National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
Senate Standing Committees on
Community Affairs Inquiry
Inquiry in relation to the proposed changes within the National Disability Insurance
Scheme Amendment (Getting the NDIS Back on Track No.1) Bill 2024
Ignoring the Risk of the Lack of Capability
Submission By
Ms Marie Johnson CEO Centre for Digital Business Pty Limited
10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
Table of Contents
Table of Contents | 1 Recap from First Submission on the NDIS Bill | 2 The Ballooning NDIA SES and Distorted NDIA Structure | 3 Participant Service Guarantee | 4 Multi-System NDIS Systems Outages | 5 Recommendation | 6 Attachment 1: FOI Documents | 7 Attachment 2: NDIS System Outages | 17 Attachment 3: Submission to the National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024 [Provisions]. Marie Johnson. May 2024. Submission Number 15. | 17
Marie Johnson |
Submission: National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.1) Bill 2024
10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
Recap from First Submission on the NDIS Bill
I am pleased to provide this submission to the Inquiry in relation to the proposed changes with the National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.1) Bill 2024.
This is in addition to my submission to the first Inquiry National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.1) Bill 2024 [Provisions]. That submission, which provides details of my background and experience, is at Attachment 3.
It is my opinion, as I have explained in my first submission at Attachment 3, and in the additional information provided in this submission - that the NDIA does not have the capability to implement, onwithstanding amendments to the NDIS Bill that have been proposed.
I believe the NDIS Bill remains fundamentally defective, and these amendments do not change the fact of the NDIA’s serious capability deficits across so many dimensions, and the organisational lack of experience in implementing large scale economic change management.
Even if the NDIS Bill is passed, implementation will fail and Participants will suffer harm, as a direct result of the NDIA’s lack of capability to implement.
The thesis of this submission, is that the NDIS Review and this Bill (with amendments) not only ignore the NDIA’s lack of capability to implement, but by radically changing the foundations of the NDIS, add extraordinary risk to already very fragile and defective systems and processes.
To reiterate. This Bill (with amendments) ignores the lack of capability of the NDIA to implement, and yet is built on untested assumptions of automation. And while the NDIS Review sets out a five-year timeframe for reform, while also bizarrely ignoring the NDIA’s lack of capability to implement, many of the items within this Bill are needed to allow for those changes to take place. This is an insurmountable disconnect.
The NDIA’s dysfunctional administration and capability deficits must be taken into consideration because it affects and undermines reforms potentially proposed by ANY government. The task of this Committee is not just about considering and passing this NDIS Bill - or any Bill - but providing Parliamentary governance so as to achieve the successful and safe implementation of the Bill’s provisions.
But what does this Committee do when confronted by such a dysfunctional administration?
The NDIA does not have the capability to implement, and I believe that the only course of action - to safeguard the sustainability of the NDIS and the safety of Participants - is to reject the NDIS Bill, and refer the NDIA to a far reaching Parliamentary inquiry or Royal Commission into its internal operations, capability, performance and governance.
The information provided below, in addition to the information provided in my first submission (Attachment 3) on this Bill, illustrates the continuing deepening governance crisis within the NDIA. Some of this information has come to light via FOI in the time since my first submission on this NDIS Bill just a few months ago.
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
In addition to the ANAO audit into the performance of the NDIA Board, it is noted that the ANAO has published an extensive program of potential audits for 2024-25, into the NDIA NDIS.
The Ballooning NDIA SES and Distorted NDIA Structure
In this section, I draw attention to the ballooning NDIA SES numbers and the distorted NDIA structure and governance, as a major factor in the Agency’s lack of capability to implement.
The NDIA SES as a cohort group, lacks the organisational capability and the deep institutional knowledge and experience in implementing complex large scale change management of a whole-of-economy operation that affects every State and Territory government.
This lack of organisational capability affects the lives of millions of Australians (Participants and their families); the survivability of tens of thousands of businesses; hundreds of thousands of people working in the NDIS ecosystem; and payments of tens of billions of dollars.
The lack of organisational capability and experience of the systems and process across government is of notable concern, for these are the very areas of serious failing causing harm, and also the very areas that the NDIS Bill is dependent upon. The NDIA Board similarly lacks this deep operational expertise and expertise in technology in its governance arrangements, which are so fundamental to the performance of the NDIS NDIA.
I refer to the documents at Attachment 1, released under Freedom of Information.
The FOI material sheds light on the inner workings of the NDIA and proposals around its senior executive numbers and structures.
Most of the senior executives and staff of the NDIA will have not seen the attached documents, now released under FOI. It is likely these documents would have been restricted to the CEO, DCEOs, and the Board. Of course, the Minister was in agreement.
The NDIA Board and the NDIA CEO less than a year ago, put forward 2 separate briefs for the government to approve an increase in its senior executive number. Both were approved by the Anthony Albanese government within six months of each other. Each separate request was seeking about 30 extra senior executives at a total cost of around $10m a year. If you noticed, that cost didn’t appear anywhere in the briefs.
There was no special notation in the material for a separate brief for more front-line staff i.e. additional planners. There was an increase in staffing overall but as the exposed FOI material detailed there were more other staff in the NDIA totalling 4718 compared with 2148 planners. For every planner, there were more than 2 other staff in the NDIA doing other stuff…
The 2 CEOs at the helm each asked for an upsizing in senior executive numbers. First in 2022 for plus 30 to 82 (just as Ms Falkingham arrived). The next on 3 July 23 by Ms Falkingham, from 82 to 115.
Reading the first brief in 2022 the increase was to “future proof the NDIA”: obviously less than a year later it didn’t work. Because that language sounded so good, the second brief used it too. Even in mid 2023
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
there were still 5 labour hire senior executives (although 30 real APS SES were added in 2022). The briefs admit labour hire executives cost at least 20% more.
The FOI documents show that the Australian Public Service Commission questions the need for more SES in 2023 since the last request was less than a year before, yet still progressed it with informality by return email.
The data on Participant projections used, didn’t refer to the previous decision by PM Anthony Albanese to moderate growth to 8% from 2026
As at 30 March 23 there were also still 2,094 other labour hire workers. 300 more than when PM Albanese came to office.
Senior executive to workforce ratios are out of whack – 1:58 for corporate senior executives and 1:266 for Participant-facing: that is 1 executive to 266 planners. There are just not enough planners, yet the workforce size could accommodate more.
FOI document 12 shows that the planner workforce (2148) is smaller in size than the corporate workforce (2401). In compare the pair table in the 2022 brief, Services Australia has a ratio of 1:193 for corporate but NDIA has 1:48
These documents released under FOI, paint a worrying picture of a lack of organisational management strategy, logic and capability: the documents themselves evidencing a bloated and growing executive fat, the apex of the inverted resourcing pyramid.
Participant Service Guarantee
In light of the bloating NDIA SES, the organisational performance against the legislated Participant Service Guarantee is damning.
On what basis can it be assumed that the NDIA would suddenly have the capability to implement large scale high-risk change management this NDIS Bill would bring about, considering that in December 2023 - just 8 months ago - the JSCNDIS excoriated the Agency over its defective culture and capability.
There have been statements by the government and Minister Shorten that efficiency would be boosted; and that the planning process would be streamlined and the planning pathway fixed. The data tells a completely different story, even with the bloated SES numbers.
The day is 31 March 2024. The NDIS quarterly report stated: of the 10 measures of the Participant Service Guarantee (PSG) only ONE met the legislated time frame.
As an example, let’s take a look at the primary Access one. PSG2: Make an access decision, or request for more information, after an access request has been received with a service guarantee of 21 days. In the March Quarter, the performance was 49%.
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
What does this mean?
More than likely there is a backlog of requests when compared to the number actually entering the Scheme in the March Quarter. The number of Participants entering the Scheme was stated as just under 8,000.
So looking at the supplementary information, in that quarter 7,905 entered the Scheme (with a plan). There were 14,374 access decisions, with 12,131 determined to be eligible. So by these numbers there is a backlog of Participants eligible without a plan of 4,226. According to the NDIA reporting over the last year, there has never been a backlog for this Participant Service Guarantee (PSG).
Taking it another step further, the recorded active number of Participants with a plan for Q3 is 649,623. Adding those in the Access backlog with the other active eligible categories without a plan, there would be 662,404 actual eligible Participants.
With the highest ever planner to Participant ratio of 1 planner to 261 Participants, why is it that the planning pathway is clogged with only ONE Participant Service Guarantee (PSG) legislated timeframes met as at 30 March 2024? Don’t get fooled, it’s not all about the new system as plan reassessments have continued to be subpar causing harm, frustration to Participants. There are also now more eligible Participants (after access decision) waiting for a plan than ever before.
The operational performance analytics and capability of the Agency needs to be closely examined, because the data indicates an Agency in crisis. “Reforms” launched into this environment via this NDIS Bill, is a recipe for disaster.
Multi-System NDIS Systems Outages
In my first submission to the first Inquiry National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024 [Provisions] (Attachment 3), I provided detailed commentary on the defective NDIA NDIS systems and risks. These are the defective systems and processes, on which the proposed NDIS Bill depends.
To reiterate.
What is proposed in this NDIS Bill, requires a high performance skilled customer focussed human workforce capability; optimal systems performance; strong and regulated data integrity; clear, consistent and documented business processes; and payment integrity to the level of Australia’s financial systems.
What is required is compliance with UNCRPD; and a culture of co-design, safety and trust. None of this exists.
To further illustrate the gravity of the NDIS systems, the following analysis of planned system outages paints a very disturbing picture of an Agency that is only a decade old, and during that time responsible for the administration of hundreds of billions of dollars in Participant plan funds.
Take a look at the stats in the diagram at Attachment 2, NDIS Systems Outages, information sourced from the NDIS website.
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
There is something seriously broken with NDIS systems. The “new” PACE system will not fix this: it is compounding the problem as examined in my first submission on this NDIS Bill (Attachment 3).
At the end of June, the NDIS community was alerted to a whopping planned multi-system outage over the weekend: a massive 31.5 hours.
But that’s not the worst. Over the past year or so, the frequency and severity of these outages is evidence of serious multi-system problems.
All up planned outages amounted to an extraordinary 398.25 hours = 16.60 days.
That is, systems offline, not available.
Imagine if this was your bank or telecommunications provider. Well, for many people who rely on NDIS funds to access essential life services, these outages have a far greater impact.
These planned outages over the past year or so DO NOT INCLUDE payment disruptions (and there are many), other systems unplanned disruptions and unavailability, other service unavailability, data breaches, and just plain lack of accessibility.
This for an organisation where a BILLION dollars or more has been spent on technology over the past decade. Where defective systems have been examined and documented by countless Senate and other inquiries. The problematic procurement of the Salesforce PACE system, and the impact of this on operational performance, is examined in my first submission on the NDIS Bill at Attachment 3.
This for an organisation whose performance and capability was NOT examined by the NDIS Review, and yet on top of this collapsing deck of digital cards, the government would have the NDIA build novel Robo assessment Algorithms and calculation tools upon which the whole NDIS “reforms” rests. The recklessness of this scenario is alarming. Who’s listening to the alarm bells?
The ANAO might ask questions about that in its forthcoming audit of the NDIA Board. And while the ANAO has already found that the NDIA Board does not have adequate oversight of risk, there is neither a Technology Committee nor Ethics Committee as part of the Board governance arrangements.
Recommendation
The problems are clear and present, as evidenced by the data presented in this submission and in many other submissions.
But who is asking questions or even understanding the risk that these statistics and FOI data are presenting? I do not believe that this risk is acknowledged or understood, and on this basis, I would urge the Committee to reject the NDIS Bill and refer the NDIA to a far reaching Parliamentary inquiry or Royal Commission into its internal operations, capability, performance and governance.
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
Attachment 1: FOI Documents
Marie Johnson
Submission: National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. Track No.1) Bill 2024
10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No. 1) Bill 2024
Submission 25
DOCUMENT 8 FOI 23/24 - 0400
“”“
National Disability
Insurance Agency
The 10 key measures are:
GPO Box700
CANBERRA ACT 2601
ndls.gov.au
Dr Gordon de Brouwer PSM
Australian Public Service Commissioner
Australian Public Service Commission
PARKES ACT 2600
Parkes Place West
Dear Dr de Brouwer
I am writing to seek approval for the National Disability Insurance Agency’s Australian Public Service {APS} Senior Executive Service (SES) cap to be increased from 82 to 115 positions, comprising 104 ongoing and 11 non-ongoing, time-limited roles.
The Agency needs a new structure to dellver Improved outcomes Since starting with the Agency on 18 October 2022, I have been carefully considering the
Agency’s capability and capacity, including a review of the Agency’s structure.
Following agency-wide staff consultation, my Agency has developed a proposed new and structure. The proposed structure is intended to future proof the Agency expand its leadership capability and capacity through the addition of new roles focused on: Scheme.
and supporting delivering the significant reforms funded in the 2023-24 budget process Implementing preferred provider arrangements to leverage buying power of the
improving the Agency’s workforce capability and capacity to deliver improved services to
the National Disability Insurance Scheme’s steadily increasing number of participants,
addressing attical gaps in the Agency’s current structure and skills.
The Agency’s current organisational structure is included at Attachment A, and the The Agency also needs to ensure it can deliver on recommendations across a rar19e of
proposed structure is included at Attachment B.
The Agency Is supporting a significant reform program and a growing Scheme intosustainabilitythe Scheme,of theestablishedScheme andby Ministerwhich willShortenreport toto examinethe Disabilitythe design,ReformoperationsMinisterial andCouncil
The Agency needs to deliver against a range of new refonns and priorities inof OctoberPeople with2023,Disabilityand the(DisabilityRoyal CommissionRoyal Commission),into Violence,whichAbuse,is dueNeglectto reportandtoExploitation
As a result of the Government’s 2023-24 budget announcements, the Agency has received S732.9m over 4 years to deliver reforms to improve the Scheme’s operation and lift the Both the NDIS Relliew and the Disability Royal Commission are expected to make Agency’s capability, capacity and systems to better support participants. The reforms will be recommendations for further significant reforms to the Scheme’s administration that the delivered through 10 key measures that will collectively improve service delivery, workforce Agency will atso need to acquit, together with a range of other priorities including capability and systems, and deliver programs aimed at improving outcomes for Scheme implementation of: participants. improving integrity, reducing fraud and stabilisiJ’IQ costs within the Scheme.
Recommendations made by the Joint Standing Committee on the NDI$, Including its
recent recommendations on improving the capability 8J’ld culture of the Agency priority initiatives from the Public Sector Reform agenda, and Page24of59
National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No. 1) Bill 2024
Submission 25
FOI 23124 • 0400
FOI 23124 • 0400
- existing Agency priorities, such as the Agency’s ICT transformation to provide stable, workers and contractors), and 5,848 people employed by the NDIS Partners In The Community (PiTC) and Contact Centre partners.
Over the last 3 years, in recognition of the Increasing demands on the Agency to support the growth and delivery of the Scheme, the allowable number of APS employees has increased to the current level of just under 5,000. As a result of the 2023-24 budget initiatives, the Agency’s average staffing level (ASL) will increase by 722.5, with new staff being onboarded over the next few mooths
In additioo to the reform program, the Agency is supporting significant and continued growth in the Scheme. Over the 10 years since the Scheme began, there has been a significant and continued growth in the number of participants (see Table 1 below), as well as growth in plan budgets and payments to participants. At the same time, community expectations of the role of the Agency in administering the Scheme have grown and matured with commensurate demands on Agency resources.
Tat>l91: r,,.,,.,,,,,_Q/lll;fmS#ll»2015–18Y••(FYJ
To the end of June 2026 and 1,017,522 by the end of June 2032 (see Figure 1 below).
Figcnl.AcliJe/f/l>d~~ts(2021-22ASFR,nd2CJ20.2021ASFR)
“”:; ….?:, put participants at the centre of the Scheme through co-design, including across the key budget NDIS Review measures.and the One Disability new role Royal will focus Commission.on implementing the recommendations of the Providers, Market Stewardship, and Home and living : changes to this group will realign its functions and improve the group’s capacity to deliver budget key measures 4 to 8. ,..~15 Transfonnatlon: up to four additiooa! time limited roles reporting to the Chief Transformation Officer will deliver on the government’s priorities to improve integrity and address fraud within the Scheme (budget key measure 10). Governance, Risk and Integrity: two new roles (one of which is a time-limited role) will provide additional enabling inhouse legal support to ensure the Agency can continue reducing its significant caseload at the Administrative Appeals Tribunal, one of the Government’s priorities for the Agency.
Corporate Services: three new roles wilt ensure that the Agency can suppor1 the Agency’s growing workforce. This includes a role focused on improving accessibility and inclusion for staff with disability. The addition of this role reflects the Agency’s need to improve suppor1 our estimated 20% of staff with disability. Two other roles will deliver improvements to the Agency’s procurement capability, improved corporate services are priorities identified from a recent independent review into procurement across direct, Agency-managed workforce of 7,466 (5,374 APS employees and 2,094 labour hire which Services Australia and the Agency.
The Agency needs Improved leadership capability and capacfty for a growing worldOl’CfJ to support the Agency’s growing workforce. This includes a role focused on improving accessibility and inclusion for staff with disability. The addition of this role reflects the Agency’s need to improve suppor1 our estimated 20% of staff with disability. Two other roles will deliver improvements to the Agency’s procurement capability, improved corporate services are priorities identified from a recent independent review into procurement across direct, Agency-managed workforce of 7,466 (5,374 APS employees and 2,094 labour hire which Services Australia and the Agency.
Page 25 of 59
Page26of59
Marie Johnson
Submission: National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No.1) Bill 2024
10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
FOI 23/24 - 0400
,. \.,>\,,)r~f'l~~•e,,,S •
Executive Placement Program conversions: five existing enduring roles filled by Executive Placement Program staff, including the Scheme Aclu8f)’ and the Agency’s Chief Information Officer and General Manager. Digital will be converted to ongoing SES roles, reflecting the critical priority of staffing enduring functions with permanent APS employees.
Revising the SES cap to 115 will ensure the Agency can deliver the Government’s immediate priorities and safeguard the Scheme’s continued operation.
In the proposed new structure, 104 roles are ongoing and the remaining 11 (comprising the New positions are funded through the Agency’s budget allocation Chief Transformation Officer, the General Manaoer. Children’s Taskforce and each of the roles reporting to them, together with the new General Counsel role) are time-limited roles of up to S years.
The 2023-24 Commonwealth Budget contains total funding of ··–·· for the Scheme outlined !2rJ!!!.!22“t0~ 1;:~~:IJi!t;=f;:~n::: Mure proof the Agency to acquit an ambitious reform program Collectively these changes above The Agency will fund the increase in SES employees from its allocated budget. and a growing Scheme. The structure has been designed to support future Scheme growth.
with no need for additional positions anticipated based on current projections. The Minister and portfolio Secretary support this request
The proposed structure maintains appropriate spans of control As the requirement for positions was identified due consideration was given to the appropriate Work Level Standards. The proposed structure has considered the classif1C8lion of roles to ensure resources are aligned lo functional requirements and SES work level standards including span of control.
In line with the Australian Public Service Commission’s optimal management structures guidelines we have recently reviewed spans of control recognising the maturing nature diversity and complexity of the Agency’s operations This includes the functions to manage fraud activities reform implementation transformation of service delivery co-design First Nations service delivery early childhood delivery service delivery management legal advice s47F - personal privacy
and capability development.
The span of control of an SES workforce of 82 based on current workforce size ts approximately 1:87. This span of control varies across different functional areas as follows:
1,923
2,337
The requirement to deliver the current Scheme and priorities with an SES cap of 82 would involve an increase in eKeculive contractors and disruption to the Agency’s operations at a critical time of heightened focus of delivering on the Govemmenfs change agenda and the projected increase in participant numbers and Scheme costs.
If the Agency’s SES cap increased to 115 as the Agency is proposing this would result in a span of control of about 1:67 based on current workforce numbers and including the additional ASL for the 2023-24 budget initiatives. This proposed structure would result in a
Page 27 of 59
Rebecca Falkingham Chief Executive Officer National Disability Insurance Agency SES won:…,.a,… ,_,., 3 July 2023…, ., Enc: Copy of proposed Organisational Structure for information {J)lllkipenllaong,n _,,,s.va~-
Page 28 of 59
Marie Johnson Submission: National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.1) Bill 2024 10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No. 1) Bill 2024
Submission 25
FOI 23/24 • 0400 DOCUMENT10 FOI 23/24 - 0400 DOCUMENT11
Hi Sally,
Thanks so much for the chat. As discussed, I am keen to support you to make your request to the Minister as strong as possible. I am hoping to get a bit more information from you.
Can you please provide an additional attachment outlining the 2.2 permanent and 11 temporary positions requested? This need only include basic information on each role, including titles, levels, Group (or name of the priority it supports), and duration (if temporary or time-limited).
Can you also please provide a brief rationale as to why these positions are needed, or what has changed since your last request for an additional 30 SES positions in October last year? The request last year mentioned that the 30 positions would support the Agency over the next three years — we just need to outline for the Minister why this has not been sufficient. In particular, you might want to look at the areas of overlap between the 2022 and 2023 requests to be clear about the work of the new roles being different to those already approved.
FYI – Currently sourcing ATO’s detail.
The above need only be provided via return email if that is easiest.
Please don’t hesitate to call if you’d like to talk through in more detail.
Warmest,
– M- - - e— -
Assistant Director. HR Reporting and Data Analytics
Workforce and capability Branch, Chief People Officer Group
National Disability Insurance Agency
NDIAlogo -she/her- k ,! l I • Wk Australian Public Service CommissionIMIII ____ _
S22(1)(a)(ii) - irrelevant material
The NOIA acknowledges the Traditional Custodians of Country throughout Australia and their continuing connection to land.$1!!8 and IXlll’VTUlity We pay our respects to them and their cultures and to Elders past, present and emerging.
From: —i.olita <- ·–~ > On Behalf Of CEO.OFFICE Sent: Monday, 3 July 2023 11:04 AM To: deBrouwer,Gordonaz:ic,KoJIIII·--~ Cc: Porter,Samuel <_ –@ndis.gov.au>; Subject: Letter from Rebecca Falkingham | NOIA Senior Executive Service Cap (SEC=OfflCIAL)
Dear Dr de Brouwer, I hope this email finds you well.
Marie Johnson Submission: National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No.1) Bill 2024 10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No. 1) Bill 2024
Submission 25
DOCUMENT 12
FOi 23/24 • 0400
RowUbels Count of NAME PtANNER 2148 238.6667 fiffi SeniorExecutlve-ServiceDellvery 9 ~ Corporate Senior Executive-Corporate 0t ServlceDellverySupport Senior Exewtive-Service OeliverySupport “’ Policy/Program ::,r::Cl) Senior Executive-Policy/Program Gr.ind Total -, “<O “ “I ~ ::, t; 2 en
·2 I "~
0
~
~
CJCl)
>< w
0 ·2
Cl)
C/1
<(
i5 z
Page 38of 59 Marie Johnson 12 Submission: National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No.1) Bill 2024 10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
FOI 23124 - 0400 DOCUMENT 18
Australian Government Australian Public Service Commission
AllSTRAIAN PUBLIC SERVICE COMMISSIONER
Ms Rebecca Falkingham Chief Executive Officer National Disability Insurance Agency delivered via: _, _ ___ @ndis.gov.au
Dear Ms rogham
Thank ’fOlJ for the correspondence dated 7 October 2022 regarding the Senior Executive Service (SES) cohort for the National Disability Insurance Agency (NOIA).
I am writing to advise that the Minister for the Public Service has approved the NDIA’s request to Increase your SES cohort by 30 positions.
It is important that we maintain the Government’s trust In the APS to reasonably constrain the size of the SES cohort. To this end, I ask that you continue to monitor and manage the size ofyourSEScohort.
As you may be aware, the Commission is developing an approach to capability reviews and updating guidance on optimal management structures. Together, these pieces of work will support agencies in the assessment and design of their organisation, while maximising workforce capability.
If you have any queries regarding !his matter, please contact Ashley Sedgwick, Assistant Commissioner, Hierarchy and Classification Review Implementation Planning, on 0262023983orvia-•– ~- s47FYours sincerely- personal privacy
Peter Woolcott AO ,, December2022 S22(1Xa)(ii)- irrelevant material
Page46 of59
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
DOCUMENT 19
FOI 23124 - 0400 “Notional’~Disability Insurance Agency Figure1: The Number Of Participants Since 2015-17 Financial Year(F? GP08ol’700 canberraact2601 1800800110 ndit.gov.au
Mr Peter Woolcott AO Australian Public Service Commissioner Australian Public Service Commission 16FurzerSt PHILLIP ACT 2606
Dear Mr Woolcott This has generally exceeded original expectations, subsequent modelling of participant growth–numbers and Scheme expenditure and the forecast by the Productivity Commission in its report in 2017 (figure 2). It is predicted the Scheme will continue to grow, The Agency’s Independently verified actuarial modelling projects there will be 670,400 participants in the Scheme by June 2025, and 859,300 by June 2030, which are significantly higher than originally estimated.
As a significant social reform, there have been challenges during the establishment and development of the National Disability Insurance Scheme (the Scheme). While the Scheme is working well for many participants, there are things we can do better. In requesting an increase to the approved number of SES for the NOIA, the intent is to provide greater stability and the right skills and leadership for the Agency into the future, with a structure and workforce that delivers a Scheme that meets participant and community expectations, is fully responsive to Government priorities and compliant in every way to the legislative and corporate responsibilities of a Commonwealth Corporate Entity
Immediate Priorities
The NOIA recognises there is much more to do to deliver the Scheme to meet the expectations of participants, carers and families, other stakeholders and the immediate priorities of the government. These include:
- fully implementing the recently legislated Participant Service Guarantee (PSG) and service standards
- reducing the number of NDIS-related matters at the Administrative Appeals Tribunal (AAD)
- accelerating timely hospital discharge of NDIS participants
- enhancing ‘whole of government’ fraud reduction activities
Projected Scheme Growth
The Scheme has now been in operation for over nine years. In this time, there has been a significant growth in the number of participants in the Scheme (figure 1), as well as growth in plan budgets and payments to participants. At the same time, community expectations of the role of the Agency in administering the Scheme have properly grown and matured with commensurate demands on Agency resources.
As a percentage of the Scheme expenditure (i.e., funding committed to participant supports), operating expenses have decreased from - per cent in 2017-18 to “…” per cent in 2021-22 (figure 3). This Is significantly lower than provided by the Productivity Commission which suggested a range of •,.·–• per cent as an appropriate amount for NOIA operating costs.
National Disability Insurance Scheme Amendment (Getting the NDI$ Back on Track No. 1) Bill 2024
Submission 25
FOI 23/24 • 0400
FOi 23/24 • 0400
FlgUN3: 0f!!!rtnq•xpenses•s•,,.,,..,,t5i!olpartrclp&’ltcoS/3
agencies, in FY2020-21 the Australian Tu:ation Office’s SES span of control was
s47D - financial or property interest of the Commonwealth Agency’sapproximatelySES 1cap:84 wereand ServicesincreasedAustralia’sto 80, thisSESwouldhadresulta spanin aofspanapproximatelyof control of1:160.aboutIf1the:87
based on current workforce numbers
In contrast to other APS agencies, a significant proportion of the Agency’s client contact operations are outsourced lo third parties and this impacts the most suitable ratio of SES to workforce. As many of the Agency’s SES have responsibility for policy, program and procedure development, the span of control is appropriately lower than in a traditional rvi,:hdlz:i~~~mc:;sr:::~~n’:.1plexity end diversity of the functions and i~ (
The table below (table 1) compares ratios at a more granular level:
Ow:>r tmc, the NOIA ha~ in:<ro<il!d d f,c;icncy. The crn.dised opcroting CO$!~ portic<p:r,t hos
TablelSESfO~mllosre—P
Workforce Requirements
At 30 June 2022. the total Scheme workforce has grown to 12,596. This consists of e direct, Agency-managed workforce of almost 7,000 (5,070 APS employees and 1,893 labour hire workers end contractors). end 5,633 people employed by the NDIS Partners in the Community (PiTC) and Contact Centre partners.
Over the lest three years, in recognition of the increasing demands on the Agency to support the growth and delivery of the Scheme, the allowable number of APS employees has increased. Over recent years, the Agency’s Average Staffing Level (ASL) has been revised three times to the current level of 4,500; however, there has been no corresponding increase lo the Agency’s SES cap.
The Agency had an approved SES staffing cap of 60 (since 2016) w’hich was scheduled to reduce to 52 in the 2020-21 fiscal year. The Australian Public Service Commission (APSC) approved the Agency’s request to maintain the cap of 60 SES until 30 September 2021 which then subsequently reverted to 52
Over the last three years, the Agency has consistently required en SES workforce of approximately 80. Over that time. the Agency has reduced its reliance on moJe costly, executive labour hire SES end today the SES consists of 73 Australian Public Service (APS) SES and 10 contracted executive labour hire SES. The Agency’s transition to having APS SES has allowed it lo reduce equivalent labour costs by a et least 20 per cent.
Spans of Control
In line with the Australian Public Service Commission’s optimal management structures guidelines’. we have recently reviewed spans of control recognising the maturing nature, diversity, and complexity of the Agency’s operations. This includes the functions of research and policy related to Scheme implementation, the development of service design, guidance end practice, market stimulation and development, provider engagement end the delivery of services vie an Agency managed workforce and netwoo: of outsourced partner organisations
The span of control of an SES workforce of 52 based on current workforce size is approximately 1: 130. Comparing the Agency to other medium to large APS service delivery
1 APSC - The APS Fra1nework forOplimal Managemem Strucrures - guidelin6 for HR prat’litioners. 2014
Page49 of59 Pege50of59
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
Supplement E:
FOI 23124 - 0400 National
This supplement shows the data for redacted. There are five parts in the supplement.
Over and above the current cohort of SES, after consideration by the Board and Agency’s leadership Team, I am proposing to create roles to support the growth and inclusion of SES with disability in our leadership cohO!’, I believe it is an appropriate time for The national rollout of the NDIA’s new compulor systom ond procossos started as planned on 30 October 2023. The Quarterly Report to tho O!soblllly Mlnlslers combines data from the old and new computer systems. This may lead to sorne minor restatements of Information In this and future reports. These roles will need to be appropriately sized and resourced to ensure individual can succeed and flourish in an APS career, so additional positions would be needed. The requiref_l’lent to deliver the current Scheme ~nd priorities with an SES cap of 52 would involve significant dislocation of employees, an increase in executive contractors and disruption to the Agency’s operations at a critical lime of heightened focus of delivering on the Government’s change agenda and the projected increase In participant numbers and Scheme costs. In summary, for the Agency to deliver on the complex, ambitious and demanding current and anticipated wor1doads over the next lhr_ee years, the Agency needs to be fully resourced with a highly capable, motivated, and inspinng ongoing APS SES leadership team in place. The Agency needs an SES cap to r1::nect its operational requirements so the appropriate and leadership can provide continuity to ensure the Scheme enables a better life for hundreds of thousands of Australians with a significant and permanent disability. I would be pleased to discuss this proposal further and look forward to your feedback. Yours sincerely Dr Lisa Sluddert (AJg) Chief Executive Officer National Disability Insurance Agency XX September 2022
Part One: Participants and their plans capabilities
Table E.1 Active participants by quarter of entry, by service previously received and entry
redacted |
650,273 | 12,131 | NJ.40,t |
|---|---|---|---|
| AOME!igible·New | 431,52\ | 11,915 | 443,,36 |
| AdlvllDltlb’e•Tabl | |||
| AOMPa1ir;:ipwl!Pur.-New | 176,ot7 | 7,820 | ,32,067 |
| Ac:tlW~,..,_•TIIIIII | … | … | … |
| Total includes participants with missing characteristics, where applicable. |
Table E.2 p—•ewho have left the Scheme alnce 1 July 2013 a■ at 31 March 2024-Nilional
| Nmllllel’Cll’,_,…ttotw
dleme l s1.• I &r,ylnll,vdonpri::lpnl 11u s1 I cllltla/ 13032 I
Page 51 of 59
redacted(s22(1)(a)(ii) - irrelevant material)redactedredacted
Table E.2 p—•ewho have left the Scheme since 1 July 2013 to 31 March 2024-National
| redacted: 1 • p22 D• o22 Mar23 Jun 23 Sep23 Mar24 |
R• •ult RH ult Reaut1 Ra■ult Ra■ult Result :=:.Pl.en Reassessment:…
Comm facilitating a 85% 77% 68% 76% 73% 65%
scheduled reassessment, prlorio reassessment date• 56 davs Plan Reassessment: Decide whether to undertake pren reassessment after participant req is received“’ 21 days Plan Reassessment: Complete plan reassessment, after decision to accept req is made - 28 days
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Attachment 2: NDIS System Outages
NDIS SYSTEM OUTAGES
-
CJ 29/30 June 2024 …… 31.5 hours
-
CJ 14 June 2024 ………. 6 hours
-
CJ 9–10 June 2024……. 8 hours
-
31 May 2024…. . .. 8 hours + 12 hours
-
CJ 11 May 2024 ……… … 6 hours
-
4–5 May 2024**…… 28.5 hours+ 31.5 hours+ 9 hours
-
CJ 14 April 2024**** …..10 hours+ 12 hours
-
CJ 23 March 2024……… 4 hours
-
CJ 1–3 March 2024******… 8 hours+ 33 hours+ 31.5 hours
-
CJ 7 February 2024*****.. 1 hour
-
11 December 2023***….. 4 hours+ 2 hours
-
CJ 5 December 2024*…… 2 hours
-
*CJ 29 November 2023…….. 8 Hours+ 30 mins
-
CJ 4 November 2023*****… 6 hours
-
CJ 24 October 2023******… 64 hours+ 6 hours
-
19 October 2023***……. 2 hours
-
12 October 2023******…….
-
CJ 14 September 2023** ….
-
CJ 1 September 2023***** …
-
CJ 5 August 2023************.
-
1 August 2023***************
-
CJ 20 July 2023******************..
-
CJ 8/9 July 2023************************ ..
-
CJ 6 July 2023******************************. .
-
CJ 18 June 2023**************************************..
-
19 June 2023***********************************************.
-
1 June 2023*********************************************************.
= 398.25 hours = 16.60 days
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Submission 25
Attachment 3: Submission to the National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024 [Provisions]
Marie Johnson. May 2024. Submission Number 15.
Marie Johnson 18
Submission:
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.1) Bill 2024 10 July 2024
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Senate Standing Committees on
Community Affairs Inquiry
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No.
1) Bill 2024 [Provisions]
Ignoring the Risk of the Lack of Capability
Submission By
Ms Marie Johnson CEO Centre for Digital Business Pty Limited
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill [Provisions] 2024
Table of Contents
- Table of Contents 2
- Background: Marie Johnson 3
- Executive Summary 6
- A Lack of Capability to Implement 10
- Joint Standing Committee on the NDIS 10
- Similarities Between RoboDebt and RoboNDIS 10
- Australian National Audit Office Reports 12
- Management of Complaints by the National Disability Insurance Agency, 22 April 2024 12
- Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports, 28 June 2023 13
- Management of Complaints by the National Disability Insurance Agency, 22 April 2024 12
- Joint Standing Committee on the NDIS 10
- Defective Systems, Data Breaches and PACE 15
- Disrupted Payments Impacting Participants and Providers 25
- An Impossible Rollout of a Defective System the Whole “New” NDIS is Dependent On 28
- Data Migration and Critical Functionality Gaps 31
- Unknown and Uncapped Costs of PACE 33
- Algorithms: The Budget Calculation Instrument ~ a Recast of the Dumped Centrelink $200 million Entitlement Calculation Engine (ECE) and the Dumped $250 million Home Affairs Permissions Capability Platform? 37
- Section 10: No Obligation for Australia to Adhere to the UNCRPD 42
- Psychosocial Disability and Mandatory Assessments 43
- References 45
- Attachment A 49
- Submission by Marie Johnson, Submission 137 Attachment 1, Supplementary Statement, 3 March 2023. JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA) 49
Marie Johnson 2
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill [Provisions] 2024
Background: Marie Johnson
I am the CEO of the Centre for Digital Business, a digital services and AI company.
I am recognised as an eminent global award-winning digital authority; advocate for the humanitarian application of AI; and a relentless inclusion and accessibility advocate. I am an international speaker, author, and commentator on artificial intelligence, human rights, technology, ehealth, cyber, identity, ethics, and innovation.
I am the author of the best selling book “Nadia: Politics | Bigotry | Artificial Intelligence”.
I was the recipient of the prestigious US Government O-Visa for Individuals with Extraordinary Ability or Achievement, in 2005 to take up my role leading Microsoft’s Worldwide Public Services and egovernment industry based in Seattle. In taking up this role, the US Government awarded the O-1 Visa, with Microsoft noting “…Marie’s egovernment knowledge is unique in the world and is of particular interest to Microsoft as we pursue our egovernment strategies’.
Throughout my career, my deep expertise has been sought by world leaders and global organisations on the geo-political and democratic dynamics of national technology.
At the forefront of digital transformation for decades, literally since the early days of the Internet, my track record across the public and private sector in Australia and internationally, covers health and human services; disability services; global ehealth immigration and visa systems; tax; identity; and payments.
The expanse of roles includes large scale service delivery operations; global technology; advisor to governments globally; Chief Information Officer; Chief Technology Architect; Technology Authority; inelligence analyst; board director; and STEM patron.
In the early 1990’s I worked in intelligence and analysis areas in the Department of Defence. In the mid 1990’s, I led the intelligence unit of an organised crime task force, at the National Crime Authority, Melbourne Office.
In the late 1990s, I led the strategic intelligence and revenue forecasting unit, and one of Australia’s first e-business projects at the State Revenue Office (SRO) of Victoria with the implementation of epayments and the investigation of the impact of credit card merchant fees which would be associated with ebusiness project was recognised as one of the world’s first successful ebusiness projects, and was developed into a case study for an international executive program managed by the Melbourne Business School and INSEAD (France).
In the year 2000, I led the Business Entry Point in a task force partnership with the Australian Tax Office to deliver the ABN registration for millions of Australian businesses in the lead up to the introduction of the New Tax System in the year 2000. Over the past twenty-five years, this has been recognised as the most significant and successful digital achievement in Australian history.
For many years, I was the Chief Technology Architect for the Australian Department of Human Services, with responsibilities including the architecture and technology business cases bringing together the massive systems of Centrelink, Medicare Australia, and the Child Support Agency. I was responsible for
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill [Provisions]2024
initiating Payment Delivery Reform, as part of Service Delivery Reform, and led in collaboration with the Reserve Bank of Australia, industry consultation on ‘Innovation in Payments and Information Services’. Previously, I was the Chief Technology Architect for the billion dollar Australian Health and Human Services Access Card, building international expertise in the application of biometrics to service delivery including in healthcare.
My advocacy and expertise in identity and payments was influential in the 2014 Australian Financial Systems Inquiry recommending the need for a federated digital identity framework as a critical element for the future robustness of Australia’s financial systems.
In a major service delivery transformation role at the Department of Immigration and Citizenship, I created and delivered the Visa Pricing Transformation, which generated interest globally from friendly counterpart Immigration agencies. For the first time, this involved the application of differential pricing to visas, channels, visa products in conjunction with an innovative digital business model, electronic payments strategy and legislative change, projecting additional revenue to the Federal Budget of $700million. Responsibilities also encompassed the delivery of the global eMedical system (a digital operating model for managing risk-based health assessments) to over one hundred countries, in partnership with citizenship and immigration Canada.
I am the former Head of the NDIA Technology Authority. In writing this submission, I am drawing on my somewhat unique experience: of lived experience supporting family with disability in addition to my depth internal knowledge and experience.
I was responsible for the business case for the NDIS ICT systems, and for this to be based on co-design and the principles of the UN Convention on the Rights of Persons with Disabilities. I was responsible for the implementation of co-design, a program of innovation and the creation of Nadia. Co-design would later be abandoned by the Agency.
I have an exceptionally deep knowledge of the NDIS processes, and the NDIS ICT system which were delivered by DHS. I have a deep understanding of NDIS capability, operating model and culture. I also have considerable operational knowledge of the cross government capability, systems and architecture on which the NDIS is dependent.
Various board and advisory roles include Independent Member of the Australian Federal Police Spectrum Program Board; member of the New South Wales Government Digital Government Advisory Board; invented member of the Accenture Global CIO Council; National Director of the Australian Information Industry Association; and Faculty at Exponential Medicine Singularity University.
I was an inaugural Member of The Australian National University Cyber Institute Advisory Board.
Over many years, I have been a judge on Australian and international technology and innovation awards. I’m a writer and regular contributor to a variety of media publications, including InnovationAus and CIO Australia, and I’ve authored chapters for books, and authored and co-authored international papers. I was one of forty Australian innovation leaders and foremost thinkers invited to write a paper on the future of Australian jobs and industry, in the first publication of “The Innovation Papers”.
I am an in-demand international keynote speaker and sought-after participant on podcasts and webinars.
Marie Johnson 4
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Amongst these, in 2019, I was faculty at Singularity University Exponential Medicine (San Diego); I have spoken at MEDICA, the world’s largest medical and health trade fair; and O’Reilly AI in London. In 2020, I delivered the 2020 Kenneth Jenkins Oration.
The innovation and digital initiatives I have led have been recognised globally. These include the United Nations Public Service Award in the category “Application of ICT in government: egovernment” for Business Entry Point (www.business.gov.au) which I led for 5 years prior. In 2006-2007 “Innovative CIO of the Year – Australia”; 2013 named one of Australia’s “100 Women of Influence”; and awarded the “Exceptional Woman of Excellence” at the 2019 Women Economic Forum, the largest gathering of women entrepreneurs & leaders worldwide. In 2021, I was the Patron of the Tech Girls Movement Foundation.
In 2022, I received the Australian Capital Territory Mental Health Carer Award.
Qualifications:
- MBA from the Melbourne Business School (specialising in innovation, technology, and ecommerce)
- Bachelor of Arts Deakin University (international relations, defence, and strategic studies)
- Graduate of the Harvard University Kennedy School of Government Senior Executive Fellows Program
- tertiary studies in law at Deakin University
- and a Graduate of Australian Institute of Company Directors
More Information: www.marie-johnson.com
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Executive Summary
My focus of this submission is the NDIA’s lack of capability to implement, and the consequences of a Bill that recklessly ignores this fact.
As the former Head of the NDIA Technology Authority, and as an advocate for family interacting with the NDIA, I predicted the devastating impact that the NDIA’s defective culture, systems and processes would have on my family. For more than seven years, I have made submissions to various JSCNDIS inquiries and other inquiries, drawing on my expert internal knowledge, predicting problems and crises with the NDIA/NDIS that would eventuate. I refer to the specifics of these throughout this submission, which are relevant and as a caution to this Bill. My submissions and articles are listed in the References to this submission.
This Bill ignores the lack of capability of the NDIA to implement, and yet is built on untested assumptions of automation. And while the NDIS Review sets out a five-year timeframe for reform, while also bizarrely ignoring the NDIA’s lack of capability to implement, many of the items within this Bill are needed to allow for those changes to take place. This is an insurmountable disconnect.
With such an enormous nation-wide implementation, transition and change management effort proposed without any understanding of the risk of implementation, transition and parallel operations, the current defective capability of the NDIA as examined in JSCNDIS reports, ANAO audit reports, FOI documents, and submissions to other inquiries referenced in this submission - paints a national risk to all governments, Commonwealth, State and Territory, and of course, above all, risk to life of NDIS Participants.
To reiterate. Just six months ago, the JSCNDIS Report into the Culture and Capability of the NDIA documented overwhelming complexity and evidence of a lack of NDIA organisational capability significant cultural and capability deficits including unlawfulness An adversarial culture that traumatises people; and practices that are incompatible with the UNCRPD.
Also examined in detail in this submission are ANAO Audit Reports over the past year, on critical aspects of risk and data security The 2024 ANAO Audit Report showed that the NDIA’s complaints management process utterly fails to correctly identify and record risk, in a process inherently about risk Complaints are not about not being happy; complaints are about risk, and this is the primary interface through which risk can be alerted This is a systemic failure of the NDIA failing to comply or apply the NDIS Risk Management Rules 2013.
The 2023 ANAO Audit Report is also damning of the NDIA over critical deficiencies regarding risk management systems controls payments integrity and performance analytics I provide detailed commentary based on these ANAO Audit Reports and FOI documents, of the NDIA’s worrying lack of command of data security.
Throughout this submission, I describe the systemic issues relating to defective systems, including PACE payment disruptions data breaches the use of defective algorithms, and I challenge the assumption inherent in this Bill that everything can be automated. I recap on my predictions that have been borne out: this is relevant because the scale of chaos and disruption that is currently happening was predicted in exacting detail and I cite these from previous submissions.
Marie Johnson 6
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
This is an organisation that for the best part of a decade has been assessed as having intractable capability deficits and defective systems; a proposed five-year implementation and transition that would also be run in parallel with maintaining the defective BAU SAP CRM legacy systems. And as described throughout this submission - and predicted in previous submissions - the four year old “new” PACE system, not yet delivered, is also defective. There will be multiple defective systems in play.
This is not simply a “new computer system”, but a fundamental change to the foundations of the NDIS introducing new processes and concepts - not yet legislated - in a sector wide change that impacts the lives of more than 600,000 Participants, thousands of providers, and hundreds of thousands of people working in the NDIS ecosystem.
For a Scheme that has administered hundreds of billions of dollars over the past decade, there has been very poor attention given to building a high integrity highly resilient payments capability. In the 2016 Transition to Full Scheme, the “swapping systems” caused payments disruption to the whole sector: The difference now is there are 20X more Participants. In addition to sector wide payment disruption in 2016, two critical functions were abandoned by the NDIA with disastrous impact lasting a decade: codesign and the Service Delivery Operating Mode (SDOM).
The lessons from 2016 have not been learnt; I was there; and the post transition report is a sobering must read. The NDIS is at this very precipice yet again.
If we look forward another 10 years - which we must - many more hundreds of billions of dollars will pass through these systems. Given the defectiveness of these systems and processes, this is an extraordinary isk to the budgets of all Australian governments, Commonwealth, State and Territories.
The reason why this discussion is relevant to the consideration of the Bill, is that the NDIA clearly does not have the capability to retrieve itself from the deep crisis it is in, let alone launch itself into a five year “transition”, into a complex undefined and unknown future state, that this Bill proposes.
In the body of the submission, I examine in some detail the concept of the proposed Budget Calculation Instrument. I ask the question:
Will this Budget Calculation Instrument be a recast of the Services Australia $200 million Entitlement Calculation Engine (ECE) that was dumped by this government, by Bill Shorten as Government Services Minister? Will it be a recast of the dumped Department of Home Affairs $250 million “Permissions Capability Platform”?
All three are essentially the same concept. And why would the government expect a different outcome for the NDIA Budget Calculation Instrument, where half a billion dollars has already been wasted by Services Australia and Department of Home Affairs on abandoned attempts at the same concept.
These are the catastrophic risks emanating from a Review and a Bill, theorising a concept without any regard for actually what is involved in implementations; or more correctly, ignoring the lack of capability to implement.
And in the hazardous era of algorithms, this Budget Calculation Instrument proposal cluelessly showcases a world first. This Bill puts an algorithm (the Budget Calculation Instrument) - yet to be defined
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
- beyond the reach of administrative review. This submission cites cases in other jurisdictions, where the application of algorithms in administrative decision making in relation to funding, created risk to life and resulting in death.
My prediction is that with such profound organizational cultural and capability deficits, combined with the extraordinary powers to be vested in the CEO, implementation will fail; Participants will suffer harm; and the NDIS will implode.
What does this look like?
The narrative will shift from ‘“financial sustainability” to a volatile political and bureaucratic posture reacting to an out of control crisis of system wide harm. Payments will be disrupted and erratic; services suspended or stopped; administrative data breaches, data defects, and lost documents will escalate uncontrollably. This system now under unnecessary extraordinary duress, will be preyed upon by cyber and other criminals. No amount of money spent on smart fraud detection systems can reverse or stop that which is recklessly set in train. People will suffer harm, and face risk to life. This is already happening, as evidenced by the horrific cases on the robondis.org website, escalating complaints, and out of control backlogs. The State and Territory governments - having part-funded the NDIS for a decade - will be forced to step in.
To emphasise, I obviously do not want this to happen and I’m extremely concerned for my family, but equally, I am not catastrophising.
I say this as someone with family dependent on the NDIS; as a person with deep internal knowledge of the NDIA NDIS, Services Australia and the systems across government; as someone whose commentary has been referenced in JSCNDIS and other reports; and as someone globally recognised for their expertise in technology and AI. I know what I am observing from decades of experience; a depth of expertise in the complex systems of government and the economy, beyond any officer currently in the NDIA. I have no vested interests.
What is proposed in this Bill, requires a high performance skilled customer focussed human workforce capability; optimal systems performance; strong and regulated data integrity; clear, consistent and documented business processes; and payment integrity to the level of Australia’s financial systems.
What is required is compliance with UNCRPD; and a culture of co-design, safety and trust.
None of this exists. The NDIA is not and has never been fit for purpose. The NDIA does not have the capability and certainly is not fit to execute the implementation of the scale of changes proposed in this Bill.
This defective Bill, which is inconsistent with Human Rights, should be dumped because the naïveté around implementation is a national security risk, as I stated in my JSCNDIS submission (Attachment A). That is only found out when it’s too late.
Certainly, the drafting of this Bill under the secrecy veil of Non-Disclosure Agreements with industry stakeholders fundamentally undermined the trust of Participants and advocates, and exposed the “commitment to co-design” as nothing more than political and marketing theatre.
Marie Johnson 8
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
The Agency would have a different view, but a decade of reviews and inquiries, evidenced from many thousands of submissions, paints a devastatingly contrasting picture.
Recommendations
- This Bill must be rejected.
- NDIA to cease work on the PACE system, pending ANAO and NACC examination.
- NDIA to reinstate the Service Delivery Operating Model, which was developed in 2016 then abandoned. The ANAO Audit Report National Disability Insurance Scheme - Management of Transition of the Disability Services Market referenced the SDOM. And the 2016 Transition to Full Scheme systems implementation review, which examined the sector wide payment disruption, recommended the SDOM be reinstated.
Marie Johnson 9
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
A Lack of Capability to Implement
Joint Standing Committee on the NDIS
In light of what’s now in front of the NDIA in terms of the wholesale recasting of the NDIS this Bill presents, the findings of the JSCNDIS Report into the Culture and Capability of the NDIA - just a mere six months ago in November 2023 - are alarming. And it is shameful that the operations of the NDIA itself were not part of the Terms of Reference of the NDIS Review.
The JSCNDIS Report into the Culture and Capability of the NDIA, documented overwhelming complexity and evidence of a lack of NDIA organisational capability, including co-design and communication; a lack of staff knowledge of the NDIS and disability conditions; an adversarial culture that traumatises people; and practices that are incompatible with the UNCRPD. This after a decade of operation.
One of the most significant and troubling findings was that the administrative construct of “primary disability” was not consistent with the NDIS legislation. Effectively, the NDIA has been operating unlawfully for 10 years.
“2.29: The NDIA’s distinction between ‘primary disability’ and ‘secondary disability’ has no basis in its governing legislation or the reality of Participants’ lives. This section will consider the impact that this imposed differentiation, which operates as a form of discrimination, has on Participants. As a starting point, it can result in Participants being denied supports for impairments that the agency determines are not related to their ‘primary disability’.”
An administrative convenience
“2.30: Legal precedents confirm that there is no legislative basis for distinguishing between ‘primary disability’ and ‘secondary disability’. It would, therefore, appear to be an artificial distinction that the NDIA has introduced and imposed.’.”
Similarities Between RoboDebt and RoboNDIS
The similarities between RoboDebt and what has become known as RoboNDIS, were evidenced at the JSCNDIS Inquiry, with the RoboDebt Royal Commission having reported during the period of the JSCNDIS inquiry.
“2.162: It was suggested that a culture has developed within the NDIA to prioritise cost-cutting above participant wellbeing. Some submitters associated this experience with a perception that people accessing any government social welfare funding are viewed with skepticism and mistrust. Consequently, many participants leave interactions with the agency feeling that their integrity has been questioned and treated as though they are seeking to defraud the public. These concerns were borne out in the Royal Commission into the Robodebt Scheme, which received evidence that ‘[t]here is an enduring assumption that all persons on welfare or pension payments are potential or actual cheats.’”
Marie Johnson 10
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
“2.212: A key recommendation of the Royal Commission into the Robodebt Scheme (Robodebt Royal Commission) was that policies and processes be designed with emphasis on the people they are meant to serve…”
“2.213: These recommendations are applicable to the capability and culture of the NDIA. Throughout the inquiry, submitters have questioned whether the NDIA’s policies and processes are actually designed to serve their primary client, the participant.‘’
Additional Comments by the Australian Greens
“1.1: It is deeply concerning that the NDIA has not, in some instances, fulfilled the promises of the NDIS Act or Australia’s international commitments. Additionally, it is disappointing that many of the same systemic problems continue to be raised through inquiries, indicating a lack of strong and immediate action from the Australian Government.”
“1.14: Several submitters likened NDIA processes and practices to those implemented under the Robodebt scheme. For example, a submitter with ME/CFS was alarmed at reports of government officials who had worked on the Robodebt scheme taking up positions with the NDIA’s compliance division:
It seems that the same tactics used for Robodebt have been applied to the NDIA, resulting in harm to the most vulnerable members of our community and depriving them of the necessary support to enhance their quality of life.“,
“1.15: The inquiry heard evidence from Ms Marie Johnson warning of risks to participants caused by automated technologies:
Algorithms based on ‘behavioural insights’ create a fiction, a persona comprised of assumed or typecast features whose fictional behaviours are used as a proxy in order to predict behaviours of real people, and for this prediction to be treated as fact. It makes huge generalisations, reductions and determinations on complex human conditions, experiences, and disparate factors … The NDIS legislation specifies that PLANS are INDIVIDUALISED and directed by the participant. That facilitates tailored and flexible responses to the individual goals and needs of the participant. The application of statistical averages in automated Roboplanning eliminates the individual person and their needs, transmuted instead to a fictional average, a fictional ‘persona’.’“,
“1.16: Another submitter called on the NDIA to immediately cease any use of algorithmic technologies or automated decision-making with participants. They indicated that the NDIA should instead focus on creating individualised plans for each participant: It is inhumane, unjust and dehumanising … Factoring in discriminatory information like my age, disability and what the NDIS think is my level of functioning into a computer program to lump me with other ‘like’ people into a pigeonhole entirely for the convenience of a ‘system’ is profoundly offensive … I’ve never met anyone like me because there is no-one like me.”
With such extraordinary god-like powers to be vested in the CEO, there is the risk that future NDIS operations will see an expansion of similar “administrative convenience” devices executed via algorithms,
Marie Johnson 11
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
presenting an unacceptable risk to current and future NDIS Participants. As detailed in the section “Algorithms: The Budget Calculation Instrument”, implementation via algorithm is an inherent and fallacious assumption underpinning this entire Bill.
To reiterate. Just six months ago, the JSCNDIS Report into the Culture and Capability of the NDIA, documented overwhelming complexity and evidence of a lack of NDIA organisational capability, including codeign and communication; a lack of staff knowledge of the NDIS and disability conditions; an adversarial culture that traumatises people; and practices that are incompatible with the UNCRPD. The JSCNDIS also heard of a lack of transparency and ineffective communication with regard to the NDIA’s complaint’s mechanism, eroding trust amongst participants.
This after a decade of operation. And yet, the government would have the Australian public believe that the NDIA - just six months later - is equipped to handle the most complex and risky of implementations affecting every State and Territory government and 600,000 Australians.
Australian National Audit Office Reports
The following recent ANAO Audit reports into aspects of the NDIA’s operations, provide evidence of systemic mismanagement of risk, and evidence that challenges the assumption that the yet undelivered and highly problematic PACE system will address all defective data, systems and processes.
Management of Complaints by the National Disability Insurance Agency, 22 April 2024
One of the most concerning references in this 2024 ANAO Audit Report, relates to the management of risk. Or rather, the systemic mismanagement of risk, and evidence of the NDIA failing to comply or apply the NDIS Risk Management Rules 2013.
Figure 2.2 reproduced below, reports the NDIA results of post completion quality checks. Highlighted is the identification and recording of risk.
| Figure 2.2! | NDIA rnults of post-completion quality checlm for ‘rlg:ht process’ category, Complalnll!I Resolutlon stream, :20:2:2-29 |
|---|---|
| 100% | . |
| •0% | |
| 80% | |
| •0% | |
| 70% | |
| •0% | |
| 60% | |
| •0% | |
| 50% | |
| •0% | |
| 40% | |
| •0% | |
| 30% | |
| •0% | |
| 20% | |
| •0% | |
| 10% ~ | |
| Jut-2’2 IW!J-2:2 Sep-22 0 |
- Fartidpant ret:ord 1Aik8d 8Pfiri>pl’mlaty lo lhe- ooniplflinl.
- Where lht!re- are repeat cam,p!Mlts. cornplain1 &lot-&~d lei appropru!lte cornplair,u offitei>r.
- Righi:i!iIIJl!(!i) id!mtilied frMl tlie complaint. cmedty idai11ified 11r1d reJd.Ontig recorded.
- COflt0Ct or contatt .at’.empl&,
- Guid!N
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Given the massive number of complaints from Participants (28,951 in 2022-2023), this is an extraordinary report identifying that risk was correctly identified ZERO percent on a number of occasions; and less than ten percent on multiple occasions. The seriousness of this cannot be overstated. Complaints would include harm and risk to life, including multiple complaints from the same complainant given the complaint had not been addressed and the risk to life persisted.
In my own submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (reproduced in full at Attachment A), I detail my own family’s experience in such a situation. I also reference other public cases.
The point I am making here, throughout this submission and in previous submissions, is that the NDIA has a systemic capability deficit regarding risk. There is no “risk to life” in the risk register, that is, risk to life resulting from the NDIA’s own operations. The NDIA’s complaints management process utterly fails to correctly identify and record risk, in a process inherently about risk. Complaints are not about not being happy; complaints are about risk, and this is the primary interface through which risk can be alerted. This is a systemic failure of the NDIA failing to comply or apply the NDIS Risk Management Rules 2013.
Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports, 28 June 2023
The year prior to the 2024 ANAO complaints audit (discussed above) which graphically illustrated the almost complete breakdown on risk recording by the NDIA, the 2023 ANAO Audit Report on the NDIA’s Management of Assistance with Daily Life Supports, was damning of the Agency over critical deficiencies regarding risk management, systems controls, payments integrity and performance analytics. It was also noted that there were seven out of nine recommendations made by the Auditor-General in prior audits, relating to improved decision-making controls and fraud controls, not fully implemented.
Once again, the reason why this discussion is relevant to the consideration of the Bill, is that in the past year alone - after a decade of operations - the ANAO and JSCNDIS continue to find deep and persistent capability and performance deficiencies in the very areas the Bill is dependent on. We have a defective Bill, incompatible with human rights, dependent on defective systems.
A synopsis of the findings of the 2023 ANAO Audit Report follows in the box below.
Risk of Fraud
- ICT controls aligned to policy requirements for planning decisions have not been implemented.
- The frequency and rigour of NDIA’s assessment of fraud risks is insufficient given it has assessed the fraud risk associated with the agency’s activities to be high.
- The risk assessment that informs the overall risk rating assigned to fraud risks is not documented.
- The NDIA Board does not have adequate oversight of fraud risk.
Lack of ICT Controls: Systems Access
Combined with the lack of ICT controls for accessing participant records, staff controls represent an
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
area of risk, especially for plan delegates.
Between February 2022 and February 2023, 255 NDIA staff had access to the Centrelink mainframe. The documentation and governance for NDIA staff access to Centrelink systems is inadequate to ensure the appropriateness of NDIA’s access to and use of the sensitive data inCentrelink’s mainframe system.
NDIA does not have processes to identify inappropriate access to participant records. Recommendation no. 6: mandatory business practices and ICT controls to restrict access to participant records that relate to a real or apparent conflict of interest reported to NDIA; and ICT controls to log all access and amendments to participant records in CRM and PACE.
Lack of ICT Controls: Recording Reasons
…indicates a low level of compliance with the NDIA’s requirement to document that reasons for decisions were communicated to participants.
…previous audit found a lack of an ICT control for the recording of reasons for decisions to decline requested supports. In 2022, the NDIA amended CRM to support recording of reasons for decliningrequested supports and automating the inclusion of such reasons in decision letters, but did not implement the enhancement. NDIA advised it did not implement this change due to the development ofthe PACE system
Inadequate System Controls: Payments
NDIA has inadequate system controls for claims for payment, in particular, from self-managedparticipants.
High Risk of Single Delegate Approvals
The ANAO’s 2021–22 financial statements audit identified that NDIA sampling does not take intoaccount the potential high risk of single delegate approved plans in its sampling methodology and also recommended that NDIA consider system driven validation for payments for self managementparticipants.
Aligning Policy and Systems Requirements
ICT controls aligned to policy requirements for planning decisions have not been implemented.
The NDIA stopped updating the existing CRM system in March 2022 to support aligning policy andsystems requirements for the introduction of PACE.
####### Inadequate Reporting The NDIA does not routinely report on Assistance with Daily Life (ADL).
######## Lack of Analysis NDIA collects comprehensive data but does not undertake analysis of trends or outcomes to inform service improvement. The ANAO saw no evidence of plans for ongoing data linkages which couldinform assessment of participant outcomes.
Assessment of outcomes: There is no analysis of the results or details of business processes changedin order to improve overall performance.
The NDIA does not use this reporting to inform an assessment of overall trend analysis and to drivecontinuous improvement.
Marie Johnson 14
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
According to the 2023 ANAO Report, the NDIA stopped updating functionality in the current SAP CRM system in March 2022 to support aligning policy and systems requirements for the introduction of the new PACE system. This was ahead of the national rollout of PACE, which would commence in September 2023. So it would appear that for more than a year, reporting functionality may not have been supported or did not exist in either the SAP CRM or the new PACE system. If this is the case, this is a serious governance and safety situation.
The discussion in the section “Data Migration and Critical Functionality Gaps”, also indicates that updating performance reporting functionality in the SAP CRM had ceased, pending the introduction of reporting functionality in PACE - this reporting capability gap resulting in a 6 to 9 month absence of performance data available for Senate Estimates oversight. So functionality in the SAP CRM ceased to be supported, notwithstanding that similar functionality in the PACE system was not yet available.
In many of the responses by the NDIA to the 2023 ANAO Audit Report regarding PACE functionality, the NDIA used generic non-time specific phrases such as “will be” or “would be”, including ICT controls supporting payment compliance. In Senate Estimates in March 2024, when questioned as to when reporting functionality would be available, the NDIA still could not be definitive, but “hoped” next quarter.
There are questions to be asked as to all the capability gaps as a result of the discontinuance of support of functionality in the SAP CRM when functionality in PACE is not available. Who made these decisions - that it was OK to have lingering gaps in critical functionality - and for what period of time have such functionality gaps existed?
As I explain throughout this submission, these critical capability deficits and defective systems combined with what this Bill proposes, present an existential risk to the NDIS. And these deficiencies cannot simply be overcome by a “new computer system”. Indeed, the “new computer system” (PACE) itself is defective, and as if the situation couldn’t get any worse, serious capability gaps between the two defective systems (SAP CRM and PACE) appear so significant that performance oversight of the Agency is affected.
In the next section “Defective Systems, Data Breaches and PACE”, I piece together a daisy chain of issues and evidence regarding NDIS data security, revealed through various FOI, AAT, ANAO, and Parliamentary and Senate Inquiry processes, that clearly shows a worrying lack of command by the NDIA of the complexity of NDIS data security of which it is the custodian.
Once again, the reason why this discussion is relevant to the consideration of the Bill, is that the NDIA clearly does not have the capability to retrieve itself from the crisis it is in, let alone launch itself into a five year “transition” into a complex undefined and unknown future state that Bill proposes.
Defective Systems, Data Breaches and PACE
In my March 2023 submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A), I stated that from my experience having run large operational systems across government, the NDIA systems and processes are the most defective and dangerous in government. I have made predictions about risk to life, the disruption to Participants’ plans, planning chaos, data defects, data breaches, and sector impact, that would occur with the haphazard introduction of PACE that
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
is so symptomatic of the NDIA’s catastrophic lack of capability. My predictions have unfortunately been borne out.
The systems and processes are defective for many reasons, most notably the absence of co-design.
Co-Design
In my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A), I explained in considerable detail, the purpose and practice of co-design, and the operational and human impact of the decision by the Agency to abandon it. Whilst I note that in recent times a co-design branch within the Agency has been established, this does not mean that an effective co-design capability exists or that co-design has been happening. The very fact that this Bill was subject to Non-Disclosure Agreements with certain stakeholders, is evidence of this.
The Bill itself contains zero mention of co-design.
Co-design is a strategic governance capability grounded in ethics. Co-design is about how things work: co-design is not about making things look pretty, via periodic or select activities.
End-to-end co-design is necessary to understand risk, hand-offs, and to challenge assumptions. Every aspect of NDIA operations without exception – including actuarial initiatives - must be co-designed. And the only way to map the end-to-end data lifecycle, is through end-to-end co-design.
All capability deficits discussed in this and previous submissions, including cyber, safety and risk, are due to the abandonment of co-design and the unconstrained over-reach of the actuarial function. Everything I predicted would happen, has happened because of this.
Prediction from 2023 JSCNDIS Submission (Attachment A)
WILL NEW SYSTEMS FIX THIS
The answer to this question is NO. And I know this domain with some authority and expertise. There will be a political temptation to point to the ‘new’ Salesforce PACE system as a fix to everything that is busted with the current SAP system. Nothing could be further from reality…Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this. I am 100% certain that people will be caught in desperate situations because part of their three-month funding has run out, or they have a lumpy capital cost.
WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted?
What is the ethics framework informing these decisions?…I predict that participants will be caught in data migration hell. Get ready for a massive loss of data during this period. It is likely that cyber security and organised crime will be watching and probably acting under the cover caused by such disruption. Any cyber infiltration of this enormously complex and chaotic environment - in an
Marie Johnson 16
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Agency of such deep capability and cultural deficits - would likely go unnoticed. Because of this, the NDIA/NDIS would have to be considered a national security risk.
Given this extraordinarily complex risk environment - created through reckless incompetence - it is alarming that the NDIA’s own Agency Security Plan (September 2020, obtained under FOI) states that ‘security is not a primary function’ (page 19) and ‘..the Agency is a low-risk Agency..’ (page 32).
Given the enormity that rests on this Salesforce PACE platform - that is, the entire execution of what is proposed in this Bill and potentially hundreds of billions of dollars of funds to be administered over the next decade - the fitness for purpose of the Salesforce PACE platform needs to be investigated, as part of the due diligence of this Bill - and not simply relying on the assurances of the Agency itself.
It is noted that the ANAO has identified PACE as a potential audit for 2023-2024, the Design and Implementation of the Participants, Platforms and Processes Program’.
It is also noted that the Interim Report of the Joint Committee of Public Accounts and Audit ‘Inquiry into Procurement at Services Australia and the NDIA’, made a recommendation regarding the National Anti-Corruption Commission, that:
“The Committee recommends that the National Anti-Corruption Commission examine all material gathered through this inquiry to determine whether or not to conduct its own inquiry into procurements at Services Australia and the National Disability Insurance Agency involving Milo Consulting (trading as Synergy 360), the Hon Stuart Robert, and John Margerison. In making this recommendation the Committee is not making any findings in relation to the conduct of any individuals.”
Furthermore, the Salesforce submission to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA, noted:
“For context, the PACE program was managed by the NDIA. Salesforce contributed its product and domain expertise. NDIA was responsible for planning, the overall architecture, resourcing the program using a combination of its own internal and contract personnel, and program management. Salesforce was not responsible for any project milestones or timelines.‘’
Salesforce is clearly drawing the line, stating that the management, design and delivery of the PACE platform has been the responsibility of the NDIA. And this goes to the very core of my thesis in this submission: NDIA does not have the capability to implement.
But there is much that is already known about the intractable NDIA capability deficits, from ANAO and JSCNDIS Reports, Parliamentary Inquiries, FOI documents, breach notices, articles, and Participant and Provider commentary. Throughout this submission, I triangulate key data from these various reports together with my own experience and knowledge, to paint a picture of critical questions of data security, accessibility, cost and NDIA’s lack of capability to implement.
Salesforce was awarded the NDIA contract on 2 April 2020.
Marie Johnson 17
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
A number of questions regarding the timing and status of the data security certification and accessibility assessment of PACE have been raised through FOI and submissions. These questions are relevant as they go to the heart of the fitness for purpose of PACE, and the capability (or lack thereof) of the NDIA to deliver a very complex system intended to deliver potentially hundreds of billions of dollars of funds over the next decade, directly affecting the lives of over 600,000 Participants and the business operations of thousands of Providers.
In a Right to Know FOI Request to the NDIA dated 11 June 2021, the following request was made:
“Please provide the documented assurance or proof that Salesforce provides PROTECTED level data security for Australian citizens in accordance with Government cloud services guidelines. That is, specific evidence (by means of assessment or certification) that all information and data created, managed, stored and accessed by the NDIS through all Salesforce products and services are at least PROTECTED with no data leaving Australia or is accessible from overseas.”
The FOI was endeavouring to determine the IRAP certification status of the Salesforce products. The FOI requester left the following annotation and link to the Salesforce IRAP Compliance webpage:
“Salesforce did not commence IRAP certification in Australia until 1 June 2021. Salesforce did not receive IRAP certification in Australia until 30 July 2021.”
These questions appear to be seeking clarification about whether IRAP certification occurred before or after contract award, and whether there was NDIS data leaving Australia or accessible from overseas. These are critical questions. Also on 30 July 2021, in response to the FOI request, the NDIA stated the reason for refusing the request:
“…all reasonable steps have been taken to locate the documents you have requested and I am satisfied that they do not exist…the NDIA is not in possession of documents matching the scope of your request. This is because the NDIA does not use Salesforce products to store, manage or create ‘protected’ level information or data.”
This is quite an extraordinary statement the NDIA is making, that documents relating to assurance of security classification of NDIS data on the NDIS Salesforce PACE system - do not exist. The response was silent on the question about whether or not data left Australia or was accessible from overseas.
Interestingly, on the question of whether or not data left Australia, Salesforce itself provided the response and on which the Committee then further questioned the NDIA.
In its supplementary submission to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA, Salesforce responded to the question:
“32: Can you take on notice whether the CRM data has ever been stored offshore? Salesforce: The NDIA has since the start of the contract in April 2020 been running the Salesforce PACE system on our infrastructure hosted by AWS in Australia.”
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
The NDIA commenced using the Salesforce Marketing Cloud (separate to PACE) to distribute
newsletters to participants in July 2022. Salesforce informed NDIA that Salesforce Marketing
Cloud was hosted in the Salesforce German data centre. NDIA approved storage at this data
centre. In December 2023, this data will be hosted in Australia.”
Clearly, some participant data (such as name, family details, email) necessary for marketing outreach,
would have been stored in the Salesforce GERMAN data centre. And that the NDIA approved this. Whilst the offshore hosting in the Salesforce German data centre commenced in July 2022 - the year after the June 2021 FOI - the sensitivity and transparency around the status of offshore hosting persisted.
Finally, in response to Questions on Notice to the Joint Committee of Public Accounts and Audit Inquiry
into Procurement at Services Australia and the NDIA, the NDIA stated:
“While the infrastructure hosting is being transitioned to Australia, Salesforce Marketing
Cloud continues to be used to deliver generic email newsletters including automated "Hello
and Welcome" email campaigns to participants. Marketing Cloud is also used to provide
generic alerts, communications and surveys. It is important to note that while the platform is
hosted in Germany, no participant information is stored on Marketing Cloud.”
This response demands further challenge, as the NDIA would have us believe that emails, surveys and communications to Participants run through the Salesforce Marketing Cloud platform hosted in Germany - that “no participant information is stored on Marketing Cloud.” These communications by their very nature inherently ARE Participant information, which is personally identifiable information (PII), therefore, requires degrees of state and commonwealth protection, especially under the PSFP.
The NDIA appears to be having continuing difficulty answering questions regarding the security of NDIS Participant data.
Significantly, as reported in iTNews on 4 October 2023, further questions about the security of the NDIA’s
PACE system were heard in an AAT case, involving a report that raised “concerns” about the system and “serious concerns” with the agency’s information security generally.
“The document - which had been sought under freedom of information (FoI) laws - is to be kept
private after a mid-September ruling deemed it too sensitive for public airing…
…it is said to have raised "some serious concerns about the security of the information and
information systems employed by the NDIA."
The AAT said the contents of the document, if released, “would damage public confidence in the
scheme and of the NDIA more broadly.”
What this AAT ruling is literally saying, is that the security issues that had been documented in the report were so serious that the report could not be released because it would damage public confidence in the Scheme and the NDIA. In making this statement, the AAT acknowledged the fact of the existence of a report of serious security issues in the NDIA.
Marie Johnson 19
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
FOI documentation and responses also indicated curious responses by the NDIA to questions about the Salesforce worldwide outage in 2022. The FOI question was:
"Has the NDIA/NDIS experienced any Salesforce service, connectivity or access disruption,
outage or failure since the original service and support agreement was signed? If so, when and
which systems/service(s) were affected and for how long? This includes all Salesforce related
APIs and subsidiaries of Salesforce, such as Mulesoft.''
In response, the NDIA stated that:
"...the NDIA has not experienced any unplanned outages, disruptions or service failures relating
to the Salesforce or Mulesoft services."''
This response from NDIA elicited a followup FOI request on 22 April 2022.
"It was widely reported and confirmed by Salesforce directly that there was a global disruption
and outage of their services on 11 May 2021. Every user, organisation and login was seemingly
affected due to this outage/disruption/service failure…
Could you please explain or provide the documentation supporting the declaration or claim that
the NDIA/NDIS was seemingly the only entity in the world NOT affected by this global outage?'"
The NDIA response was selective, referring to logins and not outages. The FOI requestor annotated the FOI request, stating that the FOI request had asked about outages, not log in. Which the rest of the world experienced for 5 hours.
It would be incredulous that the NDIA would be the only organisation worldwide not to have experienced
an outage.
Once again, it is not the incident that is necessarily the problem, although that is incredibly serious in an environment such as the NDIA, where an outage may very well result in people being unable to access funds to maintain services critical to life. As with the offshore data question, it is the NDIA’s apparent predilection for deflecting questions, and far worse, its apparent inability to connect the dots between data services, data security and Participant safety.
Piecing together this daisy chain of issues and evidence regarding NDIS data security, through various FOI, AAT, ANAO, and Parliamentary and Senate Inquiry processes, clearly shows a worrying lack of command by the NDIA of the complexity of NDIS data security of which it is the custodian.
This is an example of the defective PACE system in operation, with
My NDIS Contact: serious data security and data integrity defects.
`redacted` 1
The image is of a Participant plan doing the rounds on social media.
I am providing it here because there is no identifying data. Notice
Phone: 1800 800 110 anything odd? Well, this participant plan refers to the NDIS Contact
as "Mulesoft 1". Who is Mulesoft 1? Actually, that should be, what is
Email: enguiries@ndis.gov.au Mulesoft 1?
Marie Johnson 20
NationalDisabilityInsuranceSchemeAmendment(GettingtheNDISBackonTrackNo.
Bill[Provisions]2024
MulesoftisanAPIplatformandasaSalesforcecompany.Thatisnottheissue.
Theissuеis,hоwdoes-thenameoftheplatformmakeitswayintoanidentitydatafield,specificallyadatafieldofpersonandrole.Andforthatapparentlynottobenoticedduringtesting;iftestinghappendtomakewayintoproduction-nottobe noticed;andtomakeitstowithetheParticipant-whereitisnoticed.
Thisshouldnothappen.Itindicatesveryserioussproblemsacrossmultipledimensions:cybersecurity, idntity,privacy,dataintegrity,dataprotectionandsystemdeployment.
DatadefectsandinaccurateParticipanthrecordscannotsimplybefixedbymovingtoPACE,epeciallywhenthischange lookslikedatamigrationandqualitycontrolisnotin happening.Ifthisisthecase,onwhoseauthoritywas thisdecisionmade,andwasitincompliancewiththePublicGovernance, PerformanceandaAccountabilityAct2013thatcoversrecordkeepingbygovernmentagencies.
TheNDIAsystemsprocessesarethemostdefectiveingovernment.InmyJSCNDISSubmission,atAttachmentA,Almosteighteenmonthsago,IwrotelargelyaboutthevulnerabilitiesofAPIs andpredictedexactlywhatisonnowhappening.
“NDIahashundredsofAPIs,given theevidenceIpresentinthiseadditionalstatementandin thecontext ofextensivechangemanagementchallengesofthenewSalesforcePACESystemquestionsneedbeaskedabouthecurity,risk,cyberthreatassessmentscenario preparedness.”
InJanuary2024,iTNewsreportedthatalmost650NDISParticipantsprospectiveParticipantshavestillnotbeen toldwhichoftheirhealthrecordswereleakedonthedarkwebinJune lastyear(2023).Asanexampleofthescale,Bell*,whohasanautoimmunedisease,toldiTnews “…thathWLEbsworthobtainedmorethan900pagesofdocumentsaspartmentofanappealagainstNDIAS decision thatshe wasineligibleforNDIS.“Thisfollowsthe2022NDISCATARSdatabreachinvolvingasmuch as12,000, whichwasdetailed in my JSCNDIS submission ( Attachment A ).
Yet,inspiteoftheseriousspreadsystemicanddataintegritydataprotectiondefectsbroadly reported anddescribedinyourJSCNDISSubmissionAttachmentA)-andwhicharescalingasd escribedthroughoutthissubmission-theNDISReviewrecommended(Action 10.2),“TheNationalDisabilityInsuranceAgency’scurrentapplicationprogramminginterface(API)functionalityshouldbeexpandedtoenablebettertwo-wayinformationsharing.”
TheignoranceoftherisksoftheNDIA’sdefective datasecurityandalack ofcapability toimplementisextraordinary.
Inmakingthatrecommendation,theNDISRevi ewhasclearlygivenno regard for the NDIA’slack capability implement.Andthat isbecause theNDIA’operationscapabilitieswere notpartoftheNDISRevie wtermsreference.
Then thereisth questionaccessibility.
MarieJohnson 21
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Accessibility is not about how things look, but how things work for people. And there is a clear and known linkage between accessibility and security, which is why the submission by the Australian Federation of Disability Organisations (AFDO) to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA is so important.
In its submission AFDO stated:
- “The procurement of inaccessible information and communications technology continues to have a detrimental impact on the employment and retention of people with disability within the NDIA and Services Australia. This situation also affects the general useability of ICT products and services that are available to the Australian public…”
AFDO reminded the Committee ‘…that the Australian Government has signed and ratified the Convention on the Rights of Persons with Disabilities (CRPD) and in doing so, has made a legal commitment to uphold the rights..’
Questions have been raised about the extent to which accessibility was assessed (as distinct from marketing claim) as part of the procurement of the Salesforce platform.
The document “ACE Project Risk Management Review”, dated February 2021, redacted release under FOI, stated that accessibility had not been holistically assessed, and worryingly predicted additional accessibility issues:
- “As sub-projects progressed (e.g. Social Studio) accessibility issues have been identified, noting these issues were not identified as part of a holistic assessment of the product’s suitability for use by the Agency, additional accessibility issues may be identified.‘’
The February 2021 “ACE Project Risk Management Review”, predicted the risks and issues outlined in the AFDO submission some two years later:
- “Broad access to technology that will support participants, and other stakeholders to interact with the Agency remains a challenge.”
Participant Stories: Technology Not Accessible
“Blind employee’s can’t use PACE just like their current CRM? Due to unskilled IT internal team. Screen readers are a reasonable adjustment. They forgot to make it user friendly? Shame on using equal employment words in their recruitment rounds?” Participant.
So it would appear that there are questions about whether the evaluation process of the Salesforce PACE platform sufficiently considered IRAP and accessibility assessments. Why this matters, is that it is indicative of the NDIA’s lack of capability to implement a “new” system (PACE), costing more than $200 million (see costs below), and that after four years, is still not implemented.
Marie Johnson 22
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
In light of my predictions in earlier submissions and my predictions in this submission, the following actual current Participant stories illustrate the sheer chaos, trauma and risk people are experiencing as a result of the haphazard deployment of PACE and defective data, resulting in widespread payment problems.
Participant forums are on fire with people saying they can’t pay support workers, can’t see their plan, contacting the NDIA and being told they have multiple bank account details (when the person only ever has had one bank account).
These widespread problems are not simply a collection of individual unfortunate cases: these problems are systemic, in a new system no less, indicating questionable data integrity in the data migration, or perhaps no data migration, period.
There are literally thousands of these comments on Participant forums. With less than 10% of the PACE rollout, this will only get worse as the rollout continues and unsustainable backlogs swamp the Agency and service providers.
Participant Stories: Data Errors, Missing Bank Account Details, Cessation of Supports
“You won Bill Shorten, you cut my daughter’s funding from 1:1 to 1:2, you cute her funding so she was unsupported 1 hour a day, she required suctioning around the clock being High Intensity Complex Care, you changed to PACE that is absolutely broken in where the provider has not been payed (sic) for accommodation supports for over 8 weeks due to a “glitch” of your incompetent planners, your complaints department is appalling, your staff are not appropriately trained. The NDIS does not support those with a severe disability. As I started this post with ‘you won Bill Shorten’, my daughter passed away on Tuesday. Such a disgraceful disfunctional (sic) scheme.“ Participant Father.
-
“I remember at the end of October last year when both myself and my son had completely run out of NDIS funding and I was waiting for them to to pick up both of our urgent ‘tier 3’ change of circumstances. I was calling the general enquiries line multiple times a day to stress the urgency of our situation. I was told by a team leader (who I had become familiar with because I was calling daily) told me on the night of the change over from the previous CRM system to PACE that:
- the NDIS were not transferring any reports or any other supporting evidence on participant files from the CRM system to the PACE system.
- that if I wanted any reports to still reflect on mine and my son’s files that I would have to Re upload them.
- I was told that the CRM system will be accessible to NDIS employees for 2 years from the changeover and then it would no longer be accessible.“ Participant.
-
“I’m feeling fuming angry at the ndis, my plan has been rolled over to the ‘new pace system’. I spent over 4hrs on phone yesterday with the 1800 number only to spend at least another 3 on the line trying to see what’s gone wrong on my profile.” Participant.
-
“This week, I received a letter from the NDIA, telling ME that MY bank details had been recorded.
Marie Johnson 23
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track) Bill 2024
I am NOT the participant. Our daughter is the participant. The bank details are our daughter’s. They have not changed since her first plan in 2015! They were RECORDED in the NDIS portal. PACE is the problem!” Participant Family.
“…there is a lot wrong with my plan: my goals haven’t been updated, reports have been disregarded & The disabilities/impairments/ conditions listed on my record are vague & incorrect. I imagine in a few weeks I’ll receive the standard NDIA letter, proposing that my plan be rolled over. I’m not especially thrilled about this prospect, due to the massive errors contained in my NDIS record…Essentially I just want my NDIS record to be an accurate reflection of me. Currently the condition listed as my ‘primary’ disability, is something l’ve never even been diagnosed with, & my ‘goals’ are a four-word, meaningless sentence.” Participant.
“It’s been 10 weeks of hell, His care is a full time job, He needs are full time care. I am advocating with help ( they are on holidays now to). So we have essentially had no funding for 10 weeks. It’s appalling. Now we have a plan we can’t access it. because of the old system to new system that no one seems to know how to navigate.” Participant Family.
“I’ve spoken with the NDIA twice about this system this week. If you receive a new plan and it goes into this system, it’s likely your bank details will not transfer from the old system into the new. It won’t matter that it’s recorded on your account - ‘someone’ (a delegate for such matters) will need to effect the change. Neither the person who called me back from the 1800 call Centre, nor the Planner who devised my daughter’s new Plan, could tell how long it will take. I asked why were we rolled into this system if it wasn’t ready for us and the Planner replied with “that’s what we all ask!” Participant.
“They also don’t transfer across nominee details either or consent forms…we had a riot of a time getting that fixed because they wanted to call the participant from a private number so, and they didn’t answer but wouldn’t accept calls from the nominee because they “lost the forms” for the second time - some the plan review didn’t go ahead .. total mess.” Participant Family.
“We have canceled most supports last week and I’ll cancel the rest tomorrow. Probably the most frustrating thing I’ve had to deal with. While I have a huge pile of invoices to pay and now he will probably lose his place among his service providers because of the long time frame and know-one can even point me in the direction of possibly fixing the issue.” Participant Family.
“The new NDIS plan is with PACE. It rejected the claim, because bank details weren’t there. I checked and the bank details were there! I called the NDIS and was told that we have to verify the bank details with them before claiming with PACE for the first time! Why weren’t we told that by the planner?? Apparently that will take 7 - 10 days to fix, because there is a backlog! That’s a long time to wait to be reimbursed!” Participant.
“It took almost 4 weeks for the NDIS IT boffins before even they could get any access to my daughter’s new plan in PACE. No-one could access the financial section $$’s, so nothing could be paid for weeks. The entire system is an absolute mess.” Participant.
Marie Johnson 24
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
“…massive errors contained in my NDIS record… I just want my NDIS record to be an accurate reflection of me. Currently the condition listed as my ‘primary’ disability, is something l’ve never even been diagnosed with, & my ‘goals’ are a four-word, meaningless sentence. I’ve sent emails to the enquiries@ndis address, with updated goals & all the diagnosis letters & various necessary reports: this process has been undertaken by me personally & via several previous SCs, & yes l’ve even sent emails to all the relevant politicians, the NDIA CEO, the feedback & complaints emails. It’s a merry-go-round that I don’t have the energy for.” Participant.
“A serious privacy and confidentiality concern with PACE. We’ve had an incident today where a staff member’s NDIS plan has transferred to PACE. The way the system is set up, compared to PRODA, means that all staff can see the plan, goals, personal details and will also be able to see private progress and implementation reports down the track. There doesn’t seem to be any facility on the system to limit access for participants that might need extra privacy for certain reasons. Some participants may have a profile in the community and request they have a restricted file which is understandable, but there is no way to do this in PACE, anyone with access can see everything.” Anonymous.
Disrupted Payments Impacting Participants and Providers
For a Scheme that has administered hundreds of billions of dollars over the past decade, there has been very poor attention given to building a high integrity highly resilient payments capability. And the lessons from Full Scheme Launch in 2016, during which time I was working at the NDIA, appear to have faded unapplied into history. However, the NDIS is at this very precipice yet again.
In the MyPlace Portal Implementation Review - Final Report dated 31 August 2016, commissioned by the Department of Social Services, PWC (who undertook the review) expressed similar concerns during the Siebel to SAP ICT project transfer of hastily implementing significant Participant change in 2016 that lead to considerable disruption:
- “The complexity of the stakeholder landscape, the amount of change leading up to and after the Full Scheme Launch, the low quality and timeliness of data, and the newness (immaturity) of the process all combined to created critical risk that payments would fail”
It is important to understand that the root cause of payment failure was not a single catastrophic event, but rather a series of compounding issues…
Together, defective data integrity and defective payments capability, present a very weak underbelly and exposure point of the NDIS. Neither of these are “IT” issues, and nor will these be fixed by moving to PACE, or any new system.
If we look forward another 10 years - which we must - many more hundreds of billions of dollars will pass through these systems. Given the defectiveness of these systems and processes, this is an extraordinary risk to the Commonwealth budget.
Marie Johnson 25
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
The thesis of this submission, is that the NDIS Review and this Bill not only ignore the NDIA’s lack of capability to implement, but by radically changing the foundations of the NDIS, add extraordinary risk to already very fragile and defective systems and processes. There are multiple systemic risks which I have not seen addressed anywhere as part of this proposed Bill: data security risk; risk to the Commonwealth Budget and State Budgets; and the highest risk, that of risk to life.
In my JSCNDIS submission (Attachment A), I predicted precisely many of the problems that are now happening. The following is a recap of those predictions relating to payments, followed by Provider and Participant stories of the impact of disrupted payments.
Prediction from JSCNDIS Submission (Attachment A)
What happens when something goes wrong, which will happen. What is the system wide change management? Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this.
WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted?
The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants.
Providers
redacted
ALERT: NDIS PAYMENT ISSUE DIA PACE ISSUES ESCALATION
Imm ~ pace “-” mum
In December 2023, the Disability Intermediaries Australia issued alerts over payment disruptions and sector-wide issues with PACE. Note, this is almost a year after I predicted this in my JSCNDIS submission (Attachment A).
The DIA payments alert was issued over the significant volume of escalations from Plan Managers
Marie Johnson 26
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
indicating that the NDIA had not released funds. Based on the volume of escalations, DIA believed that
this was impacting around $30M to $40M in claims, however this could be higher as escalations are
continuing to come in.
The PACE alert was in response to DIA members and the wider intermediaries sector experiencing challenges with PACE. The DIA created the DIA PACE ISSUES ESCALATION process to support Plan Managers, Support Coordinators and Psychosocial Recovery Coaches to resolve issues impacting them. This escalation process is used to provide details of systemic issues with the PACE system.
National Disability Services [NDS] also commissioned research that has painted a grim image for the future of the care sector:
"...with 59% percent of providers expressed concerns about their organisations having the
capacity to adapt to the new 'PACE' system."
Participant Stories
"Anyone else not had their claims paid for six whole weeks? What is going on? Paid after 8 weeks.
With a nasty insinuating email implying l'm a thief.. again! They did this last time! It seems it's all over
changing a bank account. We're laying off essential support workers now." Participant.
"Omg this happened to me several weeks over Christmas. Beyond frustrating...
l talked to so many people on the phone and in person and everyone was equally flummoxed. My daughter was denied support from our main provider because we couldn’t pay invoices, despite the money being there in plain sight!“ Participant Family.
"Has anyone gone from the old system to the new system recently ? We have had to fight so hard for a
review for my son. He was without funding for 8 weeks, his needs are very high and needs one on one
for everyday things. We had to escalate and we got a plan review approved by the 15th December, But
we are still unable to lodge anything in the portal. Keeps telling us that there is a new plan (we know
the plan is approved) But cannot access funds. Apparently it's stuck with accounts to verify the bank
details. They are the same bank details from His previous plan. It's now been 10 weeks not being able
to pay supports or access care." Participant Family.
"It's been 10 weeks of hell, His care is a full time job, He needs are full time care. I am advocating with
help (they are on holidays now to). So we have essentially had no funding for 10 weeks. It's appalling.
Now we have a plan we can't access it, because of the old system to new system that no one seems to
know how to navigate." Participant Family.
"It is not just screwing up access - it's making it impossible to know what has and has not been funded
in a plan, it's breaking bank payment details so claims/invoices don't get paid (I have heard some
people have no payments made for 6+ weeks!), and has changed the language on plans in ways that
are confusing causing a lot of panic amongst participants. It is also breaking linking of plans to plan
nominees (typically parents) - the child's plan moves to PACE and is suddenly no longer available for
the parent/nominee to access." Participant Family.
"After a challenging 18 months with AAT our plan was finally agreed upon only to find that the PACE
system is resulting in our service providers not being paid in a timely manner and once again I am
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
being threatened with all services for my son being cancelled if invoices are not paid.” Participant Family.
“One of my service providers worked for nothing for months - he was owed over $60,000 and when I threatened to leave my son at the NDIS offices the next morning if all outstanding invoices were not paid by 5pm that evening, I got a phone call from the acting NDS director saying that all the outstanding invoices were now paid.” Participant Family.
An Impossible Rollout of a Defective System the Whole “New” NDIS is Dependent On
Month Month Month Month 5 (Mar 6 (Apr 7 (May 8 (Jun 2024) 2024) 2024) 2024)
Expected transition of existing participants to our new computer system
8,000 16,000 32,500 40,500
Screenshot from NDIS website with expected transition of existing participants to PACE
The simplistic narrative of a “new computer system” is a troubling sign that the NDIA has not grasped, and certainly has not communicated, what is actually happening.
To recap the PWC Report on the 2016 Siebel to SAP ICT project in the implementation of Full Scheme launch that lead to considerable disruption:
“The complexity of the stakeholder landscape, the amount of change leading up to and after the Full Scheme Launch, the low quality and timeliness of data, and the newness (immaturity) of the process all combined to created critical risk that payments would fail“
The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants.
But with only 10% of the PACE rollout, the system is already in chaos: critical functionality still not delivered; payment disruption; unsustainable backlogs; cyber security concerns; and 59% of Providers expressing concern about having the capacity to adapt to PACE. And on top of this chaos, a Bill that proposes the radical upending of the NDIS.
The risks could not be anymore extreme, or obvious. And that is why this Bill must be defeated. This is not “just” a new computer system, but a fundamental change to the foundations of the NDIS introducing new processes and concepts - not yet legislated - in a sector wide change that impacts the lives of more than 600,000 Participants, thousands of providers, hundreds of thousands of people working in the NDIS ecosystem - and the budgets of all Australian governments, Commonwealth, State and
Marie Johnson 28
National Disability Insurance Scheme Amendment (Getting the NDS Back on Track No.1) Bill [Provisions] 2024
Territories. A few information sessions is not strategic change management: that is a capability that the NDIA clearly does not have.
What exactly does the above chart say?
According to the Agency, this chart depicts the phased “transition” to PACE: doubling expected numbers between March to April (8k to 16k) then again between April and May (16k to 32.5k). Then only aiming for 8500 more May to June (32,500 to 40,500).
But this is what it doesn’t say.
As evidenced in this submission, and in countless other submissions, the PACE system is defective: critical data defects; cyber vulnerabilities; and a chaotic “introduction to service” causing backlogs and payment disruption.
In my opinion, PACE is not fit for purpose, and certainly is not ready for service.
After four years, the NDIA now has two defective systems (SAP CRM and PACE) with critical data defects, operating in parallel.
This means that the NDIA will have operating costs for both systems: this is not just IT costs, but operational costs. More on costs below in the action, “Unknown and Uncapped Costs of PACE”. It also means that many, if not all, Providers will incur additional cost overheads of working with both systems. And with differences in processes and data, this will be very problematic from an operations management perspective.
Disability Intermediaries Australia have expressed sector concern about having two systems running at the same time.
A downside to a slower release structure is that two systems will be “live” at the same time – PACe and current SAP System.
Tasmania (as it rolls out) and the “Mainland” will be running on different systems, an issue and inefficiency for organisations with national or multiple state reach. Employees of providers will need to be proficient at dual systems with limited learning and development opportunities before going live…
For Participants, the existence of two defective systems operating in parallel is also problematic. There are families with more than one NDIS Participant, and because of timing and other factors, face the complexity and chaos of interacting with the two systems. Try calling the call centre, and get the hours long run around, what system are you on? Both?
For the NDIA, Providers and Participants, having two defective systems operating in parallel is the root cause of errors, backlogs and cyber vulnerabilities. And what is the backout strategy? There always has been a viable backout strategy.
Marie Johnson 29
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
According to Disability Intermediaries Australia, this is a significant concern.
“The NDIA have indicated that they have a range of contingencies from micro individual interactions to a full pause / wind back of the Test / Pilot.
Again, we don’t have any visual confirmation (Guide, FAQ’s etc) of these contingencies so we will see the effectiveness of the Agency’s preparedness when issues arise.“
And there are no scale efficiencies in the numbers in the above chart, given the widespread problems across Providers and Participants are experiencing. To the contrary, having two defective systems operating in parallel drives disbenefits and multiple risk vectors. This is also a concern expressed by Disability Intermediaries Australia:
“…let’s be honest the current system is horrendous and does not befit a scheme of the scale or complexity as the NDIS, there are risks and DIA like many in the sector are very nervous given the risks.”
The NDIA are conducting a “Test / Pilot” of the PACE system in Tasmania which commences on 14 November. Whilst the NDIA calls this a ‘Test or Pilot’ it could be better described as a staged rollout of the new system, with no option for a participant or provider to ‘opt out’ of such testing.”
No option to opt out is an extraordinary reflection of NDIA’s own admission, as recently as August 2023 in sector briefings, of its ignorance of critical factors in large scale national highly political change management, involving risk to life.
NDIA: “The evaluation of the test in Tasmania indicated that a stakeholder-centric approach to change needed to be developed to support national expansion of PACE.”
Well yes, a stakeholder-centric approach is always critical. And anyone who has experience in large scale national change programs, affecting tens of thousands of businesses, would know this. This is my thesis in this submission: the NDIA does not have the capability to do what it’s doing, let alone what is proposed in this Bill - and that is a national risk.
And while the NDIA imagines that it will take about 18 months for all Participant plans to move to the new system, with the widespread problems and data defects compounding this stated schedule, at this rate, it will take more than FIFTEEN YEARS to roll out.
And why would a “new computer system” take 18 months to roll out, when the Transition to Full Scheme - which was every bit as complex and problematic as what’s happening with PACE - took four years (2016-2020).
Given Tasmania only has 12,819 participants, 8,445 as new entries as of Dec 22, along with only 368 initial plans approved recently, this is a dangerously low sample size for proof of concept, for a population of over 600,000 current Participants, before going live.
Marie Johnson 30
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Of course, the critical risk in the 2016 Transition to Full Scheme which caused considerable service disruption, was the massively problematic data migration from the States and Territories, the immaturity of the processes, all combined creating the critical risk that payments would fail.
In recommending the NDIA implement and embed the Service Delivery Operating Model (Model), the PWC Report noted:
“The NDIA currently has not implemented a comprehensive Service Delivery Operating Model (SDOM). This has impacted on the successful execution of the Full Scheme Launch and put the existing organisational operating model under stress. A NDIA Knowledge Tool is currently being developed with the intention to clearly define NDIA customer offerings, process, technology, information, organisational structure (including governance, roles and accountabilities), with mechanisms to understand the interaction between key components of the operating model.”
The absence of the SDOM remains a critical capability deficit: and this issue is pivotal to decisions regarding this Bill. How can proposals to fundamentally change the NDIS be considered with the necessary due diligence and risk assessment, without understanding the viability and impact of those changes.
I was working at the NDIA during the period in question, and considerable work had been done on the development of the SDOM and its governance. Considerable work had also been done on the NDIA Knowledge Tool. Both the SDOM work and the NDIA Knowledge Tool were led by the NDIA. The NDIA Knowledge Tool, was developed using the Holocentric technology (an Australian product), which would enable scenario modeling - that is, change a policy or a process and see what is affected across the whole operating model ecosystem. The NDIA Knowledge Tool would provide traceability and transparency of policies and decisions. What happened? The Department of Human Services (now Services Australia) which was the technology provider to the NDIA, decided not to support the Holocentric technology and the project was discontinued after much investment of dollars and expertise by the NDIA. This was a fundamental example of defective governance: an “IT” decision taken by DHS that would seriously impact NDIA operations for years.
And here we are, almost a decade later - and probably after almost a billion dollars spent on NDIA techonlogy (more on costs shortly) - confronted by continuing and deepening critical data capability deficiencies and sector-wide payment disruption again.
Reiterating again, in comparison to 2016, there are now almost 20X more Participants and tens of thousands more Providers.
And on top of this the NDIA is to build according to this Bill, a yet to be defined “Budget Calculation Instrument’, see following section, “Algorithms: The Budget Calculation Instrument - a Recast of the Dumped Centrelink $200 million Entitlement Calculation Engine (ECE)?”
Data Migration and Critical Functionality Gaps
The move to a new system should never disrupt key governance processes of operational reporting. To do so, is literally flying without any navigation.
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
As documented in this submission, Participants have reported that documents and data are not available and/or incorrect in the PACE system, including critically bank account information. People have reportedly been told that the NDIA was not transferring any reports or any other supporting evidence on Participant files from the SAP CRM system to the PACE system; that if they wanted any reports available, they would have to re-upload them; and that the SAP CRM system will be accessible to NDIA employees for two years from the changeover and then it would no longer be accessible.
How does this happen? The governance and decision making about data migration needs to be examined, because it is obvious that data availability issues are impacting operational performance, governance and transparency. And whether this situation is inline with the PGPA Act.
To the extent where the NDIA cannot even answer basic and essential questions in Senate Estimates, about operational performance and actuarial benchmark type questions because of “transition to the new system”.
These data migration issues - even at this very early stage of the PACE rollout - have been affecting reporting to Parliament via Senate Estimates for at least 15 months. In my March 2023 JSCNDIS submission (Attachment A), I made the observation:
"In evidence at the 15 February 2023 Senate Estimates, the NDIA Acting Actuary was unable to
answer specific questions on forecasts stating:
'...there are a few challenges with reconciling the participant numbers. It's to do with our new IT
system.
This is not just a reconciliation issue to be waved away, but points to the intractable integrity
issues with the NDIS systems – of both the old system and concerningly the new system.'"
More than a year later, at Senate Estimates in March 2024, the new system impact on data availability was a continuing narrative, with the NDIA appearing to have difficulty predicting when things would improve. Under questioning about performance data regarding timeframes for access request, decision, and plan implementation, the NDIA stated:
"NDIA: …because of the transition to the new system we don't have that aggregated reporting
available…we don't have that aggregated data available at this current point in time but as I've
said before we hope to have that for the next quarter…"
Senator Steele-John: …basically from September 2023 quarter through to the next quarter will be
in at the end of the end of March, we have no data. Therefore it's useless to us as a committee
you might well have it but we can't use it you can't use it, so so for those what two quarters
nothing that we can use to to understand the participant wait times or the performance of the
agency against a legislative requirement…which is a bit of a flaw in like your whole job of rolling
out the PACE system in a way that that doesn't actually limit the critical oversight of of a senate
committee, isn't it?"
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track) Bill 1) 2024
On this evidence from the Agency, it is highly likely that critical performance data of the NDIA will be missing for nine months. This should never happen. Reporting is a core function of public administration.
It’s not a “module” to be added at a later date.
As stated earlier in section, “Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports, 28 June 2023”, there are questions to be asked as to all the capability gaps as a result of the discontinuance of support of functionality in the SAP CRM when functionality in PACE was not (yet) available. Who made these decisions, and for what period of time did these functionality gaps exist.
There are global well established best practices in system design and implementation specifically covering data migration and continuity of reporting, which in many industries is critical for prudential compliance and operations safety. This is not only a sign of the lack of capability across the NDIA and the attendant risks, but signals that something in the NDIS systems world is fundamentally broken. This, after four years of the PACE project and ten years of NDIS.
Whatever software company or consulting firm was involved in providing this advice to the NDIA, should have contract penalties applied. Noting that the PACE project is identified as a potential ANAO audit for 2023-2024 and is being examined by the National Anti Corruption Commission, the PACE project should be subject to extensive independent review before any further work is undertaken or rollout expansion occurs.
The NDIA is incapable of doing what this Bill proposes.
Unknown and Uncapped Costs of PACE
I have never seen a worse explanation of a business case for a “system”, than the one offered by the NDIA to the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA.
To describe what is happening as a “new computer system” underscores the NDIA’s alarming lack of capability, appearing oblivious to what is actually happening.
Would we have described the introduction of the New Tax System in the year 2000 as a new “computer system”? No.
This is not simply a “new computer system”, but a fundamental change to the foundations of the NDIS introducing new processes and concepts - not yet legislated - in a sector wide change that impacts the lives of more than 600,000 Participants, thousands of Providers, hundreds of thousands of people working in the NDIS ecosystem - and the budgets of all Australian governments, Commonwealth, State and Territories.
The explanation offered by the NDIA is woefully naive and narrow. And I say this as someone with more than 30 years experience doing business cases and implementing large scale complex national and international change programs, involving policy and legislative change, in complex and contentious policy domains.
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
From the NDIA responses to questions from the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA.
PACE Costs and Business Case
“The business case for PACE estimated a 10% reduction in cost-to-serve, or a reduction of 1.8M hours from the time it takes staff to interact with the former CRM. These savings are being reinvested in increased participant contact. That is, PACE reduces the amount of time that staff and partners spend interacting with the CRM, meaning they have more time to spend working directly with NDIS participants.
While PACE is expected to make it easier for NDIS participants and their providers to interact digitally with the NDIA, the Agency have not projected any reduction to the fees that providers charge for the services they provide.“
Additional benefits include future cost avoidances when enhancing the CRM and longer-term operational efficiencies.
The independently reviewed business case for the 3P program, delivering the PACE system, identified the following benefits, which are being measured as expansion continues:
- Release 1.8M hours through more efficient end-to-end processes, enabling a workforce realignment to bringing planning in-house, and allowing Local Area Coordinator and Early Childhood partners to undertake partner supported connections, ongoing implementation and monitoring, and check-ins.
- Increase participant understanding in ‘what happens next’ to >80%
- Achievement of Participant Service Guarantee measures in >95% of cases
- Reduce participant complaints to <5%
- A more flexible Information Communications Technology system, able to inexpensively respond to the evolving NDIS policy environment.
National expansion of PACE only commenced a gradual rollout on 30 October 2023. As such, there has been no reporting on savings as yet. Once the roll out of PACE has progressed further and the old system is used less, the Agency will be able to see some cost savings being realised.
NDIA trialled the PACE system in Tasmania for 12 months from November 2022. As part of the trial, staff and participant experience interacting with the new system was evaluated. In line with the expected benefits of PACE, the results of the evaluation indicate that 72% of participants said their planning experience in the Tasmania test was good or very good, with 55% of participants saying it was better, or a lot better than their last planning experience.“
Before dissecting the Agency’s claims on the business case for the “new computer system”, the following commentary from the Disability Intermediaries Australia, demonstrates a very different view of costs, with sector wide concerns about the sector being forced to absorb development and implementation costs.
Marie Johnson 34
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Provisions
Disability Intermediaries Australia
“Considering the price freezes that Plan Managers and Support Coordinators have experienced for the past three years, along with the requirement for Plan Managers and Support Coordinators to operate peak efficiency to be viable, how the NDIA expects transition costs to be absorb by providers remains unanswered by the NDIA.
The implementation of PACE in Tasmania feels rushed which will result in the front-line intermediary support providers, one again, bearing the brunt of such change.“
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Not only does it signal a severe lack of readiness, it points to a massive lack of competence in respect of change management, and reinforces widespread concerns that there has been no actual co-design.
The final sentence in chapter 8 of the report is damning:
“NDIS partners thought we [the NDIA] could improve how we explain the work we expect them to do, supported by training resources”.
It has been clear for several years now that the NDIA has done very poorly in explaining the work that people are supposed to do, resulting in self-admitted deficiencies and inconsistencies in practice. To see a statement that NDIS Partners still need an uplift in the effectiveness of resources that should prepare people for working with the NDIS is a scathing indictment. This reported feedback is amplified by the sector criticism discussed above by Disability Intermediaries Australia, about the NDIA expecting providers to absorb transition costs and bear the brunt of the change.
This is not change management. And in no way, ensures a viable resilient provider sector, critical to the sustainability of the NDIS.
The PACE system was not ready to be rolled out. More critical work was /is needed. This brings us to the dissection of the business case, challenging the “business case” information that has been provided by the NDIA itself.
Dissecting the Business Case
The evidence presented in this submission and in this section on the PACE costs and business case, doest not stack up with the NDIA’s claimed benefits.
The sector wide and economy wide costs and disbenefits are unaccounted. Transition costs and disbenefits, including risks, of working with parallel systems, are borne across the entire NDIS ecosystem: The NDIA, all Providers and all Participants.
The uncapped NDIA cost alone so far has to be north of $200 million - not just $124 million Salesforce licensing - when NDIA staff costs, specialist Salesforce consulting and contractor resources are factored in.
Also not factored in, are decommissioning costs for both PACE and SAP: such costs need to be factored in, as either or both events will happen.
In answers to question on notice, the NDIA noted that in relation to Salesforce’s two other contracts that will expire in mid-2025:
“…costs beyond April 2025 are subject to change and cannot reliably be estimated as they remain subject to future decisions”.
What this is saying is that forward costs only ONE year hence, CANNOT be estimated.
So in a market of extremely scarce and expensive specialist technical skills, it’s impossible for a partially
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
factored “business case” which doesn’t go beyond 2025 to yield a 10% reduction in cost-to-serve, as claimed by the NDIA.
And the reason why all this matters to the consideration of this Bill, is that the NDIA has neither the capability to execute what the Bill proposes nor the capability to estimate a fully loaded business case upon which the sustainability of the Scheme pivots.
Algorithms: The Budget Calculation Instrument ~ a Recast of the Dumped Centrelink $200 million Entitlement Calculation Engine (ECE) and the Dumped $250 million Home Affairs Permissions Capability Platform?
The focus of this submission is the NDIA’s catastrophic lack of capability to implement, and the concomitant of this, being the organisational incompetence regarding risk. The ANAO Audit reports are evidence of the NDIA’s failings on risk.
This Bill takes to a new height the ungoverned and reckless adoption of algorithms in automated decision making in the public sector administration in Australia, and I believe, globally. Algorithms in this Bill are undefined and not reviewable.
Let’s consider the Budget Calculation Instrument proposed in this Bill.
It is argued that the "Plan Flexibility" derives from not having to construct a plan budget from individual
line items, because the Budget Calculation Instrument will do this. Because this instrument will be defined
by a legislative mechanism, this calculation will not be a reviewable decision. Does this look like Plan Flexibility?
The Budget Calculation Instrument is a new concept and the tools to give it effect do not exist anywhere in the world.
This is exceptionally hazardous policy and defective drafting of the Bill: expecting an agency in crisis, without the organisational capability to implement, to take on something so dangerous that it is held unreviewable and undefined in legislation.
With such widespread sector concern over the defectiveness of the “new” PACE system (replacing the defective SAP CRM system) and disruption to payments as documented above - the government would have the NDIA create, without the capability to do so, a yet to be defined Budget Calculation Instrument, that does not exist anywhere else in the world.
In my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA dated 3 March 2023
(Attachment A), I examined in detail, the risks and unlawfulness of the use of algorithms - which this Bill apparently seeks to retrospectively make lawful by defining such algorithms as a legislative mechanism.
But the level of ignorance of the risks involved with such a Budget Calculation Instrument, is appalling.
Marie Johnson 37
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Will this Budget Calculation Instrument be a recast of the Services Australia $200 million Entitlement Calculation Engine (ECE) that was dumped by this government, by Bill Shorten as Government Services Minister?
Or a recast of the dumped Home Affairs $250 million “Permissions Capability Platform”, which is the subject of inquiry by the Joint Committee of Public Accounts and Audit?
And why would the NDIA expect a different outcome, when Services Australia with all its resources failed catastrophically. I know a lot about the systems of both the NDIA and Services Australia: having been the Head of the NDIA Technology Authority, and previously the Department of Human Chief Technology Architect responsible for the business cases bringing together the massive systems of Centrelink, Medicare Australia and the Child Support Agency.
Or why would the NDIA expect a different outcome to that of the Department of Home Affairs “Permissions Capability Platform”; which was dumped undelivered after years of work at a cost of $250 million. I also have knowledge of Immigration systems. According to the Department of Home Affairs Permissions Capability Industry Information Paper, a permission is defined as:
A permission is broadly defined to include processes involving the Government giving an individual or business the right to be someone, do something or have something following the provision of information and an assessment of eligibility against legislation, regulation, or policy. Permissions include, for example, visas, permits, licences, accreditations, and registrations.
All three are essentially the same concept: a theoretical automated calculation involving complex variables to determine such things as entitlements, eligibility and budget. And two of these “calculation platforms” have consumed almost half a billion dollars in public funds only to be terminated undelivered after years of mismanagement.
It is noted that the Joint Committee of Public Accounts and Audit is currently conducting an inquiry into the Procurement of the Permissions Capability.
And yet here is the government through this Bill expecting a different outcome for the NDIA when the massive systems of State of Services Australia and the Department of Home Affairs have for various reasons failed to deliver such a capability.
To reiterate The risk of ignoring the lack of capability is extraordinary.
- With such widespread sector concern over the defectiveness of the “new” PACE system (replacing the defective SAP CRM system) and disruption to payments as documented above…
- …just six months after the JSCNDIS found that the NDIA had for a decade operated unlawfully by its construction of the administrative convenience of “primary disability”…
- …the government would have the NDIA create without the capability to do so a yet to be defined Budget Calculation Instrument that does not exist anywhere else in the world…
- …and with no apparent regard for the half a billion dollars that has already been wasted by Services Australia and Department of Home Affairs on abandoned attempts at the same concept.
Marie Johnson 38
National Disability Insurance Scheme Amendment (Getting the NDS Back on Track No.1) Bill [Provisions] 2024
Then to the question of algorithms, of which the Budget Calculation Instrument is the apex.
The question of risk, including the risk to life from the operation of algorithms, remains unexamined and unanswered. Before examining the concept of “plan flexibility”, I would like to recast some of the questions I posed regarding risk and algorithms,in my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A).
“…as demonstrated throughout the whole INDEPENDENT ASSESSMENT debacle, notwithstanding the risk to life, the NDIA recklessly pursued the use of systems, algorithms and methods that have been shown in other jurisdictions to harm people leading to death.
In fact, and against the advice of health professionals, the AMA and others, the Agency ruthlessly and recklessly used these systems, algorithms, and methods in trials of Independent Assessments.
Did the NDIA have any knowledge or evidence that the application of algorithms results in harm and death? An answer either way - yes or no - is damning.
The NDIA either had this knowledge and recklessly ignored it.
Or did not have this knowledge - which is readily publicly obtained - and recklessly decided not to acquire and investigate this knowledge.“
These questions were posed just over a year ago in March 2023, about the Agency’s knowledge of algorithms causing harm and the Agency’s knowledge of the unlawfulness of the fiction of “primary disability”. For a decade, the actuarial model was based on the fiction of “primary disability”, even though the legislation covers for multiple disabilities. Last December (2023), the JSCNDIS found that the actuarial fiction of “primary disability” was unlawful, not consistent with the governing legislation, a construct of administrative convenience by the NDIA, and discriminatory.
This “unlawfulness” finding of the actuarial fiction of “primary disability” is then compounded by commentary in the 2023 ANAO Audit Report footnote 29, bottom of page 35, regarding Typical Support Packages (TSPs):
Information collected by the planner informs the automated calculation of a Typical Support Package (TSP) funding amount for NDIS supports relative to a participant’s functional capacity. The TSP assists planners to guide and support consistency in decision-making consistency and does not limit plan amounts.
TSPs are calculated automatically in CRM, based on built-in actuarial data and participant responses to questionnaires recorded during pre-planning.
This
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
This decade-long actuarial and algorithmic defect is symptomatic of the NDIA’s lack of capability to implement and lack of competence and risk governance in the central areas upon which this Bill sits: algorithmic decision making, that is the Budget Calculation Instrument.
Does the NDIA now have knowledge of the growing number of cases of algorithmic decision making in other jurisdictions leading to harm, risk to human life, and suicides, as documented in the report “United against algorithms: a primer on disability-led struggles against algorithmic injustice”
Among the growing number of cases globally, the following were provided in my submission to the JSCNDIS Inquiry into the Capability and Culture of the NDIA (Attachment A).
The Netherlands. In 2019, it was revealed that the Dutch tax authority ruined thousands of lives by using a self-learning algorithm to create a risk profile for childcare benefits fraud. Authorities issued exorbitant debt notices to families over the mere suspicion of fraud based on the algorithm’s risk indicators. Some victims suicided. More than a thousand children were taken into foster care.
The Dutch parliamentary inquiry that followed found that the fundamental principles of the rule of law had been violated, and there was a total lack of checks and balances.
Once the enormous scale of the scandal came to light, the Dutch government resigned.
United States. And as a warning of what could possibly go wrong, the horrific examples of algorithm-driven funding assessment models used in the United States read like a template for NDIS independent assessments and robo planning.
The US algorithm-driven funding assessments “hit low income seniors and people with disabilities in Pennsylvania, Iowa, New York, Maryland, New Jersey, Arkansas and other states, after algorithms became the arbiters of how their home health care was allocated – replacing judgments that used to be primarily made by nurses and social workers.”
In Arkansas, “you had people lying in their own waste. You had people getting bed sores because there’s nobody there to turn them. You had people being shut in, you had people skipping meals. It was just incalculable human suffering.”
What will the Agency now do with this knowledge?
In raising questions about the possibility of the offence of misfeasance in public office, the RoboDebt Royal Commission Report defined the three elements of the offence.
Misfeasance occurs where:
-
- There is an abuse of public power or authority by a public officer. This first requirement is not contentious, but is not sufficient. Misfeasance requires further that the public officer:
-
- Either knew that they were abusing their power/authority or were recklessly indifferent to that fact, and
-
- They acted or omitted to act either with malice (the intention to harm), the knowledge of the probability of harm, or with a conscious and reckless indifference to the probability of harm.
Being silent is not an option, and nor is launching into an implementation without the very significant capability to implement what is required, and doing so safely. Such deep capability does not materialise
Marie Johnson 40
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
within a matter of months. The JSCNDIS, the Disability Royal Commission and ANAO Audit Reports in recent months, have all described and provided evidence of an Agency in crisis and with profound capability deficits.
The government has placed the officers of the NDIA in an invidious position. The defective drafting of this Bill shows this.
“Plan Flexibility”
The concept of “plan flexibility’”is being promoted as the core of a reframed NDIS. This central concept is used as the rationale for the substantial changes proposed and the extraordinary powers being given to the Minister, the CEO and the NDIA.
The term “plan flexibility” refers to a Total Support Budget that can be used to purchase the supports a Participant requires, provided they fit within the definition of an NDIS Support under Section 10 of the proposed Bill.
This flexible budget will be generated by a mechanism that is yet to be designed - the Budget Calculation Instrument - and will be informed by a “Needs Assessment” that is yet to be developed.
We’ve been told that the only way to generate this flexible budget through the Assessment and Budget Calculation Instruments, is to define, prescriptively, what an NDIS Support is. This definition will be used to generate a list of “whitelisted” and “blacklisted” supports.
It has always been possible to use Core Supports Flexibly, unless they were stated. Except for some items during the COVID period, it hasn’t been possible to use Capacity Building Supports interchangeably with Core Supports.
However, flexibility has always been possible within each Capacity Building Category. It has always been possible to design unique and creative solutions with the Core Supports Budget, even with Supported Independent Living (SIL), but Providers have refused to do so and the NDIA have failed to encourage and support non-traditional approaches using Core Supports. If the NDIA has been incapable of encouraging creative support solutions within the already flexible Core Supports, there is nothing in this Bill that would encourage us to believe that this will change when all the funds are bundled together in a big mass.
The Bill Amendments state that when creating a Needs Assessment and Budget Calculation Instrument, the Minister must ensure the financial sustainability of the scheme, whatever that ambiguous statement means.
Of course, as someone who is an expert in business cases as well as large scale implementations, I find it strange that the analysis of financial sustainability does not take into account the following: (1) Red tape on the sector. The impact of red tape is a fundamental omission in the actuarial model: how can there be any sense of scheme sustainability with such an unquantified burden on the very market sustaining it? (2) The hundreds of thousands of jobs created. And (3).The ROI multiplier effect of Assistive Technology, and technology more broadly.
With the wide ranging powers given to the Minister to define who can access the scheme and control what will be funded, the unworkable definition of NDIS Supports and the power of the undefined Needs Assessment and Budget Calculation Instruments to manipulate the budget outcome, is this really about
Marie Johnson 41
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
Plan Flexibility or is this simply a smokescreen to cover a substantive agenda to reduce scheme costs by controlling who can enter the scheme and lowering plan values.
It is argued that this “Plan Flexibility” derives from not having to construct a plan budget from individual line items, because the Budget Calculation Instrument will do this. Because this instrument will be defined by a legislative mechanism this calculation will not be a reviewable decision.
And the reason why this is so concerning, is that the “automatic calculation” of funding via the Typical Support Package (TSP) algorithm, has been contested and litigated for a decade. And with the December 2023 JSCNDIS finding that the actuarial fiction of “primary disability” is inconsistent with the governing legislation - i.e. unlawful - this by definition undermines the validity of the TSP algorithm. Unlike the TSP output which can be contested, the output of the Budget Calculation Instrument cannot be contested as it will not be not be a reviewable decision.
In what I believe is a world first, this Bill puts an algorithm (the Budget Calculation Instrument) - yet to be defined - beyond the reach of administrative review.
Section 10: No Obligation for Australia to Adhere to the UNCRPD
The proposed Amendments Bill doesn’t create a legal obligation for Australia to adhere to the UNCRPD. What Section 10 of the Proposed Bill does is selectively cherry-pick words from some Articles within the CRPD in order to create a definition of an NDIS Support, giving the false illusion of human rights. In engaging in this perverse political and discriminatory exercise, the drafters of the Bill have distorted the meaning of the UNCRPD Articles they have misquoted for what can only be described as, pursuing a political agenda.
This misrepresentation of the UNCRPD is sneaky and makes a mockery of Australia’s obligations as a signatory to the Convention. This misrepresentation begs the question “What is our Government afraid of within the Convention that they refuse to enshrine all the Articles as law within the new version of the NDIS legislation?”
Looking at Section 10: Definition of NDIS Support, it is observed that the language to describe an NDIS support has been selectively cherry picked from UNCRPD Article 26 and Article 20. What is extremely concerning, is that the wording for Article 19 of the UNCRPD, which outlines the principle that people with disabilities should be able to choose where they live, who they live with and who supports them, has been selectively culled. The wording in the Bill says:
“A support can only be an NDIS support if:
(a) the support:
(i) is necessary to support the person to live and be included in the community, and to prevent isolation or segregation of the person from the community“.
This reframing of the content and intent of Article 19 completely ignores very important requirements of this Article, which states that:
“States Parties to the present Convention recognize the equal right of all persons with disabilities to live in the community, with choices equal to others, and shall take effective and appropriate”,
Marie Johnson 42
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
measures to facilitate full enjoyment by persons with disabilities of this right and their full inclusion and participation in the community, including by ensuring that:
-
Persons with disabilities have the opportunity to choose their place of residence and where and with whom they live on an equal basis with others and are not obliged to live in a particular living arrangement;
-
Persons with disabilities have access to a range of in-home, residential and other community support services, including personal assistance necessary to support living and inclusion in the community, and to prevent isolation or segregation from the community;
-
Community services and facilities for the general population are available on an equal basis to persons with disabilities and are responsive to their needs.\
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
It would be more than two years before she would be accepted into the NDIS and have a plan.
As we have documented in extensive detail, my daughter’s condition worsened very significantly during the whole NDIS application and review process. Not only was my daughter initially refused the supports desperately needed (due to the NDIA administrative stuff-ups) and suffered and struggled for almost two years in the cruelest way – but my daughter and her psychiatrist both questioned whether it was worth damaging her mental health even further.
As her mother, and with the inside knowledge of the NDIA as to what was causing these issues for my daughter (and others), this situation was incredibly traumatic for me. Persevere and have the system damage my daughter’s mental health, or give up and have my daughter and her family denied justice. This was a sickening Faustian bargain.
I anticipated the trauma that she would face and that’s why I knew to take photos at the beginning of this nightmare journey - and yet with all my detailed internal knowledge, global expertise and ability to engage solicitors - I could not prevent the damaging impact of my daughter’s interaction with the NDIA.
That makes the NDIA administration manifestly unsafe, unjust, and unlawful.
The experience of lost documents and unread medical reports has continued over the years through various planning processes, and urgent complaints regarding a 75% funding cut.
The trauma of ongoing mandatory assessments present risk to life for people with Psychosocial disability: I explained this in my submission on Independent Assessments, and how such assessments are discriminatory and a breach of human rights.
To recap my JSCNDIS submission into Independent Assessments:
“In this day and age, that a government agency can forcibly and arbitrarily subject people with disability to lifelong examination and study – an intervention that has been shown to damage people - without any oversight or ethics framework cannot be tolerated by civil society.
Effectively, the NDIA is proposing to undertake human research driven by an actuarial doctrine…
This is verging on human experimentation. The view that this can happen and be justified on flimsy “actuarial” grounds has to be exposed and quashed.
To reiterate our statements in previous submissions, which describe in detail my daughter’s catastrophic experiences in applying for and dealing with the NDIS, all this underscores the sheer terror that she feels at the prospect of being forced to endure an Independent Assessment.
And for what purpose? And what “safeguards” are there in place that would anticipate such adverse reactions. None.
It would appear that the actuarial doctrine which has driven such systemic complexities and inconsistencies – and through which my daughter has horrifically suffered - will somehow be made
Marie Johnson 44
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
“more consistent” through a 20 minute outsourced high-risk arrangement.
My daughter is not an actuarial experiment. And nor is any other participant or family.
With my internal knowledge, I anticipated my daughter’s traumatic experience in accessing the NDIS and documented this in previous submissions. It now sickens me with full knowledge and in anticipation that the Independent Assessment process will proceed in spite of all the health and professional evidence to the contrary.
This will cause immense trauma perpetrated by government on its most vulnerable citizens in full knowledge of the evidence that these processes cost people their lives.
Effectively, the NDIS is proposing to undertake human research driven by an actuarial and political doctrine, without evidence and without ethics oversight. This is verging on human experimentation.
Australian civil society must not tolerate the actions of government that forcibly and arbitrarily subject people with disability to lifelong examination, study and monitoring. History is a reminder of where these actions can lead. That this control of people with disability will be effected through technologies such as biometrics, algorithms and blockchain is anathema to a harmonious and inclusive civil society and the human rights of all people.“
What will save Participants costs, time and trauma is for the NDIA to get its house in order first and to bring about consistency in its processes, communication and transparency in decision making.
Pushed off the NDIS cliff, will be tens of thousands of people with Psychosocial disability. The souls in society that no government wants. I speak of this with some experience. People will die as a direct result of this.
Perhaps I should recite the cases of people with Psychosocial disability that the NDIA ceased communication with and abandoned them, because these poor souls did not and could not answer the phone. Death resulting. Think about that.
Instead of addressing the horrific capability and culture of the NDIA NDIS regarding people with Psychosocial disability, the answer in the NDIS Review and through the mandatory assessments provision in this Bill, is to subject people with Psychosocial disability to ongoing mandatory assessments - using tools (algorithms) yet to be designed - and to sort people out and push them out into a fantasy land no-man’s land of another made-up concept “foundational supports” that do not exist.
This Bill must be defeated. And the dangerous rollout of the PACE system must be halted immediately.
END
Marie Johnson 45
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track No. 1) Bill 2024
References
-
JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA). Report. November 2023. https://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/RB000146/toc pdf/CapabilityandCultureoftheNDIA.pdf
-
JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA). Submission by Marie Johnson, Submission 137 Attachment 1, Supplementary Statement, 3 March 2023. Note: Statement produced in full as Attachment A. https://www.aph.gov.au/DocumentStore.ashx?id=db365fea-d327-4683-a9f2-1f72de0cbf74&subId=722398
-
JSCNDIS Inquiry into Independent Assessments. Submission by Marie Johnson. Submission 33. https://www.aph.gov.au/DocumentStore.ashx?id=92a45ded-c00c-4946-9776-812353f486df&subId=703536 33.1 Supplementary to Submission 33 https://www.aph.gov.au/DocumentStore.ashx?id=533ec41c-a4f0-4934-96a8-2321d2f1f738&subId=703536
-
ANAO Audit Report. Management of Complaints by the National Disability Insurance Agency. 22 April 2024. https://www.anao.gov.au/work/performance-audit/management-complaints-the-national-disability-insurance-agency
National Disability Insurance Scheme—Risk Management Rules 2013 https://www.legislation.gov.au/F2013L01183/asmade/text
ANAO Audit Report. Effectiveness of the National Disability Insurance Agency’s Management of Assistance with Daily Life Supports. 28 June 2023. https://www.anao.gov.au/work/performance-audit/effectiveness-the-national-disability-insurance-agencys-management-assistance-daily-life-supports
ANAO Audit Report. National Disability Insurance Scheme - Management of Transition of the Disability Services Market. 9 November 2016. https://www.anao.gov.au/sites/default/files/ANAO Report 2016-17 24.pdf
ANAO Potential Audit. 2023-2024. Design and implementation of the Participants, Platforms and Processes Program. https://www.anao.gov.au/work-program/search?query=ndia&items per page=10
Interim Report of the Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. September 2003. https://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/RB000228/toc_pdf/Report500InquiryintoprocurementatServicesAustraliaandtheNDIA-InterimReport.pdf
Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. Salesforce Submission. https://www.aph.gov.au/DocumentStore.ashx?id=83135614-e40c-4372-9079-993f82dc4550&subId=750355
FOI: Does the NDIA’s proposed reliance on Salesforce guarantee PROTECTED data classification and ensure NDIS data remains exclusively restricted to Australia only? 11 June 2021 https://www.righttoknow.org.au/request/does_the_ndias_proposed_reliance?unfold=1 https://compliance.salesforce.com/en/irap
Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. Salesforce Supplementary Submission. https://www.aph.gov.au/DocumentStore.ashx?id=eb4c6ec4-f10d-4b2d-9e1c-24895c95c452&subId=750355
Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. NDIA Supplementary Submission 10.1 https://www.aph.gov.au/DocumentStore.ashx?id=685b6468-0ab9-4fd1-adb0-0d4ee3f42876&subId=750959
NDIA backs infosec after internal report kept private. Ry Crozier. iTNews. 4 October 2023. https://www.itnews.com.au/news/ndia-backs-infosec-after-internal-report-kept-private-600713?
Marie Johnson 46
NationalDisabilityInsuranceSchemeAmendment(Gettingthe NDISBackon TrackNo.
Bill [Provisions]2024
FOI: NDIS: Salesforce disruption, outage or failures. 23 March 2022. hhttps://www.righttoknow.org.au/request/ndis_salesforce_disruption_outag
FOI: NDIS: Only entity in the world not affected by Salesforce Global Outage? (2021). 22 April 2022. hhttps://www.righttoknow.org.au/request/ndis_only_entity_in_the_world_no
FOI: Copy of the full evaluation of the Tasmanian NDIS PACE test. 10 August 2023. hhttps://www.righttoknow.org.au/request/copy_of_the_full_evaluation_of_t#incoming-31984
644 NDIS users not told which medical records leaked, seven months after HWL Ebsworth hack. Jeremy Nadel. iTNews. 19 January 2024. hhttps://www.itnews.com.au/news/644-ndis-users-not-told-which-medical-records-leaked-seven-months-after-hwl-ebsworth-hack-604 150
Failed DNS server restarts caused Salesforce outage. Juha Saarinen. iTNews. 22 May 2021. hhttps://www.itnews.com.au/news/failed-dns-server-restarts-caused-salesforce-outage-564893
Joint Committee of Public Accounts and Audit Inquiry into Procurement at Services Australia and the NDIA. Submission by the
Australian Federation of Disability Organisations (AFDO).
hhttps://www.afdo.org.au/wp-content/uploads/2023/08/AFDO-Submission-Inquiry-into-Procurement-at-Services-Australia-and-NDIA-A ugust-2023.pdf
FOI. 05 February 2021 | ACE Project Risk Review. AAT2022-4295 - Matter 6 - Document for release on 20230418 - Redacted.
PWC (2016) National Disability Insurance Scheme MyPlace Portal Implementation Review - Final Report, section 21: Conclusions, dated 31 Aug 2016. Available at: < https://www.dss.gov.au/sites/default/fil…
ALERT: NDIS PAYMENT ISSUE. Disability Intermediaries Australia. 6 December 2023. hhttps://www.intermediaries.org.au/news/alert-ndis-payment-issues/
DIA PACE ISSUES ESCALATION. Disability Intermediaries Australia. 1 December 2023. hhttps://www.intermediaries.org.au/news/dia-pace-issue-escalation/
‘Mass exodus’ of disability support providers on the horizon, data suggests. Disability Support Guide. August 2023. hhttps://www.disabilitysupportguide.com.au/talking-disability/mass-exodus-of-disability-support-providers-on-the-horizon-data-suggests
When Govt took a wrecking ball to the NDIS operating model. Marie Johnson. InnovationAus. 3 May 2022. hhttps://www.innovationaus.com/when-govt-took-a-wrecking-ball-to-the-ndis-operating-model/
NDIA BEGIN ‘TEST’ OF NEW PACE SYSTEM IN TASMANIA. Disability Intermediaries Australia. 11 November 2022. hhttps://www.intermediaries.org.au/news/ndia-begin-test-of-new-pace-system-in-tasmania/
The NDIS test in Tasmania: insights from our evaluation. NDIS. 14 November 2022 - 31 March 2023. The NDIS test in Tasmania: - insights from our evaluationNational Disability Insurance Scheme (NDIS)hhttps://www.ndis.gov.au › media › download › att…
Junked $191m Centrelink calculator was ‘slow and defect-ridden’. Justin Hendry. InnovationAus. 11 September 2023. hhttps://www.innovationaus.com/junked-191m-centrelink-calculator-was-slow-and-defect-ridden/
Permissions denied: Home Affairs tech platform gets the hook. Joseph Brookes. InnovationAus. 11 July 2022. hhttps://www.innovationaus.com/permissions-denied-home-affairs-tech-platform-gets-the-hook/
United against algorithms: a primer on disability-led struggles against algorithmic injustice. Georgia van Toorn. ARC Centre of Excellence for Automated Decision-Making and Society. 15 April 2024. hhttps://apo.org.au/node/326312
Marie Johnson 47
National Disability Insurance Scheme Amendment (Getting the NDS Back on Track No. 1) Bill 2024
What happened when a ‘wildly irrational’ Algorithm made crucial healthcare decisions. https://www.theguardian.com/us-news/2021/jul/02/Algorithm-crucial-healthcare-decisions?CMP=Share_iOSApp_Other
Dutch scandal serves as a warning for Europe over risks of using Algorithms. https://www.politico.eu/article/dutch-scandal-serves-as-a-warning-for-europe-over-risks-of-using-Algorithms/
Not just A-levels: unfair Algorithms are being used to make all sorts of government decisions. https://theconversation.com/not-just-a-levels-unfair-Algorithms-are-being-used-to-make-all-sorts-of-government-decisions-145138
Permissions Capability Industry Information Paper. Delivery of a Permissions Capability for Government Services. Department of Home Affairs. Digital Transformation Agency. October 2020. https://www.homeaffairs.gov.au/programs-subsite/files/permissions-capability-industry-information-paper.pdf
Joint Committee of Public Accounts and Audit. Inquiry into the Failed Visa Privatisation Process and the Implementation of Other Public Sector IT Procurements and Projects. 30 November 2023. https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Public_Accounts_and_Audit/IT_procurement_and_projects
Govt scraps NDIS ‘robo-planning’ after states revolt. https://www.innovationaus.com/govt-scraps-ndis-robo-planning-after-states-revolt/
‘Unethical’: NDIS Participants ‘lured’ into trials. https://www.innovationaus.com/unethical-ndis-Participants-lured-into-trials/
Robo-debt public servants now shaping the NDIS. https://www.thesaturdaypaper.com.au/news/politics/2021/04/10/robo-debt-public-servants-now-shaping-the-ndis/161797680011420# hrd
Inquest cancelled into death of man with disabilities as family drip-fed crucial information on NDS failures. https://www.msn.com/en-au/news/australia/inquest-cancelled-into-death-of-man-with-disabilities-as-family-drip-fed-crucial-informatio n-on-nds-failures/ar-AA13spVP?fbclid=IwAR3Y-Wy2kXXlYgras429mPQo72_tH39m2i8Cou77pDG__1dT1PnZu7M7ijI
A Look Inside the Deadly Digital Transformation Agenda that created RoboDebt and RoboNDIS. Marie Johnson. Substack. 14 April 2023. https://open.substack.com/pub/mariehjohnson/p/a-look-inside-the-deadly-digital?r=ynoa&utm_campaign=post&utm_medium=web
No ‘fairness’ in the harm caused by Algorithms. https://www.innovationaus.com/no-fairness-in-the-harm-caused-by-Algorithms/
NDIS Algorithms and King Henry VIII powers. https://www.innovationaus.com/ndis-Algorithms-and-king-henry-viii-powers/
‘Citizen-centric’ demolished by NDIS Algorithms. https://www.innovationaus.com/citizen-centric-demolished-by-ndis-Algorithms/
Govt scraps NDS ‘robo-planning’ after states revolt. https://www.innovationaus.com/govt-scraps-nds-robo-planning-after-states-revolt/
‘Unethical’: NDS Participants ‘lured’ into trials. https://www.innovationaus.com/unethical-nds-participants-lured-into-trials/
Robo-debt public servants now shaping the NDIs. hhtps://www.thesaturdaypaper.com.au/news/politics/2021/04/10/robo-debt-public-servants-now-shaping-the-ndis/161797680011420# hrd
Marie Johnson 48
National Disability Insurance Scheme Amendment (Getting the NDS Back on Track No. 1) Bill 2024
Attachment A
Submission by Marie Johnson, Submission 137 Attachment 1, Supplementary Statement, 3 March 2023.
JSCNDIS Inquiry into the Capability and Culture of the National Disability Insurance Agency (NDIA)
https://www.aph.gov.au/DocumentStore.ashx?id=db365fea-d327-4683-a9f2-1f72de0cbf74&subId=722398
Marie Johnson 49
National Disability Insurance Scheme Amendment and Getting the NDIS Back on Track (No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSC NDIs Inquiry into the Culture and Capability of the Ndla
Supplementary Statement By Marie Johnson
Addendum To submission 137
Joint Standing Committee On The National Disability Insurance Scheme Senate Inquiry – capability And culture Of The ndia
Supplementary statement By marie johnson addendum To submission 137
~ robodebt + robondis ~ culture That automated harm
Marie Johnson CEO Centre For digital business pty limited abn: 16 162 122 072
3 march 2023
marie johnson ceo, centre for digital business 3 march 2023
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
BACKGROUND
I would like to thank the Committee for the opportunity to meet the Committee and make a statement.
I am the former Head of the NDIA Technology Authority, a specialist appointment reporting directly to the NDIA CEO. I led the business case for the NDIS ICT systems, and for this to be based on co-design and the principles of the UN Convention on the Rights of Persons with Disabilities. I was responsible for establishing co-design, a capability which would later be abandoned by the bureaucracy. A disastrous action of significant consequence. Everything I predicted would happen, has happened because of this.
In providing this testimony, I draw on my lived experience of family with disability interacting with the NDIA. I was honoured to receive the ACT Mental Health Carer Award for 2022.
This supplementary statement tabled in full is lengthy, describing in detail with evidence my detailed internal knowledge of the NDIA and evidence of systemic defects; systemic breaches of the NDIS Act and other unlawful practices; and extreme cyber security risks.
I am also often asked about the ‘new’ PACE Salesforce system – and will it fix things. My answer to this is no. The same errors are being repeated, with risk compounded by dangerous predictive algorithms and algorithmic processes modelled on RoboDebt. I explain in detail throughout this written supplementary statement.
In this testimony I will highlight key issues that warrant exposition, starting with my professional background and my family’s horrific experience with the NDIA.
My professional background and expertise are relevant to the comments I am making. I am the CEO of the Centre for Digital Business, a digital services AI company. I am a recognised global digital authority; author and commentator on artificial intelligence; human rights; technology; ehealth; cyber; identity; and ethics.
I have been at the forefront of digital transformation for decades, with a track record across the public and private sector in Australia and internationally, covering health and human services; disability services; visa systems; tax; identity; and payments.
I was awarded the prestigious US Government O-1 Visa for Individuals with Extraordinary Ability or Achievement, many years ago, to take up the role leading Microsoft’s Worldwide Public Services and eGovernment business based in Seattle.
For many years, I was the Chief Technology Architect for the Australian Department of Human Services, with responsibilities including the architecture and technology business cases bringing together the massive systems of Centrelink, Medicare Australia, and the Child Support Agency.
I was previously the Chief Technology Architect for the Australian Health and Human Services Access Card.
I have an exceptionally deep knowledge of the NDIA processes, and the NDIS ICT system built and delivered by DHS. I also have extensive knowledge and operational experience of the cross-government capability, systems, and architecture on which the NDIA is dependent.
I was an Inaugural member of the ANU Cyber Institute Advisory Board. In my early career, I led an intelligence team on an organised crime investigation run by the National Crime Authority. For many years I was the Independent Member on the AFP Spectrum Board.
From my experience I believe that the NDIA systems and processes are the most defective and dangerous in government. The defective NDIA systems which I have been writing about for years, not only directly cause harm but present risk to life.
Marie Johnson 2 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track Bill
No.1) 2024 [Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
The many hundreds of submissions to this inquiry and to previous inquiries including the inquiry into Independent Assessments, all of which I have read in preparation for this statement, present irrefutable evidence of this. Every submission is like ours. That is not a coincidence.
I was working at the NDIA as the Head of the Technology Authority during the period when RoboDebt was being devised and rolled out, under what would become whole-of-government digital and automation strategies.
As the former Chief Technology Architect of DHS and with extensive whole-of-government and global experience, I well understand whole-of-government strategies and what automation involved and the implications.
I knew too much and had too much experience to be dazzled by the technology hubris across government, pushed by tech companies and consulting firms – with hundreds of millions of dollars at stake - that would cause so much harm.
My perspective has long been the fundamental need for co-design, not only to ‘improve the client experience’ but more importantly as an essential governance and ethics mechanism to protect human rights.
My role with the NDIA involved amongst other things, the establishment of an end-to-end co-design capability, staffed by NDIA staff with disability.
As I explain in detail in this statement, end-to-end co-design is necessary in order to map the life cycle of data.
Co-design would eventually be dumped by the bureaucracy, with significant consequence. The culture across the bureaucracy was brutal and toxic.
I was criticised by powerful personalities within the broader bureaucracy, outside the NDIA, for taking co-design ‘to the extreme’. That this gave the NDIA perspective that did not accord with the DHS direction.
I was personally vilified and accused of a lack of loyalty for ‘not supporting DHS’. I had to choose between NDIA and DHS, and I chose NDIA.
As RoboDebt was starting to blow up, it was said to me that for ‘not supporting DHS’, I could not be saved from the consequences of this choice.
I was yelled at. Book slamming in meetings. Equipment slammed. I was dis-invited to meetings. Senior DHS bureaucrats would simply not show up at critical meetings, long planned, involving interstate, and international attendees.
The treatment of disabled and neurodivergent staff was disgraceful – and in fact, unlawful. Moved around – ‘where could we park them’. Spoken about in the most offensive, disparaging and hurtful language.
Accommodations and adjustments were difficult and had to be justified, ridiculously – including assistive technology, and from evidence at Senate Estimates, this is still the case.
Meetings would be cancelled without notice, and this happened not only with the DHS but also the Digital Transformation Office (now DTA). The DTO cancelled at least 6 meetings, the last cancellation just one hour before the meeting was to take place. With no care or consideration for disabled attendees, for the length of time and effort involved including with support workers, in preparing for and travel to meetings.
According to DTO, DHS would be representing the needs of the NDIA in ‘whole-of-government’ digital transformation. No need to meet with disabled people. Well, one size fits all, fits no one.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
The IT bureaucrats would determine what people with disability would and would not get – and then put the ‘offerings’ in front of people with disability for testing, and dress this up as co-design. This is still happening. Clearly, digital government is not meant for people with disabilities and their families. And because I was taking a divergent approach – which was absolutely needed, endorsed, and funded in the business case - it was said to me quite menacingly, that taking a stand on co-design at the same time that RoboDebt was blowing up in the media, for ‘not supporting DHS’, I would not work for government in Canberra again. I was not the only one to be threatened in this way. This was and is a common practice. At the end of my contract, I left to take up opportunities overseas in AI. And I will say, that my work in AI has continued to be acknowledged globally. I did not deserve this treatment. Nor did the many disabled people who were undertaking extraordinarily important work. Nor did my daughter and family deserve to suffer the consequences of all this – defective harmful technology born of supreme arrogance and incompetence. I feel that I am able to say these things now, given what is now on the public record through the RoboDebt Royal Commission. Whilst I was not involved in RoboDebt, given my previous role as the DHS Chief Technology Architect, my expert presence inside the bureaucracy with NDIA, was perhaps seen as inconvenient.
And it is no surprise that Robo practices have become embedded in the NDIA, with the same horrific results. RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government digital and automation strategies driven by DHS, now Services Australia. There is a duty in law and ethics to understand the ‘why’ and ‘how’, including the distorting and destructive power of defective systems and algorithms used at scale by the state. It is the purpose of my expert testimony with evidence to expose these questions. Without doing so, further harm cannot be prevented. In my family’s experience, I did not have a crystal ball. I did not need a crystal ball. I knew ahead of time exactly what my daughter and our family were in for.
FAMILY EXPERIENCE
The continuing telling of our family’s experience is immensely traumatising. But we feel we have no option. Telling our story in the hope that it will help change things, and suffer in the telling. Or shut up and suffer anyway. My daughter’s initial NDIS application was REFUSED because the NDIA LOST her entire application, including the 400+ pages lever arch folder and documents. It had taken her more than TWELVE MONTHS to assemble almost TWENTY years of medical evidence, including having made additional specialist appointments for reports and assessments to be written at very considerable cost. In anticipation of the torture that my daughter went on to actually experience, I took photographs of her at the NDIA offices lodging her application; which was stamped and receipted by the NDIA officer at my insistence.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
The reason why I took the photos, is that I knew ahead of time the gross deficiencies in the Agency culture, capability and processes and anticipated the very difficult time my daughter would have. I knew exactly what would happen. This haunts me.
And we fought a bitter battle for two years to have that perverted refusal decision over-turned. Throughout the application and appeal period, I maintained a detailed chronology and analysis of the various interactions with the NDIA.
The chronology shows that on TWELVE times, information was provided/re-sent/re-requested. The Agency admitted to not having all the documents, even though we had receipts showing inconsistencies on the part of the Agency as to what they had and when they received it.
And yet with all my detailed internal knowledge and ability to engage solicitors, I could not prevent the damaging impact on my daughter of the interaction with the NDIA.
UNLAWFUL ALGORITHMS ~ ABSENCE OF ETHICS ~ RISK TO LIFE In previous evidence, I have described the over-reach of the actuarial function, and the system and systemic risks this creates. These risks are catastrophic, not understood and not documented.
The NDIS actuary function operated as a closed loop that created the algorithms without governance or ethics framework; designed assessment interventions opposed by the medical and health community; determined services based on a fiction; designed the so-called digital experience; and then reported the outcomes.
Effectively, participants have been subject to a perverse form of human experimentation. This must never be allowed to happen again.
But mere changes to the org chart and reporting lines won’t fix this. The role of the actuary needs to be legislatively limited and legislatively counter-balanced by co-design and ethics. I will talk more about co-design later in this testimony.
Throughout this testimony, I will raise questions of lawfulness and unlawfulness of the construction and operation of these algorithms and systems; and whether misfeasance or malfeasance in public office has occurred.
Similar questions were raised during RoboDebt Royal Commission1 hearings, with the examination of legal advice regarding misfeasance in public office, that if established, could be a basis for a class action. This was of course, the RoboDebt class action. Some of the elements of misfeasance in public office covered in that legal advice, include:
- the defendant must be the holder of a public office…
- the defendant must have been recklessly indifferent to whether the act was beyond power and recklessly indifferent to the likelihood of harm being caused to the plaintiff;
- the defendant must have acted with reckless indifference to whether the act was beyond power and there must have been, objectively, a foreseeable risk of harm to the plaintiff.
Legal advice regarding malfeasance in public office was also exhibited. RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government automation strategies driven by DHS, now Services Australia.
The first question of lawfulness goes to the very foundation of the NDIS.
NATIONAL DISABILITY INSURANCE SCHEME
Amendment (Getting the NDIS on Track) No. 1 Bill 2024 [Provisions]
SUBMISSION TO THE JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
Given that the NDIS legislation specifically allows for MULTIPLE DISABILITIES, questions need to be asked about the origins and evidence basis of the actuarial fiction of ‘primary disability’. And question whether the fictional device of ‘primary disability’ arose because the systems built by OHS could not be configured for multiple disabilities. Was this design fiction of ‘primary disability’ ever examined as to its LAWFULNESS or UNLAWFULNESS? So fundamental is this question, that its status simply cannot be ignored, assumed or accepted unchallenged. This might very well be a catastrophic multi-billion-dollar design defect: one that has caused untold human harm, including for my family. Putting in bluntly and simply, the NOIA system can only cater for one disability - the ‘primary disability’. People have to pick one. Let that sink in. And the consequences are catastrophic.
This is in breach of Section 24 of the ND/5 Act ‘Disability Requirements’, which legislatively specifies one or more disabilities and ‘impairment or impairments’. As if anybody - including health professionals - would actually be able to do this, or even understand the consequences of such a decision to ‘pick one’. This is a human rights, ethics and legal minefield.
The whole operating model panders to the complexity of this actuarial fiction. There are so many processes, systems, appeals, reviews, rules, administrative loops, turgid language, assessment reports, and human harm because of it . Horrific system-wide costs and yet people still do not get the supports they need. And as demonstrated throughout the whole INDEPENDENT ASSESSMENT debacle, notwithstanding the risk to life, the NOIA recklessly pursued the use of systems, algorithms and methods that have been shown in other jurisdictions to harm people leading to death. In fact, and against the advice of health professionals, the AMA and others, the Agency ruthlessly and recklessly used these systems, algorithms, and methods in trials of Independent Assessments. Did the NOIA have any knowledge or evidence that the application of algorithms results in harm and death? An answer either way - yes or no - is damning. The NOIA either had this knowledge and recklessly ignored it. Or did not have this knowledge - which is readily publicly obtained - and recklessly decided not to acquire and investigate this knowledge.
Specifically, what is the process and governance by which the algorithms and methods were/are developed: including the governance regarding safety, risk and ethics?
And in evidence at the JSCNDIS inquiry into Independent Assessments, NOIA executive shockingly stumbled over whether or not there was even an ethics framework (there is none), and appeared to not even understand the question. How could IA trials - effectively human research - progress so far, in the absence of the necessary ethics governance as outlined in the National Statement on Ethical Conduct in Human Research 2007 (Updated 2018).2 Other notable health and research experts also documented concerns in submissions.3
2 https:/fwww .nhmrc.gov.au/’about-uS/publications/national-smement• thic.akonduct-human-research-2007-updated-201.Mblock-views-blOO:-file-attach.ments-content-blod:-1
3 Royal Commission into Violence, Abuse, Neglect and Exploitation of People with Disabilities. Submission by Muriel Cummins, AHPRA-registered Mental Health Occupational Therapist, page 9)
Ma~~hmoo 6 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1 Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
‘Should an external body seek to complete a study using the same methodology as outlined in the IA pilot, researching NDIS participants, they would be required to adhere to the National Statement on Ethical Conduct in Human Research (NMHRC, 2018), and the study would be overseen by an independent Human Research Ethics Committee (HREC) [9]. Human Research Ethics Committees oversee ethical conduct in research practice, including, but not limited to: evil ethical research process; evaluation of risk of participants; informed consent; data and record management; publication of findings; conflict of interest; and the handling of allegations of research misconduct. Why do these research standards not apply to research undertaken by the NDIA?’ [Emphases added]
The message here is that rigorous training is needed for any profession whether it is health work or qualitative research in order to conduct the work in a careful, appropriate and scientific manner. Assumptions, biases, methods and researchers behaviours must be subject to scrutiny and ethics.
The lack of fundamental ethics governance in the core operations of the Agency, is a most reckless capability failure.
One of the most alarming consequences of this, is that there remains no documented risk to life, arising from the Agency’s own operations.
And notwithstanding this, the widespread implementation of RoboPlanning and NDIS RoboDebt compliance practices was occurring at the same time the RoboDebt Royal Commission was hearing of harms resulting from the same practices and methods.
Later in this submission, the NDIA is shown to be recklessly confused and conflicted over privacy, data protection and risk.
Furthermore, in my submission to the JSCNDIS Inquiry into Independent Assessments, I detailed cyber security concerns about systems and applications being used by the NDIA in Independent Assessment trials that would see personal sensitive data processed by uncleared contractors and transmitted unprotected offshore.
Built on the actuarial fiction of ‘primary disability’ are roboplanning algorithms, based on the equally flawed concept of statistical averages.
‘Mathematically this is wrong because an average for a fluctuating variable never speaks to its constituent parts.’4
The community has come to understand the horrific impact of ‘averaging’ in the unlawful RoboDebt catastrophe, happening in the very same portfolio as NDIS.
Algorithms based on ‘behavioural insights’ create a fiction, a persona comprised of assumed or typecast features whose fictional behaviours are used as a proxy in order to predict behaviours of real people, and for this prediction to be treated as fact. It makes huge generalisations, reductions and determinations on complex human conditions, experiences and disparate factors.
This perverts power and access to justice in a number of ways.
The state, with all its power, is automating decisions relating to individuals, based on ‘insights’ and fiction. Not evidence.
By contrast, the individual, must produce extraordinary evidence to prove otherwise in order to overturn the fiction-based automated decision of the state (the NDIA) - evidence which the state ignores.
National Disability Insurance Scheme
Amendment (Getting the NDIS on Track) No.1 Bill [Provisions] 2024
Submission 25
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA SUPPLEMENTARY STATEMENT BY MARIE JOHNSON Addendum to Submission 137
The problem with algorithms based on personas and behavioural insights, is in its application to administrative decision making by the state - not some marketing function. And we see the catastrophic result of this in both RoboDebt and RoboNDIS.
The NDIS legislation specifies that PLANS are INDIVIDUALISED and directed by the participant . That facilitate tailored and flexible responses to the individual goals and needs of the participant .
The application of statistical averages in automated roboplanning eliminates the individual person and their needs, transmuted instead to a fictitious average, a fictional ‘persona’.
Roboplanes are incompatible wit h the legislat ion and therefore UNLAWFUL. And this is happening systematically at scale.
This is in breach of Part 2 Section 31 (a) of the NDIS Act ‘Participants’ Plans’: the first principle, that plans be INDIVIDUALISED. These algorithmic roboplans eliminate the stated legislative rights of the participant… …AND they also over-ride the CEO’s legislated responsibilities, breaching Section 33 (5) of the NDIS Act which states: that the CEO MUST have REGARD for the individual part icipant stated goals, reports and assessment.
This is not an isolated, one-off or mistaken breach. It is happening at scale to all participants. A fictitious ‘persona’ does not exist; does not have goals; does not have right s. And nor does the algorithm, which is also not a person, have the human capacity to exercise REGARD - that is, the legislated responsibility of t he CEO, a defined person. So here we see two UNLAWFUL devices at the very core of the NDIS: One. The actuarial fiction of ‘primary disability’. And two. The algorithmic elimination of the legally defined rights of the participants as individuals and the annulment of the CEO’s responsibilities to exercise REGARD. My daughter’s plan was cut by 75% creating a situation of extreme safety and health risk. Her current situation is not an isolated or one-off circumstance. The harm she is continuing to suffer is the only outcome - the only possible and inevitable outcome - of a system that is recklessly driven by dangerous algorithms. The depth of the cuts across the different categories of my daughter’s plan is extreme and has created significant safety risks. Critical areas have been completely de-funded.
This is a reckless withdrawal of funding so as to make the whole plan unworkable, unsafe, and a risk to life. This is in contravention of many areas of the NDIS Act; contravention of other Commonwealth legislation including the Public Service Act; and contravention of international conventions. My daughter’s treatment was and is UNLAWFUL. We asked what was the basis for the 75% cut, and there was no explanation given. We could appeal. Or go to the AAT. We appealed on safety and hazard grounds. An urgent communication IGNORED by t he Agency for a MONTH.
Marie Johnson 8 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment (Getting the NDIS Back on Track) No. 1 Bill 2024
Submission 137 - Attachment 1525
JSC NDIS Inquiry Into the Culture and Capability Of the Ndia
Supplementary Statement By Marie Johnson
Addendum To submission 137
While the government has now abolished the AAT, as an instrument of justice, the AAT was never an option for us and for many thousands of people. We are deeply traumatised, we knew the AAT process would be destructive, as was the original access appeal. We could not face the unthinkable. ALGORITHMS AND THE DENIAL OF ACCESS TO JUSTICE But this is far more than culture. This is a large-scale orchestrated denial of human rights and denial of access to justice – orchestrated either by intent or recklessness or defective systems – most likely all of these. Not only are these algorithms incompatible with the NDIS legislation, perverting individuals’ access to life supports and services, but these algorithms continue to have a catastrophic impact on the broader operation of access to justice. That a judicial body such as the AAT and advocacy groups could be so overwhelmed by the scale and network effects of an algorithm, signals a completely different risk that central government is either choosing to ignore or inexcusably ignorant of. In my opinion, perhaps the most concerning aspect of algorithmic decision making is that any human who might be in the loop, will defer to the algorithm because they are simply overwhelmed by contracted volumes and KPIs. Local Area Coordinators. Planners. Decision makers. Appeals officers. Health professionals. Legal representatives for the agency. Legal representatives for participants. Members of the AAT - and its successor. Across all these parties making decisions regarding the lives of people with disabilities, there is not a common – or any – understanding as to the construction and effect of the algorithms. How exactly is the AAT or its successor or a temporary taskforce, ever to understand the black box algorithms and determine if these are just, safe, and lawfully applied? Indeed, do they have the expertise and authority to make such a determination? At the core of the NDIS, are unlawful opaque algorithms that cannot be explained. We were not given an answer to our question about the basis of the 75% cut. I intentionally asked this question because I knew that the LAC couldn’t or wouldn’t give an answer. And on the evidence of a great many submissions, the standard operating practice of the NDIA is ‘no explanation of how plans are constructed and cut.’ UNLAWFUL on so many levels, and in breach of the NDIS Act, Public Service Act, and AD(JR) Act. Submission 120 from People With Disabilities WA (PWDWA), provides extraordinary insight into the widespread the practice of ‘no explanation’. ‘Most Planners believe they don’t need to respond to a request for reasons about a planning decision made by the NDIA despite s 13(2) of the AD(JR) Act making administrative provision for requests.’ The submission from PWDWA also provides evidence of the harmful impact of KPIs: ‘The LAC Planner stated that they do not get any time to read or review any of the reports submitted, and they go into these planning meetings without any knowledge of the case or the person. The LAC Planner further stated that there is a pressure to conduct 8 planning meetings per day, giving them an hour maximum for each meeting.’ This Is the most serious perfect storm Of risk.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
That LACs are incented and driven by KPI’s to drive throughput by not reading reports; not providing explanations; not discussing goals; incented to reduce budget load over their participant caseloads using dangerous and opaque algorithms that they cannot explain, notwithstanding the medical evidence regarding the health and safety of the participant.
Targets driven by NDIA practices such as the ‘Hour of Power’ to finalise roboplans, explains a lot of our experience. And the experience described by a great many people.
Worryingly, the RoboDebt Royal Commission has also heard evidence of a similar practice – the ‘Boost Board’ – introduced to drive targets in RoboDebt notices.
It is no coincidence that opaque algorithms, robo-decisions and KPI’s are common to both RoboDebt and RoboNDIS.
Further evidence at the RoboDebt Royal Commission, heard that:
‘The online compliance interaction through myGov is a key component of this measure that enables the significant increase in compliance activity and cost savings by removing the need for staff decision making.’ [Emphasis added].
This is Robo administration at scale, where humans – both the decision-makers and applicants (whatever their situation or condition) are automated out.
What is directly witnessed is that the algorithm has taken over, causing systemic defective administrative decision making, which is then sent into the cycle of plan review.
The interplay of algorithms and KPIs also dangerously perverts ‘complaint resolution’ actions.
We made an urgent serious safety complaint, which was ignored.
My daughter supported her 2022 plan review and appeal with ELEVEN reports – this in addition to the THIRTY medical reports submitted in her initial NDIS application and in addition to the countless additional reports in the just TWO years she has been a participant in the NDIS.
So all up, in just TWO short years as many as FIFTY reports have been provided to the NDIA. The financial cost of this is extraordinary and the human toll of this on my daughter is sickening.
In this one and only plan review, my daughter was informed that the recording of her disabilities in the system was CHANGED singularly to bipolar disorder – an arbitrary and dangerous splitting out of one element of the cluster of complex conditions that constitute her psychosocial disabilities.
All the THIRTY medical reports provided to the NDIA on her initial application – and as many as FIFTY reports all up – describe the interplay and compounding impact of these complex conditions.
My daughter has provided several detailed personal statements describing the severity and life impact of these conditions. Her husband, father and I have all provided detailed personal statements.
The NDIA has ignored the advice of all these reports, arbitrarily, aggressively and punitively withdrawing funding to a dangerous level - driven by roboplanning algorithms - in contravention of the medical advice and my daughter’s own stated goals, leaving her deeply vulnerable, at risk and unsupported.
And far worse. A person who my daughter has not met before and who by their own admission had not read or had lost my daughter’s documents - more documents lost yet again - informs her that her disability has been CHANGED in the system.
This arbitrary action not only ignores the TWENTY years of medical diagnosis but CHANGES it – by a person not qualified to do so.
This is INTERFERENCE with medical evidence. And it is UNLAWFUL.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
Furthermore, notwithstanding the FIFTY reports – including the ELEVEN reports my daughter provided in support of the 2022 plan review and appeal process and which the Agency lost and ignored – the LAC wanted my daughter to provide even MORE reports including further personal statements. Not read, are my daughter’s harrowing personal written statements that have already been made. The LAC was told of the extremely desperate situation in writing following the catastrophic 75% funding cuts. And yet, while even more reports were demanded, my daughter’s own request to discuss, review and update her goals were ignored and denied. KPIs that do not allow the time to consider goals. An organisational culture and behaviours that are antagonistic to this. Being denied the right to discuss goals and update ‘about me’ statements, is happening across the board. There is out-roar over this in participant forums. The NDIA and LACs are REFUSING participants’ legislative right to update their goals, breaching Section 33(1) of the NDIS Act ‘the participant’s statement of goals and aspirations’. This in addition to the earlier discussion on the systemic breaches to Section 33(2) of the NDIS Act ‘statement of participant’s supports’ arising from the use of roboplans and algorithms. What is being experienced across the board, is the systemic and orchestrated breach of Section 33 of the NDIS Act that covers the TWO legislated pillars of a participant’s plan: the participant’s statement of goals and aspirations Section 33 (1) AND the statement of participant’s supports Section 33 (2). The day following the plan review meeting, my daughter communicated with the LAC via email stating that she had not been given the opportunity to discuss her goals in the plan review meeting the previous day. My daughter requested the opportunity to discuss her goals before the plan was finalised, but this request was ignored and a mere 27 MINUTES later was informed that the final plan had been submitted.
75% cut. Not explained by the Agency. But we explained that what this means is the aggressive, immediate, and unsafe removal of supports; enforced isolation; and denial of access to life saving therapies. Again, request a review or go to the AAT is the default position of conflicted LACs who are driven by KPIs to ram through plan reviews and reduce plan budgets, but don’t bear the financial costs of the reviews and AAT actions. Want to appeal? The LAC threatened the prospect of further cuts if we did appeal. Contracted LAC organisations are acting in their own financial interests, defined by KPIs, which is in conflict with the interests of the participant. Incented and driven by KPI’s to drive throughput by not reading reports; not providing explanations; not discussing goals; deterring appeals; and incented to reduce budget load over their participant caseloads using dangerous and opaque algorithms that they cannot explain. This is a fundamental defect of the outsourced NDIA operating model, and is a catastrophic breach of the NDIS Act, other Commonwealth Acts, and UN Conventions.
SAFETY: A CATASTROPHIC CAPABILITY FAILURE
The NDIA does not have the culture nor the capability to manage the psychosocial caseload.
Marie Johnson 11 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track Bill (No. 1) 2024
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
Reckless and life-threatening decisions are being made in direct contravention of the advice of treating psychiatrists and health teams, by people not qualified; with no consultation; with no transparency; and without any accountability for the consequences of risk to life. The NDIA is operating dangerously and is incapable of addressing operational safety. Matters of safety need to be considered by the Committee as a catastrophic capability failure of the NDIA itself, as distinct from safety risks arising from providers and outsourced contractors. I am not aware that operational safety risks of the Agency itself have ever been considered. Certainly from my knowledge, ‘risk to life’ from the Agency’s own operations, is not a risk that has been acknowledged or documented by the Agency. We lodged a serious urgent safety complaint with the Agency regarding my daughter’s serious situation over the 75% cut and the situation this created. The urgent safety complaint was IGNORED by the Agency for more than a MONTH. A torrent of nonsensical emails was only received following our letters to Minister Shorten, who passed our urgent letters back to the Agency. We then received emails from the Agency saying that the complaint was being closed down because the ‘telephone was not answered’ after three calls. A person in a desperate situation – whose stated communication preference is NOT the phone – receives phone calls from a private number. The expressed communication preference is continually ignored by the NDIA and LAC providers in breach of the NDIS legislation and the UNCRPD. The Agency recklessly sought to close off the complaint because the telephone was not answered three times in quick succession. Multiple times during this episode, I intervened and told the Agency not to close down the complaint as it had not been resolved. The ‘three phone calls’ is a bizarre and dangerous KPI, determining the ‘closure’ of safety complaints. This should all sound very familiar, because it is hauntingly similar to the processes and organisational behaviour seen in the case of Mr David Harris, a gentleman with paranoid schizophrenia, who died after his NDIS funding was cut off and the Agency closed off communication with him. It is also reported that the Agency refused to disclose to his family, details of his NDIS funding as the material would ‘reveal methodologies the NDIA uses in determining levels of support provided to participants’ and would ‘compromise the financial suitability, integrity and longevity of the NDIS’. These are the algorithms: dangerous and out of the reach of scrutiny and governance. Whereas this gentleman’s loving family fought for three years for information and a full investigation into the failures and neglect he suffered in his final months, I have the dreaded burden of knowing exactly what is going on inside. In our case, NO action was taken by the Agency; the safety complaint was IGNORED by everyone. Neither investigated nor resolved. No letter from the Agency. No letter from Minister Shorten. The urgency from the 75% cut lingers. And I do not believe that it is the role of the Quality and Safeguards Commission to handle operational safety issues of the NDIA itself. Nor is the AAT or its successor, the forum for responding to operational safety issues. The role and core function of the NDIA – and not its outsourced contractors – to respond to operational safety swiftly.
National Disability Insurance Scheme Amendment and (Getting the NDIS Back on Track) Bill 2024
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
It has been my ongoing experience that the Agency does not have the culture, capability nor operating model demanded of an environment of extreme systemic risk, including risk to life of vulnerable and disadvantaged populations.
Harm and fear of harm is the only result.
SYSTEMS, DATA, PRIVACY AND CYBER SECURITY
I have run large operational systems across government, and in my experience, the NDIA systems and processes are the most defective and dangerous in government.
So serious are the defective NDIA systems, processes and governance, that the Government and this Committee is grappling with the economic concerns arising from the NDIA administration, as well as the exploitation of this systemic weakness by organised crime, reportedly to the tune of billions of dollars per year.
The core of the NDIA systems – the participant record – lacks integrity and that is an extremely serious situation.
The fact that a diagnosis can arbitrarily be changed, is not only an extreme safety risk, but signals a lack of integrity, risk management and control framework around the participant record.
This not only happened in our case. It is a systemic, aberrant and widespread practice of the NDIA suffered by a great many people evidenced by widespread commentary on participant forums and in submissions. This is a dangerous and arbitrary splitting out of diagnosis so as not to record a person’s full circumstances.
There are several critical points and consequences regarding data integrity defects and changes to the participant record, specifically diagnosis.
In evidence at the 15 February 2023 Senate Estimates, the NDIA Acting Actuary was unable to answer specific questions on forecasts stating: ‘…there are a few challenges with reconciling the participant numbers. It’s to do with our new IT system.’6
This is not just a reconciliation issue to be waved away, but points to the intractable integrity issues with the NDIS systems – of both the old system and concerningly the new system. I’ll talk about the new IT systems later in this testimony.
With such widespread reports of the NDIA changing participant diagnosis in the system - and systemic data integrity defects – it is perhaps not surprising, though disturbing, that data integrity appears to be a factor in the December 2022 NDIS Quarterly Report7 with unexplained anomalies surfacing.
Commentary of an independent analysis89of the December 2022 NDIS Quarterly Report points to the potential erroneous recording of a diagnosis as a factor leading to anomalies. This would mean that the TSP (Typical Support Package) is miscalculated by the NDIA algorithm, potentially leading to tens of thousands of people being allocated NDIS funding that is not fair or equitable.
This analysis lines up with the widespread experience of participants, grievous cuts, appeals, and complaints.
None of this should be excused simply as defect of the IT systems – as grossly problematic as that is.
National Disability Insurance Scheme
Amendment (Getting the NDIS on Track) No. 1 Bill 2024
[Provisions]
Submission 25
JSC NDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
The problems are far more profound and disturbing, an extreme risk impacting the Commonwealth Federal Budget. These anomalies are the inevitable consequence of defective porous systems; a lack of data integrity; an d a lack of the end-to-end data lifecycle.
And the only way to map the end-to-end data lifecycle, is through end-to-end co-design.
The effect of having permanent disabilities not recorded or removed from the record, is to withdraw funding. This is an UNLAWFUL act . It is a large-scale systemic breach of Section 24 of the NDIS Act denying people funding for all their permanent disabilities. It is a practice so widespread as evidenced by commentary in community forums, in submissions and in AAT appeals, that the only interpretation would appear to be the intentional removal of permanent disabilities from the record, so that those disabilities not thus recorded are not funded. Whatever the explanation, this is malfeasance. And it is deadly.
Case after case of systemically recording the WRONG diagnosis; fundamental errors; a person with a physical disability found their diagnosis had been recorded as an intellectual disability. Permanent disabilities initially recorded then disappear with a new plan. Documents mixed up. Plans containing copy-paste info from other people’s plans. Plans with no goals. Other cases, permanent diagnosis of disability NOT RECORDED - discovered only via a PIA process.
A participant reported they got two plans in one - the first part of the plan was their plan and then the last part - capacity building and capital supports was someone else’s plan! And from another family: a report that ‘Sam would like to walk independently as a goal. My child’s name is not Sam, and they walk just fine.’ Furthermore, there are fundamental questions to be asked about why detailed and highly sensitive medical and personal documents and records are REPEATEDLY lost. This is a common ongoing situation experience by a great many people. LOST documents. And extremely sensitive documents discovered in the wild on the PUBLIC web. From a family: ’ …my husband searched for my email address on google. He found the full-service agreement between my daughter and [name of service provider] for support coordination.’ And there are many ot her instances of other service providers. These documents and records are far more sensit ive than t he medical records held by My Health Record. In addition to health and medical information, these documents cover the most sensit ive personal and family information about a person’s very existence. And it needs to be understood that these lost documents also include information about OTHER people - the participant’s family and who else is in their life. The seriousness of the cyber security and organised crime risks arising from the continuous stream of lost participant documents and health information, is evidenced by the recent security advisory regarding My Health Record, cyber security and connected systems.10
How this happens is via a daisy chain of unmonitored mailboxes; no intelligent workflow; process dead- ends; off-system manual manipulation of data and documents; printouts; metastasised off-system
Security Requirements for My Health Record Connecting Systems - Conformance Profile vl.O I Australian Digital Health Agency Developer Centre https://developer.digitalhealth.gov.au/specifications/national-infrastructure/ep-3648-2022/dh-3583-2022 Marie Johnson 14 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment and (Getting the NDIS Back on Track) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA SUPPLEMENTARY STATEMENT BY MARIE JOHNSON Addendum to Submission 137
databases; and the passing around of spreadsheets and emailing of extremely sensitive medical information to outsourced providers.
Effectively, there is a continuous and uncontrolled mass leakage of highly sensitive health information and other personal data. The NDIA systems and processes are porous - not fit for purpose - and expose all participants and providers to risk, including identity theft and cyber risk. I know both of these domains with some authority.
Over many years, I have written about the defective NDIA/NDIS systems. And in this defective systems setting, the cyber security and privacy risks of the NDIA API arrangements, need to be very clearly understood.
NDIA has hundreds of APIs, and given the evidence I present in this additional statement, and in the context of the extensive change management challenges of the ‘new’ Salesforce PACE system, quations need to be asked about security, risk, and cyber threat assessments and scenario preparedness.
Cyber security and privacy need to be considered by the Committee as a serious culture and capability deficiency of the NDIA. Responses from the Agency to questions on privacy at Senate Estimates11 are further evidence of this.
API’s are a serious threat vector, and analysts have long warned of a tidal wave of API exploitation. a survey12 of more than 400 security and engineering professionals found that 53% have experienced a data breach to networks or apps due to compromised API tokens.
This same report details the case of T-Mobile, where 37 million customer accounts were stolen via API vulnerability. And recently, 235 million Twitter user accounts were exposed by hackers exploiting an API vulnerability. The cyber black market is, by some measures, the third largest economy in the world.
This brings us to the NDIS CTARS breach. The NDIA asserts that the CTARS breach was not a breach of ‘NDIA systems’. That is not the full story. The CTARS breach was of NDIS participant data made available to CTARS systems via NDIA APIs, with the breach compromising 12,000 email addresses resulting in data posted on the DEEP web.
This very large volume of personal, health and other sensitive information included identity documents, Medicare details, tax file numbers, and personal contact information. In addition to this, is the extraordinarily sensitive personal health information including mental health, suicide attempts, drug use and abuse, violent behaviour and sexual abuse. As reported,13 this data was published to a hacking forum and accessed by an untold number of people. The question is why ANY of this data is in the CTARS systems in the first place. And that key question points to concerns over the rigour of the risk and control framework for NDIA APIs - and data more broadly. Questions about the management of API automation via MuleSoft (owned by Salesforce) cannot be waved away as the realm of the IT folks. Co-design is necessary in the design of APIs, in order to understand risk.
https://parlinfo.aph.gov.au/parlInfo/download/committees/estimate/26269/toc_pdf/Community%20Affairs%20Legislation%20Committee_2022_1 _09_Official.pdf;fileType=application%2Fpdf#search=%22committees/estimate/26269/0000%22
https://venturebeat.com/security/t-mobile-data-breach-shows-api-security-cant-be-ignored/
Marie Johnson 15 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment and (Getting the NDIS Back on Track) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA SUPPLEMENTARY STATEMENT BY MARIE JOHNSON Addendum to Submission 137
I have written about the data, cyber, and defective NDIA systems risks in previous submissions, years ahead of the NDIS CTARS data breach, which still does not appear to have been responded to appropriately.
At Senate Estimates on 9 November 2022, the Agency was badly confused over questions about the CTARS breach, wasn’t able to answer basic questions, indicating that it doesn’t understand the issue or even what the response was or should have been.
Given the scale of the data breach, the Agency appears out of its depth.
Just a few weeks later on 28 November 2022, an ABC investigation reported that it had identified large swathes of previously unreported confidential material that is widely available on the internet, ranging from sensitive legal contracts to the login details of individual MyGov accounts, which are being sold for as little as $1 USD.
Many of those impacted learnt they were victims of data theft only after being contacted by the ABC. The NDIA told a Senate Committee that it had confirmed with CTARS that all 9800 affected participants had been notified, but this is not the case. The ABC spoke with 20 victims and all but one had not received a notification or even heard of the attack.
The victims said they were either not adequately notified by the organisations responsible for securing their data, or were misled as to the gravity of the breach.
The NDIA’s typical and problematic communication with participants renders utterly ineffective any strategies for actually responding to circumstances of data breaches and cyber security incidences.
Notwithstanding that many participants expressed preference is NOT to be called by phone, the NDIA as a matter of course ignores the stated preference of participants, sends anonymous text messages to participants saying that ‘someone’ from the NDIA will call them from a private number - telling participants to answer the phone.
This scam-like behaviour of the NDIA exposes participants and their family to unacceptable cyber and privacy risks.
Imagine how someone with psychosocial disability or cognitive disability might react to such coercive high-pressure messaging from the NDIA. How would a person ever actually know who these anonymous text messages are from? They wouldn’t — it’s impossible for them to know and the NDIA has recklessly created a dangerous jeopardy situation for many thousands of at-risk people.
Not only has the ABC investigation called into question the NDIA responses to questions on the CTARS breach at Senate Estimates, the Agency’s responses at the November 2022 Senate Estimates demonstrate a deep lack of understanding of privacy; the difference between privacy and data protection; and their role as stewards of our private medical, financial, care, and personal details.
Given the endemic and intractable problems with lost documents, defective systems, and lack of integrity of the participant record, it is extraordinary that the NDIS Privacy Policy points to the accepted business practice of personal information emailed around (using NDIA email doesn’t reduce the risk), including to board members:
‘All our personnel (including staff and contractors), board members and community partners are issued with NDIA email addresses. When we need to use personal information for our business purposes, we will limit this use to only those NDIA personnel, board members or community partners who need to know that information. Where business use requires us to
National Disability Insurance Scheme Amendment Capability and Getting the NDIA Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
e-mail personal information internally to NDIA personnel, board members or community partners, we will use NDIA e-mail addresses to send that information.’ Such information should not be e-mailed – at all. And questions need to be asked as to why board members are getting personal info of participants (which would also include info about other people). Official email addresses and APIs do not constitute a control framework, nor safeguard the integrity of the participant record. The Agency’s confused commentary on its own Privacy Policy and the Privacy Act, in response to questions at Senate Estimates points to a serious lack of capability and due diligence regarding risk, cyber security, and the protection of information. And the recent Report of the Privacy Act Review is likely to present even greater challenges for an Agency so clearly incapable of protecting personal information, across every area of its operations, systems integrity, automated decision-making, roboplans, and algorithms. Pointing to ‘…high-profile data breaches, exposing millions of Australians to privacy risks including identity fraud, reputational damage and blackmail…’, the Privacy Act Review Report calls for: ‘Transparency requirements for automated decisions that use personal information and have a significant effect on individuals are also proposed. Entities would need to provide information about types of personal information used in automated decisions-making systems and how such decisions are made.’ Furthermore, given the widespread cases of harm resulting from the Agency’s own actions and operations reported to this Committee and other forums and Inquiries, it is significant that the Privacy Act Review Report also proposes a direct right of action to enable individuals to seek remedies in the courts for breaches of the Act which cause harm. From what I understand, the design of the new PACE system and overall Agency risk architecture have not contemplated privacy protections – necessary and anticipated privacy protections - of this magnitude.
WILL NEW SYSTEMS FIX THIS
The answer to this question is NO. And I know this domain with some authority and expertise. There will be a political temptation to point to the ‘new’ Salesforce PACE system as a fix to everything that is busted with the current SAP system. Nothing could be further from reality. Before exploring the question about the ‘new’ Salesforce PACE system, there is further commentary on the scale of the defective systems environment beyond algorithms, lost documents, porous systems, data breaches and cyber security. And this involves two serious examples of defective critical infrastructure: the NDIS Operational Guidelines and the NDIS Price Catalogue. The level of incompetence in these examples is shocking, matching the reckless incompetence of systems, processes and governance, detailed in the preceding discussion. All areas documented in this testimony make a disgraceful mockery of the UNCRPD. The excellent examination of the NDIS Operational Guidelines is documented in the South-West Autism Network JSCNDIS submission.
National Disability Insurance Scheme Amendment Capability and (Getting Culture Getting the of NDIS Back on Track No. 1) Bill [Provisions] 2024
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
This examination shockingly reveals that the NDIS Operational Guidelines are hidden in 508 web pages on an external hidden website.
‘The NDIA has created an external website for the NDIS Operational Guidelines at https://ourguidelines.ndis.gov.au/.’
There is no centralised, integrated menu for the more than 508 webpages located on the site, and being an external website separate to the primary website of https://www.ndis.gov.au/, the site remains unknown to most NDIS participants and families.
Concerningly, however, participants and nominees are being expected by NDIA and NDIS Partners in Community to comply with Operational Guidelines which are overly complicated, and without being advised of their existence.
The search function is ineffective, and the NDIA continuously add to and alter the webpages at https://ourguidelines.ndis.gov.au/, with no notification being given to participants and families of changes occurring.
The second example of defective critical infrastructure involves the NDIS Catalogue and the non-delivery of the eMarket.18
The Catalogue, the jewel in the crown, is comprised of extraordinarily dense PDF, word and CSV documents that have no intelligence; not interactive; not explanatory; not searchable; and utterly fail accessibility standards.
The Catalogue is not fit-for-purpose. It is a cadaverous, inert and incomprehensible spreadsheet and text documents with cascading and hidden links; different versions, addenda, and archives nested across dozens of webpages.
This defective critical services infrastructure affects the entire sector and discriminates against every participant.
Clearly, digital government is not meant for people with disabilities and their families.
Questions need to be asked as to why the Catalogue has been left festering for years. The abandonment of co-design is part of the answer.
Against this wasteland of defective and unlawful systems, and reckless disregard of risk, let’s consider then what appears to be on the drawing board with the ‘new’ Salesforce PACE system.
The Committee should not be lulled into the spin that the ‘new’ Salesforce PACE system will sort things out.
More to the point, what is described in project documentation on the ‘new’ Salesforce PACE system appears to be far more than systems change: there appears to be fundamental concepts changing for the Scheme.
Fundamental and sector wide changes involving payments paid in 3 month drops; no draft plan; no service bookings; and uncertainty about goals. Legislative change is likely to be needed for many of these changes.
This raises the question: Is the ‘new’ Salesforce PACE system being unlawfully designed to include features and changes that do not have legislative authority?
It appears that the ‘new’ Salesforce PACE system being developed includes major changes to plans and goals. These are not just ‘IT’ changes. These appear to be fundamental changes to the legislated concept of plans and goals.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
What is the legislative authority for these changes? Is the ‘primary disability’ fiction - which is contradictory to the NDIS Legislation - also being unlawfully designed into the ‘new’ Salesforce PACE system? Similar governance questions such as these have been examined in the RoboDebt Royal Commission. And what is the Budget and procurement authority for the expenditure of public funds, for work on system features that appear to be inconsistent with the underpinning NDIS Act? In addition to apparent breaches of the NDIS Act, have the Budget Process Operational Rules, Commonwealth Procurement Rules, and APS Code of Conduct also been breached – by the expenditure of public funds on system features that are effectively unlawful? All these questions point to a broader capability deficit with the NDIA, of knowledge, skills and experience in Commonwealth public sector governance. Given the Board and Executive turnover, have the risks been adequately identified and modelled to support decision making for such a drastic and high-risk change, with serious consequences for participants and providers. Indeed, does the Board and Executive even have the authority to accept such extreme risk, if known? What happens when something goes wrong, which will happen. What is the system wide change management? How are these changes all together actually going to work? Have participants actually been involved? And not just one or two in a focus group. Evidence from other submissions indicates consultation is tokenistic and there is no co-design. However, it doesn’t appear that participants have been deeply involved and listened to. Take for example, changing payments to the release of funding in three-month drips. People’s funding needs are never smooth: co-design would have informed this. WHO accepts responsibility for this, including death resulting from withdrawal of services due to funding cuts and quarantined controlled payment cycles. This has happened in similar cases in many jurisdictions overseas. Has the risk of this been analysed and accepted? What is the ethics framework informing these decisions?
And to cap it all off, is this. The project documentation talks about swapping systems. As if there are only two systems. This is an activity of extreme risk. ‘Swapping systems’ was the problem with the initial move from the DSS Oracle system to DHS built current NDIA SAP systems. The initial ‘swapping systems’ caused payments disruption to the whole sector: the difference now is there are 20X more participants. ‘Swapping’ systems involves data migration, a complex high-risk exercise. Given the earlier discussion on the widespread participant record irregularities and lost documents, will the data migration exercise remediate this?
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
This was the very complex and problematic exercise in the transition to full scheme.
Data migration from the DSS Oracle NDIA systems to the DHS SAP NDIA systems; and of course,
The extremely disruptive data migration from the States and Territories due to data gaps, errors and incompleteness.
Whilst the running of systems in parallel is a strategy used in such transitions, the risk and management overheads are exponential requiring significant resourcing, experience and expertise.
As discussed earlier, the problems with this strategy were evident at the 15 February 2023 Senate Estimates, with the Acting Actuary unable to answer questions on forecasts due to ‘reconciliation’ challenges with the new system.–
I predict that participants will be caught in data migration hell. Get ready for a massive loss of data during this period. It is likely that cyber security and organised crime will be watching and probably acting under the cover caused by such disruption.
Worryingly, in the project documentation on the ‘new’ Salesforce PACE system work, there is a comment that ‘we will not go live with defective systems’.
It matters not whether it is the DSS Oracle NDIA systems; the DHS SAP NDIA systems; or the ‘new’
Salesforce PACE NDIA systems.
The preeminent factor is end-to-end co-design. But co-design was dumped as a strategic capability by
the Agency, meaning that the end-to-end risk is unknown, and assumptions remain unchallenged.
And this is evident already in ‘on the ground’ trials of the new PACE system in Tasmania that are not going well.
Evidence that end-to-end co-design has not happened, is sitting in plain sight on the NDIS website. Lists of booklets and information – specifically about the system trials in Tasmania – inaccessible,
unreadable, non-responsive design, not able to be read on a phone.
For such critical change management content to be ‘designed’ in this way, there is an inherent assumption that such content is consumed via a computer monitor in a controlled office-type environment. And not as is the case for a majority of people, mobile phones of different models in all sorts of environments using assistive communication.
This is disgraceful discrimination demonstrates a lack of competence, a lack of care, and a lack of co-
design.
Feedback from a participant on the booklets: ‘Oh FFS! They can’t be read on a phone. Is it conceivable that they will ever understand their customers?’
Considerable preparedness and expertise are required in change management, risk management and risk mitigation. There will always be something that goes wrong in such complex change, that’s just a fact.
There needs to be a comprehensive plan in anticipation for what happens when things do go wrong, and swift pre-planned action. Who is accountable. And what is the governance.
What IS the change management strategy for 500K people? And tens of thousands of providers.
Imagine this change for CALD, Indigenous, people with intellectual disability, and people with psychosocial disabilities.
The ‘not going live with defective systems’ statement indicates a naïveté and lack of experience - consistent the NDIA’s lack of sophistication in responses at Senate hearings on ethics, privacy and data protection.
On the basis of the ‘reconciliation’ problems and information in the project documentation on the ‘new’
Salesforce PACE system, it looks like the whole show is changing – yet the Agency does not appear to
understand nor be prepared for, the risk and the enormity of the change.
Marie Johnson
CEO, Centre for Digital Business
3 March 2023
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
CO-DESIGN
I was responsible for establishing and initiating co-design and have written extensively in previous submissions and in other public commentary of the devastating impact of its abandonment by the bureaucracy.
And notwithstanding NDIA platitudes about co-design, I identified that references to co-design in NDIA corporate documents had mysteriously disappeared. It was the intervention of this Committee in its report on Independent Assessments, that directed legislative change to include co-design ‘so that it never disappears again’ thus forcing the NDIA to revert.
All capability deficits discussed in this and previous submissions, including cyber, safety and risk, are due to the abandonment of co-design and the unconstrained over-reach of the actuarial function. Everything I predicted would happen, has happened because of this. Co-design is a strategic governance capability grounded in ethics. Co-design is not about making things look pretty, via periodic or select activities. End-to-end co-design is necessary to understand risk, hand-offs, and challenge assumptions. Every aspect of NDIA operations without exception – including actuarial initiatives - must be co-designed. As stated earlier, end-to-end co-design is necessary to map the data lifecycle. By urgent necessity, this will involve building up internal APS capability – not consultants – led by people with disability. The co-design capability must be resourced to at least the same degree as the actuarial function – which is a team of more than 200 professionals according to the Acting Actuary’s LinkedIn profile. Imagine what could be achieved with a permanent NDIA APS staff of 200 co-design professionals undertaking ongoing end-to-end co-design of every aspect of NDIA operations – including internal NDIA operations with staff with disability. Together with matched resourcing of the actuary and co-design capabilities, there must be matched governance authority embedded in legislation. It will be the co-design governance authority that will be the pre-eminent determinant for rebuilding the NDIS, retrieving trust, and remediating data integrity.
SUMMARY
My daughter is terrified to contact the NDIA and is in fear of re-suffering the trauma. And I am haunted by this experience. My daughter’s traumatic experience with the NDIA has adversely impacted every aspect of her life; her sons; her husband; her father (my husband) who is a heart patient with disability; and myself. The fact that I anticipated the trauma that my daughter would face and contemporaneously documented her horrific journey, demonstrates that her experience was not a one-off, but absolutely the predictable and only possible outcome from such a defective system. This is the case for literally hundreds of thousands of people. There would be perhaps few other NDIS applicants or families who would have the insight at the beginning of their journey to make such detailed documentary recordings from the outset. I knew what would happen and I am haunted by this knowledge and foresight. My daughter has stated that dealing with the NDIA has damaged her mental health to the worst it has been in more than ten years. This is the impact of ‘averaging’ and the outcome of roboplans.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
After so many appeals, lost documents, extreme safety risks, data security breaches, the never-ending cycle of re-submitting reports that have been lost, and the always present threat and dread of the withdrawal of supports, we are out of time.
As described in this submission and by a great many other people, there are catastrophic and additive defects in every area of NDIA operations and operating model.
People with disability and their desperate families seen as soft targets by predators; intractable cyber security exposures; defective and porous systems; continuing and unresolved data breaches; lost documents; and exploitation by organised crime in the order of billions of dollars.
Added to this chaotic risk environment, is the unlawful use of powerful algorithms without governance – similar in practice to RoboDebt – resulting in the catastrophic withdrawal of funding creating risk to life.
Any cyber infiltration of this enormously complex and chaotic environment – in an Agency of such deep capability and cultural deficits – would likely go un-noticed. Because of this, the NDIA/NDIS would have to be considered a national security risk.
Given this extraordinarily complex risk environment - created through reckless incompetence - it is alarming that the NDIA’s own Agency Security Plan (September 2020, obtained under FOI) states that ‘security is not a primary function’ (page 19) and ‘…the Agency is a low-risk Agency…’ (page 32).
In what possible scenario could:
- Immediate risk to life, causing harm and death.
- Unlawful operations and practices.
- Porous defective systems.
- Serious cyber security.
- Data breaches and systemic loss of documents and medical information.
- Mega outsourcing and contracting conflicts of interest.
- Escalating political and financial impact on the Federal Budget.
- And the penetration of organised crime. …ever be considered ‘LOW RISK’?
This is the Agency’s own demonstration of the depth of its capability deficit and recklessness.
A capability and culture incapable of understanding the consequences including the risk to life, of multi-factor multi-vector systemic risk. An Agency that can’t explain ethics: in fact, has no ethics framework. Becomes muddled over privacy. And cannot explain data protection. An Agency that abandoned co-design; was forced to revert; and yet even with all the political controversy and UNCRPD implications over co-design, still could not explain it at the February 2023 Senate Estimates. An Agency with such profound capability deficits, nevertheless aggressively adopted defective Robo algorithms that cannot be explained.
This collapse in capability is almost entirely due to the gutting of public sector resourcing; the transfer of funding to and the pernicious dependence on consulting firms; multi-billion-dollar outsourcing; and system wide conflicts of interest. But I am not the only one pointing this out. Indeed, the JSCNDIS has received excellent and highly detailed submissions from other global and Australian experts and advocates.
National Disability Insurance Scheme Amendment Capability and Getting the NDIS Back on Track No. 1) Bill 2024
[Provisions]
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
And what of the Independent Review? The Independent Review team are good people. However, the Independent Review governance is insufficient. The Review team cannot provide Parliamentary Privilege - which is why I am providing this testimony to the JSCNDIS. It is also not clear how and if Whistle-blower protections apply. There are people in the bureaucracy, ex-public servants, and those who work for providers, who might want to provide evidence, but are reluctant to do so due to concerns about protections.
The issues with the NDIA/NDIS are so deep and so hidden, that a Royal Commission is necessary with the powers to compel the production of confidential documents otherwise withheld by FOI and secrecy; the power to compel witnesses; the power to provide legal protections; and the power to refer for criminal and National Anti-Corruption Commission investigation. Fraud investigations and task forces whilst necessary, are after the fact. Contract arrangements as currently constructed are part of the NDIA capability distortion, and given the multi-billion-dollar honeypot, need to be scrutinised by the National Anti-Corruption Commission. For those of us who have worked on the inside know that what is being revealed at the RoboDebt Royal Commission, mirrors what is happening with the NDIA/NDIS. But it is no accident and should be no surprise that Robo practices – RoboPlanning and RoboDebt practices - have become embedded in the NDIA. RoboDebt and NDIS are of course, administered within the same portfolio DSS, and subject to the same whole-of-government automation strategies driven by DHS, now Services Australia. Same bureaucracy. Same people. Same methods. Same systems. Same fictions. Exactly the same. And what is being revealed, is only coming to light as a result of the powers of a Royal Commission, triggered by years of community activism led by remarkable individuals; the RoboDebt Class Action; and the Federal Court decision on unlawfulness. In all of this, suicide and untold harm suffered by hundreds of thousands of Australian citizens at the hands of its own government and bureaucracy. It is my combined lived experience and professional view, that the NDIS/NDIA requires complete re-engineering; legislative reconstruction involving the limitation of the Actuary function counter-balanced by the matching co-design resourcing and governance authority; and scenario risk analysis, driven by end-to-end co-design. Judicial oversight is necessary to ensure that the unlawful actions and human rights violations can never be orchestrated at scale again. Board governance is insufficient. But this will only be possible with the deep evidence base arising from a Royal Commission. Without complete re-engineering, the national security, data security and organised crime risks become intractable, undermining the sustainability and integrity of the Scheme. The risk to life becomes unacceptably extreme. The Labor Government stated that the RoboDebt Royal Commission was necessary to ensure RoboDebt never happens again. Well, it is still happening. RoboNDIS. There can be no ‘learnings’ from the RoboDebt Royal Commission alone - the ‘learnings’ will only come when the combined common RoboDebt + RoboNDIS malfeasance is confronted - and people are brought to account - for BOTH.
Marie Johnson 23 CEO, Centre for Digital Business 3 March 2023
National Disability Insurance Scheme Amendment Capability (Getting the NDIS Back on Track) No.1 Bill 2024
Submission 137 - Attachment 1525
JSCNDIS INQUIRY INTO THE CULTURE AND CAPABILITY OF THE NDIA
SUPPLEMENTARY STATEMENT BY MARIE JOHNSON
Addendum to Submission 137
Then the big question. How was the combined common RoboDebt + RoboNDIS malfeasance allowed to continue for years? The only way to fix the NDIA/NDIS, is via a Royal Commission into the NDIA. But given the commonureaucratic and technology lineage, the extension of the RoboDebt Royal Commission into a Royal Commission into RoboNDIS would be an opportunity to consider the full ramifications in context. However, there is immediate action the government can take and needs to take. There is no need to wait for the findings of the Independent Review, or political triggers for a Royal Commission. The cessation of roboplanning - and the reinstatement of all cut funds - should happen immediately as an urgent action to safeguard life. This scaffolding will provide NDIS participants with some certainty about their lives, while in parallel, the new simplified NDIS/NDIA is built. But we are not waiting. We have run out of time, and we have suffered too much harm. The NDIS Class Action effort is underway. We see this is our only pathway to justice. I would like to thank the Committee for conducting this important Inquiry, and for providing me with the opportunity to make this testimony. Marie Johnson Date: 3 March 2023
Marie Johnson 24 CEO, Centre for Digital Business 3 March 2023