, notwithstanding the FIFTY reports – including the ELEVEN reports my daughter provided in support of the 2022 plan review and appeal process and which the Agency lost and ignored – the LAC wanted my daughter to provide even MORE reports including further personal statements. Not read, are my daughter’s harrowing personal written statements that have already been made. The LAC was told of the extremely desperate situation in writing following the catastrophic 75% funding cuts. And yet, while even more reports were demanded, my daughter’s own request to discuss, review and update her goals were ignored and denied. KPIs that do not allow the time to consider goals. An organisational culture and behaviours that are antagonistic to this. Being denied the right to discuss goals and update ‘about me’ statements, is happening across the board. There is out-roar over this in participant forums. The NDIA and LACs are REFUSING participants’ legislative right to update their goals, breaching Section 33(1) of the NDIS Act ‘the participant’s statement of goals and aspirations’. This in addition to the earlier discussion on the systemic breaches to Section 33(2) of the NDIS Act ‘statement of participant’s supports’ arising from the use of roboplans and algorithms. What is being experienced across the board, is the systemic and orchestrated breach of Section 33 of the NDIS Act that covers the TWO legislated pillars of a participant’s plan: the participant’s statement of goals and aspirations Section 33 (1) AND the statement of participant’s supports Section 33 (2). The day following the plan review meeting, my daughter communicated with the LAC via email stating that she had not been given the opportunity to discuss her goals in the plan review meeting the previous day. My daughter requested the opportunity to discuss her goals before the plan was finalised, but this request was ignored and a mere 27 MINUTES later was informed that the final plan had been submitted. 75% cut. Not explained by the Agency. But we explained that what this means is the aggressive, immediate, and unsafe removal of supports; enforced isolation; and denial of access to life saving therapies. Again, request a review or go to the AAT is the default position of conflicted LACs who are driven by KPIs to ram through plan reviews and reduce plan budgets, but don’t bear the financial costs of the reviews and AAT actions. Want to appeal? The LAC threatened the prospect of further cuts if we did appeal. Contracted LAC organisations are acting in their own financial interests, defined by KPIs, which is in conflict with the interests of the participant. Incented and driven by KPI’s to drive throughput by not reading reports; not providing explanations; not discussing goals; deterring appeals; and incented to reduce budget load over their participant caseloads using dangerous and opaque algorithms that they cannot explain. This is a fundamental defect of the outsourced NDIA operating model, and is a catastrophic breach of the NDIS Act, other Commonwealth Acts, and UN Conventions. SAFETY: A CATASTROPHIC CAPABILITY FAILURE The NDIA does not have the culture nor the capability to manage the psychosocial caseload.

Addendum to Submission 137

Reckless and life-threatening decisions are being made in direct contravention of the advice of treating psychiatrists and health teams, by people not qualified; with no consultation; with no transparency; and without any accountability for the consequences of risk to life. The NDIA is operating dangerously and is incapable of addressing operational safety. Matters of safety need to be considered by the Committee as a catastrophic capability failure of the NDIA itself, as distinct from safety risks arising from providers and outsourced contractors. I am not aware that operational safety risks of the Agency itself have ever been considered. Certainly from my knowledge, ‘risk to life’ from the Agency’s own operations, is not a risk that has been acknowledged or documented by the Agency. We lodged a serious urgent safety complaint with the Agency regarding my daughter’s serious situation over the 75% cut and the situation this created. The urgent safety complaint was IGNORED by the Agency for more than a MONTH. A torrent of nonsensical emails was only received following our letters to Minister Shorten, who passed our urgent letters back to the Agency. We then received emails from the Agency saying that the complaint was being closed down because the ‘telephone was not answered’ after three calls. A person in a desperate situation – whose stated communication preference is NOT the phone – receives phone calls from a private number. The expressed communication preference is continually ignored by the NDIA and LAC providers in breach of the NDIS legislation and the UNCRPD. The Agency recklessly sought to close off the complaint because the telephone was not answered three times in quick succession. Multiple times during this episode, I intervened and told the Agency not to close down the complaint as it had not been resolved. The ‘three phone calls’ is a bizarre and dangerous KPI, determining the ‘closure’ of safety complaints. This should all sound very familiar, because it is hauntingly similar to the processes and organisational behaviour seen in the case of Mr David Harris, a gentleman with paranoid schizophrenia, who died after his NDIS funding was cut off and the Agency closed off communication with him. It is also reported that the Agency refused to disclose to his family, details of his NDIS funding as the material would ‘reveal methodologies the NDIA uses in determining levels of support provided to participants’ and would ‘compromise the financial suitability, integrity and longevity of the NDIS’. These are the algorithms: dangerous and out of the reach of scrutiny and governance. Whereas this gentleman’s loving family fought for three years for information and a full investigation into the failures and neglect he suffered in his final months, I have the dreaded burden of knowing exactly what is going on inside. In our case, NO action was taken by the Agency; the safety complaint was IGNORED by everyone. Neither investigated nor resolved. No letter from the Agency. No letter from Minister Shorten. The urgency from the 75% cut lingers. And I do not believe that it is the role of the Quality and Safeguards Commission to handle operational safety issues of the NDIA itself. Nor is the AAT or its successor, the forum for responding to operational safety issues. It is the role and core function of the NDIA – and not its outsourced contractors – to respond to operational safety swiftly.

Marie Johnson 12

Addendum to Submission 137

It has been my ongoing experience that the Agency does not have the culture, capability nor operating model demanded of an environment of extreme systemic risk, including risk to life of vulnerable and disadvantaged populations. Harm and fear of harm is the only result.

SYSTEMS, DATA, PRIVACY AND CYBER SECURITY

I have run large operational systems across government, and in my experience, the NDIA systems and processes are the most defective and dangerous in government. So serious are the defective NDIA systems, processes and governance, that the Government and this Committee is grappling with the economic concerns arising from the NDIA administration, as well as the exploitation of this systemic weakness by organised crime, reportedly to the tune of billions of dollars per year. The core of the NDIA systems – the participant record – lacks integrity and that is an extremely serious situation. The fact that a diagnosis can arbitrarily be changed, is not only an extreme safety risk, but signals a lack of integrity, risk management and control framework around the participant record. This not only happened in our case. It is a systemic, aberrant and widespread practice of the NDIA suffered by a great many people evidenced by widespread commentary on participant forums and in submissions. This is a dangerous and arbitrary splitting out of diagnosis so as not to record a person’s full circumstances. There are several critical points and consequences regarding data integrity defects and changes to the participant record, specifically diagnosis. In evidence at the 15 February 2023 Senate Estimates, the NDIA Acting Actuary was unable to answer specific questions on forecasts stating: ‘…there are a few challenges with reconciling the participant numbers. It’s to do with our new IT system.’6 This is not just a reconciliation issue to be waved away, but points to the intractable integrity issues with the NDIS systems – of both the old system and concerningly the new system. I’ll talk about the new IT systems later in this testimony. With such widespread reports of the NDIA changing participant diagnosis in the system - and systemic data integrity defects – it is perhaps not surprising, though disturbing, that data integrity appears to be a factor in the December 2022 NDIS Quarterly Report7 with unexplained anomalies surfacing. Commentary of an independent analysis89of the December 2022 NDIS Quarterly Report points to the potential erroneous recording of a diagnosis as a factor leading to anomalies. This would mean that the TSP (Typical Support Package) is miscalculated by the NDIA algorithm, potentially leading to tens of thousands of people being allocated NDIS funding that is not fair or equitable. This analysis lines up with the widespread experience of participants, grievous cuts, appeals, and complaints. None of this should be excused simply as defect of the IT systems – as grossly problematic as that is.

Addendum to Submission 137

The problems are far more profound and disturbing, an extreme risk impacting the Commonwealth Federal Budget. These anomalies are the inevitable consequence of defective porous systems; a lack of data integrity; an end-to-end data lifecycle. And the only way to map the end-to-end data lifecycle, is through end-to-end co-design.

The effect of having permanent disabilities not recorded or removed from the record, is to withdraw funding. This is an UNLAWFUL act. It is a large-scale systemic breach of Section 24 of the NDIS Act denying people funding for all their permanent disabilities. It is a practice so widespread as evidenced by commentary in community forums, in submissions and in AAT appeals, than the only interpretation would appear to be the intentional removal of permanent disabilities from the record, so that those disabilities not thus recorded are not funded. Whatever the explanation, this is malfeasance. And it is deadly.

Case after case of systemically recording the WRONG diagnosis; fundamental errors; a person with a physical disability found their diagnosis had been recorded as an intellectual disability. Permanent disabilities initially recorded then disappear with a new plan. Documents mixed up. Plans containing copy-paste info from other people’s plans. Plans with no goals. Other cases, permanent diagnosis of disability NOT RECORDED –discovered only via a PIA process. A participant reported they got two plans in one - the first part of the plan was their plan and then the last part - capacity building and capital supports was someone else’s plan! And from another family: a report that ‘Sam would like to walk independently as a goal. My child’s name is not Sam, and they walk just fine.’ Furthermore, there are fundamental questions to be asked about why detailed and highly sensitive medical and personal documents and records are REPEATEDLY lost. This is a common ongoing situation experience by a great many people. LOST documents. And extremely sensitive documents discovered in the wild on the PUBLIC web. From a family: ‘…my husband searched for my email address on google. He found the full-service agreement between my daughter and [name of service provider] for support coordination.’ And there are many other instances of other service providers. These documents and records are far more sensitive than the medical records held by My Health Record. In addition to health and medical information, these documents cover the most sensitive personal and family information about a person’s very existence.

And it needs to be understood that these lost documents also include information about OTHER people–the participant’s family and who else is in their life. The seriousness of the cyber security and organised crime risks arising from the continuous stream of lost participant documents and health information, is evidenced by the recent security advisory regarding My Health Record, cyber security and connected systems.[10] How this happens is via a daisy chain of unmonitored mailboxes; no intelligent workflow; process dead-ends; off-system manual manipulation of data and documents; printouts; metastasised off-system

Addendum to Submission 137

databases; and the passing around of spreadsheets and emailing of extremely sensitive medical information to outsourced providers.

Effectively, there is a continuous and uncontrolled mass leakage of highly sensitive health information and other personal data.

The NDIA systems and processes are porous - not fit for purpose - and expose all participants and providers to risk, including identity theft and cyber risk. I know both of these domains with some authority.

Over many years, I have written about the defective NDIA/NDIS systems. And in this defective systems setting, the cyber security and privacy risks of the NDIA API arrangements, need to be very clearly understood.

NDIA has hundreds of APIs, and given the evidence I present in this additional statement, and in the context of the extensive change management challenges of the ‘new’ Salesforce PACE system, questions need to be asked about security, risk, and cyber threat assessments and scenario preparedness.

Cyber security and privacy need to be considered by the Committee as a serious culture and capability deficiency of the NDIA. Responses from the Agency to questions on privacy at Senate Estimates11 are further evidence of this.

API’s are a serious threat vector, and analysts have long warned of a tidal wave of API exploitation. A survey12 of more than 400 security and engineering professionals found that 53% have experienced a data breach to networks or apps due to compromised API tokens. This same report details the case of T-Mobile, where 37 million customer accounts were stolen via API vulnerability. And recently, 235 million Twitter user accounts were exposed by hackers exploiting an API vulnerability.

The cyber black market is, by some measures, the third largest economy in the world.

This brings us to the NDIS CTARS breach. The NDIA asserts that the CTARS breach was not a breach of ‘NDIA systems’. That is not the full story. The CTARS breach was of NDIS participant data made available to CTARS systems via NDIA APIs, with the breach compromising 12,000 email addresses resulting in data posted on the DEEP web. This very large volume of personal, health and other sensitive information included identity documents, Medicare details, tax file numbers, and personal contact information. In addition to this, is the extraordinarily sensitive personal health information including mental health, suicide attempts, drug use and abuse, violent behaviour and sexual abuse. As reported,13 this data was published to a hacking forum and accessed by an untold number of people. The question is why ANY of this data is in the CTARS systems in the first place. And that key question points to concerns over the rigour of the risk and control framework for NDIA APIs – and data more broadly. Questions about the management of API automation via MuleSoft (owned by Salesforce) cannot be waved away as the realm of the IT folks. Co-design is necessary in the design of APIs, in order to understand risk.

Addendum to Submission 137

I have written about the data, cyber, and defective NDIA systems risks in previous submissions, years ahead of the NDIS CTARS data breach, which still does not appear to have been responded to appropriately.

At Senate Estimates on 9 November 2022,14 the Agency was badly confused over questions about the CTARS breach, wasn’t able to answer basic questions, indicating that it doesn’t understand the issue or even what the response was or should have been.

Given the scale of the data breach, the Agency appears out of its depth.

Just a few weeks later on 28 November 2022, an ABC investigation15 reported that it had identified large swathes of previously unreported confidential material that is widely available on the internet, ranging from sensitive legal contracts to the login details of individual MyGov accounts, which are being sold for as little as $1 USD.

Many of those impacted learnt they were victims of data theft only after being contacted by the ABC. While the NDIA told a Senate Committee that it had confirmed with CTARS that all 9800 affected participants had been notified, ABC established this is not the case. The ABC spoke with 20 victims and all but one had not received a notification or even heard of the attack. The victims said they were either not adequately notified by the organisations responsible for securing their data, or were misled as to the gravity of the breach. The NDIA’s typical and problematic communication with participants renders utterly ineffective, any strategies for actually responding to circumstances of data breaches and cyber security incidences. Notwithstanding that many participants expressed preference is NOT to be called by phone, the NDIA as a matter of course ignores the stated preference of participants, sends anonymous text messages to participants saying that ‘someone’ from the NDIA will call them from a private number - telling participants to answer the phone. This scam-like behaviour of the NDIA exposes participants and their family to unacceptable cyber and privacy risks. Imagine how someone with psychosocial disability or cognitive disability might react to such coercive high-pressure messaging from the NDIA. How would a person ever actually know who these anonymous text messages are from. They wouldn’t

• it’s impossible for them to know and the NDIA has recklessly created a dangerous jeopardy situation for many thousands of at-risk people. Not only has the ABC investigation called into question the NDIA responses to question on the CTARS breach at Senate Estimates, the Agency’s responses at the November 2022 Senate Estimates demonstrates a deep lack of understanding of privacy; the difference between privacy and data protection; and their role as stewards of our private medical, financial, care, and personal details. Given the endemic and intractable problems with lost documents, defective systems, and lack of integrity of the participant record, it is extraordinary that the NDIS Privacy Policy points to the accepted business practice of personal information emailed around (using NDIA email doesn’t reduce the risk), including to board members: ’All our personnel (including staff and contractors), board members and community partners are issued with NDIA email addresses. When we need to use personal information for our business purposes, we will limit this use to only those NDIA personnel, board members or community partners who need to know that information. Where business use requires us to

Addendum to Submission 137

e-mail personal information internally to NDIA personnel, board members or community partners, we will use NDIA e-mail addresses to send that information.’ Such information should not be e-mailed – at all. And questions need to be asked as to why board members are getting personal info of participants (which would also include info about other people). Official email addresses and APIs do not constitute a control framework, nor safeguard the integrity of the participant record. The Agency’s confused commentary on its own Privacy Policy and the Privacy Act, in response to questions at Senate Estimates points to a serious lack of capability and due diligence regarding risk, cyber security, and the protection of information. And the recent Report of the Privacy Act Review[redacted] is likely to present even greater challenges for an Agency so clearly incapable of protecting personal information, across every area of its operations, systems integrity, automated decision-making, roboplans, and algorithms. Pointing to ‘…high-profile data breaches, exposing millions of Australians to privacy risks including identity fraud, reputational damage and blackmail…’, the Privacy Act Review Report calls for: ‘Transparency requirements for automated decisions that use personal information and have a significant effect on individuals are also proposed. Entities would need to provide information about types of personal information used in automated decisions-making systems and how such decisions are made.’ Furthermore, given the widespread cases of harm resulting from the Agency’s own actions and operations reported to this Committee and other forums and Inquiries, it is significant that the Privacy Act Review Report also proposes a direct right of action to enable individuals to seek remedies in the courts for breaches of the Act which cause harm. From what I understand, the design of the new PACE system and overall Agency risk architecture have not contemplated privacy protections – necessary and anticipated privacy protections - of this magnitude. WILL NEW SYSTEMS FIX THIS The answer to this question is NO. And I know this domain with some authority and expertise. There will be a political temptation to point to the ‘new’ Salesforce PACE system as a fix to everything that is busted with the current SAP system. Nothing could be further from reality. Before exploring the question about the ‘new’ Salesforce PACE system, there is further commentary on the scale of the defective systems environment beyond algorithms, lost documents, porous systems, data breaches and cyber security. And this involves two serious examples of defective critical infrastructure: the NDIS Operational Guidelines and the NDIS Price Catalogue. The level of incompetence in these examples is shocking, matching the reckless incompetence of systems, processes and governance, detailed in the preceding discussion. All areas documented in this testimony make a disgraceful mockery of the UNCRPD. The excellent examination of the NDIS Operational Guidelines is documented in the South-West Autism Network JSCNDIS submission.[redacted]

Addendum to Submission 137

This examination shockingly reveals that the NDIS Operational Guidelines are hidden in 508 web pages on an external hidden website. ‘The NDIA has created an external website for the NDIS Operational Guidelines at https://ourguidelines.ndis.gov.au/.’ There is no centralised, integrated menu for the more than 508 webpages located on the site, and being an external website separate to the primary website of https://www.ndis.gov.au/, the site remains unknown to most NDIS participants and families. Concerningly, however, participants and nominees are being expected by NDIA and NDIS Partners in Community to comply with Operational Guidelines which are overly complicated, and without being advised of their existence. The search function is ineffective, and the NDIA continuously add to and alter the webpages at https://ourguidelines.ndis.gov.au/, with no notification being given to participants and families of changes occurring.’

The second example of defective critical infrastructure involves the NDIS Catalogue and the non- delivery of the eMarket.18

The Catalogue, the jewel in the crown, is comprised of extraordinarily dense PDF, word and CSV documents that have no intelligence; not interactive; not explanatory; not searchable; and utterly fail accessibility standards.

The Catalogue is not fit-for-purpose. It is a cadaverous, inert and incomprehensible spreadsheet and text documents with cascading and hidden links; different versions, addenda, and archives nested across dozens of webpages.

This defective critical services infrastructure affects the entire sector and discriminates against every participant.

Clearly, digital government is not meant for people with disabilities and their families.

Questions need to be asked as to why the Catalogue has been left festering for years. The abandonment of co-design is part of the answer.

Against this wasteland of defective and unlawful systems, and reckless disregard of risk, let’s consider then what appears to be on the drawing board with the ‘new’ Salesforce PACE system.

The Committee should not be lulled into the spin that the ‘new’ Salesforce PACE system will sort things out.

More to the point, what is described in project documentation on the ‘new’ Salesforce PACE system appears to be far more than systems change: there appears to be fundamental concepts changing for the Scheme.

Fundamental and sector wide changes involving payments paid in 3 month drops; no draft plan; no service bookings; and uncertainty about goals. Legislative change is likely to be needed for many of these changes.

This raises the question: Is the ‘new’ Salesforce PACE system being unlawfully designed to include features and changes that do not have legislative authority? It appears that the ‘new’ Salesforce PACE system being developed includes major changes to plans and goals. These are not just ‘IT’ changes. These appear to be fundamental changes to the legislated concept of plans and goals.

Addendum to Submission 137

What is the legislative authority for these changes? Is the ‘primary disability’ fiction - which is contradictory to the NDIS Legislation - also being unlawfully designed into the ‘new’ Salesforce PACE system? Similar governance questions such as these have been examined in the RoboDebt Royal Commission. And what is the Budget and procurement authority for the expenditure of public funds, for work on system features that appear to be inconsistent with the underpinning NDIS Act? In addition to apparent breaches of the NDIS Act, have the Budget Process Operational Rules, Commonwealth Procurement Rules, and APS Code of Conduct also been breached – by the expenditure of public funds on system features that are effectively unlawful? All these questions point to a broader capability deficit with the NDIA, of knowledge, skills and experience in Commonwealth public sector governance. Given the Board and Executive turnover, have the risks been adequately identified and modelled to support decision making for such a drastic and high-risk change, with serious consequences for participants and providers. Indeed, does the Board and Executive even have the authority to accept such extreme risk, if known? What happens when something goes wrong, which will happen. What is the system wide change management? How are these changes all together actually going to work? Have participants actually been involved? And not just one or two in a focus group. Evidence from other submissions indicates consultation is tokenistic and there is no co-design. However, it doesn’t appear that participants have been deeply involved and listened to. Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this. I am 100% certain that people will be caught in desperate situations because part of their three-month funding has run out, or they have a lumpy capital cost.WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted? What is the ethics framework informing these decisions? And to cap it all off, is this. The project documentation talks about swapping systems. As if there are only two systems. This is an activity of extreme risk.‘Swapping systems’ was the problem with the initial move from the DSS Oracle system to DHS built current NDIA SAP systems.The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants.‘Swapping’ systems involves data migration, a complex high-risk exercise.Given the earlier discussion on the widespread participant record irregularities and lost documents, will the data migration exercise remediate this?

Addendum to Submission 137

This was the very complex and problematic exercise in the transition to full scheme. Data migration from the DSS Oracle NDIA systems to the DHS SAP NDIA systems; and of course, the extremely disruptive data migration from the States and Territories due to data gaps, errors and incompleteness. Whilst the running of systems in parallel is a strategy used in such transitions, the risk and management overheads are exponential requiring significant resourcing, experience and expertise. As discussed earlier, the problems with this strategy were evident at the 15 February 2023 Senate Estimates, with the Acting Actuary unable to answer questions on forecasts due to ‘reconciliation’ challenges with the new system. I predict that participants will be caught in data migration hell. Get ready for a massive loss of data during this period. It is likely that cyber security and organised crime will be watching and probably acting under the cover caused by such disruption. Worryingly, in the project documentation on the ‘new’ Salesforce PACE system work, there is a comment that ‘we will not go live with defective systems’. It matters not whether it is the DSS Oracle NDIA systems; the DHS SAP NDIA systems; or the ‘new’ Salesforce PACE NDIA systems. The preeminent factor is end-to-end co-design. But co-design was dumped as a strategic capability by the Agency, meaning that the end-to-end risk is unknown, and assumptions remain unchallenged. And this is evident already in ‘on the ground’ trials of the new PACE system in Tasmania that are not going well. Evidence that end-to-end co-design has not happened, is sitting in plain sight on the NDIS website. Lists of booklets and information – specifically about the system trials in Tasmania – inaccessible, unreadable, non-responsive design, not able to be read on a phone. For such critical change management content to be ‘designed’ in this way, there is an inherent assumption that such content is consumed via a computer monitor in a controlled office-type environment. And not as is the case for a majority of people, mobile phones of different models in all sorts of environments using assistive communication. This is disgraceful discrimination demonstrates a lack of competence, a lack of care, and a lack of co-design. Feedback from a participant on the booklets: ‘Oh FFS! They can’t be read on a phone. Is it conceivable that they will ever understand their customers?’ Considerable preparedness and expertise are required in change management, risk management and risk mitigation. There will always be something that goes wrong in such complex change, that’s just a fact. There needs to be a comprehensive plan in anticipation for what happens when things do go wrong, and swift pre-planned action. Who is accountable. And what is the governance. What IS the change management strategy for 500K people? And tens of thousands of providers. Imagine this change for CALD, Indigenous, people with intellectual disability, and people with psychosocial disabilities. The ‘not going live with defective systems’ statement indicates a naïveté and lack of experience - consistent the NDIA’s lack of sophistication in responses at Senate hearings on ethics, privacy and data protection. On the basis of the ‘reconciliation’ problems and information in the project documentation on the ‘new’ Salesforce PACE system, it looks like the whole show is changing – yet the Agency does not appear to understand nor be prepared for, the risk and the enormity of the change.

Addendum to Submission 137

CO-DESIGN

I was responsible for establishing and initiating co-design and have written extensively in previous submissions and in other public commentary of the devastating impact of its abandonment by the bureaucracy.

And notwithstanding NDIA platitudes about co-design, I identified that references to co-design in NDIA corporate documents had mysteriously disappeared. It was the intervention of this Committee in its report on Independent Assessments, that directed legislative change to include co-design ‘so that it never disappears again’ thus forcing the NDIA to revert.

All capability deficits discussed in this and previous submissions, including cyber, safety and risk, are due to the abandonment of co-design and the unconstrained over-reach of the actuarial function.

Everything I predicted would happen, has happened because of this.

Co-design is a strategic governance capability grounded in ethics. Co-design is not about making things look pretty, via periodic or select activities.

End-to-end co-design is necessary to understand risk, hand-offs, and challenge assumptions. Every aspect of NDIA operations without exception – including actuarial initiatives - must be co-designed.

As stated earlier, end-to-end co-design is necessary to map the data lifecycle.

By urgent necessity, this will involve building up internal APS capability – not consultants – led by people with disability.

The co-design capability must be resourced to at least the same degree as the actuarial function – which is a team of more than 200 professionals according to the Acting Actuary’s LinkedIn profile.

Imagine what could be achieved with a permanent NDIA APS staff of 200 co-design professionals undertaking ongoing end-to-end co-design of every aspect of NDIA operations – including internal NDIA operations with staff with disability.

Together with matched resourcing of the actuary and co-design capabilities, there must be matched governance authority embedded in legislation.

It will be the co-design governance authority that will be the pre-eminent determinant for rebuilding the NDIS, retrieving trust, and remediating data integrity.

SUMMARY

My daughter is terrified to contact the NDIA and is in fear of re-suffering the trauma. And I am haunted by this experience.

My daughter’s traumatic experience with the NDIA has adversely impacted every aspect of her life; her sons; her husband; her father (my husband) who is a heart patient with disability; and myself.

The fact that I anticipated the trauma that my daughter would face and contemporaneously documented her horrific journey, demonstrates that her experience was not a one-off, but absolutely the predictable and only possible outcome from such a defective system.

This is the case for literally hundreds of thousands of people.

There would be perhaps few other NDIS applicants or families who would have the insight at the beginning of their journey to make such detailed documentary recordings from the outset.

I knew what would happen and I am haunted by this knowledge and foresight.

My daughter has stated that dealing with the NDIA has damaged her mental health to the worst it has been in more than ten years. This is the impact of ‘averaging’ and the outcome of roboplans.

Addendum to Submission 137

After so many appeals, lost documents, extreme safety risks, data security breaches, the never-ending cycle of re-submitting reports that have been lost, and the always present threat and dread of the withdrawal of supports, we are out of time. As described in this submission and by a great many other people, there are catastrophic and additive defects in every area of NDIA operations and operating model. People with disability and their desperate families seen as soft targets by predators; intractable cyber security exposures; defective and porous systems; continuing and unresolved data breaches; lost documents; and exploitation by organised crime in the order of billions of dollars. Added to this chaotic risk environment, is the unlawful use of powerful algorithms without governance - similar in practice to RoboDebt - resulting in the catastrophic withdrawal of funding creating risk to life. Any cyber infiltration of this enormously complex and chaotic environment - in an Agency of such deep capability and cultural deficits - would likely go un-noticed. Because of this, the NDIA/NDIS would have to be considered a national security risk. Given this extraordinarily complex risk environment - created through reckless incompetence - it is alarming that the NDIA’s own Agency Security Plan (September 2020, obtained under FOI) states that ‘security is not a primary function’ (page 19) and ‘…the Agency is a low-risk Agency…’ (page 32). In what possible scenario could: o Immediate risk to life, causing harm and death. o Unlawful operations and practices. o Porous defective systems. o Serious cyber security. o Data breaches and systemic loss of documents and medical information. o Mega outsourcing and contracting conflicts of interest. o Escalating political and financial impact on the Federal Budget. o And the penetration of organised crime. …ever be considered ‘LOW RISK’? This is the Agency’s own demonstration of the depth of its capability deficit and recklessness. A capability and culture incapable of understanding the consequences including the risk to life, of multi-factor multi-vector systemic risk. An Agency that can’t explain ethics: in fact, has no ethics framework. Becomes muddled over privacy. And cannot explain data protection. An Agency that abandoned co-design; was forced to revert; and yet even with all the political controversy and UNCRPD implications over co-design, still could not explain it at the February 2023 Senate Estimates. An Agency with such profound capability deficits, nevertheless aggressively adopted defective Robo algorithms that cannot be explained. This collapse in capability is almost entirely due to the gutting of public sector resourcing; the transfer of funding to and the pernicious dependence on consulting firms; multi-billion-dollar outsourcing; and system wide conflicts of interest. But I am not the only one pointing this out. Indeed, the JSCNDIS has received excellent and highly detailed submissions from other global and Australian experts and advocates.

Marie Johnson 22

Addendum to Submission 137

And what of the Independent Review?

The Independent Review team are good people. However, the Independent Review governance is insufficient. The Review team cannot provide Parliamentary Privilege - which is why I am providing this testimony to the JSCNDIS. It is also not clear how and if Whistle-blower protections apply. There are people in the bureaucracy, ex-public servants, and those who work for providers, who might want to provide evidence, but are reluctant to do so due to concerns about protections.

The issues with the NDIA/NDIS are so deep and so hidden, that a Royal Commission is necessary with the powers to compel the production of confidential documents otherwise withheld by FOI and secrecy; the power to compel witnesses; the power to provide legal protections; and the power to refer for criminal and National Anti-Corruption Commission investigation.

Fraud investigations and task forces whilst necessary, are after the fact. Contract arrangements as currently constructed are part of the NDIA capability distortion, and given the multi-billion-dollar honeypot, need to be scrutinised by the National Anti-Corruption Commission.

For those of us who have worked on the inside know that what is being revealed at the RoboDebt Royal Commission, mirrors what is happening with the NDIA/NDIS. But it is no accident and should be no surprise that Robo practices – RoboPlanning and RoboDebt practices - have become embedded in the NDIA. RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government automation strategies driven by DHS, now Services Australia. Same bureaucracy. Same people. Same methods. Same systems. Same fictions. Exactly the same.

And what is being revealed, is only coming to light as a result of the powers of a Royal Commission, triggered by years of community activism led by remarkable individuals; the RoboDebt Class Action; and the Federal Court decision on unlawfulness. In all of this, suicide and untold harm suffered by hundreds of thousands of Australian citizens at the hands of its own government and bureaucracy.

It is my combined lived experience and professional view, that the NDIS/NDIA requires complete re-engineering; legislative reconstruction involving the limitation of the Actuary function counter-balanced by the matching co-design resourcing and governance authority; and scenario risk analysis, driven by end-to-end co-design. Judicial oversight is necessary to ensure that the unlawful actions and human rights violations can never be orchestrated at scale again. Board governance is insufficient. But this will only be possible with the deep evidence base arising from a Royal Commission. Without complete re-engineering, the national security, data security and organised crime risks become intractable, undermining the sustainability and integrity of the Scheme. The risk to life becomes unacceptably extreme.

The Labor Government stated that the RoboDebt Royal Commission was necessary to ensure RoboDebt never happens again. Well, it is still happening. RoboNDIS. There can be no ‘learnings’ from the RoboDebt Royal Commission alone - the ‘learnings’ will only come when the combined common RoboDebt + RoboNDIS malfeasance is confronted - and people are brought to account - for BOTH.

Marie Johnson 23

Addendum to Submission 137

Then the big question. How was the combined common RoboDebt + RoboNDIS malfeasance allowed to continue for years? The only way to fix the NDIA/NDIS, is via a Royal Commission into the NDIA. But given the common bureaucratic and technology lineage, the extension of the RoboDebt Royal Commission into a Royal Commission into RoboNDIS would be an opportunity to consider the full ramifications in context. However, there is immediate action the government can take and needs to take. There is no need to wait for the findings of the Independent Review, or political triggers for a Royal Commission. The cessation of roboplanning - and the reinstatement of all cut funds - should happen immediately as an urgent action to safeguard life. This scaffolding will provide NDIS participants with some certainty about their lives, while in parallel, the new simplified NDIS/NDIA is built. But we are not waiting. We have run out of time, and we have suffered too much harm. The NDIS Class Action effort is underway. We see this is our only pathway to justice. I would like to thank the Committee for conducting this important Inquiry, and for providing me with the opportunity to make this testimony.

Marie Johnson Date: 3 March 2023

---

Marie Johnson 24