Christopher John Duff, 40, has pleaded not guilty to four counts of accessing restricted data held in a computer after the Department of Communities and Justice discovered a data breach in March last year. Police allege between January and March 2025, 8,769 restricted documents were accessed without authorisation from the department's online registry website.
A three-day hearing at Downing Centre Local Court this week stalled after the judge was told of the extraordinary volume of material involved. Defence counsel Daniel McMahon estimated there were some 10,000 or more pages of proposed exhibit material, raising doubts about whether the hearing could be completed even if a week was allocated.
Prosecutors will seek to rely on ChatGPT conversations and forensic expert testimony. According to police prosecutor Sergeant Andrew Maldigri, the crux of the allegation is that Mr Duff used ChatGPT to code and employ 'scraper' Python scripts designed to bulk download data.
"It's a piece of code that a user can run against a website to essentially circumvent the usual navigation process," Sergeant Maldigri told Judge Lisa Graham. "It means a user has used computer coding to obtain data that they weren't authorised to. That's, in a nutshell, what this matter is about."
He compared the alleged conduct to "throwing out a fishing net in the ocean, drawing it back in, and then hauling up the catch onto the deck to see whether any of the catch that he pulled up from the ocean was what he was after."
The court heard Mr Duff was assisting a friend involved in complicated bankruptcy proceedings. Defence counsel Mr McMahon described the prosecution's task as "prodigious" and said it would be a difficult case to present. He argued the offence requires proof that the accused knew at the time any access he was causing was unauthorised, as opposed to being reckless. "Recklessness is insufficient. They have to prove actual knowledge and nothing less than actual knowledge," he said.
Mr McMahon indicated there may not be a general dispute that his client was responsible for some of the alleged conduct.