u/sam-at-aristotle_mdr

A software engineer and academic, who once worked as a public servant, warns Canberra’s mismanagement of Australia’s data is a “national scandal”.

Samuel Spencer tells 7NEWS Podcast The Issue that sensitive data on the Budget, Pharmaceutical Benefits Scheme and COMCAR (politicians’ travel) is being collected and stored on dated and inappropriate software, leaving it vulnerable to criminals and bad actors.

He is blowing the lid on what he believes are poor practises in the Australian Public Service.

“So before we even look at the cyber security risks, it’s the risks around errors, miscalculations, and even data being sent out the door.

“I think this is a national scandal.”

The Master Database – Special Appropriations is used to track created and abolished special appropriations, which includes more than a trillion dollars in federal government spending.

The Master Database – Special Accounts is used to track created and abolished special accounts including the portfolio responsible, sunset dates, investments, borrowing powers and purposes.

A spokesperson for the Department of Finance has told 7NEWS: “The Department of Finance does not use Excel to manage special accounts or special appropriations”.

“The referenced documents are internal, administrative documents, separate from the Central Budget Management System, which is the Australian Government’s authoritative system for appropriation management, budget development and management, and whole-of-government financial reporting.

“Access to internal documents and financial management systems is subject to established security controls and government security requirements, including role-based access controls, Multi-Factor Authentication, audit trails and compliance with the Protective Security Policy Framework and Information Security Manual.”

Deputy Prime Minister Richard Marles says he has “a high degree of confidence about the way we are managing our information”.

“Australians should have that confidence as well,” Marles told 7NEWS.

“In the Australian Signals Directorate we have one of the best agencies in the world.”

Similar concerns with management of health data and politicians’ travel records

Spencer also claims records show MPs and Senators travel is collected and stored on Excel spreadsheets.

The Government’s Dataplace website says the COMCAR Automated Resource System (CARS) is on MS Excel and saves all trip, vehicle and driver data.

“Anthony Albanese’s private taxi service for himself and every politician in Parliament House and around Australia is managed in a spreadsheet,” Spencer said.

“This isn’t asking for a deep technical attack, this is just asking the right person to send you a file and you would then know the travel locations of almost every parliamentarian.”

Similarly, Spencer is concerned that the Department of Health collects details about Pharmaceutical Benefits Scheme claims on an Excel spreadsheet.

The Department of Health, Disability and Ageing says it “publishes aggregate PBS claims data”, and that “these files do not contain patient-level records or any information that could identify individual patients, prescribers or pharmacies”.

Spencer also points out that the Prime Minister has had his phone number and bank details compromised in the last 12 months, and says that should push his Government to crackdown on the public service.

He also wants new national AI standards to include specific requirements for the federal government.

“He’s had his phone number leaked and he’s had his bank account details breached,” Spencer said.

“If he’s saying that he can protect Medicare, why doesn’t he start with trying to put in regulations that will protect himself? How’s he going to protect Medicare for us?”

[removed]

Everyone has a hot take on the difference between Data Management and Data Governance. I've also seen a few posts here asking what "Data Governance" is, so figured this might go well here.

One in three public-sector data professionals do not trust the data held within their own departments, a recent survey showed.

The survey of 133 public-sector data professionals between February and April 2026 suggested tools for tracking data assets, and more than half said departments did not document the reasons for collecting data.

---

As the person who ran this research (and an ex-public servant), do you agree with our findings? Do you think trust in data is higher, lower or were we about right?

One in three public-sector data professionals do not trust the data held within their own departments, a recent survey showed.

The survey of 111 public-sector data professionals between February and April 2026 suggested tools for tracking data assets, and more than half said departments did not document the reasons for collecting data.

Canberra-based Aristotle Metadata and public-sector platform Public Spectrum carried out the survey at the AusGov Data Summit, the annual collaborative forum for public sector data and technology leaders, held in April 2026.

The findings come amid several significant data management incidents in 2026, including an incident where 13 federal agencies engaged a transcription provider that shared sensitive court transcripts with unvetted offshore personnel in India.

Fewer than one-third of data professionals surveyed were familiar with their organisation's data governance policies and about half said they could not easily locate the data required for their duties.

The research also found 37 per cent of respondents didn't know their organisation was failing to give the true value of its data and 67 per cent said they could not easily find documentation describing what their organisation's data meant.

Aristotle Metadata owner Sam Spencer said the results showed a gap between high-level digital strategies and daily data management operations. He said without clear visibility into what data agencies held, it was difficult to ensure its protection.

"I stand by the fact that if somebody doesn't know what data they've got, they have no hope of protecting it. It's your social security data. It's not an abstract technical issue but 'how we know things get done', from public servants being paid correctly to patients receiving timely medical care," he said.

The federal government now relies on the Australian Government Data Catalogue, a centralised registry that contained more than 36,000 records drawn from various public databases for data governance.

An analysis of the registry by Aristotle Metadata showed that of those 36,000 entries, 99 per cent were duplicates from older platforms.

The data also showed that 505 unique assets had not been updated by nearly a dozen large agencies in more than two years.

To manage these records, the Office of the National Data Commissioner used a framework called ONDC26, which listed 26 metadata attributes.

Ten fields were designated as mandatory and 16 as optional, including fields describing the purpose of collection, who could use the data, who it was shared with and when it should be disposed of.

Although agencies were required by the Australian PSPF to use the fields, the Aristotle Metadata analysis showed agencies fell short on the 36 optional attributes – such as the underlying purpose of collection and data licensing rules – with even the largest four agencies, on-site across large agencies such as the education department and the Australian Taxation Office (ATO), showing four per cent completion rates for the optional fields.

A Finance department spokesperson said metadata in the Australian Government Data Catalogue had been published based on requirements for making data discoverable and accessible outside the agency that held the data.

"Mandatory fields are those which are most important for users requesting data, including security classification," the spokesperson said.

For Mr Spencer, treating these 36 optional fields as secondary overlooked their role in day-to-day security.

Classifying attributes like the purpose of data collection or licensing guidelines as optional left agencies without the baseline visibility needed to track how sensitive material was being handled, leaving it exposed to misuse and error, Mr Spencer said.

"There are seven areas about children in schools, not one of those records was written down who's allowed to use it, whether or not it's sensitive and when it's deleted," he said.

Mr Spencer said the ATO listed a single data asset in the catalogue. "Does that sound right to you?" he said.

A government spokesperson from Public Service Minister Katy Gallagher's office said that established data governance frameworks were in place and that accountable authorities were responsible for implementing them within their respective agencies.

The spokesperson said a biennial Data Maturity Assessment evaluated organisational capabilities and helped agencies identify capability priorities.

The inaugural 2024 assessment established an average public service data maturity rating of "developing", with a score of 2.02 out of five, identifying data quality, reference and metadata as the lowest-scoring focus areas.

Mr Spencer said advocating for improved data governance came with personal difficulties.

He had compiled the research and repeatedly taken it to the Office of the National Data Commissioner, ministers and chief data officers, but received little engagement in return.

"I have no budget, no mandate and now I have no friends, because I'm making people very annoyed about this, because I'm making a lot of noise," he said.

Mr Spencer said there was a tendency to invest in large international software products rather than the known work of foundational governance.

"We'll get squeezed over the smallest amount of money for infrastructure, but all of a sudden there's a blank chequebook for international big tech firms," he said. "It's like they're just going to fix anything with a flashy name."