Latest / Tech Talks With Kinsoft / Australian Court Files Sent Offshore – A Data-Sovereignty Failure

Transcript

Australian Court Files Sent Offshore – A Data-Sovereignty Failure · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Glad to be
• 0:02
  here for this one. Yeah. So usually when an organization
• 0:05
  builds a system to protect something incredibly
• 0:08
  valuable, the instinct is just to obsess over
• 0:11
  the physical boundaries. Right. The geography
• 0:14
  of it all. Exactly. The boardroom questions are
• 0:17
  always, you know, where are our servers located?
• 0:19
  Which data center is this in? Do we have a primary
• 0:23
  and secondary site within our own borders? It
• 0:25
  makes sense, right? I mean, humans are wired
• 0:27
  to understand physical geography. A data center
• 0:31
  in Sydney. It feels tangible. It feels safe.
• 0:35
  You can point to it. Right. You can point to
• 0:37
  it. And the assumption is that if the data is
• 0:39
  physically sitting within the walls of our country,
• 0:42
  well, it's inherently protected by our legal
• 0:44
  frameworks. But the danger there, of course,
• 0:46
  is that a fortified physical location means absolutely
• 0:50
  nothing if you casually hand out a master key
• 0:53
  to an unvetted third party. Oh, absolutely. Especially
• 0:56
  one operating in a totally different jurisdiction.
• 0:58
  Right. And that is exactly what we are getting
• 1:00
  into today. In this exploration, we are taking
• 1:03
  a massive stack of sources reports, investigative
• 1:06
  articles, corporate statements, and extracting
• 1:09
  the absolute most crucial insights. You don't
• 1:12
  have to sift through all that raw reporting yourself.
• 1:15
  Exactly. Our mission today is analyzing a massive
• 1:18
  real world failure in data sovereignty, security
• 1:21
  governance, and third party contracting. Now,
• 1:24
  if you are listening to this analysis, you're
• 1:26
  likely already managing these conversations.
• 1:28
  complex risks in your own environment. Which
• 1:30
  is why this is so relevant. Right. But I do want
• 1:33
  to set a firm ground rule for you right at the
• 1:35
  top. We are keeping this strictly professional.
• 1:37
  No sensationalism. None. We are not here to dramatize
• 1:41
  the situation. We're not speculating about individual
• 1:43
  court cases or the people involved. We are simply
• 1:47
  looking at the architectural IT and the security
• 1:49
  failures. Because the core tension we're unpacking
• 1:52
  here, it represents a really fundamental misunderstanding
• 1:55
  in modern enterprise IT. It's the classic trap.
• 1:59
  Yeah, the trap of confusing where data is stored
• 2:01
  with who actually has access to it. So let's
• 2:04
  start with the mechanics of the incident to understand
• 2:07
  how the breach actually occurred. This helps
• 2:09
  map out the attack surface before we dissect
• 2:11
  why the governance failed. Good place to start.
• 2:14
  So in February 2026, this was actually broken
• 2:17
  by ABC News on February 16th. And then we saw
• 2:20
  a company statement follow up on February 2024.
• 2:24
  It emerged that a Canadian transcription provider,
• 2:27
  VIQ Solutions, had breached its Commonwealth
• 2:30
  contracts. Right. They were contracted to do
• 2:32
  Australian court transcriptions, but they subcontracted
• 2:36
  that Australian work to E24 Technologies, which
• 2:39
  is a firm based out in India. And that is the
• 2:41
  crux of it, because this resulted in highly sensitive
• 2:43
  federal court, federal circuit, and family court
• 2:46
  files being actively accessed offshore. I try
• 2:49
  to think about it like this. It's like renting
• 2:51
  a highly secure bank vault in Sydney, right?
• 2:54
  But then leaving a live webcam feed of the open
• 2:57
  vault just completely accessible to someone in
• 2:59
  another country. If they can see the feed, does
• 3:01
  it really matter that the physical paper is technically
• 3:03
  in Australia? It doesn't matter at all. That
• 3:06
  analogy is spot on. And this brings us to the
• 3:09
  difference between data residency and data sovereignty.
• 3:12
  Which people mix up all the time. Constantly.
• 3:15
  Notice the defense from VIQ's CEO, Larry Taylor.
• 3:19
  He stated, and I quote, Right. Stored. Exactly.
• 3:28
  Stored. That defense misses the point entirely.
• 3:31
  Data residency is just where the data sits. It's
• 3:34
  the geographic location of the hard drive. But
• 3:36
  sovereignty is the access part. Right. Sovereignty
• 3:39
  is about who is legally and operationally able
• 3:42
  to view and process that data. So Larry Taylor
• 3:46
  saying the data is stored in Australia, well,
• 3:48
  that's practically useless if offshore staff
• 3:50
  with Indian IP addresses are actively accessing
• 3:52
  those files. Right. If you have remote read and
• 3:54
  write privileges, the physical location of the
• 3:56
  server rack is totally relevant. Exactly. The
• 3:58
  physical layer was secure, sure, but the application
• 4:01
  layer was completely porous. Okay. So the technical
• 4:03
  mechanism makes sense, storage versus access.
• 4:06
  But this brings us to the human element, which
• 4:07
  is honestly wild to me. The internal governance
• 4:10
  failures. Yeah. Why didn't internal governance
• 4:12
  catch this or stop it? Because you don't just
• 4:14
  set up an offshore pipeline without some alarms
• 4:16
  going off. And the alarms did go off. Loudly.
• 4:20
  Right. The reporting shows that internal staff
• 4:22
  actually raised alarms about this unvetted offshore
• 4:25
  access as early as August 2025. Months before
• 4:29
  it broke the news. Months before. And management's
• 4:32
  response was basically to dismiss them. They
• 4:34
  told staff the concerns were, quote, not relevant,
• 4:37
  and told them to stop spreading rumors. Which
• 4:40
  is just a textbook failure of security culture.
• 4:42
  Oh, it gets worse. Management even issued an
• 4:44
  internal memo falsely claiming the E24 resources
• 4:47
  were based in Sydney. Wow. Yeah. And meanwhile,
• 4:50
  there is this massive turnover happening. Since
• 4:52
  July 2025, at least 12 senior staff either quit
• 4:56
  or were made redundant. And then, the absolute
• 4:59
  kicker, they fired the entire quality assurance
• 5:02
  team. That is the part that just screams structural
• 5:04
  collapse. Right. The remaining contractors were
• 5:07
  suddenly forced to do unpaid quality control
• 5:09
  on these E24 transcripts. And these transcripts
• 5:11
  are coming back at impossible human speeds and
• 5:14
  were full of major errors. Which heavily implies
• 5:17
  unvetted automated AI being used in the background.
• 5:20
  Exactly. But wait, so the automated transcripts
• 5:23
  are coming back full of errors and their response
• 5:25
  is to fire the quality assurance team. Isn't
• 5:28
  that like... Cutting your parachute strings while
• 5:30
  you're already in free fall? That is exactly
• 5:32
  what it is. I mean, from a security governance
• 5:34
  perspective, this is a total collapse. What you're
• 5:37
  seeing is a culture of silence. Right. When you
• 5:40
  dismantle internal auditing, like firing the
• 5:42
  QA team, you are removing the necessary friction
• 5:45
  that keeps an organization secure. Friction is
• 5:48
  a good word for it. Yeah. In security, friction
• 5:50
  is a feature, not a bug. Yeah. QA teams, compliance
• 5:54
  officers, they purposefully slow things down
• 5:57
  to ensure safety. But here, they prioritize speed
• 6:01
  and cost cutting over rigorous internal compliance.
• 6:04
  They didn't want the friction. Right. And when
• 6:07
  you remove the people asking the hard questions,
• 6:09
  you basically unplug your own anomaly detection.
• 6:11
  Which leads us directly to the national security
• 6:13
  ripple effect, because we need to look at exactly
• 6:15
  why where your data is processed matters on a
• 6:18
  macro scale. The payload itself. The payload.
• 6:21
  This wasn't just mundane administrative stuff.
• 6:24
  The compromised files contained incredibly sensitive
• 6:27
  data. We are talking about evidence from ALSIO
• 6:31
  and the Australian Federal Police. That is about
• 6:34
  as sensitive as it gets. Right. The reporting
• 6:36
  notes this potentially exposed covert operatives,
• 6:39
  protected witnesses, and international criminal
• 6:42
  links. And the technical proof was sitting right
• 6:45
  there in the logs. Access logs showing offshore
• 6:48
  staff viewing files outside of Australian business
• 6:51
  hours. Which is a massive red flag. Huge. And
• 6:54
  ultimately, the matter had to be referred to
• 6:56
  the Australian Cyber Service. Security Center.
• 6:58
  Now, the sources also discussed the political
• 7:01
  reactions specifically from Green Senator David
• 7:04
  Shoebridge. Right. He was very vocal about this.
• 7:06
  He was. He called this a national security risk.
• 7:08
  He urged the termination of the contract and
• 7:10
  he labeled the situation a failed privatization.
• 7:14
  Now, I want to be very clear for you listening
• 7:16
  right now. Yes. An important note here. Yeah.
• 7:18
  We are neutrally reporting the contents of the
• 7:20
  sources. We are not endorsing Senator Shoebridge's
• 7:23
  political viewpoints or taking a side on privatization.
• 7:26
  We are simply conveying. the perspectives that
• 7:29
  are present in the material. Our focus is on
• 7:31
  the architecture. Exactly. But looking at the
• 7:33
  architecture, the senator did make a point about
• 7:35
  set and forget contracts. And I have to ask you,
• 7:38
  how do standard vendor risk assessments completely
• 7:41
  miss the true sensitivity of a payload like this?
• 7:45
  Well, that phrase, set and forget. really hits
• 7:48
  a nail on the head. Standard vendor risk assessments,
• 7:51
  or VRAs, they usually happen at the very beginning
• 7:54
  of a contract. Right, during procurement. Yeah.
• 7:56
  You check their ISO certifications, you look
• 7:58
  at their data policies, and you approve them.
• 8:00
  But initial due diligence is completely useless
• 8:03
  without ongoing continuous auditing. Because
• 8:05
  environments change. Exactly. Vendors change
• 8:08
  their software stacks, they change their personnel,
• 8:10
  or like here, they quietly subcontract the work.
• 8:13
  If you treat a VRA as a one -time checklist,
• 8:16
  you are blind to those changes. And the automated
• 8:19
  systems, why didn't they catch this? Well, they
• 8:21
  should have. Offshore access outside of local
• 8:24
  business hours is a glaring anomaly. If you have
• 8:28
  a properly configured zero trust environment,
• 8:31
  an automated monitoring system should instantly
• 8:34
  isolate that session and lock it down. Right.
• 8:36
  It shouldn't just be a line of text in a log
• 8:38
  file that someone finds months later. No, it
• 8:40
  should be an active automated trigger. But if
• 8:44
  you are in a set and forget mindset, nobody's
• 8:46
  looking at the logs and the automated triggers
• 8:49
  aren't configured to stop the bleeding. Which
• 8:51
  brings us to the actual contractual agreements.
• 8:53
  We really need to bring this down to the listener's
• 8:55
  own environment. The subcontractor blind spot.
• 8:58
  Yes. How contractual controls basically fail
• 9:00
  in the real world. So according to the sources,
• 9:03
  the VIQ staff in Australia, they had to undergo
• 9:06
  national security checks. Makes sense. And they
• 9:08
  had to sign a Commonwealth court's deed of confidentiality.
• 9:11
  Yeah. Very strict stuff. But it was completely
• 9:13
  unclear if the E24 staff in India underwent any
• 9:17
  of the same vetting. Right. A massive discrepancy.
• 9:20
  Yet the VIQ CEO stated publicly that contractors
• 9:23
  like E24 are, quote, required to adhere to the
• 9:27
  same strict privacy guidelines, service delivery
• 9:30
  standards and confidentiality as all employees.
• 9:33
  Which is a bold claim to make. Right. It's like
• 9:36
  hiring a highly vetted security guard for your
• 9:39
  office building. But then that guard secretly
• 9:41
  outsources their night shift to a random stranger
• 9:44
  on the Internet. Yeah, just completely undermining
• 9:46
  the whole system. So how does a company actually
• 9:49
  enforce contractual controls down the supply
• 9:51
  chain? Does a contract even do anything? Well,
• 9:54
  what you're describing is what we call the illusion
• 9:57
  of inherited compliance. The illusion. Yeah.
• 10:00
  It is this false belief that just because you
• 10:03
  wrote a strict standard into a legal contract
• 10:05
  that it magically translates into technical security.
• 10:08
  But it's just paper. Exactly. A legal contract
• 10:11
  is a remedy for after a breach happens. It does
• 10:14
  not stop a breach from happening. Saying a subcontractor
• 10:17
  must adhere to guidelines means absolutely nothing
• 10:20
  without technical controls to physically enforce
• 10:22
  it. So what do those technical controls actually
• 10:24
  look like? Well, it requires strict access management.
• 10:27
  It requires geofencing. Meaning literally blocking
• 10:30
  IP addresses outside of Australia. Exactly. The
• 10:34
  API gateway should just drop any query from an
• 10:36
  unapproved region. But it also means you have
• 10:39
  to control the endpoint. If a remote worker needs
• 10:42
  to transcribe a file, can they download it to
• 10:45
  their local hard drive? Right. Or can they just
• 10:48
  copy and paste the text into an email? If the
• 10:50
  answer is yes, then your contract is useless.
• 10:53
  To enforce it technologically, you need things
• 10:55
  like virtual desktop infrastructure or VDI. Where
• 10:59
  the data never actually leaves the server. Right.
• 11:01
  The remote worker just sees a secure pixel stream
• 11:04
  of the application. You disable their local clipboard,
• 11:07
  you block print screen, you lock it down completely.
• 11:09
  But companies don't like doing that because it
• 11:11
  adds that friction we talked about. Exactly.
• 11:13
  It slows things down. It costs money. Vendors
• 11:16
  complain. So companies cave. They accept the
• 11:19
  operational risk and just hope the legal contract
• 11:21
  will protect them. And as we've seen today, a
• 11:24
  contract cannot secure a digital perimeter. It
• 11:26
  absolutely cannot. So we've covered a lot of
• 11:29
  ground today. The storage versus access trap
• 11:31
  ignoring the internal alarms. The national security
• 11:35
  implications and the danger of inherited compliance.
• 11:38
  A lot of hard lessons here. Very hard lessons.
• 11:41
  And we want to leave you with a lingering question
• 11:43
  to think about in your own architecture. Something
• 11:46
  that builds on all of this. Exactly. If a supposedly
• 11:49
  mundane administrative task like transcribing
• 11:52
  court audio can accidentally expose covert operatives
• 11:56
  and national security secrets. Right. What harmless
• 11:59
  outsourced services in your own organization
• 12:02
  secretly hold the keys to your most sensitive
• 12:05
  data? Is it your marketing analytics vendor?
• 12:07
  Is it the AI chatbot widget on your website?
• 12:11
  your payroll processor. It's a terrifying thought,
• 12:14
  but you have to look at the basement doors, not
• 12:15
  just the front gate. You really do. You have
• 12:17
  to evaluate your third party risks constantly.
• 12:20
  So before you sign off on your next vendor agreement,
• 12:23
  we want you to take action. You need the right
• 12:25
  experts to help you build those technical fences.
• 12:27
  Don't rely on the paper contracts. Right. So
• 12:30
  please visit www .kinsoft .com .au to discuss
• 12:34
  your security and IT needs with the team. get
• 12:37
  those technical controls in place. Thank you
• 12:39
  so much for joining us on this exploration today.
• 12:41
  Protect your boundaries, and we'll see you next
• 12:42
  time.