Family court dismissed concerns over India court data breach a decade ago, emails reveal

Former Auscript manager says inaction set stage for 2026 disaster that shut down transcription company

By LineZotpaper
Published
Read Time2 min
Newly surfaced emails show that the family court dismissed concerns about Indian access to sensitive Australian court data a decade ago, taking no action despite warnings from a former Auscript manager. Years later, the offshoring recurred, leading to a breach that forced the successor company into liquidation.

Concerns about Australian court data being accessed in India were raised more than a decade ago, but the court deemed the matter a minor breach and took no further action, according to newly surfaced emails.

In December 2014, Paul Cutbush, then national manager at Auscript, the company responsible for transcription services for the federal courts, alerted both the courts and the Australian Federal Police (AFP) that data was being offshored without court authorisation. The family court later described Auscript's failure to notify the court as a "technical, minor and inconsequential breach" that did not warrant significant action.

Mr Cutbush told the ABC he had concerns when he discovered court managers had not been advised of the offshoring plan and that the quality of transcripts produced in India was poor. He said he strongly suggested the Auscript CEO contact the court for authorisation, but the court did not respond to his public interest disclosures (PIDs) for two years.

Earlier this year, VIQ Solutions, which had taken over from Auscript, breached its Commonwealth contract by allowing highly sensitive court files to be accessed in India. Shortly after the ABC reported the breach, VIQ went into liquidation and shut down following calls for a forensic audit and concerns about potential national security risks.

Mr Cutbush said the latest breach was a "slap in the face" after his earlier warnings were ignored. " If they had taken action ten years ago … then the mess and the disaster that has unravelled now … might not have happened," he said.

§

Analysis

Why This Matters

  • Reveals a pattern of inaction by the family court that allowed sensitive data to be repeatedly sent offshore without authorisation.
  • Raises questions about the court's oversight of contractors handling highly confidential legal transcripts.
  • The eventual breach led to the collapse of a Commonwealth contractor and sparked national security concerns.

Background

Auscript was contracted to provide transcription services for the family court and Federal Court. In 2014, Mr Cutbush raised internal concerns about its plan to send data to India without court permission. He later made public interest disclosures to the courts and the AFP. The court responded only years later, describing the breach as minor. In 2026, successor contractor VIQ Solutions was found to have similarly allowed Indian access to court files, leading to its liquidation.

Key Perspectives

Paul Cutbush, former Auscript national manager: He believes the court's failure to act on his 2014 warnings directly enabled the more serious breach in 2026. He describes the outcome as a preventable disaster. The family court (2014 position): At the time, the court viewed Auscript's conduct as a minor, technical breach that did not warrant action, indicating it saw no systemic risk. Critcs and security experts: The repeated offshoring without authorisation suggests weak contracting oversight and insufficient penalties for non-compliance. The potential access to sensitive court data by foreign actors raises ongoing concerns about national security.

What to Watch

  • Any parliamentary or government response, such as an inquiry into court contractor oversight.
  • Whether further breaches or security incidents emerge from VIQ Solutions' operations before its liquidation.
  • Possible legal or regulatory changes to require mandatory notification of data offshoring by court contractors.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe