Senate Standing Committees on

Community Affairs Inquiry

National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.

1. Bill 2024 [Provisions]

Ignoring the Risk of the Lack of Capability

Submission By

• Ms Marie Johnson
• CEO
• Centre for Digital Business Pty Limited

Table of Contents

• Table of Contents
• Background: Marie Johnson
• Executive Summary
• A Lack of Capability to Implement
  • Joint Standing Committee on the NDIS
    • Similarities Between RoboDebt and RoboNDIS
  • Australian National Audit Office Reports
    • Management of Complaints by the National Disability Insurance Agency, 22 April 2024
      • Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports, 28 June 2023
• Defective Systems, Data Breaches and PACE
  • Disrupted Payments Impacting Participants and Providers
• An Impossible Rollout of a Defective System the Whole “New” NDIS is Dependent On
  • Data Migration and Critical Functionality Gaps
  • Unknown and Uncapped Costs of PACE
• Algorithms: The Budget Calculation Instrument ~ a Recast of the Dumped Centrelink $200 million Entitlement Calculation Engine (ECE) and the Dumped $250 million Home Affairs Permissions Capability Platform?
• Section 10: No Obligation for Australia to Adhere to the UNCRPD
• Psychosocial Disability and Mandatory Assessments
• References
• Attachment A
  • Submission by Marie Johnson, Submission 137 Attachment 1, Supplementary Statement, 3 March 2023. JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA)

Background: Marie Johnson

I am the CEO of the Centre for Digital Business, a digital services and AI company.

I am recognised as an eminent global award-winning digital authority; advocate for the humanitarian application of AI; and a relentless inclusion and accessibility advocate. I am an international speaker, author, and commentator on artificial intelligence, human rights, technology, ehealth, cyber, identity, ethics, and innovation.

I am the author of the best selling book “Nadia: Politics | Bigotry | Artificial Intelligence”.

I was the recipient of the prestigious US Government O-Visa for Individuals with Extraordinary Ability or Achievement, in 2005 to take up my role leading Microsoft’s Worldwide Public Services and eGovernment industry based in Seattle. In taking up this role, the US Government awarded the O-1 Visa, with Microsoft noting “…Marie’s egovernment knowledge is unique in the world and is of particular interest to Microsoft as we pursue our egovernment strategies’

Throughout my career, my deep expertise has been sought by world leaders and global organisations on the geo-political and democratic dynamics of national technology.

At the forefront of digital transformation for decades, literally since the early days of the Internet, my track record across the public and private sector in Australia and internationally, covers health and human services; disability services; global ehealth immigration and visa systems; tax; identity; and payments.

The expanse of roles includes large scale service delivery operations; global technology; advisor to governments globally; Chief Information Officer; Chief Technology Architect; Technology Authority; intelligence analyst; board director; and STEM patron.

In the early 1990’s I worked in intelligence and analysis areas in the Department of Defence. In the mid 1990’s, I led the intelligence unit of an organised crime task force, at the National Crime Authority, Melbourne Office.

In the late 1990s, I led the strategic intelligence and revenue forecasting unit, and one of Australia’s first e-business projects at the State Revenue Office (SRO) of Victoria with the implementation of epayments and the investigation of the impact of credit card merchant fees which would be associated with epayments. The e-business project was recognised as one of the world’s first successful e-business projects, and was developed into a case study for an international executive program managed by the Melbourne Business School and INSEAD (France).

In the year 2000, I led the Business Entry Point in a task force partnership with the Australian Tax Office to deliver the ABN registration for millions of Australian businesses in the lead up to the introduction of the New Tax System in the year 2000. Over the past twenty-five years, this has been recognised as the most significant and successful digital achievement in Australian history.

For many years, I was the Chief Technology Architect for the Australian Department of Human Services, with responsibilities including the architecture and technology business cases bringing together the massive systems of Centrelink, Medicare Australia, and the Child Support Agency. I was responsible for

Page 4

initiating Payment Delivery Reform, as part of Service Delivery Reform, and led in collaboration with the Reserve Bank of Australia, industry consultation on ‘Innovation in Payments and Information Services’. Previously, I was the Chief Technology Architect for the billion dollar Australian Health and Human Services Access Card, building international expertise in the application of biometrics to service delivery including in healthcare.

My advocacy and expertise in identity and payments was influential in the 2014 Australian Financial Systems Inquiry recommending the need for a federated digital identity framework as a critical element for the future robustness of Australia’s financial systems.

In a major service delivery transformation role at the Department of Immigration and Citizenship, I created and delivered the Visa Pricing Transformation, which generated interest globally from friendly counterpart Immigration agencies. For the first time, this involved the application of differential pricing to visas, channels, visa products in conjunction with an innovative digital business model, electronic payments strategy and legislative change, projecting additional revenue to the Federal Budget of $700million. Responsibilities also encompassed the delivery of the global eMedical system (a digital operating model for managing risk-based health assessments) to over one hundred countries, in partnership with citizenship and immigration Canada.

I am the former Head of the NDIA Technology Authority. In writing this submission, I am drawing on my somewhat unique experience: of lived experience supporting family with disability in addition to my depth internal knowledge and experience.

I was responsible for the business case for the NDIS ICT systems, and for this to be based on co-design and the principles of the UN Convention on the Rights of Persons with Disabilities. I was responsible for the implementation of co-design, a program of innovation and the creation of Nadia. Co-design would later be abandoned by the Agency.

I have an exceptionally deep knowledge of the NDIS processes, and the NDIS ICT system which were delivered by DHS. I have a deep understanding of NDIS capability, operating model and culture. I also have considerable operational knowledge of the cross government capability, systems and architecture on which the NDIS is dependent.

Various board and advisory roles include Independent Member of the Australian Federal Police Spectrum Program Board; member of the New South Wales Government Digital Government Advisory Board; invented member of the Accenture Global CIO Council; National Director of the Australian Information Industry Association; and Faculty at Exponential Medicine Singularity University.

I was an inaugural Member of The Australian National University Cyber Institute Advisory Board.

Over many years, I have been a judge on Australian and international technology and innovation awards. I’m a writer and regular contributor to a variety of media publications, including InnovationAus and CIO Australia, and I’ve authored chapters for books, and authored and co-authored international papers. I was one of forty Australian innovation leaders and foremost thinkers invited to write a paper on the future of Australian jobs and industry, in the first publication of “The Innovation Papers”.

I am an in-demand international keynote speaker and sought-after participant on podcasts and webinars.

Marie Johnson 4

Amongst these, in 2019, I was faculty at Singularity University Exponential Medicine (San Diego); I have spoken at MEDICA, the world’s largest medical and health trade fair; and O’Reilly AI in London. In 2020, I delivered the 2020 Kenneth Jenkins Oration.

The innovation and digital initiatives I have led have been recognised globally. These include the United Nations Public Service Award in the category “Application of ICT in government: egovernment” for Business Entry Point (www.business.gov.au) which I led for 5 years prior. In 2006-2007 “Innovative CIO of the Year – Australia”; 2013 named one of Australia’s “100 Women of Influence”; and awarded the “Exceptional Woman of Excellence” at the 2019 Women Economic Forum, the largest gathering of women entrepreneurs & leaders worldwide. In 2021, I was the Patron of the Tech Girls Movement Foundation.

In 2022, I received the Australian Capital Territory Mental Health Carer Award.

Qualifications: MBA from the Melbourne Business School (specialising in innovation, technology, and ecommerce); Bachelor of Arts Deakin University (international relations, defence, and strategic studies); Graduate of the Harvard University Kennedy School of Government Senior Executive Fellows Program; tertiary studies in law at Deakin University; and a Graduate of Australian Institute of Company Directors.

More Information: www.marie-johnson.com

Marie Johnson 5

Executive Summary

My focus of this submission is the NDIA’s lack of capability to implement, and the consequences of a Bill that recklessly ignores this fact.

As the former Head of the NDIA Technology Authority, and as an advocate for family interacting with the NDIA, I predicted the devastating impact that the NDIA’s defective culture, systems and processes would have on my family. For more than seven years, I have made submissions to various JSCNDIS inquiries and other inquiries, drawing on my expert internal knowledge, predicting problems and crises with the NDIA/NDIS that would eventuate. I refer to the specifics of these throughout this submission, which are relevant and as a caution to this Bill. My submissions and articles are listed in the References to this submission.

This Bill ignores the lack of capability of the NDIA to implement, and yet is built on untested assumptions of automation. And while the NDIS Review sets out a five-year timeframe for reform, while also bizarrely ignoring the NDIA’s lack of capability to implement, many of the items within this Bill are needed to allow for those changes to take place. This is an insurmountable disconnect.

With such an enormous nation-wide implementation, transition and change management effort proposed without any understanding of the risk of implementation, transition and parallel operations, the current defective capability of the NDIA as examined in JSCNDIS reports, ANAO audit reports, FOI documents, and submissions to other inquiries referenced in this submission - paints a national risk to all governments, Commonwealth, State and Territory, and of course, above all, risk to life of NDIS Participants.

To reiterate. Just six months ago, the JSCNDIS Report into the Culture and Capability of the NDIA documented overwhelming complexity and evidence of a lack of NDIA organisational capability significant cultural and capability deficits, including unlawfulness. An adversarial culture that traumatises people; and practices that are incompatible with the UNCRPD.

Also examined in detail in this submission are ANAO Audit Reports over the past year, on critical aspects of risk and data security. The 2024 ANAO Audit Report showed that the NDIA’s complaints management process utterly fails to correctly identify and record risk, in a process inherently about risk. Complaints are not about not being happy; complaints are about risk, and this is the primary interface through which risk can be alerted. This is a systemic failure of the NDIA failing to comply or apply the NDIS Risk Management Rules 2013.

The 2023 ANAO Audit Report is also damning of the NDIA over critical deficiencies regarding risk management, systems controls, payments integrity and performance analytics. I provide detailed commentary based on these ANAO Audit Reports and FOI documents, of the NDIA’s worrying lack of command of data security.

Throughout this submission, I describe the systemic issues relating to defective systems, including PACE payment disruptions; data breaches; the use of defective algorithms, and I challenge the assumption inherent in this Bill that everything can be automated. I recap on my predictions that have been borne out: this is relevant because the scale of chaos and disruption that is currently happening was predicted in exacting detail and I cite these from previous submissions.

Page 7

This is an organisation that for the best part of a decade has been assessed as having intractable capability deficits and defective systems; a proposed five-year implementation and transition that would also be run in parallel with maintaining the defective BAU SAP CRM legacy systems. And as described throughout this submission - and predicted in previous submissions - the four year old “new” PACE system, not yet delivered, is also defective. There will be multiple defective systems in play.

This is not simply a “new computer system”, but a fundamental change to the foundations of the NDIS introducing new processes and concepts - not yet legislated - in a sector wide change that impacts the lives of more than 600,000 Participants, thousands of providers, and hundreds of thousands of people working in the NDIS ecosystem.

For a Scheme that has administered hundreds of billions of dollars over the past decade, there has been very poor attention given to building a high integrity highly resilient payments capability. In the 2016 Transition to Full Scheme, the “swapping systems” caused payments disruption to the whole sector: The difference now is there are 20X more Participants. In addition to sector wide payment disruption in 2016, two critical functions were abandoned by the NDIA with disastrous impact lasting a decade: codesign and the Service Delivery Operating Mode (SDOM).

The lessons from 2016 have not been learnt; I was there; and the post transition report is a sobering must read. The NDIS is at this very precipice yet again.

If we look forward another 10 years - which we must - many more hundreds of billions of dollars will pass through these systems. Given the defectiveness of these systems and processes, this is an extraordinary isk to the budgets of all Australian governments, Commonwealth, State and Territories.

The reason why this discussion is relevant to the consideration of the Bill, is that the NDIA clearly does not have the capability to retrieve itself from the deep crisis it is in, let alone launch itself into a five year “transition”, into a complex undefined and unknown future state, that this Bill proposes.

In the body of the submission, I examine in some detail the concept of the proposed Budget Calculation Instrument. I ask the question:

“Will this Budget Calculation Instrument be a recast of the Services Australia $200 million Entitlement Calculation Engine (ECE) that was dumped by this government, by Bill Shorten as Government Services Minister?” Will it be a recast of the dumped Department of Home Affairs $250 million “Permissions Capability Platform”?

All three are essentially the same concept. And why would the government expect a different outcome for the NDIA Budget Calculation Instrument, where half a billion dollars has already been wasted by Services Australia and Department of Home Affairs on abandoned attempts at the same concept.

These are the catastrophic risks emanating from a Review and a Bill, theorising a concept without any regard for actually what is involved in implementations; or more correctly, ignoring the lack of capability to implement.

And in the hazardous era of algorithms, this Budget Calculation Instrument proposal cluelessly showcases a world first. This Bill puts an algorithm (the Budget Calculation Instrument) - yet to be defined

• beyond the reach of administrative review. This submission cites cases in other jurisdictions, where the application of algorithms in administrative decision making in relation to funding, created risk to life and resulting in death.

My prediction is that with such profound organizational cultural and capability deficits, combined with the extraordinary powers to be vested in the CEO, implementation will fail; Participants will suffer harm; and the NDIS will implode.

What does this look like?

The narrative will shift from ‘“financial sustainability“ to a volatile political and bureaucratic posture reacting to an out of control crisis of system wide harm. Payments will be disrupted and erratic; services suspended or stopped; administrative data breaches, data defects, and lost documents will escalate uncontrollably. This system now under unnecessary extraordinary duress, will be preyed upon by cyber and other criminals. No amount of money spent on smart fraud detection systems can reverse or stop that which is recklessly set in train. People will suffer harm, and face risk to life. This is already happening, as evidenced by the horrific cases on the robondis.org website, escalating complaints, and out of control backlogs. The State and Territory governments - having part-funded the NDIS for a decade - will be forced to step in.

To emphasise, I obviously do not want this to happen and I’m extremely concerned for my family, but equally, I am not catastrophising.

I say this as someone with family dependent on the NDIS; as a person with deep internal knowledge of the NDIA NDIS, Services Australia and the systems across government; as someone whose commentary has been referenced in JSCNDIS and other reports; and as someone globally recognised for their expertise in technology and AI. I know what I am observing from decades of experience; a depth of expertise in the complex systems of government and the economy, beyond any officer currently in the NDIA. I have no vested interests.

What is proposed in this Bill, requires a high performance skilled customer focussed human workforce capability; optimal systems performance; strong and regulated data integrity; clear, consistent and documented business processes; and payment integrity to the level of Australia’s financial systems.

What is required is compliance with UNCRPD; and a culture of co-design, safety and trust.

None of this exists. The NDIA is not and has never been fit for purpose. The NDIA does not have the capability and certainly is not fit to execute the implementation of the scale of changes proposed in this Bill.

This defective Bill, which is inconsistent with Human Rights, should be dumped because the naïveté around implementation is a national security risk, as I stated in my JSCNDIS submission (Attachment A). That is only found out when it’s too late.

Certainly, the drafting of this Bill under the secrecy veil of Non-Disclosure Agreements with industry stakeholders fundamentally undermined the trust of Participants and advocates, and exposed the “commitment to co-design” as nothing more than political and marketing theatre.

Marie Johnson 8

The Agency would have a different view, but a decade of reviews and inquiries, evidenced from many thousands of submissions, paints a devastatingly contrasting picture.

Recommendations

e 1. This Bill must be rejected.

e 2. NDIA to cease work on the PACE system, pending ANAO and NACC examination.

e 3. NDIA to reinstate the Service Delivery Operating Model, which was developed in 2016 then abandoned. The ANAO Audit Report National Disability Insurance Scheme - Management of Transition of the Disability Services Market referenced the SDOM. And the 2016 Transition to Full Scheme systems implementation review, which examined the sector wide payment disruption, recommended the SDOM be reinstated.

Marie Johnson 9

A Lack of Capability to Implement

Joint Standing Committee on the NDIS

In light of what’s now in front of the NDIA in terms of the wholesale recasting of the NDIS this Bill presents, the findings of the JSCNDIS Report into the Culture and Capability of the NDIA - just a mere six months ago in November 2023 - are alarming. And it is shameful that the operations of the NDIA itself were not part of the Terms of Reference of the NDIS Review.

The JSCNDIS Report into the Culture and Capability of the NDIA, documented overwhelming complexity and evidence of a lack of NDIA organisational capability, including co-design and communication; a lack of staff knowledge of the NDIS and disability conditions; an adversarial culture that traumatises people; and practices that are incompatible with the UNCRPD. This after a decade of operation.

One of the most significant and troubling findings was that the administrative construct of “primary disability” was not consistent with the NDIS legislation. Effectively, the NDIA has been operating unlawfully for 10 years.

“2.29: The NDIA’s distinction between ‘primary disability’ and ‘secondary disability’ has no basis in its governing legislation or the reality of Participants’ lives. This section will consider the impact that this imposed differentiation, which operates as a form of discrimination, has on Participants. As a starting point, it can result in Participants being denied supports for impairments that the agency determines are not related to their ‘primary disability’.”

An administrative convenience

“2.30: Legal precedents confirm that there is no legislative basis for distinguishing between ‘primary disability’ and ‘secondary disability’. It would, therefore, appear to be an artificial distinction that the NDIA has introduced and imposed.’”

Similarities Between RoboDebt and RoboNDIS

The similarities between RoboDebt and what has become known as RoboNDIS, were evidenced at the JSCNDIS Inquiry, with the RoboDebt Royal Commission having reported during the period of the JSCNDIS inquiry.

“2.162: It was suggested that a culture has developed within the NDIA to prioritise cost-cutting above participant wellbeing. Some submitters associated this experience with a perception that people accessing any government social welfare funding are viewed with skepticism and mistrust. Consequently, many participants leave interactions with the agency feeling that their integrity has been questioned and treated as though they are seeking to defraud the public. These concerns were borne out in the Royal Commission into the Robodebt Scheme, which received evidence that ’[t]here is an enduring assumption that all persons on welfare or pension payments are potential or actual cheats.”

Marie Johnson 10

Page 11

“2.212: A key recommendation of the Royal Commission into the Robodebt Scheme (Robodebt Royal Commission) was that policies and processes be designed with emphasis on the people they are meant to serve…”

“2.213: These recommendations are applicable to the capability and culture of the NDIA. Throughout the inquiry, submitters have questioned whether the NDIA’s policies and processes are actually designed to serve their primary client, the participant.‘’

Additional Comments by the Australian Greens

“1.1: It is deeply concerning that the NDIA has not, in some instances, fulfilled the promises of the NDIS Act or Australia’s international commitments. Additionally, it is disappointing that many of the same systemic problems continue to be raised through inquiries, indicating a lack of strong and immediate action from the Australian Government.”

“1.14: Several submitters likened NDIA processes and practices to those implemented under the Robodebt scheme. For example, a submitter with ME/CFS was alarmed at reports of government officials who had worked on the Robodebt scheme taking up positions with the NDIA’s compliance division:

It seems that the same tactics used for Robodebt have been applied to the NDIA, resulting in harm to the most vulnerable members of our community and depriving them of the necessary support to enhance their quality of life.“

“1.15: The inquiry heard evidence from Ms Marie Johnson warning of risks to participants caused by automated technologies:

Algorithms based on ‘behavioural insights’ create a fiction, a persona comprised of assumed or typecast features whose fictional behaviours are used as a proxy in order to predict behaviours of real people, and for this prediction to be treated as fact. It makes huge generalisations, reductions and determinations on complex human conditions, experiences, and disparate factors … The NDIS legislation specifies that PLANS are INDIVIDUALISED and directed by the participant. That facilitates tailored and flexible responses to the individual goals and needs of the participant. The application of statistical averages in automated Roboplanning eliminates the individual person and their needs, transmuted instead to a fictional average, a fictional ‘persona’.’“

“1.16: Another submitter called on the NDIA to immediately cease any use of algorithmic technologies or automated decision-making with participants. They indicated that the NDIA should instead focus on creating individualised plans for each participant: It is inhumane, unjust and dehumanising … Factoring in discriminatory information like my age, disability and what the NDIS think is my level of functioning into a computer program to lump me with other ‘like’ people into a pigeonhole entirely for the convenience of a ‘system’ is profoundly offensive … I’ve never met anyone like me because there is no-one like me.”

With such extraordinary god-like powers to be vested in the CEO, there is the risk that future NDIS operations will see an expansion of similar “administrative convenience” devices executed via algorithms,

Marie Johnson 11

presenting an unacceptable risk to current and future NDIS Participants. As detailed in the section “Algorithms: The Budget Calculation Instrument”, implementation via algorithm is an inherent and fallacious assumption underpinning this entire Bill.

To reiterate. Just six months ago, the JSCNDIS Report into the Culture and Capability of the NDIA, documented overwhelming complexity and evidence of a lack of NDIA organisational capability, including code-sign and communication; a lack of staff knowledge of the NDIS and disability conditions; an adversarial culture that traumatises people; and practices that are incompatible with the UNCRPD. The JSCNDIS also heard of a lack of transparency and ineffective communication with regard to the NDIA’s complaint’s mechanism, eroding trust amongst participants.

This after a decade of operation. And yet, the government would have the Australian public believe that the NDIA - just six months later - is equipped to handle the most complex and risky of implementations affecting every State and Territory government and 600,000 Australians.

Australian National Audit Office Reports

The following recent ANAO Audit reports into aspects of the NDIA’s operations, provide evidence of systemic mismanagement of risk, and evidence that challenges the assumption that the yet undelivered and highly problematic PACE system will address all defective data, systems and processes.

Management of Complaints by the National Disability Insurance Agency, 22 April 2024

One of the most concerning references in this 2024 ANAO Audit Report, relates to the management of risk. Or rather, the systemic mismanagement of risk, and evidence of the NDIA failing to comply or apply the NDIS Risk Management Rules 2013.

Figure 2.2 reproduced below, reports the NDIA results of post completion quality checks. Highlighted is the identification and recording of risk.

Marie Johnson 12

Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports

Given the massive number of complaints from Participants (28,951 in 2022-2023), this is an extraordinary report identifying that risk was correctly identified ZERO percent on a number of occasions; and less than ten percent on multiple occasions. The seriousness of this cannot be overstated. Complaints would include harm and risk to life, including multiple complaints from the same complainant given the complaint had not been addressed and the risk to life persisted.

In my own submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (reproduced in full at Attachment A), I detail my own family’s experience in such a situation. I also reference other public cases.

The point I am making here, throughout this submission and in previous submissions, is that the NDIA has a systemic capability deficit regarding risk. There is no “risk to life” in the risk register, that is, risk to life resulting from the NDIA’s own operations. The NDIA’s complaints management process utterly fails to correctly identify and record risk, in a process inherently about risk. Complaints are not about not being happy; complaints are about risk, and this is the primary interface through which risk can be alerted. This is a systemic failure of the NDIA failing to comply or apply the NDIS Risk Management Rules 2013.

Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports, 28 June 2023

The year prior to the 2024 ANAO complaints audit (discussed above) which graphically illustrated the almost complete breakdown on risk recording by the NDIA, the 2023 ANAO Audit Report on the NDIA’s Management of Assistance with Daily Life Supports, was damning of the Agency over critical deficiencies regarding risk management, systems controls, payments integrity and performance analytics. It was also noted that there were seven out of nine recommendations made by the Auditor-General in prior audits, relating to improved decision-making controls and fraud controls, not fully implemented.

Once again, the reason why this discussion is relevant to the consideration of the Bill, is that in the past year alone - after a decade of operations - the ANAO and JSCNDIS continue to find deep and persistent capability and performance deficiencies in the very areas the Bill is dependent on. We have a defective Bill, incompatible with human rights, dependent on defective systems.

A synopsis of the findings of the 2023 ANAO Audit Report follows in the box below.

Risk of Fraud

• ICT controls aligned to policy requirements for planning decisions have not been implemented.
• The frequency and rigour of NDIA’s assessment of fraud risks is insufficient given it has assessed the fraud risk associated with the agency’s activities to be high.
• The risk assessment that informs the overall risk rating assigned to fraud risks is not documented.
• The NDIA Board does not have adequate oversight of fraud risk.

Lack of ICT Controls: Systems Access

Combined with the lack of ICT controls for accessing participant records, staff controls represent an

• area of risk, especially for plan delegates.

• Between February 2022 and February 2023, 255 NDIA staff had access to the Centrelink mainframe. The documentation and governance for NDIA staff access to Centrelink systems is inadequate to ensure the appropriateness of NDIA’s access to and use of the sensitive data in Centrelink’s mainframe system.

• NDIA does not have processes to identify inappropriate access to participant records. Recommendation no. 6: mandatory business practices and ICT controls to restrict access to participant records that relate to a real or apparent conflict of interest reported to NDIA; and ICT controls to log all access and amendments to participant records in CRM and PACE.

Lack of ICT Controls: Recording Reasons …indicates a low level of compliance with the NDIA’s requirement to document that reasons for decisions were communicated to participants.

…previous audit found a lack of an ICT control for the recording of reasons for decisions to decline requested supports. In 2022, the NDIA amended CRM to support recording of reasons for declining requested supports and automating the inclusion of such reasons in decision letters, but did not implement the enhancement. NDIA advised it did not implement this change due to the development of the PACE system

Inadequate System Controls: Payments NDIA has inadequate system controls for claims for payment, in particular, from self-managed participants.

High Risk of Single Delegate Approvals The ANAO’s 2021–22 financial statements audit identified that NDIA sampling does not take into account the potential high risk of single delegate approved plans in its sampling methodology and also recommended that NDIA consider system driven validation for payments for self management participants.

Aligning Policy and Systems Requirements ICT controls aligned to policy requirements for planning decisions have not been implemented.

The NDIA stopped updating the existing CRM system in March 2022 to support aligning policy and systems requirements for the introduction of PACE.

Inadequate Reporting The NDIA does not routinely report on Assistance with Daily Life (ADL).

Lack of Analysis NDIA collects comprehensive data but does not undertake analysis of trends or outcomes to inform service improvement. The ANAO saw no evidence of plans for ongoing data linkages which could inform assessment of participant outcomes.

Assessment of outcomes: There is no analysis of the results or details of business processes changed in order to improve overall performance.

The NDIA does not use this reporting to inform an assessment of overall trend analysis and to drive continuous improvement.

According to the 2023 ANAO Report

According to the 2023 ANAO Report, the NDIA stopped updating functionality in the current SAP CRM system in March 2022 to support aligning policy and systems requirements for the introduction of the new PACE system. This was ahead of the national rollout of PACE, which would commence in September 2023. So it would appear that for more than a year, reporting functionality may not have been supported or did not exist in either the SAP CRM or the new PACE system. If this is the case, this is a serious governance and safety situation.

The discussion in the section “Data Migration and Critical Functionality Gaps”, also indicates that updating performance reporting functionality in the SAP CRM had ceased, pending the introduction of reporting functionality in PACE - this reporting capability gap resulting in a 6 to 9 month absence of performance data available for Senate Estimates oversight. So functionality in the SAP CRM ceased to be supported, notwithstanding that similar functionality in the PACE system was not yet available.

In many of the responses by the NDIA to the 2023 ANAO Audit Report regarding PACE functionality, the NDIA used generic non-time specific phrases such as “will be” or “would be”, including ICT controls supporting payment compliance. In Senate Estimates in March 2024, when questioned as to when reporting functionality would be available, the NDIA still could not be definitive, but “hoped” next quarter.

There are questions to be asked as to all the capability gaps as a result of the discontinuance of support of functionality in the SAP CRM when functionality in PACE is not available. Who made these decisions - that it was OK to have lingering gaps in critical functionality - and for what period of time have such functionality gaps existed?

As I explain throughout this submission, these critical capability deficits and defective systems combined with what this Bill proposes, present an existential risk to the NDIS. And these deficiencies cannot simply be overcome by a “new computer system”. Indeed, the “new computer system” (PACE) itself is defective, and as if the situation couldn’t get any worse, serious capability gaps between the two defective systems (SAP CRM and PACE) appear so significant that performance oversight of the Agency is affected.

In the next section “Defective Systems, Data Breaches and PACE”, I piece together a daisy chain of issues and evidence regarding NDIS data security, revealed through various FOI, AAT, ANAO, and Parliamentary and Senate Inquiry processes, that clearly shows a worrying lack of command by the NDIA of the complexity of NDIS data security of which it is the custodian.

Once again, the reason why this discussion is relevant to the consideration of the Bill, is that the NDIA clearly does not have the capability to retrieve itself from the crisis it is in, let alone launch itself into a five year “transition” into a complex undefined and unknown future state that Bill proposes.

Defective Systems, Data Breaches and PACE

In my March 2023 submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A), I stated that from my experience having run large operational systems across government, the NDIA systems and processes are the most defective and dangerous in government. I have made predictions about risk to life, the disruption to Participants’ plans, planning chaos, data defects, data breaches, and sector impact, that would occur with the haphazard introduction of PACE that

Co-Design

In my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A), I explained in considerable detail, the purpose and practice of co-design, and the operational and human impact of the decision by the Agency to abandon it. Whilst I note that in recent times a co-design branch within the Agency has been established, this does not mean that an effective co-design capability exists or that co-design has been happening. The very fact that this Bill was subject to Non-Disclosure Agreements with certain stakeholders, is evidence of this.

The Bill itself contains zero mention of co-design.

Co-design is a strategic governance capability grounded in ethics. Co-design is about how things work: co-design is not about making things look pretty, via periodic or select activities.

End-to-end co-design is necessary to understand risk, hand-offs, and to challenge assumptions. Every aspect of NDIA operations without exception – including actuarial initiatives - must be co-designed. And the only way to map the end-to-end data lifecycle, is through end-to-end co-design.

All capability deficits discussed in this and previous submissions, including cyber, safety and risk, are due to the abandonment of co-design and the unconstrained over-reach of the actuarial function. Everything I predicted would happen, has happened because of this.

Prediction from 2023 JSCNDIS Submission (Attachment A)

WILL NEW SYSTEMS FIX THIS The answer to this question is NO. And I know this domain with some authority and expertise. There will be a political temptation to point to the ‘new’ Salesforce PACE system as a fix to everything that is busted with the current SAP system. Nothing could be further from reality…Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this. I am 100% certain that people will be caught in desperate situations because part of their three-month funding has run out, or they have a lumpy capital cost.

WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted?

What is the ethics framework informing these decisions?…I predict that participants will be caught in data migration hell. Get ready for a massive loss of data during this period. It is likely that cyber security and organised crime will be watching and probably acting under the cover caused by such disruption. Any cyber infiltration of this enormously complex and chaotic environment - in an

Agency of such deep capability and cultural deficits - would likely go unnoticed.

Because of this, the NDIA/NDIS would have to be considered a national security risk.

Given this extraordinarily complex risk environment - created through reckless incompetence - it is alarming that the NDIA’s own Agency Security Plan (September 2020, obtained under FOI) states that ‘security is not a primary function’ (page 19) and ‘…the Agency is a low-risk Agency…’ (page 32).

Given the enormity that rests on this Salesforce PACE platform - that is, the entire execution of what is proposed in this Bill and potentially hundreds of billions of dollars of funds to be administered over the next decade - the fitness for purpose of the Salesforce PACE platform needs to be investigated, as part of the due diligence of this Bill - and not simply relying on the assurances of the Agency itself.

It is noted that the ANAO has identified PACE as a potential audit for 2023-2024, the Design and Implementation of the Participants, Platforms and Processes Program’.

It is also noted that the Interim Report of the Joint Committee of Public Accounts and Audit ‘Inquiry into Procurement at Services Australia and the NDIA’, made a recommendation regarding the National Anti-Corruption Commission, that:

“The Committee recommends that the National Anti-Corruption Commission examine all material gathered through this inquiry to determine whether or not to conduct its own inquiry into procurements at Services Australia and the National Disability Insurance Agency involving Milo Consulting (trading as Synergy 360), the Hon Stuart Robert, and John Margerison. In making this recommendation the Committee is not making any findings in relation to the conduct of any individuals.”

Furthermore, the Salesforce submission to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA, noted:

“For context, the PACE program was managed by the NDIA. Salesforce contributed its product and domain expertise. NDIA was responsible for planning, the overall architecture, resourcing the program using a combination of its own internal and contract personnel, and program management. Salesforce was not responsible for any project milestones or timelines.’”

Salesforce is clearly drawing the line, stating that the management, design and delivery of the PACE platform has been the responsibility of the NDIA. And this goes to the very core of my thesis in this submission: NDIA does not have the capability to implement.

But there is much that is already known about the intractable NDIA capability deficits, from ANAO and JSCNDIS Reports, Parliamentary Inquiries, FOI documents, breach notices, articles, and Participant and Provider commentary. Throughout this submission, I triangulate key data from these various reports together with my own experience and knowledge, to paint a picture of critical questions of data security, accessibility, cost and NDIA’s lack of capability to implement.

Salesforce was awarded the NDIA contract on 2 April 2020.

A number of questions regarding the timing and status of the data security certification and accessibility assessment of PACE have been raised through FOI and submissions.

These questions are relevant as they go to the heart of the fitness for purpose of PACE, and the capability (or lack thereof) of the NDIA to deliver a very complex system intended to deliver potentially hundreds of billions of dollars of funds over the next decade, directly affecting the lives of over 600,000 Participants and the business operations of thousands of Providers.

In a Right to Know FOI Request to the NDIA dated 11 June 2021, the following request was made:

• “Please provide the documented assurance or proof that Salesforce provides PROTECTED level data security for Australian citizens in accordance with Government cloud services guidelines. That is, specific evidence (by means of assessment or certification) that all information and data created, managed, stored and accessed by the NDIS through all Salesforce products and services are at least PROTECTED with no data leaving Australia or is accessible from overseas.”

The FOI was endeavouring to determine the IRAP certification status of the Salesforce products. The FOI requester left the following annotation and link to the Salesforce IRAP Compliance webpage:

• “Salesforce did not commence IRAP certification in Australia until 1 June 2021. Salesforce did not receive IRAP certification in Australia until 30 July 2021.”

These questions appear to be seeking clarification about whether IRAP certification occurred before or after contract award, and whether there was NDIS data leaving Australia or accessible from overseas. These are critical questions. Also on 30 July 2021, in response to the FOI request, the NDIA stated the reason for refusing the request:

• “…all reasonable steps have been taken to locate the documents you have requested and I am satisfied that they do not exist…the NDIA is not in possession of documents matching the scope of your request. This is because the NDIA does not use Salesforce products to store, manage or create ‘protected’ level information or data.”

This is quite an extraordinary statement the NDIA is making, that documents relating to assurance of security classification of NDIS data on the NDIS Salesforce PACE system - do not exist. The response was silent on the question about whether or not data left Australia or was accessible from overseas.

Interestingly, on the question of whether or not data left Australia, Salesforce itself provided the response and on which the Committee then further questioned the NDIA.

In its supplementary submission to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA, Salesforce responded to the question:

• “32: Can you take on notice whether the CRM data has ever been stored offshore?”

Salesforce: The NDIA has since the start of the contract in April 2020 been running the Salesforce PACE system on our infrastructure hosted by AWS in Australia.

Page 19

The NDIA commenced using the Salesforce Marketing Cloud (separate to PACE) to distribute newsletters to participants in July 2022. Salesforce informed NDIA that Salesforce Marketing Cloud was hosted in the Salesforce German data centre. NDIA approved storage at this data centre. In December 2023, this data will be hosted in Australia.”

Clearly, some participant data (such as name, family details, email) necessary for marketing outreach, would have been stored in the Salesforce GERMAN data centre. And that the NDIA approved this. Whilst the offshore hosting in the Salesforce German data centre commenced in July 2022 - the year after the June 2021 FOI - the sensitivity and transparency around the status of offshore hosting persisted.

Finally, in response to Questions on Notice to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA, the NDIA stated:

“While the infrastructure hosting is being transitioned to Australia, Salesforce Marketing Cloud continues to be used to deliver generic email newsletters including automated “Hello and Welcome” email campaigns to participants. Marketing Cloud is also used to provide generic alerts, communications and surveys. It is important to note that while the platform is hosted in Germany, no participant information is stored on Marketing Cloud.”

This response demands further challenge, as the NDIA would have us believe that emails, surveys and communications to Participants run through the Salesforce Marketing Cloud platform hosted in Germany - that “no participant information is stored on Marketing Cloud.” These communications by their very nature inherently ARE Participant information, which is personally identifiable information (PII), therefore, requires degrees of state and commonwealth protection, especially under the PSFP.

The NDIA appears to be having continuing difficulty answering questions regarding the security of NDIS Participant data.

Significantly, as reported in iTNews on 4 October 2023, further questions about the security of the NDIA’s PACE system were heard in an AAT case, involving a report that raised “concerns” about the system and “serious concerns” with the agency’s information security generally.

“The document - which had been sought under freedom of information (FoI) laws - is to be kept private after a mid-September ruling deemed it too sensitive for public airing…

…it is said to have raised “some serious concerns about the security of the information and information systems employed by the NDIA.”

The AAT said the contents of the document, if released, “would damage public confidence in the scheme and of the NDIA more broadly.”

What this AAT ruling is literally saying, is that the security issues that had been documented in the report were so serious that the report could not be released because it would damage public confidence in the Scheme and the NDIA. In making this statement, the AAT acknowledged the fact of the existence of a report of serious security issues in the NDIA.

Marie Johnson 19

FOI documentation and responses also indicated curious responses by the NDIA to questions about the Salesforce worldwide outage in 2022. The FOI question was:

  "Has the NDIA/NDIS experienced any Salesforce service, connectivity or access disruption,
  outage or failure since the original service and support agreement was signed? If so, when and
  which systems/service(s) were affected and for how long? This includes all Salesforce related
  APIs and subsidiaries of Salesforce, such as Mulesoft.''

In response, the NDIA stated that:

          "...the NDIA has not experienced any unplanned outages, disruptions or service failures relating

to the Salesforce or Mulesoft services.“’`

This response from NDIA elicited a followup FOI request on 22 April 2022.

             "It was widely reported and confirmed by Salesforce directly that there was a global disruption
     and outage of their services on 11 May 2021. Every user, organisation and login was seemingly
        affected due to this outage/disruption/service failure…

      Could you please explain or provide the documentation supporting the declaration or claim that
       the NDIA/NDIS was seemingly the only entity in the world NOT affected by this global outage?"

The NDIA response was selective, referring to logins and not outages. The FOI requestor annotated the FOI request, stating that the FOI request had asked about outages, not log in. Which the rest of the world experienced for 5 hours.

  It would be incredulous that the NDIA would be the only organisation worldwide not to have experienced

an outage.

Once again, it is not the incident that is necessarily the problem, although that is incredibly serious in an environment such as the NDIA, where an outage may very well result in people being unable to access funds to maintain services critical to life. As with the offshore data question, it is the NDIA’s apparent predilection for deflecting questions, and far worse, its apparent inability to connect the dots between data services, data security and Participant safety.

Piecing together this daisy chain of issues and evidence regarding NDIS data security, through various FOI, AAT, ANAO, and Parliamentary and Senate Inquiry processes, clearly shows a worrying lack of command by the NDIA of the complexity of NDIS data security of which it is the custodian.

                                  This is an example of the defective PACE system in operation, with
                                   serious data security and data integrity defects.

                           The image is of a Participant plan doing the rounds on social media.
                                                            I am providing it here because there is no identifying data. Notice
                                  anything odd? Well, this participant plan refers to the NDIS Contact
                              as "Mulesoft 1". Who is Mulesoft 1? Actually, that should be, what is
                                  Mulesoft 1?

 Marie Johnson                                                                                           20

Mulesoft is an API platform and a Salesforce company. That’s not the issue.

The issue is, how does the name of the platform make its way into an identity data field, specifically a data field of person and role. And for that apparently not to be noticed during testing, if testing happened; to make its way into production - not to be noticed; and to make its way to the Participant - where it is noticed.

This should not happen. It indicates very serious problems across multiple dimensions: cyber security, identity, privacy, data integrity, data protection and system deployment.

Data defects and inaccurate Participant records cannot simply be fixed by moving to PACE, especially when this change looks like data migration and quality control is not happening. If this is the case, on whose authority was this decision made, and was it in compliance with the Public Governance, Performance and Accountability Act 2013 that covers record keeping by government agencies.

The NDIA systems and processes are the most defective in government. In my JSCNDIS submission, at Attachment A, Almost eighteen months ago, I wrote extensively about the vulnerabilities of APIs and predicted exactly what is now happening.

“NDIA has hundreds of APIs, and given the evidence I present in this additional statement, and in the context of the extensive change management challenges of the ‘new’ Salesforce PACE system, questions need to be asked about security, risk, and cyber threat assessments and scenario preparedness.”

In January 2024, iTNews reported that almost 650 NDIS Participants and prospective Participants have still not been told which of their health records were leaked on the dark web in June last year (2023). As an example of the scale, Bell*, who has an autoimmune disease, told iTnews “…that HWL Ebsworth obtained more than 900 pages of documents as part of an appeal against NDIA’s decision that she was ineligible for NDIS.” This follows the 2022 NDIS CTARS data breach involving as many as 12,000, which was detailed in my JSCNDIS submission (Attachment A).

Yet, in spite of the serious widespread systemic and data integrity and data protection defects widely reported and described in my JSCNDIS submission (Attachment A) - and which are escalating as described throughout this submission - the NDIS Review recommended (Action 10.2), “The National Disability Insurance Agency’s current application programming interface (API) functionality should be expanded to enable better two-way information sharing.”

The ignorance of the risks of the NDIA’s defective data security and lack of capability to implement is extraordinary.

In making that recommendation, the NDIS Review has clearly given no regard for the NDIA’s lack of capability to implement. And that is because the NDIA’s operations and capability were not part of the NDIS Review terms of reference.

Then there is the question of accessibility.

Marie Johnson 21

Accessibility is not about how things look, but how things work for people. And there is a clear and known linkage between accessibility and security, which is why the submission by the Australian Federation of Disability Organisations (AFDO) to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA is so important.

In its submission AFDO stated:

  "The procurement of inaccessible information and communications technology continues to have
 a detrimental impact on the employment and retention of people with disability within the NDIA
 and Services Australia. This situation also affects the general useability of ICT products and
   services that are available to the Australian public…." 

AFDO reminded the Committee ‘…that the Australian Government has signed and ratified the Convention on the Rights of Persons with Disabilities (CRPD) and in doing so, has made a legal commitment to uphold the rights..’

Questions have been raised about the extent to which accessibility was assessed (as distinct from marketing claim) as part of the procurement of the Salesforce platform.

The document “ACE Project Risk Management Review”, dated February 2021, redacted release under FOI, stated that accessibility had not been holistically assessed, and worryingly predicted additional accessibility issues:

  "As sub-projects progressed (e.g. Social Studio) accessibility issues have been identified, noting
   these issues were not identified as part of a holistic assessment of the product’s suitability for use
  by the Agency, additional accessibility issues may be identified.'"

The February 2021 “ACE Project Risk Management Review”, predicted the risks and issues outlined in the AFDO submission some two years later:

  "Broad access to technology that will support participants, and other stakeholders to interact with
   the Agency remains a challenge." 

Participant Stories: Technology Not Accessible

“Blind employee’s can’t use PACE just like their current CRM? Due to unskilled IT internal team. Screen readers are a reasonable adjustment. They forgot to make it user friendly? Shame on using equal employment words in their recruitment rounds?” Participant.

So it would appear that there are questions about whether the evaluation process of the Salesforce PACE platform sufficiently considered IRAP and accessibility assessments. Why this matters, is that it is indicative of the NDIA’s lack of capability to implement a “new” system (PACE), costing more than $200 million (see costs below), and that after four years, is still not implemented.

Marie Johnson 22

In light of my predictions in earlier submissions and my predictions in this submission, the following actual current Participant stories illustrate the sheer chaos, trauma and risk people are experiencing as a result

of the haphazard deployment of PACE and defective data, resulting in widespread payment problems.

Participant forums are on fire with people saying they can’t pay support workers, can’t see their plan, counting the NDIA and being told they have multiple bank account details (when the person only ever has had one bank account).

These widespread problems are not simply a collection of individual unfortunate cases: these problems are systemic, in a new system no less, indicating questionable data integrity in the data migration, or perhaps no data migration, period.

There are literally thousands of these comments on Participant forums. With less than 10% of the PACE rollout, this will only get worse as the rollout continues and unsustainable backlogs swamp the Agency and service providers.

Participant Stories: Data Errors, Missing Bank Account Details, Cessation of Supports

“You won Bill Shorten, you cut my daughter’s funding from 1:1 to 1:2, you cute her funding so she was unsupported 1 hour a day, she required suctioning around the clock being High Intensity Complex Care, you changed to PACE that is absolutely broken in where the provider has not been payed (sic) for accommodation supports for over 8 weeks due to a “glitch” of your incompetent planners, your complaints department is appalling, your staff are not appropriately trained. The NDIS does not support those with a severe disability. As I started this post with ‘you won Bill Shorten’, my daughter passed away on Tuesday. Such a disgraceful disfunctional (sic) scheme.” Participant Father.

"I remember at the end of October last year when both myself and my son had completely run out of

NDIS funding and I was waiting for them to to pick up both of our urgent ‘tier 3’ change of circumstances. I was calling the general enquiries line multiple times a day to stress the urgency of our situation. I was told by a team leader (who I had become familiar with because I was calling daily) told me on the night of the change over from the previous CRM system to PACE that: 1. the NDIS were not transferring any reports or any other supporting evidence on participant files over from the CRM system to the PACE system. 2. that if I wanted any reports to still reflect on mine and my son’s files that I would have to Re upload them. 3. I was told that the CRM system will be accessible to NDIS employees for 2 years from the changeover and then it would no longer be accessible.“ Participant.

“I’m feeling fuming angry at the ndis, my plan has been rolled over to the ‘new pace system’. I spent over 4hrs on phone yesterday with the 1800 number only to spend at least another 3 on the line trying to see what’s gone wrong on my profile.” Participant.

“This week, I received a letter from the NDIA, telling ME that MY bank details had been recorded.

Marie Johnson 23

I am NOT the participant. Our daughter is the participant. The bank details are our daughter’s. They have not changed since her first plan in 2015! They were RECORDED in the NDS portal. PACE is the problem!” Participant Family.

“…there is a lot wrong with my plan: my goals haven’t been updated, reports have been disregarded & The disabilities/impairments/ conditions listed on my record are vague & incorrect. I imagine in a few weeks I’ll receive the standard NDIA letter, proposing that my plan be rolled over. I’m not especially thrilled about this prospect, due to the massive errors contained in my NDIS record…Essentially I just want my NDIS record to be an accurate reflection of me. Currently the condition listed as my ‘primary’ disability, is something l’ve never even been diagnosed with, & my ‘goals’ are a four-word, meaningless sentence.” Participant.

“It’s been 10 weeks of hell, His care is a full time job, He needs are full time care. I am advocating with help ( they are on holidays now to). So we have essentially had no funding for 10 weeks. It’s appalling. Now we have a plan we can’t access it. because of the old system to new system that no one seems to know how to navigate.” Participant Family.

“I’ve spoken with the NDIA twice about this system this week. If you receive a new plan and it goes into this system, it’s likely your bank details will not transfer from the old system into the new. It won’t matter that it’s recorded on your account - ‘someone’ (a delegate for such matters) will need to effect the change. Neither the person who called me back from the 1800 call Centre, nor the Planner who devised my daughter’s new Plan, could tell how long it will take. I asked why were we rolled into this system if it wasn’t ready for us and the Planner replied with “that’s what we all ask!” Participant.

“They also don’t transfer across nominee details either or consent forms…we had a riot of a time getting that fixed because they wanted to call the participant from a private number so, and they didn’t answer but wouldn’t accept calls from the nominee because they “lost the forms” for the second time - some the plan review didn’t go ahead .. total mess.” Participant Family.

“We have canceled most supports last week and I’ll cancel the rest tomorrow. Probably the most frustrating thing I’ve had to deal with. While I have a huge pile of invoices to pay and now he will probably lose his place among his service providers because of the long time frame and know-one can even point me in the direction of possibly fixing the issue.” Participant Family.

“The new NDIS plan is with PACE. It rejected the claim, because bank details weren’t there. I checked and the bank details were there! I called the NDIA and was told that we have to verify the bank details with them before claiming with PACE for the first time! Why weren’t we told that by the planner?? Apparently that will take 7 - 10 days to fix, because there is a backlog! That’s a long time to wait to be reimbursed!” Participant.

“It took almost 4 weeks for the NDS IT boffins before even they could get any access to my daughter’s new plan in PACE. No-one could access the financial section $$’s, so nothing could be paid for weeks. The entire system is an absolute mess.” Participant.

Marie Johnson 24

“…massive errors contained in my NDIS record… I just want my NDIS record to be an accurate reflection of me. Currently the condition listed as my ‘primary’ disability, is something l’ve never even been diagnosed with, & my ‘goals’ are a four-word, meaningless sentence. I’ve sent emails to the enquiries@ndis address, with updated goals & all the diagnosis letters & various necessary reports: thi s process has been undertaken by me personally & via several previous SCs, & yes l’ve even sent e-mails to all the relevant politicians, the NDIA CEO, the feedback & complaints emails. It’s a merry-go-round that I don’t have the energy for.” Participant.

“A serious privacy and confidentiality concern with PACE. We’ve had an incident today where a staff member’s NDIS plan has transferred to PACE. The way the system is set up, compared to PRODA, means that all staff can see the plan, goals, personal details and will also be able to see private progress and implementation reports down the track. There doesn’t seem to be any facility on the system to limit access for participants that might need extra privacy for certain reasons. Some participants may have a profile in the community and request they have a restricted file which is understandable, but there is no way to do this in PACE, anyone with access can see everything.” Anonymous.

Disrupted Payments Impacting Participants and Providers

For a Scheme that has administered hundreds of billions of dollars over the past decade, there has been very poor attention given to building a high integrity highly resilient payments capability. And the lessons from Full Scheme Launch in 2016, during which time I was working at the NDIA, appear to have faded unapplied into history. However, the NDIS is at this very precipice yet again.

In the MyPlace Portal Implementation Review - Final Report dated 31 August 2016, commissioned by the Department of Social Services, PWC (who undertook the review) expressed similar concerns during the Siebel to SAP ICT project transfer of hastily implementing significant Participant change in 2016 that lead to considerable disruption:

      "The complexity of the stakeholder landscape, the amount of change leading up to and after the
         Full Scheme Launch, the low quality and timeliness of data, and the newness (immaturity) of the
      process all combined to created critical risk that payments would fail"

               It is important to understand that the root cause of payment failure was not a single catastrophic
       event, but rather a series of compounding issues…" 

Together, defective data integrity and defective payments capability, present a very weak underbelly and exposure point of the NDIS. Neither of these are “IT” issues, and nor will these be fixed by moving to PACE, or any new system.

  If we look forward another 10 years - which we must - many more hundreds of billions of dollars will pass

through these systems. Given the defectiveness of these systems and processes, this is an extraordinary risk to the Commonwealth budget.

 Marie Johnson                                                                                           25

Page 26

The thesis of this submission, is that the NDIS Review and this Bill not only ignore the NDIA’s lack of capability to implement, but by radically changing the foundations of the NDIS, add extraordinary risk to already very fragile and defective systems and processes. There are multiple systemic risks which I have not seen addressed anywhere as part of this proposed Bill: data security risk; risk to the Commonwealth Budget and State Budgets; and the highest risk, that of risk to life.

In my JSCNDIS submission (Attachment A), I predicted precisely many of the problems that are now happening. The following is a recap of those predictions relating to payments, followed by Provider and Participant stories of the impact of disrupted payments.

Prediction from JSCNDIS Submission (Attachment A)

What happens when something goes wrong, which will happen. What is the system wide change management? Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this.

I am 100% certain that people will be caught in desperate situations because part of their three-month funding has run out, or they have a lumpy capital cost.

WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted?

The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants.

Providers

In December 2023, the Disability Intermediaries Australia issued alerts over payment disruptions and sector-wide issues with PACE. Note, this is almost a year after I predicted this in my JSCNDIS submission (Attachment A).

The DIA payments alert was issued over the significant volume of escalations from Plan Managers

Marie Johnson 26

Page 27

indicating that the NDIA had not released funds. Based on the volume of escalations, DIA believed that this was impacting around $30M to $40M in claims, however this could be higher as escalations are continuing to come in.

The PACE alert was in response to DIA members and the wider intermediaries sector experiencing challenges with PACE. The DIA created the DIA PACE ISSUES ESCALATION process to support Plan Managers, Support Coordinators and Psychosocial Recovery Coaches to resolve issues impacting them. This escalation process is used to provide details of systemic issues with the PACE system.

National Disability Services [NDS] also commissioned research that has painted a grim image for the future of the care sector:

         "...with 59% percent of providers expressed concerns about their organisations having the capacity to adapt to the new 'PACE' system." 

Participant Stories

“Anyone else not had their claims paid for six whole weeks? What is going on? Paid after 8 weeks. With a nasty insinuating email implying l’m a thief.. again! They did this last time! It seems it’s all over changing a bank account. We’re laying off essential support workers now.” Participant.

“Omg this happened to me several weeks over Christmas. Beyond frustrating… l talked to so many people on the phone and in person and everyone was equally flummoxed. My daughter was denied support from our main provider because we couldn’t pay invoices, despite the money being there in plain sight!” Participant Family.

“Has anyone gone from the old system to the new system recently ? We have had to fight so hard for a review for my son. He was without funding for 8 weeks, his needs are very high and needs one on one for everyday things. We had to escalate and we got a plan review approved by the 15th December, But we are still unable to lodge anything in the portal. Keeps telling us that there is a new plan (we know the plan is approved) But cannot access funds. Apparently it’s stuck with accounts to verify the bank details. They are the same bank details from His previous plan. It’s now been 10 weeks not being able to pay supports or access care.” Participant Family.

“It’s been 10 weeks of hell, His care is a full time job, He needs are full time care. I am advocating with help (they are on holidays now to). So we have essentially had no funding for 10 weeks. It’s appalling. Now we have a plan we can’t access it, because of the old system to new system that no one seems to navigate.” Participant Family.

“It is not just screwing up access - it’s making it impossible to know what has and has not been funded in a plan, it’s breaking bank payment details so claims/invoices don’t get paid (I have heard some people have no payments made for 6+ weeks!), and has changed the language on plans in ways that are confusing causing a lot of panic amongst participants. It is also breaking linking of plans to plan nominees (typically parents) - the child’s plan moves to PACE and is suddenly no longer available for the parent/nominee to access.” Participant Family.

“After a challenging 18 months with AAT our plan was finally agreed upon only to find that the PACE system is resulting in our service providers not being paid in a timely manner and once again I am

Participant Family.

“One of my service providers worked for nothing for months - he was owed over $60,000 and when I threatened to leave my son at the NDIS offices the next morning if all outstanding invoices were not paid by 5pm that evening, I got a phone call from the acting NDIS director saying that all the outstanding invoices were now paid.” Participant Family.

An Impossible Rollout of a Defective System the Whole “New” NDIS is Dependent On

Screenshot from NDIS website with expected transition of existing participants to PACE

The simplistic narrative of a “new computer system” is a troubling sign that the NDIA has not grasped, and certainly has not communicated, what is actually happening.

To recap the PWC Report on the 2016 Siebel to SAP ICT project in the implementation of Full Scheme launch that lead to considerable disruption:

    "The complexity of the stakeholder landscape, the amount of change leading up to and after the Full Scheme Launch, the low quality and timeliness of data, and the newness (immaturity) of the process all combined to created critical risk that payments would fail"

The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants.

But with only 10% of the PACE rollout, the system is already in chaos: critical functionality still not delivered; payment disruption; unsustainable backlogs; cyber security concerns; and 59% of Providers expressing concern about having the capacity to adapt to PACE. And on top of this chaos, a Bill that proposes the radical upending of the NDIS.

The risks could not be anymore extreme, or obvious. And that is why this Bill must be defeated. This is not “just” a new computer system, but a fundamental change to the foundations of the NDIS introducing new processes and concepts - not yet legislated - in a sector wide change that impacts the lives of more than 600,000 Participants, thousands of providers, hundreds of thousands of people working in the NDIS ecosystem - and the budgets of all Australian governments, Commonwealth, State and

Marie Johnson 28

Page 29

Territories. A few information sessions is not strategic change management: that is a capability that the NDIA clearly does not have.

What exactly does the above chart say?

According to the Agency, this chart depicts the phased “transition” to PACE: doubling expected numbers between March to April (8k to 16k) then again between April and May (16k to 32.5k). Then only aiming for 8500 more May to June (32,500 to 40,500).

But this is what it doesn’t say.

As evidenced in this submission, and in countless other submissions, the PACE system is defective: critical data defects; cyber vulnerabilities; and a chaotic “introduction to service” causing backlogs and payment disruption.

In my opinion, PACE is not fit for purpose, and certainly is not ready for service.

After four years, the NDIA now has two defective systems (SAP CRM and PACE) with critical data defects, operating in parallel.

This means that the NDIA will have operating costs for both systems: this is not just IT costs, but operational costs. More on costs below in the action, “Unknown and Uncapped Costs of PACE”. It also means that many, if not all, Providers will incur additional cost overheads of working with both systems. And with differences in processes and data, this will be very problematic from an operations management perspective.

Disability Intermediaries Australia have expressed sector concern about having two systems running at the same time.

“A downside to a slower release structure is that two systems will be “live” at the same time –	PACE and current SAP System.

Tasmania (as it rolls out) and the “Mainland” will be running on different systems, an issue and
inefficiency for organisations with national or multiple state reach. Employees of providers will
need to be proficient at dual systems with limited learning and development opportunities before
going live…"

For Participants, the existence of two defective systems operating in parallel is also problematic. There are families with more than one NDIS Participant, and because of timing and other factors, face the complexity and chaos of interacting with the two systems. Try calling the call centre, and get the hours long run around, what system are you on? Both?

For the NDIA, Providers and Participants, having two defective systems operating in parallel is the root cause of errors, backlogs and cyber vulnerabilities. And what is the backout strategy? There always has been a viable backout strategy.

Marie Johnson 29

According to Disability Intermediaries Australia, this is a significant concern.

“The NDIA have indicated that they have a range of contingencies from micro individual interactions to a full pause / wind back of the Test / Pilot.

Again, we don’t have any visual confirmation (Guide, FAQ’s etc) of these contingencies so we will see the effectiveness of the Agency’s preparedness when issues arise.“

And there are no scale efficiencies in the numbers in the above chart, given the widespread problems across Providers and Participants are experiencing. To the contrary, having two defective systems operating in parallel drives disbenefits and multiple risk vectors. This is also a concern expressed by Disability Intermediaries Australia:

“…let’s be honest the current system is horrendous and does not befit a scheme of the scale or complexity as the NDIS, there are risks and DIA like many in the sector are very nervous given the risks.”

The NDIA are conducting a “Test / Pilot” of the PACE system in Tasmania which commences on 14 November. Whilst the NDIA calls this a ‘Test or Pilot’ it could be better described as a staged rollout of the new system, with no option for a participant or provider to ‘opt out’ of such testing.“

No option to opt out is an extraordinary reflection of NDIA’s own admission, as recently as August 2023 in sector briefings, of its ignorance of critical factors in large scale national highly political change management, involving risk to life.

NDIA: “The evaluation of the test in Tasmania indicated that a stakeholder-centric approach to change needed to be developed to support national expansion of PACE.”

Well yes, a stakeholder-centric approach is always critical. And anyone who has experience in large scale national change programs, affecting tens of thousands of businesses, would know this. This is my thesis in this submission: the NDIA does not have the capability to do what it’s doing, let alone what is proposed in this Bill - and that is a national risk.

And while the NDIA imagines that it will take about 18 months for all Participant plans to move to the new system, with the widespread problems and data defects compounding this stated schedule, at this rate, it will take more than FIFTEEN YEARS to roll out.

And why would a “new computer system” take 18 months to roll out, when the Transition to Full Scheme - which was every bit as complex and problematic as what’s happening with PACE - took four years (2016-2020).

Given Tasmania only has 12,819 participants, 8,445 as new entries as of Dec 22, along with only 368 initial plans approved recently, this is a dangerously low sample size for proof of concept, for a population of over 600,000 current Participants, before going live.

Marie Johnson 30

Of course, the critical risk in the 2016 Transition to Full Scheme which caused considerable service

disruption, was the massively problematic data migration from the States and Territories, the immaturity of the processes, all combined creating the critical risk that payments would fail.

In recommending the NDIA implement and embed the Service Delivery Operating Model (Model), the PWC Report noted:

    "The NDIA currently has not implemented a comprehensive Service Delivery Operating Model
   (SDOM). This has impacted on the successful execution of the Full Scheme Launch and put the
      existing organisational operating model under stress. A NDIA Knowledge Tool is currently being
    developed with the intention to clearly define NDIA customer offerings, process, technology,
      information, organisational structure (including governance, roles and accountabilities), with
   mechanisms to understand the interaction between key components of the operating model." 

The absence of the SDOM remains a critical capability deficit: and this issue is pivotal to decisions regarding this Bill. How can proposals to fundamentally change the NDIS be considered with the necessary due diligence and risk assessment, without understanding the viability and impact of those changes.

I was working at the NDIA during the period in question, and considerable work had been done on the development of the SDOM and its governance. Considerable work had also been done on the NDIA Knowledge Tool. Both the SDOM work and the NDIA Knowledge Tool were led by the NDIA. The NDIA Knowledge Tool, was developed using the Holocentric technology (an Australian product), which would enable scenario modeling - that is, change a policy or a process and see what is affected across the whole operating model ecosystem. The NDIA Knowledge Tool would provide traceability and transparency of policies and decisions. What happened? The Department of Human Services (now Services Australia) which was the technology provider to the NDIA, decided not to support the Holocentric technology and the project was discontinued after much investment of dollars and expertise by the NDIA. This was a fundamental example of defective governance: an “IT” decision taken by DHS that would seriously impact NDIA operations for years.

And here we are, almost a decade later - and probably after almost a billion dollars spent on NDIA techonlogy (more on costs shortly) - confronted by continuing and deepening critical data capability deficiencies and sector-wide payment disruption again.

Reiterating again, in comparison to 2016, there are now almost 20X more Participants and tens of thousands more Providers.

And on top of this the NDIA is to build according to this Bill, a yet to be defined “Budget Calculation Instrument’, see following section, “Algorithms: The Budget Calculation Instrument - a Recast of the Dumped Centrelink $200 million Entitlement Calculation Engine (ECE)?”

Data Migration and Critical Functionality Gaps

The move to a new system should never disrupt key governance processes of operational reporting. To do so, is literally flying without any navigation.

Marie Johnson 31

As documented in this submission, Participants have reported that documents and data are not available

and/or incorrect in the PACE system, including critically bank account information. People have reportedly been told that the NDIA was not transferring any reports or any other supporting evidence on Participant files from the SAP CRM system to the PACE system; that if they wanted any reports available, they would have to re-upload them; and that the SAP CRM system will be accessible to NDIA employees for two years from the changeover and then it would no longer be accessible.

How does this happen? The governance and decision making about data migration needs to be examined, because it is obvious that data availability issues are impacting operational performance, governance and transparency. And whether this situation is inline with the PGPA Act.

To the extent where the NDIA cannot even answer basic and essential questions in Senate Estimates, about operational performance and actuarial benchmark type questions because of “transition to the new system”.

These data migration issues - even at this very early stage of the PACE rollout - have been affecting reporting to Parliament via Senate Estimates for at least 15 months. In my March 2023 JSCNDIS submission (Attachment A), I made the observation:

“In evidence at the 15 February 2023 Senate Estimates, the NDIA Acting Actuary was unable to answer specific questions on forecasts stating:

‘…there are a few challenges with reconciling the participant numbers. It’s to do with our new IT system.’

This is not just a reconciliation issue to be waved away, but points to the intractable integrity issues with the NDIS systems – of both the old system and concerningly the new system.“

More than a year later, at Senate Estimates in March 2024, the new system impact on data availability was a continuing narrative, with the NDIA appearing to have difficulty predicting when things would improve. Under questioning about performance data regarding timeframes for access request, decision, and plan implementation, the NDIA stated:

“NDIA: …because of the transition to the new system we don’t have that aggregated reporting available…we don’t have that aggregated data available at this current point in time but as I’ve said before we hope to have that for the next quarter…”

Senator Steele-John: …basically from September 2023 quarter through to the next quarter will be in at the end of the end of March, we have no data. Therefore it’s useless to us as a committee you might well have it but we can’t use it you can’t use it, so so for those what two quarters nothing that we can use to to understand the participant wait times or the performance of the agency against a legislative requirement…which is a bit of a flaw in like your whole job of rolling out the PACE system in a way that that doesn’t actually limit the critical oversight of of a senate committee, isn’t it?

On this evidence from the Agency, it is highly likely that critical performance data of the NDIA will be missing for nine months. This should never happen. Reporting is a core function of public administration. It’s not a “module” to be added at a later date.

As stated earlier in section, “Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports, 28 June 2023”, there are questions to be asked as to all the capability gaps as a result of the discontinuance of support of functionality in the SAP CRM when functionality in PACE was not (yet) available. Who made these decisions, and for what period of time did these functionality gaps exist.

There are global well established best practices in system design and implementation specifically covering data migration and continuity of reporting, which in many industries is critical for prudential compliance and operations safety. This is not only a sign of the lack of capability across the NDIA and the attendant risks, but signals that something in the NDIS systems world is fundamentally broken. This, after four years of the PACE project and ten years of NDIS.

Whatever software company or consulting firm was involved in providing this advice to the NDIA, should have contract penalties applied. Noting that the PACE project is identified as a potential ANAO audit for 2023-2024 and is being examined by the National Anti Corruption Commission, the PACE project should be subject to extensive independent review before any further work is undertaken or rollout expansion occurs.

The NDIA is incapable of doing what this Bill proposes.

Unknown and Uncapped Costs of PACE

I have never seen a worse explanation of a business case for a “system”, than the one offered by the NDIA to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA.

To describe what is happening as a “new computer system” underscores the NDIA’s alarming lack of capability, appearing oblivious to what is actually happening.

Would we have described the introduction of the New Tax System in the year 2000 as a new “computer system”? No.

This is not simply a “new computer system”, but a fundamental change to the foundations of the NDIS introducing new processes and concepts - not yet legislated - in a sector wide change that impacts the lives of more than 600,000 Participants, thousands of Providers, hundreds of thousands of people working in the NDIS ecosystem - and the budgets of all Australian governments, Commonwealth, State and Territories.

The explanation offered by the NDIA is woefully naive and narrow. And I say this as someone with more than 30 years experience doing business cases and implementing large scale complex national and international change programs, involving policy and legislative change, in complex and contentious policy domains.

Marie Johnson 33

From the NDIA responses to questions from the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA.

PACE Costs and Business Case

“The business case for PACE estimated a 10% reduction in cost-to-serve, or a reduction of 1.8M hours from the time it takes staff to interact with the former CRM. These savings are being reinvested in increased participant contact. That is, PACE reduces the amount of time that staff and partners spend interacting with the CRM, meaning they have more time to spend working directly with NDIS participants.

While PACE is expected to make it easier for NDIS participants and their providers to interact digitally with the NDIA, the Agency have not projected any reduction to the fees that providers charge for the services they provide.”

Additional benefits include future cost avoidances when enhancing the CRM and longer-term operational efficiencies.

The independently reviewed business case for the 3P program, delivering the PACE system, identified the following benefits, which are being measured as expansion continues: - Release 1.8M hours through more efficient end-to-end processes, enabling a workforce realignment to bringing planning in-house, and allowing Local Area Coordinator and Early Childhood partners to undertake partner supported connections, ongoing implementation and monitoring, and check-ins. - Increase participant understanding in ‘what happens next’ to >80% - Achievement of Participant Service Guarantee measures in >95% of cases - Reduce participant complaints to <5% - A more flexible Information Communications Technology system, able to inexpensively respond to the evolving NDIS policy environment.

National expansion of PACE only commenced a gradual rollout on 30 October 2023. As such, there has been no reporting on savings as yet. Once the roll out of PACE has progressed further and the old system is used less, the Agency will be able to see some cost savings being realised.

NDIA trialled the PACE system in Tasmania for 12 months from November 2022. As part of the trial, staff and participant experience interacting with the new system was evaluated. In line with the expected benefits of PACE, the results of the evaluation indicate that 72% of participants said their planning experience in the Tasmania test was good or very good, with 55% of participants saying it was better, or a lot better than their last planning experience.”

Before dissecting the Agency’s claims on the business case for the “new computer system”, the following commentary from the Disability Intermediaries Australia, demonstrates a very different view of costs, with sector wide concerns about the sector being forced to absorb development and implementation costs.

Disability Intermediaries Australia

“Considering the price freezes that Plan Managers and Support Coordinators have experienced for the past three years, along with the requirement for Plan Managers and Support Coordinators to operate peak efficiency to be viable, how the NDIA expects transition costs to be absorb by providers remains unanswered by the NDIA.

The implementation of PACE in Tasmania feels rushed which will result in the front-line intermediary support providers, one again, bearing the brunt of such change.“

Not only does it signal a severe lack of readiness, it points to a massive lack of competence in respect of change management, and reinforces widespread concerns that there has been no actual co-design.

The final sentence in chapter 8 of the report is damning:

    "NDIS partners thought we [the NDIA] could improve how we explain the work we expect them
         (to) do, supported by training resources".

It has been clear for several years now that the NDIA has done very poorly in explaining the work that people are supposed to do, resulting in self-admitted deficiencies and inconsistencies in practice. To see a statement that NDIS Partners still need an uplift in the effectiveness of resources that should prepare people for working with the NDIS is a scathing indictment. This reported feedback is amplified by the sector criticism discussed above by Disability Intermediaries Australia, about the NDIA expecting providers to absorb transition costs and bear the brunt of the change.

This is not change management. And in no way, ensures a viable resilient provider sector, critical to the sustainability of the NDIS.

The PACE system was not ready to be rolled out. More critical work was /is needed. This brings us to the dissection of the business case, challenging the “business case” information that has been provided by the NDIA itself.

Dissecting the Business Case

The evidence presented in this submission and in this section on the PACE costs and business case, doest not stack up with the NDIA’s claimed benefits.

The sector wide and economy wide costs and disbenefits are unaccounted. Transition costs and disbenefits, including risks, of working with parallel systems, are borne across the entire NDIS ecosystem: The NDIA, all Providers and all Participants.

The uncapped NDIA cost alone so far has to be north of $200 million - not just $124 million Salesforce licensing - when NDIA staff costs, specialist Salesforce consulting and contractor resources are factored in.

Also not factored in, are decommissioning costs for both PACE and SAP: such costs need to be factored in, as either or both events will happen.

In answers to question on notice, the NDIA noted that in relation to Salesforce’s two other contracts that will expire in mid-2025:

          "...costs beyond April 2025 are subject to change and cannot reliably be estimated as they
      remain subject to future decisions".

What this is saying is that forward costs only ONE year hence, CANNOT be estimated.

So in a market of extremely scarce and expensive specialist technical skills, it’s impossible for a partially

Marie Johnson 36

factored “business case” which doesn’t go beyond 2025 to yield a 10% reduction in cost-to-serve, as claimed by the NDIA.

And the reason why all this matters to the consideration of this Bill, is that the NDIA has neither the capability to execute what the Bill proposes nor the capability to estimate a fully loaded business case upon which the sustainability of the Scheme pivots.

Algorithms: The Budget Calculation Instrument ~ a Recast of the Dumped Centrelink $200 million Entitlement Calculation Engine (ECE) and the Dumped $250 million Home Affairs Permissions Capability Platform?

The focus of this submission is the NDIA’s catastrophic lack of capability to implement, and the concomitant of this, being the organisational incompetence regarding risk. The ANAO Audit reports are evidence of the NDIA’s failings on risk.

This Bill takes to a new height the ungoverned and reckless adoption of algorithms in automated decision making in the public sector administration in Australia, and I believe, globally. Algorithms in this Bill are undefined and not reviewable.

Let’s consider the Budget Calculation Instrument proposed in this Bill.

It is argued that the “Plan Flexibility” derives from not having to construct a plan budget from individual line items, because the Budget Calculation Instrument will do this. Because this instrument will be defined by a legislative mechanism, this calculation will not be a reviewable decision. Does this look like Plan Flexibility?

The Budget Calculation Instrument is a new concept and the tools to give it effect do not exist anywhere in the world.

This is exceptionally hazardous policy and defective drafting of the Bill: expecting an agency in crisis, once again without the organisational capability to implement, to take on something so dangerous that it is held unreviewable and undefined in legislation.

With such widespread sector concern over the defectiveness of the “new” PACE system (replacing the defective SAP CRM system) and disruption to payments as documented above - the government would have the NDIA create, once again without the capability to do so, a yet to be defined Budget Calculation Instrument, than does not exist anywhere else in the world.

In my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA dated 3 March 2023 (Attachment A), I examined in detail, the risks and unlawfulness of the use of algorithms - which this Bill apparently seeks to retrospectively make lawful by defining such algorithms as a legislative mechanism.

But the level of ignorance of the risks involved with such a Budget Calculation Instrument, is appalling.

Marie Johnson 37

Will this Budget Calculation Instrument be a recast of the Services Australia $200 million Entitlement Calculation Engine (ECE) that was dumped by this government, by Bill Shorten as Government Services Minister?

Or a recast of the dumped Home Affairs $250 million “Permissions Capability Platform”, which is the subject of inquiry by the Joint Committee of Public Accounts and Audit?

And why would the NDIA expect a different outcome, when Services Australia with all its resources failed catastrophically. I know a lot about the systems of both the NDIA and Services Australia: having been the Head of the NDIA Technology Authority, and previously the Department of Human Chief Technology Architect responsible for the business cases bringing together the massive systems of Centrelink, Medicare Australia and the Child Support Agency.

Or why would the NDIA expect a different outcome to that of the Department of Home Affairs “Permissions Capability Platform”; which was dumped undelivered after years of work, at a cost of $250 million. I also have knowledge of Immigration systems. According to the Department of Home Affairs Permissions Capability Industry Information Paper, a permission is defined as:

A permission is broadly defined to include processes involving the Government giving an individual or business the right to be someone, do something or have something following the provision of information and an assessment of eligibility against legislation, regulation, or policy. Permissions include, for example, visas, permits, licences, accreditations, and registrations.

All three are essentially the same concept: a theoretical automated calculation involving complex variables to determine such things as entitlements, eligibility and budget. And two of these “calculation platforms” have consumed almost half a billion dollars in public funds, only to be terminated undelivered after years of mismanagement.

It is noted that the Joint Committee of Public Accounts and Audit is currently conducting an inquiry into the Procurement of the Permissions Capability.

And yet, here is the government through this Bill, expecting a different outcome for the NDIA, when the massive systems of State of Services Australia and the Department of Home Affairs have, for various reasons, failed to deliver such a capability.

To reiterate. The risk of ignoring the lack of capability is extraordinary.

• With such widespread sector concern over the defectiveness of the “new” PACE system (replacing the defective SAP CRM system) and disruption to payments as documented above…
• …just six months after the JSCNDIS found that the NDIA had for a decade operated unlawfully by its construction of the administrative convenience of “primary disability”…
• …the government would have the NDIA create, without the capability to do so, a yet to be defined Budget Calculation Instrument, that does not exist anywhere else in the world…
• …and with no apparent regard for the half a billion dollars that has already been wasted by Services Australia and Department of Home Affairs on abandoned attempts at the same concept.

Then to the question of algorithms, of which the Budget Calculation Instrument is the apex.

The question of risk, including the risk to life from the operation of algorithms, remains unexamined and unanswered. Before examining the concept of “plan flexibility”, I would like to recast some of the questions I posed regarding risk and algorithms,in my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A).

“…as demonstrated throughout the whole INDEPENDENT ASSESSMENT debacle, notwithstanding the risk to life, the NDIA recklessly pursued the use of systems, algorithms and methods that have been shown in other jurisdictions to harm people leading to death.

In fact, and against the advice of health professionals, the AMA and others, the Agency ruthlessly and recklessly used these systems, algorithms, and methods in trials of Independent Assessments.

Did the NDIA have any knowledge or evidence that the application of algorithms results in harm and death? An answer either way - yes or no - is damning.

The NDIA either had this knowledge and recklessly ignored it.

Or did not have this knowledge - which is readily publicly obtained - and recklessly decided not to acquire and investigate this knowledge.“

These questions were posed just over a year ago in March 2023, about the Agency’s knowledge of algorithms causing harm and the Agency’s knowledge of the unlawfulness of the fiction of “primary disability”. For a decade, the actuarial model was based on the fiction of “primary disability”, even though the legislation covers for multiple disabilities. Last December (2023), the JSCNDIS found that the actuarial fiction of “primary disability” was unlawful, not consistent with the governing legislation, a construct of administrative convenience by the NDIA, and discriminatory.

This “unlawfulness” finding of the actuarial fiction of “primary disability” is then compounded by commentary in the 2023 ANAO Audit Report footnote 29, bottom of page 35, regarding Typical Support Packages (TSPs):

        "Information collected by the planner informs the automated calculation of a Typical Support Package (TSP) funding amount for NDIS supports relative to a participant's functional capacity. The TSP assists planners to guide and support consistency in decision-making consistency and does not limit plan amounts."

    "TSPs are calculated automatically in CRM, based on built-in actuarial data and participant responses to questionnaires recorded during pre-planning." 

This “built-in actuarial data” referred to, would be based on the unlawful fiction of primary disability: therefore by definition, every output from the TSP is flawed.

Marie Johnson 39

Page 40

This decade-long actuarial and algorithmic defect is symptomatic of the NDIA’s lack of capability to implement and lack of competence and risk governance in the central areas upon which this Bill sits: algorithmic decision making, that is the Budget Calculation Instrument.

Does the NDIA now have knowledge of the growing number of cases of algorithmic decision making in other jurisdictions leading to harm, risk to human life, and suicides, as documented in the report “United against algorithms: a primer on disability-led struggles against algorithmic injustice”

Among the growing number of cases globally, the following were provided in my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A).

The Netherlands. In 2019, it was revealed that the Dutch tax authority ruined thousands of lives by using a self-learning algorithm to create a risk profile for childcare benefits fraud. Authorities issued exorbitant debt notices to families over the mere suspicion of fraud based on the algorithm’s risk indicators. Some victims suicided. More than a thousand children were taken into foster care.

The Dutch parliamentary inquiry that followed found that the fundamental principles of the rule of law had been violated, and there was a total lack of checks and balances.

Once the enormous scale of the scandal came to light, the Dutch government resigned.

United States. And as a warning of what could possibly go wrong, the horrific examples of algorithm-driven funding assessment models used in the United States read like a template for NDIS independent assessments and robo planning.

The US algorithm-driven funding assessments “hit low income seniors and people with disabilities in Pennsylvania, Iowa, New York, Maryland, New Jersey, Arkansas and other states, after algorithms became the arbiters of how their home health care was allocated – replacing judgments that used to be primarily made by nurses and social workers.”

In Arkansas, “you had people lying in their own waste. You had people getting bed sores because there’s nobody there to turn them. You had people being shut in, you had people skipping meals. It was just incalculable human suffering.”

What will the Agency now do with this knowledge?

In raising questions about the possibility of the offence of misfeasance in public office, the RoboDebt Royal Commission Report defined the three elements of the offence.

Misfeasance occurs where:

• 1. There is an abuse of public power or authority by a public officer. This first requirement is not contentious, but is not sufficient. Misfeasance requires further that the public officer:
  • 2. Either knew that they were abusing their power/authority or were recklessly indifferent to that fact, and
  • 3. They acted or omitted to act either with malice (the intention to harm), the knowledge of the probability of harm, or with a conscious and reckless indifference to the probability of harm.

Being silent is not an option, and nor is launching into an implementation without the very significant capability to implement what is required, and doing so safely. Such deep capability does not materialise

Page 41

within a matter of months. The JSCNDIS, the Disability Royal Commission and ANAO Audit Reports in recent months, have all described and provided evidence of an Agency in crisis and with profound capability deficits.

The government has placed the officers of the NDIA in an invidious position. The defective drafting of this Bill shows this.

“Plan Flexibility”

The concept of “plan flexibility’”is being promoted as the core of a reframed NDIS. This central concept is used as the rationale for the substantial changes proposed and the extraordinary powers being given to the Minister, the CEO and the NDIA.

The term “plan flexibility” refers to a Total Support Budget that can be used to purchase the supports a Participant requires, provided they fit within the definition of an NDIS Support under Section 10 of the proposed Bill.

This flexible budget will be generated by a mechanism that is yet to be designed - the Budget Calculation Instrument - and will be informed by a “Needs Assessment” that is yet to be developed.

We’ve been told that the only way to generate this flexible budget through the Assessment and Budget Calculation Instruments, is to define, prescriptively, what an NDIS Support is. This definition will be used to generate a list of “whitelisted” and “blacklisted” supports.

It has always been possible to use Core Supports Flexibly, unless they were stated. Except for some items during the COVID period, it hasn’t been possible to use Capacity Building Supports interchangeably with Core Supports.

However, flexibility has always been possible within each Capacity Building Category. It has always been possible to design unique and creative solutions with the Core Supports Budget, even with Supported Independent Living (SIL), but Providers have refused to do so and the NDIA have failed to encourage and support non-traditional approaches using Core Supports. If the NDIA has been incapable of encouraging creative support solutions within the already flexible Core Supports, there is nothing in this Bill that would encourage us to believe that this will change when all the funds are bundled together in a big mass.

The Bill Amendments state that when creating a Needs Assessment and Budget Calculation Instrument, the Minister must ensure the financial sustainability of the scheme, whatever that ambiguous statement means.

Of course, as someone who is an expert in business cases as well as large scale implementations, I find it strange that the analysis of financial sustainability does not take into account the following: (1) Red tape on the sector. The impact of red tape is a fundamental omission in the actuarial model: how can there be any sense of scheme sustainability with such an unquantified burden on the very market sustaining it? (2) The hundreds of thousands of jobs created. And (3).The ROI multiplier effect of Assistive Technology, and technology more broadly.

With the wide ranging powers given to the Minister to define who can access the scheme and control what will be funded, the unworkable definition of NDIS Supports and the power of the undefined Needs Assessment and Budget Calculation Instruments to manipulate the budget outcome, is this really about

Marie Johnson 41

Plan Flexibility or is this simply a smokescreen to cover a substantive agenda to reduce scheme costs by controlling who can enter the scheme and lowering plan values.

It is argued that this “Plan Flexibility” derives from not having to construct a plan budget from individual line items, because the Budget Calculation Instrument will do this. Because this instrument will be defined by a legislative mechanism this calculation will not be a reviewable decision.

And the reason why this is so concerning, is that the “automatic calculation” of funding via the Typical Support Package (TSP) algorithm, has been contested and litigated for a decade. And with the December 2023 JSCNDIS finding that the actuarial fiction of “primary disability” is inconsistent with the governing legislation - i.e. unlawful - this by definition undermines the validity of the TSP algorithm. Unlike the TSP output which can be contested, the output of the Budget Calculation Instrument cannot be contested as it will not be not be a reviewable decision.

In what I believe is a world first, this Bill puts an algorithm (the Budget Calculation Instrument) - yet to be defined - beyond the reach of administrative review.

Section 10: No Obligation for Australia to Adhere to the UNCRPD

The proposed Amendments Bill doesn’t create a legal obligation for Australia to adhere to the UNCRPD. What Section 10 of the Proposed Bill does is selectively cherry-pick words from some Articles within the CRPD in order to create a definition of an NDIS Support, giving the false illusion of human rights. In engaging in this perverse political and discriminatory exercise, the drafters of the Bill have distorted the meaning of the UNCRPD Articles they have misquoted for what can only be described as, pursuing a political agenda.

This misrepresentation of the UNCRPD is sneaky and makes a mockery of Australia’s obligations as a signatory to the Convention. This misrepresentation begs the question “What is our Government afraid of within the Convention that they refuse to to enshrine all the Articles as law within the new version of the NDIS legislation?”

Looking at Section 10: Definition of NDIS Support, it is observed that the language to describe an NDIS support has been selectively cherry picked from UNCRPD Article 26 and Article 20. What is extremely concerning, is that the wording for Article 19 of the UNCRPD, which outlines the principle that people with disabilities should be able to choose where they live, who they live with and who supports them, has been selectively culled. The wording in the Bill says:

“A support can only be an NDIS support if:

(a) the support:

(i) is necessary to support the person to live and be included in the community, and to prevent isolation or segregation of the person from the community“.

This reframing of the content and intent of Article 19 completely ignores very important requirements of this Article, which states that:

“States Parties to the present Convention recognize the equal right of all persons with disabilities to live in the community, with choices equal to others, and shall take effective and appropriate

Marie Johnson 42

measures to facilitate full enjoyment by persons with disabilities of this right and their full inclusion

and participation in the community, including by ensuring that:

• Persons with disabilities have the opportunity to choose their place of residence and where and with whom they live on an equal basis with others and are not obliged to live in a particular living arrangement;

• Persons with disabilities have access to a range of in-home, residential and other community support services, including personal assistance necessary to support living and inclusion in the community, and to prevent isolation or segregation from the community;

• Community services and facilities for the general population are available on an equal basis to persons with disabilities and are responsive to their needs.“

This is an example of how the language used to describe the contents of the Bill is misleading when it was asserted that it includes, for the first time, supports grounded in the CRPD. It is more accurate to say that the Bill does not require supports to align with the CRPD, but instead, it draws selectively from its Articles to create a distorted and inaccurate inference of alignment with the Convention.

You don’t get to cherry pick which bits of the UNCRPD you want to adhere to and those bits you don’t. This is manipulation of the Convention to create the illusion of compliance.

My further contention is, that this Bill in its entirety breaches human rights in the most reckless manner, because it is based on and assumes the use of tools/technologies/algorithms that are known to cause harm and risk human life, to be created by an agency without the expertise to do so.

Psychosocial Disability and Mandatory Assessments

I have written extensively on my family’s experience with Psychosocial disability interacting with the NDIA, and refer Committee members to my JSCNDIS submission and supplementary submission on Independent Assessments. I have also written extensively on the use of algorithms in public administration, and am an in demand expert commentator in this area. The NDIA’s defective systems and processes present substantial risk to life for people with Psychosocial disability.

The widespread systemic and worsening issue of lost documents is a catastrophic symptom of the NDIA defective systems and processes. On my daughter’s initial application, the NDIA lost her entire NDIS application - including the 400+ pages lever arch folder of medical evidence.

In addition to the photos I took at lodgement, I maintained a detailed chronology and analysis of the various interactions with the NDIS. This chronology shows that on TWELVE times, information was provided/re-sent/re-requested. The NDIS admitted to not having all the documents that were submitted at lodgment, and inconsistencies on the part of the NDIS as to what they had and when they received it.

In total, more than 30 medical reports and assessments had been provided to the NDIA over a period of 22 months as part of a seemingly never-ending process of application and review, describing in extensive detail, the diagnoses and impacts of my daughter’s long-standing, complex, significant and permanent psychosocial disability.

Marie Johnson 43

It would be more than two years before she would be accepted into the NDIS and have a plan.

As we have documented in extensive detail, my daughter’s condition worsened very significantly during the whole NDIS application and review process. Not only was my daughter initially refused the supports desperately needed (due to the NDIA administrative stuff-ups) and suffered and struggled for almost two years in the cruelest way – but my daughter and her psychiatrist both questioned whether it was worth damaging her mental health even further.

As her mother, and with the inside knowledge of the NDIA as to what was causing these issues for my daughter (and others), this situation was incredibly traumatic for me. Persevere and have the system damage my daughter’s mental health, or give up and have my daughter and her family denied justice. This was a sickening Faustian bargain.

I anticipated the trauma that she would face and that’s why I knew to take photos at the beginning of this nightmare journey - and yet with all my detailed internal knowledge, global expertise and ability to engage solicitors - I could not prevent the damaging impact of my daughter’s interaction with the NDIA.

That makes the NDIA administration manifestly unsafe, unjust, and unlawful.

The experience of lost documents and unread medical reports has continued over the years through various planning processes, and urgent complaints regarding a 75% funding cut.

The trauma of ongoing mandatory assessments present risk to life for people with Psychosocial disability: I explained this in my submission on Independent Assessments, and how such assessments are discriminatory and a breach of human rights.

To recap my JSCNDIS submission into Independent Assessments:

“In this day and age, that a government agency can forcibly and arbitrarily subject people with disability to lifelong examination and study – an intervention that has been shown to damage people - without any oversight or ethics framework cannot be tolerated by civil society.

Effectively, the NDIA is proposing to undertake human research driven by an actuarial doctrine…

This is verging on human experimentation. The view that this can happen and be justified on flimsy “actuarial” grounds has to be exposed and quashed.

To reiterate our statements in previous submissions, which describe in detail my daughter’s catastrophic experiences in applying for and dealing with the NDIS, all this underscores the sheer terror that she feels at the prospect of being forced to endure an Independent Assessment.

And for what purpose? And what “safeguards” are there in place that would anticipate such adverse reactions. None.

It would appear that the actuarial doctrine which has driven such systemic complexities and inconsistencies – and through which my daughter has horrifically suffered - will somehow be made

“more consistent” through a 20 minute outsourced high-risk arrangement.

My daughter is not an actuarial experiment. And nor is any other participant or family.

With my internal knowledge, I anticipated my daughter’s traumatic experience in accessing the NDIS and documented this in previous submissions. It now sickens me with full knowledge and in anticipation that the Independent Assessment process will proceed in spite of all the health and professional evidence to the contrary.

This will cause immense trauma perpetrated by government on its most vulnerable citizens in full knowledge of the evidence that these processes cost people their lives.

Effectively, the NDIS is proposing to undertake human research driven by an actuarial and political doctrine, without evidence and without ethics oversight. This is verging on human experimentation.

Australian civil society must not tolerate the actions of government that forcibly and arbitrarily subject people with disability to lifelong examination, study and monitoring. History is a reminder of where these actions can lead. That this control of people with disability will be effected through technologies such as biometrics, algorithms and blockchain is anathema to a harmonious and inclusive civil society and the human rights of all people.“

What will save Participants costs, time and trauma is for the NDIA to get its house in order first and to bring about consistency in its processes, communication and transparency in decision making.

Pushed off the NDIS cliff, will be tens of thousands of people with Psychosocial disability. The souls in society that no government wants. I speak of this with some experience. People will die as a direct result of this.

Perhaps I should recite the cases of people with Psychosocial disability that the NDIA ceased communication with and abandoned them, because these poor souls did not and could not answer the phone. Death resulting. Think about that.

Instead of addressing the horrific capability and culture of the NDIA NDIS regarding people with Psychosocial disability, the answer in the NDIS Review and through the mandatory assessments provision in this Bill, is to subject people with Psychosocial disability to ongoing mandatory assessments - using tools (algorithms) yet to be designed - and to sort people out and push them out into a fantasy land no-man’s land of another made-up concept “foundational supports” that do not exist.

This Bill must be defeated. And the dangerous rollout of the PACE system must be halted immediately.

END

Marie Johnson 45

References

JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA). Report. November 2023. https://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/RB000146/toc_pdf/CapabilityandCultureoftheNDIA.pdf

JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA). Submission by Marie Johnson, Submission 137 Attachment 1, Supplementary Statement, 3 March 2023. Note: Statement produced in full as Attachment A. https://www.aph.gov.au/DocumentStore.ashx?id=db365fea-d327-4683-a9f2-1f72de0cbf74&subId=722398

JSCNDIS Inquiry into Independent Assessments. Submission by Marie Johnson. Submission 33. hhtps://www.aph.gov.au/DocumentStore.ashx?id=92a45ded-c00c-4946-9776-812353f486df&subId=703536 33.1 Supplementary to Submission 33 https://www.aph.gov.au/DocumentStore.ashx?id=533ec41c-a4f0-4934-96a8-2321d2f1f738&subId=703536

ANAO Audit Report. Management of Complaints by the National Disability Insurance Agency. 22 April 2024. https://www.anao.gov.au/work/performance-audit/management-complaints-the-national-disability-insurance-agency

National Disability Insurance Scheme—Risk Management Rules 2013 https://www.legislation.gov.au/F2013L01183/asmade/text

ANAO Audit Report. Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports. 28 June 2023. hhtps://www.anao.gov.au/work/performance-audit/effectiveness-the-national-disability-insurance-agencys-management-assistance-daily-life-supports

ANAO Audit Report. National Disability Insurance Scheme - Management of Transition of the Disability Services Market. 9 November 2016. https://www.anao.gov.au/sites/default/files/ANAO_Report_2016-17_24.pdf

ANAO Potential Audit. 2023-2024. Design and implementation of the Participants, Platforms and Processes Program. https://www.anao.gov.au/work-program/search?query=ndia&items_per_page=10

Interim Report of the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. September 2003. hhtps://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/RB000228/toc_pdf/Report500InquiryintoprocurementatServicesAustraliaandtheNDIA-InterimReport.pdf

Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. Salesforce Submission. hhtps://www.aph.gov.au/DocumentStore.ashx?id=83135614-e40c-4372-9079-993f82dc4550&subId=750355

FOI: Does the NDIA’s proposed reliance on Salesforce guarantee PROTECTED data classification and ensure NDIS data remains exclusively restricted to Australia only? 11 June 2021 ehhtp://www.righttoknow.org.au/request/does_the_ndias_proposed_reliance?unfold=1 https://compliance.salesforce.com/en/irap

Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. Salesforce Supplementary Submission. hhtps://www.aph.gov.au/DocumentStore.ashx?id=eb4c6ec4-f10d-4b2d-9e1c-24895c95c452&subId=750355

Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. NDIA Supplementary Submission 10.1 hhtps://www.aph.gov.au/DocumentStore.ashx?id=685b6468-0ab9-4fd1-adb0-0d4ee3f42876&subId=750959

NDIA backs infosec after internal report kept private. Ry Crozier. iTNews. 4 October 2023. http://www.itnews.com.au/news/ndia-backs-infosec-after-internal-report-kept-private-600713?

Marie Johnson 46

FOI: NDIS: Salesforce disruption, outage or failures. 23 March 2022. https://www.righttoknow.org.au/request/ndis_salesforce_disruption_outag

FOI: NDIS: Only entity in the world not affected by Salesforce Global Outage? (2021). 22 April 2022. https://www.righttoknow.org.au/request/ndis_only_entity_in_the_world_no

FOI: Copy of the full evaluation of the Tasmanian NDIS PACE test. 10 August 2023. https://www.righttoknownow.org.au/request/copy_of_the_full_evaluation_of_t#incoming-31984

644 NDIS users not told which medical records leaked, seven months after HWL Ebsworth hack. Jeremy Nadel. iTNews. 19 January 2024. https://www.itnews.com.au/news/644-ndis-users-not-told-which-medical-records-leaked-seven-months-after-hwl-ebsworth-hack-604 150

Failed DNS server restarts caused Salesforce outage. Juha Saarinen. iTNews. 22 May 2021. https://www.itnews.com.au/news/failed-dns-server-restarts-caused-salesforce-outage-564893

Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. Submission by the Australian Federation of Disability Organisations (AFDO). hhtps://www.afdo.org.au/wp-content/uploads/2023/08/AFDO-Submission-Inquiry-into-Procurement-at-Services-Australia-and-NDIA-August-2023.pdf

FOI. 05 February 2021 | ACE Project Risk Review. AAT2022-4295 - Matter 6 - Document for release on 20230418 - Redacted.

PWC (2016) National Disability Insurance Scheme MyPlace Portal Implementation Review - Final Report, section 21: Conclusions, dated 31 Aug 2016. Available at: < https://www.dss.gov.au/sites/default/fil…

ALERT: NDIS PAYMENT ISSUE. Disability Intermediaries Australia. 6 December 2023. https://www.intermediaries.org.au/news/alert-ndis-payment-issues/

DIA PACE ISSUES ESCALATION. Disability Intermediaries Australia. 1 December 2023. https://www.intermediaries.org.au/news/dia-pace-issue-escalation/

‘Mass exodus’ of disability support providers on the horizon, data suggests. Disability Support Guide. August 2023. https://www.disabilitysupportguide.com.au/talking-disability/mass-exodus-of-disability-support-providers-on-the-horizon-data-suggests

When Govt took a wrecking ball to the NDIS operating model. Marie Johnson. InnovationAus. 3 May 2022. https://www.innovationaus.com/when-govt-took-a-wrecking-ball-to-the-ndis-operating-model/

NDIA BEGIN ‘TEST’ OF NEW PACE SYSTEM IN TASMANIA. Disability Intermediaries Australia. 11 November 2022. https://www.intermediaries.org.au/news/ndia-begin-test-of-new-pace-system-in-tasmania/

The NDIS test in Tasmania: insights from our evaluation. NDIS. 14 November 2022 - 31 March 2023. The NDIS test in Tasmania: - insights from our evaluationNational Disability Insurance Scheme (NDIS)https://www.ndis.gov.au › media › download › att…

Junked $191m Centrelink calculator was ‘slow and defect-ridden’. Justin Hendry. InnovationAus. 11 September 2023. https://www.innovationaus.com/junked-191m-centrelink-calculator-was-slow-and-defect-ridden/

Permissions denied: Home Affairs tech platform gets the hook. Joseph Brookes. InnovationAus. 11 July 2022. https://www.innovationaus.com/permissions-denied-home-affairs-tech-platform-gets-the-hook/

United against algorithms: a primer on disability-led struggles against algorithmic injustice. Georgia van Toorn. ARC Centre of Excellence for Automated Decision-Making and Society. 15 April 2024. hhtps://apo.org.au/node/326312

Marie Johnson 47

What happened when a ‘wildly irrational’ Algorithm made crucial healthcare decisions.

https://www.theguardian.com/us-news/2021/jul/02/Algorithm-crucial-healthcare-decisions?CMP=Share_iOSApp_Other

Dutch scandal serves as a warning for Europe over risks of using Algorithms.

https://www.politico.eu/article/dutch-scandal-serves-as-a-warning-for-europe-over-risks-of-using-Algorithms/

Not just A-levels: unfair Algorithms are being used to make all sorts of government decisions.

https://theconversation.com/not-just-a-levels-unfair-Algorithms-are-being-used-to-make-all-sorts-of-government-decisions-145138

Permissions Capability Industry Information Paper. Delivery of a Permissions Capability for Government Services. Department of Home Affairs. Digital Transformation Agency. October 2020.

https://www.homeaffairs.gov.au/programs-subsite/files/permissions-capability-industry-information-paper.pdf

Joint Committee of Public Accounts and Audit. Inquiry into the Failed Visa Privatisation Process and the Implementation of Other Public Sector IT Procurements and Projects. 30 November 2023.

https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Public_Accounts_and_Audit/IT_procurement_and_projects

Govt scraps NDIS ‘robo-planning’ after states revolt.

https://www.innovationaus.com/govt-scraps-ndis-robo-planning-after-states-revolt/

‘Unethical’: NDIS Participants ‘lured’ into trials. https://www.innovationaus.com/unethical-ndis-Participants-lured-into-trials/

Robo-debt public servants now shaping the NDIS.

https://www.thesaturdaypaper.com.au/news/politics/2021/04/10/robo-debt-public-servants-now-shaping-the-ndis/161797680011420# hrd

Inquest cancelled into death of man with disabilities as family drip-fed crucial information on NDIS failures.

https://www.msn.com/en-au/news/australia/inquest-cancelled-into-death-of-man-with-disabilities-as-family-drip-fed-crucial-informatio n-on-ndis-failures/ar-AA13spVP?fbclid=IwAR3Y-Wy2kXXlYgras429mPQo72_tH39m2i8Cou77pDG__1dT1PnZu7M7ijI

https://www.itnews.com.au/news/644-ndis-users-not-told-which-medical-records-leaked-seven-months-after-hwl-ebsworth-hack-604 150

A Look Inside the Deadly Digital Transformation Agenda that created RoboDebt and RoboNDIS. Marie Johnson. Substack. 14 April 2023.

https://open.substack.com/pub/mariehjohnson/p/a-look-inside-the-deadly-digital?r=ynoa&utm_campaign=post&utm_medium=web

No ‘fairness’ in the harm caused by Algorithms. https://www.innovationaus.com/no-fairness-in-the-harm-caused-by-Algorithms/

NDIS Algorithms and King Henry VIII powers. https://www.innovationaus.com/ndis-Algorithms-and-king-henry-viii-powers/

‘Citizen-centric’ demolished by NDIS Algorithms. https://www.innovationaus.com/citizen-centric-demolished-by-ndis-Algorithms/

Govt scraps NDIS ‘robo-planning’ after states revolt.

https://www.innovationaus.com/govt-scraps-ndis-robo-planning-after-states-revolt/

‘Unethical’: NDIS Participants ‘lured’ into trials. https://www.innovationaus.com/unethical-ndis-Participants-lured-into-trials/

Robo-debt public servants now shaping the NDIS.

https://www.thesaturdaypaper.com.au/news/politics/2021/04/10/robo-debt-public-servants-now-shaping-the-ndis/161797680011420# hrd

Marie Johnson 48

Attachment A

Submission by Marie Johnson, Submission 137 Attachment 1, Supplementary Statement, 3 March 2023. JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA)

https://www.aph.gov.au/DocumentStore.ashx?id=db365fea-d327-4683-a9f2-1f72de0cbf74&subId=722398

Marie Johnson 49

National Disability Insurance Scheme Amendment (Capability and Getting Culture of NDIS the NDIABack on Track No. 1) Bill 2024 [Provisions]

Submission 137 - Attachment 15

JSCNDIS Inquiry into the Culture and Capability of the NDIA

Supplementary Statement by Marie Johnson

Addendum to Submission 137

Joint Standing Committee

On the National Disability Insurance Scheme Senate Inquiry – Capability and Culture of the NDIA

Supplementary Statement by Marie Johnson

Addendum to Submission 137

~ RoboDebt + RoboNDIS ~ Culture that Automated Harm

Marie Johnson CEO Centre for Digital Business Pty Limited ABN: 16 162 122 072

3 March 2023

Marie Johnson CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

Submission 137 - Attachment 15

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

BACKGROUND

I would like to thank the Committee for the opportunity to meet the Committee and make a statement.

I am the former Head of the NDIA Technology Authority, a specialist appointment reporting directly to the NDIA CEO. I led the business case for the NDIS ICT systems, and for this to be based on co-design and the principles of the UN Convention on the Rights of Persons with Disabilities. I was responsible for establishing co-design, a capability which would later be abandoned by the bureaucracy. A disastrous action of significant consequence. Everything I predicted would happen, has happened because of this.

In providing this testimony, I draw on my lived experience of family with disability interacting with the NDIA. I was honoured to receive the ACT Mental Health Carer Award for 2022.

This supplementary statement tabled in full is lengthy, describing in detail with evidence my detailed internal knowledge of the NDIA and evidence of systemic defects; systemic breaches of the NDIS Act and other unlawful practices; and extreme cyber security risks.

I am also often asked about the ‘new’ PACE Salesforce system – and will it fix things. My answer to this is no. The same errors are being repeated, with risk compounded by dangerous predictive algorithms and algorithmic processes modelled on RoboDebt. I explain in detail throughout this written supplementary statement.

In this testimony I will highlight key issues that warrant exposition, starting with my professional background and my family’s horrific experience with the NDIA.

My professional background and expertise are relevant to the comments I am making. I am the CEO of the Centre for Digital Business, a digital services AI company. I am a recognised global digital authority; author and commentator on artificial intelligence; human rights; technology; ehealth; cyber; identity; and ethics.

I have been at the forefront of digital transformation for decades, with a track record across the public and private sector in Australia and internationally, covering health and human services; disability services; visa systems; tax; identity; and payments.

I was awarded the prestigious US Government O-1 Visa for Individuals with Extraordinary Ability or Achievement, many years ago, to take up the role leading Microsoft’s Worldwide Public Services and eGovernment business based in Seattle.

For many years, I was the Chief Technology Architect for the Australian Department of Human Services, with responsibilities including the architecture and technology business cases bringing together the massive systems of Centrelink, Medicare Australia, and the Child Support Agency.

I was previously the Chief Technology Architect for the Australian Health and Human Services Access Card.

I have an exceptionally deep knowledge of the NDIA processes, and the NDIS ICT system built and delivered by DHS. I also have extensive knowledge and operational experience of the cross-government capability, systems, and architecture on which the NDIA is dependent.

I was an Inaugural member of the ANU Cyber Institute Advisory Board. In my early career, I led an intelligence team on an organised crime investigation run by the National Crime Authority. For many years I was the Independent Member on the AFP Spectrum Board.

From my experience I believe that the NDIA systems and processes are the most defective and dangerous in government. The defective NDIA systems which I have been writing about for years, not only directly cause harm but present risk to life.

Marie Johnson 2 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

The many hundreds of submissions to this inquiry and to previous inquiries including the inquiry into Independent Assessments, all of which I have read in preparation for this statement, present irrefutable evidence of this. Every submission is like ours. That is not a coincidence.

I was working at the NDIA as the Head of the Technology Authority during the period when RoboDebt was being devised and rolled out, under what would become whole-of-government digital and automation strategies.

As the former Chief Technology Architect of DHS and with extensive whole-of-government and global experience, I well understand whole-of-government strategies and what automation involved and the implications.

I knew too much and had too much experience to be dazzled by the technology hubris across government, pushed by tech companies and consulting firms – with hundreds of millions of dollars at stake - that would cause so much harm.

My perspective has long been the fundamental need for co-design, not only to ‘improve the client experience’ but more importantly as an essential governance and ethics mechanism to protect human rights.

My role with the NDIA involved amongst other things, the establishment of an end-to-end co-design capability, staffed by NDIA staff with disability.

As I explain in detail in this statement, end-to-end co-design is necessary in order to map the life cycle of data.

Co-design would eventually be dumped by the bureaucracy, with significant consequence. The culture across the bureaucracy was brutal and toxic.

I was criticised by powerful personalities within the broader bureaucracy, outside the NDIA, for taking co-design ‘to the extreme’. That this gave the NDIA perspective that did not accord with the DHS direction.

I was personally vilified and accused of a lack of loyalty for ‘not supporting DHS’. I had to choose between NDIA and DHS, and I chose NDIA.

As RoboDebt was starting to blow up, it was said to me that for ‘not supporting DHS’, I could not be saved from the consequences of this choice.

I was yelled at. Book slamming in meetings. Equipment slammed. I was dis-invited to meetings. Senior DHS bureaucrats would simply not show up at critical meetings, long planned, involving interstate, and international attendees.

The treatment of disabled and neurodivergent staff was disgraceful – and in fact, unlawful. Moved around – ‘where could we park them’. Spoken about in the most offensive, disparaging and hurtful language.

Accommodations and adjustments were difficult and had to be justified, ridiculously – including assistive technology, and from evidence at Senate Estimates, this is still the case.

Meetings would be cancelled without notice, and this happened not only with the DHS but also the Digital Transformation Office (now DTA). The DTO cancelled at least 6 meetings, the last cancellation just one hour before the meeting was to take place. With no care or consideration for disabled attendees, for the length of time and effort involved including with support workers, in preparing for and travel to meetings.

According to DTO, DHS would be representing the needs of the NDIA in ‘whole-of-government’ digital transformation. No need to meet with disabled people. Well, one size fits all, fits no one.

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

The IT bureaucrats would determine what people with disability would and would not get – and then put the ‘offerings’ in front of people with disability for testing, and dress this up as co-design. This is still happening.

Clearly, digital government is not meant for people with disabilities and their families.

And because I was taking a divergent approach – which was absolutely needed, endorsed, and funded in the business case - it was said to me quite menacingly, that taking a stand on co-design at the same time that RoboDebt was blowing up in the media, for ‘not supporting DHS’, I would not work for government in Canberra again.

I was not the only one to be threatened in this way. This was and is a common practice.

At the end of my contract, I left to take up opportunities overseas in AI. And I will say, that my work in AI has continued to be acknowledged globally.

I did not deserve this treatment. Nor did the many disabled people who were undertaking extraordinarily important work.

And nor did my daughter and family deserve to suffer the consequences of all this – defective harmful technology born of supreme arrogance and incompetence.

I feel that I am able to say these things now, given what is now on the public record through the RoboDebt Royal Commission. Whilst I was not involved in RoboDebt, given my previous role as the DHS Chief Technology Architect, my expert presence inside the bureaucracy with NDIA, was perhaps seen as inconvenient.

And it is no surprise that Robo practices have become embedded in the NDIA, with the same horrific results.

RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government digital and automation strategies driven by DHS, now Services Australia.

There is a duty in law and ethics to understand the ‘why’ and ‘how’, including the distorting and destructive power of defective systems and algorithms used at scale by the state.

It is the purpose of my expert testimony with evidence to expose these questions. Without doing so, further harm cannot be prevented.

In my family’s experience, I did not have a crystal ball. I did not need a crystal ball.

I knew ahead of time exactly what my daughter and our family were in for.

FAMILY EXPERIENCE

The continuing telling of our family’s experience is immensely traumatising. But we feel we have no option. Telling our story in the hope that it will help change things, and suffer in the telling. Or shut up and suffer anyway.

My daughter’s initial NDIS application was REFUSED because the NDIA LOST her entire application, including the 400+ pages lever arch folder and documents.

It had taken her more than TWELVE MONTHS to assemble almost TWENTY years of medical evidence, including having made additional specialist appointments for reports and assessments to be written at very considerable cost.

In anticipation of the torture that my daughter went on to actually experience, I took photographs of her at the NDIA offices lodging her application; which was stamped and receipted by the NDIA officer at my insistence.

Marie Johnson 4 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture the Of NDIS the NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

The reason why I took the photos, is that I knew ahead of time the gross deficiencies in the Agency culture, capability and processes and anticipated the very difficult time my daughter would have. I knew exactly what would happen. This haunts me.

And we fought a bitter battle for two years to have that perverted refusal decision over-turned. Throughout the application and appeal period, I maintained a detailed chronology and analysis of the various interactions with the NDIA.

The chronology shows that on TWELVE times, information was provided/re-sent/re-requested. The Agency admitted to not having all the documents, even though we had receipts showing inconsistencies on the part of the Agency as to what they had and when they received it.

And yet with all my detailed internal knowledge and ability to engage solicitors, I could not prevent the damaging impact on my daughter of the interaction with the NDIA.

UNLAWFUL ALGORITHMS ~ ABSENCE OF ETHICS ~ RISK TO LIFE In previous evidence, I have described the over-reach of the actuarial function, and the system and systemic risks this creates. These risks are catastrophic, not understood and not documented.

The NDIS actuary function operated as a closed loop that created the algorithms without governance or ethics framework; designed assessment interventions opposed by the medical and health community; determined services based on a fiction; designed the so-called digital experience; and then reported the outcomes.

Effectively, participants have been subject to a perverse form of human experimentation. This must never be allowed to happen again.

But mere changes to the org chart and reporting lines won’t fix this. The role of the actuary needs to be legislatively limited and legislatively counter-balanced by co-design and ethics. I will talk more about co-design later in this testimony.

Throughout this testimony, I will raise questions of lawfulness and unlawfulness of the construction and operation of these algorithms and systems; and whether misfeasance or malfeasance in public office has occurred.

Similar questions were raised during RoboDebt Royal Commission1 hearings, with the examination of legal advice regarding misfeasance in public office, that if established, could be a basis for a class action.

This was of course, the RoboDebt class action. Some of the elements of misfeasance in public office covered in that legal advice, include:

• the defendant must be the holder of a public office…
• the defendant must have been recklessly indifferent to whether the act was beyond power and recklessly indifferent to the likelihood of harm being caused to the plaintiff;
• the defendant must have acted with reckless indifference to whether the act was beyond power and there must have been, objectively, a foreseeable risk of harm to the plaintiff.

Legal advice regarding malfeasance in public office was also exhibited. RoboDept and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government automation strategies driven by DHS, now Services Australia.

The first question of lawfulness goes to the very foundation of the NDIS.

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

Given that the NDIS legislation specifically allows for MULTIPLE DISABILITIES, questions need to be asked about the origins and evidence basis of the actuarial fiction of ‘primary disability’. And question whether the fictional device of ‘primary disability’ arose because the systems built by DHS could not be configured for multiple disabilities. Was this design fiction of ‘primary disability’ ever examined as to its LAWFULLNESS or UNLAWFULNESS? So fundamental is this question, that its status simply cannot be ignored, assumed or accepted unchallenged. This might very well be a catastrophic multi-billion-dollar design defect: one that has caused untold human harm, including for my family. Putting in bluntly and simply, the NDIA system can only cater for one disability - the ‘primary disability’. People have to pick one. Let that sink in. And the consequences are catastrophic. This is in breach of Section 24 of the NDIS Act ‘Disability Requirements’, which legislatively specifies one or more disabilities and ‘impairment or impairments’. As if anybody – including health professionals - would actually be able to do this, or even understand the consequences of such a decision to ‘pick one’. This is a human rights, ethics and legal minefield. The whole operating model panders to the complexity of this actuarial fiction. There are so many processes, systems, appeals, reviews, rules, administrative loops, turgid language, assessment reports, and human harm because of it. Horrific system-wide costs and yet people still do not get the supports they need. And as demonstrated throughout the whole INDEPENDENT ASSESSMENT debacle, notwithstanding the risk to life, the NDIA recklessly pursued the use of systems, algorithms and methods that have been shown in other jurisdictions to harm people leading to death. In fact, and against the advice of health professionals, the AMA and others, the Agency ruthlessly and recklessly used these systems, algorithms, and methods in trials of Independent Assessments. Did the NDIA have any knowledge or evidence that the application of algorithms results in harm and death? An answer either way - yes or no - is damning. The NDIA either had this knowledge and recklessly ignored it. Or did not have this knowledge - which is readily publicly obtained - and recklessly decided not to acquire and investigate this knowledge.

Specifically, what is the process and governance by which the algorithms and methods were/are developed: including the governance regarding safety, risk and ethics?

And in evidence at the JSCNDIS inquiry into Independent Assessments, NDIA executive shockingly stumbled over whether or not there was even an ethics framework (there is none), and appeared to not even understand the question. How could IA trials – effectively human research – progress so far, in the absence of the necessary ethics governance as outlined in the National Statement on Ethical Conduct in Human Research 2007 (Updated 2018).2 Other notable health and research experts also documented concerns in submissions.3

National Disability Insurance Scheme Amendment Capability and Getting Culture theof NDIS theNDIABackonTrack No. 1 Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

‘Should an external body seek to complete a study using the same methodology as outlined in the IA pilot, researching NDIS participants, they would be required to adhere to the National Statement on Ethical Conduct in Human Research (NMHRC, 2018), and the study would be overseen by an independent Human Research Ethics Committee (HREC) [9]. Human Research Ethics Committees oversee ethical conduct in research practice, including, but not limited to: human research process; evaluation of risk of participants; informed consent; data and record management; publication of findings; conflict of interest; and the handling of allegations of research misconduct. Why do these research standards not apply to research undertaken by the NDIA?’ [Emphases added]

The message here is that rigorous training is needed for any profession whether it is health work or qualitative research in order to conduct the work in a careful, appropriate and scientific manner. Assumptions, biases, methods and researchers behaviours must be subject to scrutiny and ethics.

The lack of fundamental ethics governance in the core operations of the Agency, is a most reckless capability failure.

One of the most alarming consequences of this, is that there remains no documented risk to life, arising from the Agency’s own operations.

And notwithstanding this, the widespread implementation of RoboPlanning and NDIS RoboDebt compliance practices was occurring at the same time the RoboDebt Royal Commission was hearing of harms resulting from the same practices and methods.

Later in this submission, the NDIA is shown to be recklessly confused and conflicted over privacy, data protection and risk.

Furthermore, in my submission to the JSCNDIS Inquiry into Independent Assessments, I detailed cyber security concerns about systems and applications being used by the NDIA in Independent Assessment trials that would see personal sensitive data processed by uncleared contractors and transmitted unprotected offshore.

Built on the actuarial fiction of ‘primary disability’ are roboplanning algorithms, based on the equally flawed concept of statistical averages.

‘Mathematically this is wrong because an average for a fluctuating variable never speaks to its constituent parts.’4

The community has come to understand the horrific impact of ‘averaging’ in the unlawful RoboDebt catastrophe, happening in the very same portfolio as NDIS.

Algorithms based on ‘behavioural insights’ create a fiction, a persona comprised of assumed or typecast features whose fictional behaviours are used as a proxy in order to predict behaviours of real people, and for this prediction to be treated as fact. It makes huge generalisations, reductions and determinations on complex human conditions, experiences and disparate factors.

This perverts power and access to justice in a number of ways.

The state, with all its power, is automating decisions relating to individuals, based on ‘insights’ and fiction. Not evidence.

By contrast, the individual, must produce extraordinary evidence to prove otherwise in order to overturn the fiction-based automated decision of the state (the NDIA) - evidence which the state ignores.

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

The problem with algorithms based on personas and behavioural insights, is in its application to administrative decision making by the state – not some marketing function. And we see the catastrophic result of this in both RoboDebt and RoboNDIS. The NDIS legislation specifies that PLANS are INDIVIDUALISED and directed by the participant. That facilitate tailored and flexible responses to the individual goals and needs of the participant. The application of statistical averages in automated roboplanning eliminates the individual person and their needs, transmuted instead to a fictional average, a fictional ‘persona’. Roboplans are incompatible with the legislation and therefore UNLAWFUL. And this is happening systematically at scale.

This is in breach of Part 2 Section 31 (a) of the NDIS Act ‘Participants’ Plans’: the first principle, that plans be INDIVIDUALISED. These algorithmic roboplanes eliminate the stated legislative rights of the participant… …AND they also over-ride the CEO’s legislated responsibilities, breaching Section 33 (5) of the NDIS Act which states: that the CEO MUST have REGARD for the individual participant stated goals, reports and assessment.

This is not an isolated, one-off or mistaken breach. It is happening at scale to all participants. A fictional ‘persona’ does not exist; does not have goals; does not have rights. And nor does the algorithm, which is also not a person, have the human capacity to exercise REGARD - that is, the legislated responsibility of the CEO, a defined person. So here we see two UNLAWFUL devices at the very core of the NDIS: one. The actuarial fiction of ‘primary disability’. And two. The algorithmic elimination of the legally defined rights of the participants as individuals and the annulment of the CEO’s responsibilities to exercise REGARD. My daughter’s plan was cut by 75% creating a situation of extreme safety and health risk. Her current situation is not an isolated or one-off circumstance. The harm she is continuing to suffer is the only outcome - the only possible and inevitable outcome - of a system that is recklessly driven by dangerous algorithms. The depth of the cuts across the different categories of my daughter’s plan is extreme and has created significant safety risks. Critical areas have been completely de-funded. This is a reckless withdrawal of funding so as to make the whole plan unworkable, unsafe, and a risk to life. This is in contravention of many areas of the NDIS Act; contravention of other Commonwealth legislation including the Public Service Act; and contravention of international conventions.

My daughter’s treatment was and is UNLAWFUL. We asked what was the basis for the 75% cut, and there was no explanation given. We could appeal. or go to the AAT. We appealed on safety and hazard grounds. An urgent communication IGNORED by the Agency for a MONTH.

National Disability Insurance Scheme Amendment (Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

While the government has now abolished the AAT, as an instrument of justice, the AAT was never an option for us and for many thousands of people. We are deeply traumatised, we knew the AAT process would be destructive, as was the original access appeal.

We could not face the unthinkable.

ALGORITHMS AND THE DENIAL OF ACCESS TO JUSTICE

But this is far more than culture. This is a large-scale orchestrated denial of human rights and denial of access to justice – orchestrated either by intent or recklessness or defective systems – most likely all of these.

Not only are these algorithms incompatible with the NDIS legislation, perverting individuals’ access to life supports and services, but these algorithms continue to have a catastrophic impact on the broader operation of access to justice.

That a judicial body such as the AAT and advocacy groups could be so overwhelmed by the scale and network effects of an algorithm, signals a completely different risk that central government is either choosing to ignore or inexcusably ignorant of.

In my opinion, perhaps the most concerning aspect of algorithmic decision making is that any human who might be in the loop, will defer to the algorithm because they are simply overwhelmed by contracted volumes and KPIs.

Local Area Coordinators. Planners. Decision makers. Appeals officers. Health professionals. Legal representatives for the agency. Legal representatives for participants. Members of the AAT - and its successor.

Across all these parties making decisions regarding the lives of people with disabilities, there is not a common – or any – understanding as to the construction and effect of the algorithms.

How exactly is the AAT or its successor or a temporary taskforce, ever to understand the black box algorithms and determine if these are just, safe, and lawfully applied? Indeed, do they have the expertise and authority to make such a determination?

At the core of the NDIS, are unlawful opaque algorithms that cannot be explained. We were not given an answer to our question about the basis of the 75% cut. I intentionally asked this question because I knew that the LAC couldn’t or wouldn’t give an answer.

And on the evidence of a great many submissions, the standard operating practice of the NDIA is ‘no explanation of how plans are constructed and cut.’ UNLAWFUL on so many levels, and in breach of the NDIS Act, Public Service Act, and AD(JR) Act.

Submission 120 from People with Disabilities WA (PWDWA), provides extraordinary insight into the widespread the practice of ‘no explanation’.

Most Planners believe they don’t need to respond to a request for reasons about a planning decision made by the NDIA despite s 13(2) of the AD(JR) Act making administrative provision for requests.’

The submission from PWDWA, also provides evidence of the harmful impact of KPIs:

The LAC Planner stated that they do not get any time to read or review any of the reports submitted, and they go into these planning meetings without any knowledge of the case or the person. The LAC Planner further stated that there is a pressure to conduct 8 planning meetings per day, giving them an hour maximum for each meeting.’

This is the most serious perfect storm of risk.

Marie Johnson 9 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture the Of NDIS the Ndias Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

That LACs are incented and driven by KPI’s to drive throughput by not reading reports; not providing explanations; not discussing goals; incented to reduce budget load over their participant caseloads using dangerous and opaque algorithms that they cannot explain, notwithstanding the medical evidence regarding the health and safety of the participant.

Targets driven by NDIA practices such as the ‘Hour of Power’ to finalise roboplans, explains a lot of our experience. And the experience described by a great many people.

Worryingly, the RoboDebt Royal Commission has also heard evidence of a similar practice – the ‘Boost Board’ – introduced to drive targets in RoboDebt notices.

It is no coincidence that opaque algorithms, robo-decisions and KPI’s are common to both RoboDebt and RoboNDIS.

Further evidence at the RoboDebt Royal Commission, heard that:

‘The online compliance interaction through myGov is a key component of this measure that enables the significant increase in compliance activity and cost savings by removing the need for staff decision making.’ [Emphasis added].

This is Robo administration at scale, where humans – both the decision-makers and applicants (whatever their situation or condition) are automated out.

What is directly witnessed is that the algorithm has taken over, causing systemic defective administrative decision making, which is then sent into the cycle of plan review.

The interplay of algorithms and KPIs also dangerously perverts ‘complaint resolution’ actions. We made an urgent serious safety complaint, which was ignored. My daughter supported her 2022 plan review and appeal with ELEVEN reports – this in addition to the THIRTY medical reports submitted in her initial NDIS application and in addition to the countless additional reports in the just TWO years she has been a participant in the NDIS. So all up, in just TWO short years as many as FIFTY reports have been provided to the NDIA. The financial cost of this is extraordinary and the human toll of this on my daughter is sickening. In this one and only plan review, my daughter was informed that the recording of her disabilities in the system was CHANGED singularly to bipolar disorder – an arbitrary and dangerous splitting out of one element of the cluster of complex conditions that constitute her psychosocial disabilities. All the THIRTY medical reports provided to the NDIA on her initial application – and as many as FIFTY reports all up – describe the interplay and compounding impact of these complex conditions. My daughter has provided several detailed personal statements describing the severity and life impact of these conditions. Her husband, father and I have all provided detailed personal statements. The NDIA has ignored the advice of all these reports, arbitrarily, aggressively and punitively withdrawing funding to a dangerous level - driven by roboplanning algorithms - in contravention of the medical advice and my daughter’s own stated goals, leaving her deeply vulnerable, at risk and unsupported. And far worse. A person who my daughter has not met before and who by their own admission had not read or had lost my daughter’s documents - more documents lost yet again - informs her that her disability has been CHANGED in the system. This arbitrary action not only ignores the TWENTY years of medical diagnosis but CHANGES it – by a person not qualified to do so.

This is INTERFERENCE with medical evidence. And it is UNLAWFUL.

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDIABack on Track No.

SubmissionSubmission137 - Attachment15

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

Furthermore, notwithstanding the FIFTY reports – including the ELEVEN reports my daughter provided in support of the 2022 plan review and appeal process and which the Agency lost and ignored – the LAC wanted my daughter to provide even MORE reports including further personal statements.

Not read, are my daughter’s harrowing personal written statements that have already been made. The LAC was told of the extremely desperate situation in writing following the catastrophic 75% funding cuts.

And yet, while even more reports were demanded, my daughter’s own request to discuss, review and update her goals were ignored and denied.

KPIs that do not allow the time to consider goals. An organisational culture and behaviours that are antagonistic to this.

Being denied the right to discuss goals and update ‘about me’ statements, is happening across the board. There is out-roar over this in participant forums.

The NDIA and LACs are REFUSING participants’ legislative right to update their goals, breaching Section 33(1) of the NDIS Act ‘the participant’s statement of goals and aspirations’.

This in addition to the earlier discussion on the systemic breaches to Section 33(2) of the NDIS Act ‘statement of participant’s supports’ arising from the use of roboplans and algorithms.

What is being experienced across the board, is the systemic and orchestrated breach of Section 33 of the NDIS Act that covers the TWO legislated pillars of a participant’s plan: the participant’s statement of goals and aspirations Section 33 (1) AND the statement of participant’s supports Section 33 (2).

The day following the plan review meeting, my daughter communicated with the LAC via email stating that she had not been given the opportunity to discuss her goals in the plan review meeting the previous day.

My daughter requested the opportunity to discuss her goals before the plan was finalised, but this request was ignored and a mere 27 MINUTES later was informed that the final plan had been submitted.

75% cut. Not explained by the Agency. But we explained that what this means is the aggressive, immediate, and unsafe removal of supports; enforced isolation; and denial of access to life saving therapies.

Again, request a review or go to the AAT is the default position of conflicted LACs who are driven by KPIs to ram through plan reviews and reduce plan budgets, but don’t bear the financial costs of the reviews and AAT actions. Want to appeal?

The LAC threatened the prospect of further cuts if we did appeal.

Contracted LAC organisations are acting in their own financial interests, defined by KPIs, which is in conflict with the interests of the participant. Incented and driven by KPI’s to drive throughput by not reading reports; not providing explanations; not discussing goals; deterring appeals; and incented to reduce budget load over their participant caseloads using dangerous and opaque algorithms that they cannot explain.

This is a fundamental defect of the outsourced NDIA operating model, and is a catastrophic breach of the NDIS Act, other Commonwealth Acts, and UN Conventions.

SAFETY: A CATASTROPHIC CAPABILITY FAILURE

The NDIA does not have the culture nor the capability to manage the psychosocial caseload.

Marie Johnson 11 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

Reckless and life-threatening decisions are being made in direct contravention of the advice of treating psychiatrists and health teams, by people not qualified; with no consultation; with no transparency; and without any accountability for the consequences of risk to life. The NDIA is operating dangerously and is incapable of addressing operational safety. Matters of safety need to be considered by the Committee as a catastrophic capability failure of the NDIA itself, as distinct from safety risks arising from providers and outsourced contractors. I am not aware that operational safety risks of the Agency itself have ever been considered. Certainly from my knowledge, ‘risk to life’ from the Agency’s own operations, is not a risk that has been acknowledged or documented by the Agency. We lodged a serious urgent safety complaint with the Agency regarding my daughter’s serious situation over the 75% cut and the situation this created. The urgent safety complaint was IGNORED by the Agency for more than a MONTH. A torrent of nonsensical emails was only received following our letters to Minister Shorten, who passed our urgent letters back to the Agency. We then received emails from the Agency saying that the complaint was being closed down because the ‘telephone was not answered’ after three calls. A person in a desperate situation – whose stated communication preference is NOT the phone – receives phone calls from a private number. The expressed communication preference is continually ignored by the NDIA and LAC providers in breach of the NDIS legislation and the UNCRPD. The Agency recklessly sought to close off the complaint because the telephone was not answered three times in quick succession. Multiple times during this episode, I intervened and told the Agency not to close down the complaint as it had not been resolved. The ‘three phone calls’ is a bizarre and dangerous KPI, determining the ‘closure’ of safety complaints. This should all sound very familiar, because it is hauntingly similar to the processes and organisational behaviour seen in the case of Mr David Harris, a gentleman with paranoid schizophrenia, who died after his NDIS funding was cut off and the Agency closed off communication with him. It is also reported that the Agency refused to disclose to his family, details of his NDIS funding as the material would ‘reveal methodologies the NDIA uses in determining levels of support provided to participants’ and would ‘compromise the financial suitability, integrity and longevity of the NDIS’. These are the algorithms: dangerous and out of the reach of scrutiny and governance. Whereas this gentleman’s loving family fought for three years for information and a full investigation into the failures and neglect he suffered in his final months, I have the dreaded burden of knowing exactly what is going on inside. In our case, NO action was taken by the Agency; the safety complaint was IGNORED by everyone. Neither investigated nor resolved. No letter from the Agency. No letter from Minister Shorten. The urgency from the 75% cut lingers. And I do not believe that it is the role of the Quality and Safeguards Commission to handle operational safety issues of the NDIA itself. Nor is the AAT or its successor, the forum for responding to operational safety issues. The role and core function of the NDIA – and not its outsourced contractors – to respond to operational safety swiftly.

Marie Johnson 12 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture of NDIS Back on Track No. 1) Bill 2024 [Provisions]

Submission 137 - Attachment 15

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

It has been my ongoing experience that the Agency does not have the culture, capability nor operating model demanded of an environment of extreme systemic risk, including risk to life of vulnerable and disadvantaged populations.

Harm and fear of harm is the only result.

SYSTEMS, DATA, PRIVACY AND CYBER SECURITY

I have run large operational systems across government, and in my experience, the NDIA systems and processes are the most defective and dangerous in government.

So serious are the defective NDIA systems, processes and governance, that the Government and this Committee is grappling with the economic concerns arising from the NDIA administration, as well as the exploitation of this systemic weakness by organised crime, reportedly to the tune of billions of dollars per year.

The core of the NDIA systems – the participant record – lacks integrity and that is an extremely serious situation.

The fact that a diagnosis can arbitrarily be changed, is not only an extreme safety risk, but signals a lack of integrity, risk management and control framework around the participant record.

This not only happened in our case. It is a systemic, aberrant and widespread practice of the NDIA suffered by a great many people evidenced by widespread commentary on participant forums and in submissions. This is a dangerous and arbitrary splitting out of diagnosis so as not to record a person’s full circumstances.

There are several critical points and consequences regarding data integrity defects and changes to the participant record, specifically diagnosis.

In evidence at the 15 February 2023 Senate Estimates, the NDIA Acting Actuary was unable to answer specific questions on forecasts stating: ‘…there are a few challenges with reconciling the participant numbers. It’s to do with our new IT system.’6

This is not just a reconciliation issue to be waved away, but points to the intractable integrity issues with the NDIS systems – of both the old system and concerningly the new system. I’ll talk about the new IT systems later in this testimony.

With such widespread reports of the NDIA changing participant diagnosis in the system - and systemic data integrity defects – it is perhaps not surprising, though disturbing, that data integrity appears to be a factor in the December 2022 NDIS Quarterly Report7 with unexplained anomalies surfacing.

Commentary of an independent analysis89of the December 2022 NDIS Quarterly Report points to the potential erroneous recording of a diagnosis as a factor leading to anomalies. This would mean that the TSP (Typical Support Package) is miscalculated by the NDIA algorithm, potentially leading to tens of thousands of people being allocated NDIS funding that is not fair or equitable.

This analysis lines up with the widespread experience of participants, grievous cuts, appeals, and complaints.

None of this should be excused simply as defect of the IT systems – as grossly problematic as that is.

National Disability Insurance Scheme Amendment (Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

Submission 137 - Attachment 15

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

The problems are far more profound and disturbing, an extreme risk impacting the Commonwealth Federal Budget. These anomalies are the inevitable consequence of defective porous systems; a lack of data integrity; and a lack of the end-to-end data lifecycle. The only way to map the end-to-end data lifecycle, is through end-to-end co-design.

The effect of having permanent disabilities not recorded or removed from the record, is to withdraw funding. This is an UNLAWFUL act. It is a large-scale systemic breach of Section 24 of the NDIS Act denying people funding for all their permanent disabilities. It is a practice so widespread as evidenced by commentary in community forums, in submissions and in AAT appeals, that the only interpretation would appear to be the intentional removal of permanent disabilities from the record, so that those disabilities not thus recorded are not funded. Whatever the explanation, this is malfeasance. And it is deadly.

Case after case of systemically recording the WRONG diagnosis; fundamental errors; a person with a physical disability found their diagnosis had been recorded as an intellectual disability. Permanent disabilities initially recorded then disappear with a new plan. Documents mixed up. Plans containing copy-paste info from other people’s plans. Plans with no goals. Other cases, permanent diagnosis of disability NOT RECORDED – discovered only via a PIA process. A participant reported they got two plans in one - the first part of the plan was their plan and then the last part - capacity building and capital supports was someone else’s plan! And from another family: a report that ‘Sam would like to walk independently as a goal. My child’s name is not Sam, and they walk just fine.’ Furthermore, there are fundamental questions to be asked about why detailed and highly sensitive medical and personal documents and records are REPEATEDLY lost. This is a common ongoing situation experience by a great many people. LOST documents. And extremely sensitive documents discovered in the wild on the PUBLIC web. From a family: ‘…my husband searched for my email address on google. He found the full-service agreement between my daughter and [name of service provider] for support coordination.’ And there are many other instances of other service providers. These documents and records are far more sensitive than the medical records held by My Health Record. In addition to health and medical information, these documents cover the most sensitive personal and family information about a person’s very existence. And it needs to be understood that these lost documents also include information about OTHER people – the participant’s family and who else is in their life. The seriousness of the cyber security and organised crime risks arising from the continuous stream of lost participant documents and health information, is evidenced by the recent security advisory regarding My Health Record, cyber security and connected systems.10 How this happens is via a daisy chain of unmonitored mailboxes; no intelligent workflow; process dead-ends; off-system manual manipulation of data and documents; printouts; metastasised off-system

National Disability Insurance Scheme Amendment (Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

databases; and the passing around of spreadsheets and emailing of extremely sensitive medical information to outsourced providers.

Effectively, there is a continuous and uncontrolled mass leakage of highly sensitive health information and other personal data. The NDIA systems and processes are porous - not fit for purpose - and expose all participants and providers to risk, including identity theft and cyber risk. I know both of these domains with some authority.

Over many years, I have written about the defective NDIA/NDIS systems. And in this defective systems setting, the cyber security and privacy risks of the NDIA API arrangements, need to be very clearly understood.

NDIA has hundreds of APIs, and given the evidence I present in this additional statement, and in the context of the extensive change management challenges of the ‘new’ Salesforce PACE system, quations need to be asked about security, risk, and cyber threat assessments and scenario preparedness.

Cyber security and privacy need to be considered by the Committee as a serious culture and capability deficiency of the NDIA. Responses from the Agency to questions on privacy at Senate Estimates11 are further evidence of this.

API’s are a serious threat vector, and analysts have long warned of a tidal wave of API exploitation. a survey12 of more than 400 security and engineering professionals found that 53% have experienced a data breach to networks or apps due to compromised API tokens.

This same report details the case of T-Mobile, where 37 million customer accounts were stolen via API vulnerability. And recently, 235 million Twitter user accounts were exposed by hackers exploiting an API vulnerability. The cyber black market is, by some measures, the third largest economy in the world.

This brings us to the NDIS CTARS breach. The NDIA asserts that the CTARS breach was not a breach of ‘NDIA systems’. That is not the full story. The CTARS breach was of NDIS participant data made available to CTARS systems via NDIA APIs, with the breach compromising 12,000 email addresses resulting in data posted on the DEEP web.

This very large volume of personal, health and other sensitive information included identity documents, Medicare details, tax file numbers, and personal contact information. In addition to this, is the extraordinarily sensitive personal health information including mental health, suicide attempts, drug use and abuse, violent behaviour and sexual abuse. As reported,13 this data was published to a hacking forum and accessed by an untold number of people. The question is why ANY of this data is in the CTARS systems in the first place. And that key question points to concerns over the rigour of the risk and control framework for NDIA APIs - and data more broadly. Questions about the management of API automation via MuleSoft (owned by Salesforce) cannot be waved away as the realm of the IT folks. Co-design is necessary in the design of APIs, in order to understand risk.

https://parlinfo.aph.gov.au/parlInfo/download/committees/estimate/26269/toc_pdf/Community%20Affairs%20Legislation%20Committee_2022_1 1_09_Official.pdf;fileType=application%2Fpdf#search=%22committees/estimate/26269/0000%22

https://venturebeat.com/security/t-mobile-data-breach-shows-api-security-cant-be-ignored/

https://www.zdnet.com/article/australian-national-disability-insurance-scheme-provider-breached-and-treating-its-database-as-compromised/

Marie Johnson 15 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture of NDIS Back on Track No. 1) Bill 2024 [Provisions]

Submission 137 - Attachment 15

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

I have written about the data, cyber, and defective NDIA systems risks in previous submissions, years ahead of the NDIS CTARS data breach, which still does not appear to have been responded to appropriately.

At Senate Estimates on 9 November 2022, the Agency was badly confused over questions about the CTARS breach, wasn’t able to answer basic questions, indicating that it doesn’t understand the issue or even what the response was or should have been.

Given the scale of the data breach, the Agency appears out of its depth.

Just a few weeks later on 28 November 2022, an ABC investigation reported that it had identified large swathes of previously unreported confidential material that is widely available on the internet, ranging from sensitive legal contracts to the login details of individual MyGov accounts, which are being sold for as little as $1 USD.

Many of those impacted learnt they were victims of data theft only after being contacted by the ABC. The NDIA told a Senate Committee that it had confirmed with CTARS that all 9800 affected participants had been notified, but ABC established this is not the case. The ABC spoke with 20 victims and all but one had not received a notification or even heard of the attack.

The victims said they were either not adequately notified by the organisations responsible for securing their data, or were misled as to the gravity of the breach.

The NDIA’s typical and problematic communication with participants renders utterly ineffective any strategies for actually responding to circumstances of data breaches and cyber security incidences.

Notwithstanding that many participants expressed preference is NOT to be called by phone, the NDIA as a matter of course ignores the stated preference of participants, sends anonymous text messages to participants saying that ‘someone’ from the NDIA will call them from a private number - telling participants to answer the phone.

This scam-like behaviour of the NDIA exposes participants and their family to unacceptable cyber and privacy risks.

Imagine how someone with psychosocial disability or cognitive disability might react to such coercive high-pressure messaging from the NDIA.

How would a person ever actually know who these anonymous text messages are from? They wouldn’t — it’s impossible for them to know and the NDIA has recklessly created a dangerous jeopardy situation for many thousands of at-risk people.

Not only has the ABC investigation called into question the NDIA responses to questions on the CTARS breach at Senate Estimates, the Agency’s responses at the November 2022 Senate Estimates demonstrate a deep lack of understanding of privacy; the difference between privacy and data protection; and their role as stewards of our private medical, financial, care, and personal details.

Given the endemic and intractable problems with lost documents, defective systems, and lack of integrity of the participant record, it is extraordinary that the NDIS Privacy Policy points to the accepted business practice of personal information emailed around (using NDIA email doesn’t reduce the risk), including to board members:

‘All our personnel (including staff and contractors), board members and community partners are issued with NDIA email addresses. When we need to use personal information for our business purposes, we will limit this use to only those NDIA personnel, board members or community partners who need to know that information. Where business use requires us to

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDIABack on Track No. 1) Bill 2024 [Provisions]

Submission 137 - Attachment 15

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

e-mail personal information internally to NDIA personnel, board members or community partners, we will use NDIA e-mail addresses to send that information.’ Such information should not be e-mailed – at all. And questions need to be asked as to why board members are getting personal info of participants (which would also include info about other people). Official email addresses and APIs do not constitute a control framework, nor safeguard the integrity of the participant record. The Agency’s confused commentary on its own Privacy Policy and the Privacy Act, in response to questions at Senate Estimates points to a serious lack of capability and due diligence regarding risk, cyber security, and the protection of information. And the recent Report of the Privacy Act Review is likely to present even greater challenges for an Agency so clearly incapable of protecting personal information, across every area of its operations, systems integrity, automated decision-making, roboplans, and algorithms. Pointing to ‘…high-profile data breaches, exposing millions of Australians to privacy risks including identity fraud, reputational damage and blackmail…’, the Privacy Act Review Report calls for: ‘Transparency requirements for automated decisions that use personal information and have a significant effect on individuals are also proposed. Entities would need to provide information about types of personal information used in automated decisions-making systems and how such decisions are made.’ Furthermore, given the widespread cases of harm resulting from the Agency’s own actions and operations reported to this Committee and other forums and Inquiries, it is significant that the Privacy Act Review Report also proposes a direct right of action to enable individuals to seek remedies in the courts for breaches of the Act which cause harm. From what I understand, the design of the new PACE system and overall Agency risk architecture have not contemplated privacy protections – necessary and anticipated privacy protections - of this magnitude.

WILL NEW SYSTEMS FIX THIS

The answer to this question is NO. And I know this domain with some authority and expertise. There will be a political temptation to point to the ‘new’ Salesforce PACE system as a fix to everything that is busted with the current SAP system. Nothing could be further from reality. Before exploring the question about the ‘new’ Salesforce PACE system, there is further commentary on the scale of the defective systems environment beyond algorithms, lost documents, porous systems, data breaches and cyber security. And this involves two serious examples of defective critical infrastructure: the NDIS Operational Guidelines and the NDIS Price Catalogue. The level of incompetence in these examples is shocking, matching the reckless incompetence of systems, processes and governance, detailed in the preceding discussion. All areas documented in this testimony make a disgraceful mockery of the UNCRPD. The excellent examination of the NDIS Operational Guidelines is documented in the South-West Autism Network JSCNDIS submission.

16 https://www.ag.gov.au/rights-and-protections/publications/privacy-act-review-report 17 https://www.swanautism.org.au/wp-content/uploads/2022/12/SWAN-Submission-to-Joint-Standing-Committee-on-NDIS-241122.pdf Marie Johnson 17 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

This examination shockingly reveals that the NDIS Operational Guidelines are hidden in 508 web pages on an external hidden website.

‘The NDIA has created an external website for the NDIS Operational Guidelines at https://ourguidelines.ndis.gov.au/.’

There is no centralised, integrated menu for the more than 508 webpages located on the site, and being an external website separate to the primary website of https://www.ndis.gov.au/, the site remains unknown to most NDIS participants and families.

Concerningly, however, participants and nominees are being expected by NDIA and NDIS Partners in Community to comply with Operational Guidelines which are overly complicated, and without being advised of their existence.

The search function is ineffective, and the NDIA continuously add to and alter the webpages at https://ourguidelines.ndis.gov.au/, with no notification being given to participants and families of changes occurring.’

The second example of defective critical infrastructure involves the NDIS Catalogue and the non-delivery of the eMarket.18

The Catalogue, the jewel in the crown, is comprised of extraordinarily dense PDF, word and CSV documents that have no intelligence; not interactive; not explanatory; not searchable; and utterly fail accessibility standards.

The Catalogue is not fit-for-purpose. It is a cadaverous, inert and incomprehensible spreadsheet and text documents with cascading and hidden links; different versions, addenda, and archives nested across dozens of webpages.

This defective critical services infrastructure affects the entire sector and discriminates against every participant.

Clearly, digital government is not meant for people with disabilities and their families.

Questions need to be asked as to why the Catalogue has been left festering for years. The abandonment of co-design is part of the answer.

Against this wasteland of defective and unlawful systems, and reckless disregard of risk, let’s consider then what appears to be on the drawing board with the ‘new’ Salesforce PACE system.

The Committee should not be lulled into the spin that the ‘new’ Salesforce PACE system will sort things out.

More to the point, what is described in project documentation on the ‘new’ Salesforce PACE system appears to be far more than systems change: there appears to be fundamental concepts changing for the Scheme.

Fundamental and sector wide changes involving payments paid in 3 month drops; no draft plan; no service bookings; and uncertainty about goals. Legislative change is likely to be needed for many of these changes.

This raises the question: Is the ‘new’ Salesforce PACE system being unlawfully designed to include features and changes that do not have legislative authority?

It appears that the ‘new’ Salesforce PACE system being developed includes major changes to plans and goals. These are not just ‘IT’ changes. These appear to be fundamental changes to the legislated concept of plans and goals.

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

What is the legislative authority for these changes? Is the ‘primary disability’ fiction - which is contradictory to the NDIS Legislation - also being unlawfully designed into the ‘new’ Salesforce PACE system? Similar governance questions such as these have been examined in the RoboDebt Royal Commission. And what is the Budget and procurement authority for the expenditure of public funds, for work on system features that appear to be inconsistent with the underpinning NDIS Act? In addition to apparent breaches of the NDIS Act, have the Budget Process Operational Rules, Commonwealth Procurement Rules, and APS Code of Conduct also been breached – by the expenditure of public funds on system features that are effectively unlawful? All these questions point to a broader capability deficit with the NDIA, of knowledge, skills and experience in Commonwealth public sector governance. Given the Board and Executive turnover, have the risks been adequately identified and modelled to support decision making for such a drastic and high-risk change, with serious consequences for participants and providers. Indeed, does the Board and Executive even have the authority to accept such extreme risk, if known? What happens when something goes wrong, which will happen. What is the system wide change management? How are these changes all together actually going to work? Have participants actually been involved? And not just one or two in a focus group. Evidence from other submissions indicates consultation is tokenistic and there is no co-design. However, it doesn’t appear that participants have been deeply involved and listened to. Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this.

WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted? What is the ethics framework informing these decisions? And to cap it all off, is this. The project documentation talks about swapping systems. As if there are only two systems. This is an activity of extreme risk.‘Swapping systems’ was the problem with the initial move from the DSS Oracle system to DHS built current NDIA SAP systems.The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants.‘Swapping’ systems involves data migration, a complex high-risk exercise.Given the earlier discussion on the widespread participant record irregularities and lost documents, will the data migration exercise remediate this?

Marie Johnson 19 CEO, Centre for Digital Business3 March 2023

National Disability Insurance Scheme Amendment (Capability and Getting Culture the Of NDIS the Ndias Back on Track No.1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

This was the very complex and problematic exercise in the transition to full scheme. Data migration from the DSS Oracle NDIA systems to the DHS SAP NDIA systems; and of course, the extremely disruptive data migration from the States and Territories due to data gaps, errors and incompleteness.

Whilst the running of systems in parallel is a strategy used in such transitions, the risk and management overheads are exponential requiring significant resourcing, experience and expertise.

As discussed earlier, the problems with this strategy were evident at the 15 February 2023 Senate Estimates, with the Acting Actuary unable to answer questions on forecasts due to ‘reconciliation’ challenges with the new system.

I predict that participants will be caught in data migration hell. Get ready for a massive loss of data during this period. It is likely that cyber security and organised crime will be watching and probably acting under the cover caused by such disruption.

Worryingly, in the project documentation on the ‘new’ Salesforce PACE system work, there is a comment that ‘we will not go live with defective systems’.

It matters not whether it is the DSS Oracle NDIA systems; the DHS SAP NDIA systems; or the ‘new’ Salesforce PACE NDIA systems. The preeminent factor is end-to-end co-design. But co-design was dumped as a strategic capability by the Agency, meaning that the end-to-end risk is unknown, and assumptions remain unchallenged.

And this is evident already in ‘on the ground’ trials of the new PACE system in Tasmania that are not going well.

Evidence that end-to-end co-design has not happened, is sitting in plain sight on the NDIS website. Lists of booklets and information – specifically about the system trials in Tasmania – inaccessible, inaccessible, unreadable, non-responsive design, not able to be read on a phone.

For such critical change management content to be ‘designed’ in this way, there is an inherent assumption that such content is consumed via a computer monitor in a controlled office-type environment. And not as is the case for a majority of people, mobile phones of different models in all sorts of environments using assistive communication.

This is disgraceful discrimination demonstrates a lack of competence, a lack of care, and a lack of co- design.

Feedback from a participant on the booklets: ‘Oh FFS! They can’t be read on a phone. Is it conceivable that they will ever understand their customers?’

Considerable preparedness and expertise are required in change management, risk management and risk mitigation. There will always be something that goes wrong in such complex change, that’s just a fact.

There needs to be a comprehensive plan in anticipation for what happens when things do go wrong, and swift pre-planned action. Who is accountable. And what is the governance.

What IS the change management strategy for 500K people? And tens of thousands of providers.

Imagine this change for CALD, Indigenous, people with intellectual disability, and people with psychosocial disabilities.

The ’not going live with defective systems’ statement indicates a naïveté and lack of experience - consistent the NDIA’s lack of sophistication in responses at Senate hearings on ethics, privacy and data protection.

On the basis of the ‘reconciliation’ problems and information in the project documentation on the ‘new’ Salesforce PACE system, it looks like the whole show is changing – yet the Agency does not appear to understand nor be prepared for, the risk and the enormity of the change.

Marie Johnson 20 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment Capability and Getting Culture theof NDIABack on Track No.

Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

CO-DESIGN

I was responsible for establishing and initiating co-design and have written extensively in previous submissions and in other public commentary of the devastating impact of its abandonment by the bureaucracy.

And notwithstanding NDIA platitudes about co-design, I identified that references to co-design in NDIA corporate documents had mysteriously disappeared. It was the intervention of this Committee in its report on Independent Assessments, that directed legislative change to include co-design ‘so that it never disappears again’ thus forcing the NDIA to revert.

All capability deficits discussed in this and previous submissions, including cyber, safety and risk, are due to the abandonment of co-design and the unconstrained over-reach of the actuarial function.

Everything I predicted would happen, has happened because of this.

Co-design is a strategic governance capability grounded in ethics. Co-design is not about making things look pretty, via periodic or select activities.

End-to-end co-design is necessary to understand risk, hand-offs, and challenge assumptions. Every aspect of NDIA operations without exception – including actuarial initiatives - must be co-designed.

As stated earlier, end-to-end co-design is necessary to map the data lifecycle.

By urgent necessity, this will involve building up internal APS capability – not consultants – led by people with disability.

The co-design capability must be resourced to at least the same degree as the actuarial function – which is a team of more than 200 professionals according to the Acting Actuary’s LinkedIn profile.

Imagine what could be achieved with a permanent NDIA APS staff of 200 co-design professionals undertaking ongoing end-to-end co-design of every aspect of NDIA operations – including internal NDIA operations with staff with disability.

Together with matched resourcing of the actuary and co-design capabilities, there must be matched governance authority embedded in legislation.

It will be the co-design governance authority that will be the pre-eminent determinant for rebuilding the NDIS, retrieving trust, and remediating data integrity.

SUMMARY

My daughter is terrified to contact the NDIA and is in fear of re-suffering the trauma. And I am haunted by this experience.

My daughter’s traumatic experience with the NDIA has adversely impacted every aspect of her life; her sons; her husband; her father (my husband) who is a heart patient with disability; and myself.

The fact that I anticipated the trauma that my daughter would face and contemporaneously documented her horrific journey, demonstrates that her experience was not a one-off, but absolutely the predictable and only possible outcome from such a defective system.

This is the case for literally hundreds of thousands of people.

There would be perhaps few other NDIS applicants or families who would have the insight at the beginning of their journey to make such detailed documentary recordings from the outset.

I knew what would happen and I am haunted by this knowledge and foresight.

My daughter has stated that dealing with the NDIA has damaged her mental health to the worst it has been in more than ten years. This is the impact of ‘averaging’ and the outcome of roboplans.

Marie Johnson 21 CEO, Centre for Digital Business 3 March 2023

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

After so many appeals, lost documents, extreme safety risks, data security breaches, the never-ending cycle of re-submitting reports that have been lost, and the always present threat and dread of the withdrawal of supports, we are out of time.

As described in this submission and by a great many other people, there are catastrophic and additive defects in every area of NDIA operations and operating model.

People with disability and their desperate families seen as soft targets by predators; intractable cyber security exposures; defective and porous systems; continuing and unresolved data breaches; lost documents; and exploitation by organised crime in the order of billions of dollars.

Added to this chaotic risk environment, is the unlawful use of powerful algorithms without governance - similar in practice to RoboDebt - resulting in the catastrophic withdrawal of funding creating risk to life.

Any cyber infiltration of this enormously complex and chaotic environment - in an Agency of such deep capability and cultural deficits - would likely go un-noticed. Because of this, the NDIA/NDIS would have to be considered a national security risk.

Given this extraordinarily complex risk environment - created through reckless incompetence - it is alarming that the NDIA’s own Agency Security Plan (September 2020, obtained under FOI) states that ‘security is not a primary function’ (page 19) and ‘…the Agency is a low-risk Agency…’ (page 32).

In what possible scenario could:

• Immediate risk to life, causing harm and death.
• Unlawful operations and practices.
• Porous defective systems.
• Serious cyber security.
• Data breaches and systemic loss of documents and medical information.
• Mega outsourcing and contracting conflicts of interest.
• Escalating political and financial impact on the Federal Budget.
• And the penetration of organised crime. …ever be considered ‘LOW RISK’?

This is the Agency’s own demonstration of the depth of its capability deficit and recklessness.

A capability and culture incapable of understanding the consequences including the risk to life, of multi-factor multi-vector systemic risk. An Agency that can’t explain ethics: in fact, has no ethics framework. Becomes muddled over privacy. And cannot explain data protection. An Agency that abandoned co-design; was forced to revert; and yet even with all the political controversy and UNCRPD implications over co-design, still could not explain it at the February 2023 Senate Estimates. An Agency with such profound capability deficits, nevertheless aggressively adopted defective Robo algorithms that cannot be explained.

This collapse in capability is almost entirely due to the gutting of public sector resourcing; the transfer of funding to and the pernicious dependence on consulting firms; multi-billion-dollar outsourcing; and system wide conflicts of interest. But I am not the only one pointing this out. Indeed, the JSCNDIS has received excellent and highly detailed submissions from other global and Australian experts and advocates.

National Disability Insurance Scheme Amendment Capability and (Getting Culture theof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

And what of the Independent Review? The Independent Review team are good people. However, the Independent Review governance is insufficient. The Review team cannot provide Parliamentary Privilege - which is why I am providing this testimony to the JSCNDIS. It is also not clear how and if Whistle-blower protections apply. There are people in the bureaucracy, ex-public servants, and those who work for providers, who might want to provide evidence, but are reluctant to do so due to concerns about protections.

The issues with the NDIA/NDIS are so deep and so hidden, that a Royal Commission is necessary with the powers to compel the production of confidential documents otherwise withheld by FOI and secrecy; the power to compel witnesses; the power to provide legal protections; and the power to refer for criminal and National Anti-Corruption Commission investigation. Fraud investigations and task forces whilst necessary, are after the fact. Contract arrangements as currently constructed are part of the NDIA capability distortion, and given the multi-billion-dollar honeypot, need to be scrutinised by the National Anti-Corruption Commission. For those of us who have worked on the inside know that what is being revealed at the RoboDebt Royal Commission, mirrors what is happening with the NDIA/NDIS. But it is no accident and should be no surprise that Robo practices – RoboPlanning and RoboDebt practices - have become embedded in the NDIA. RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government automation strategies driven by DHS, now Services Australia. Same bureaucracy. Same people. Same methods. Same systems. Same fictions. Exactly the same. And what is being revealed, is only coming to light as a result of the powers of a Royal Commission, triggered by years of community activism led by remarkable individuals; the RoboDebt Class Action; and the Federal Court decision on unlawfulness. In all of this, suicide and untold harm suffered by hundreds of thousands of Australian citizens at the hands of its own government and bureaucracy. It is my combined lived experience and professional view, that the NDIS/NDIA requires complete re-engineering; legislative reconstruction involving the limitation of the Actuary function counter-balanced by the matching co-design resourcing and governance authority; and scenario risk analysis, driven by end-to-end co-design. Judicial oversight is necessary to ensure that the unlawful actions and human rights violations can never be orchestrated at scale again. Board governance is insufficient. But this will only be possible with the deep evidence base arising from a Royal Commission. Without complete re-engineering, the national security, data security and organised crime risks become intractable, undermining the sustainability and integrity of the Scheme. The risk to life becomes unacceptably extreme. The Labor Government stated that the RoboDebt Royal Commission was necessary to ensure RoboDebt never happens again. Well, it is still happening. RoboNDIS. There can be no ‘learnings’ from the RoboDebt Royal Commission alone - the ‘learnings’ will only come when the combined common RoboDebt + RoboNDIS malfeasance is confronted - and people are brought to account - for BOTH.

National Disability Insurance Scheme Amendment Capability and (Getting Culturetheof NDISthe NDIA Back on Track No. 1) Bill 2024 [Provisions]

SubmissionSubmission137 - Attachment15 1

JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA

SUPPLEMENTARY STATEMENT BY MARIE JOHNSON

Addendum to Submission 137

Then the big question. How was the combined common RoboDebt + RoboNDIS malfeasance allowed to continue for years? The only way to fix the NDIA/NDIS, is via a Royal Commission into the NDIA. But given the commonureaucratic and technology lineage, the extension of the RoboDebt Royal Commission into a Royal Commission into RoboNDIS would be an opportunity to consider the full ramifications in context. However, there is immediate action the government can take and needs to take. There is no need to wait for the findings of the Independent Review, or political triggers for a Royal Commission. The cessation of roboplanning - and the reinstatement of all cut funds - should happen immediately as an urgent action to safeguard life. This scaffolding will provide NDIS participants with some certainty about their lives, while in parallel, the new simplified NDIS/NDIA is built. But we are not waiting. We have run out of time, and we have suffered too much harm. The NDIS Class Action effort is underway. We see this is our only pathway to justice.

I would like to thank the Committee for conducting this important Inquiry, and for providing me with the opportunity to make this testimony.

Marie Johnson Date: 3 March 2023

---

Marie Johnson 24 CEO, Centre for Digital Business 3 March 2023