Submission to the Joint Select Committee on Artificial Intelligence

SUBMISSION TO THE JOINT SELECT COMMITTEE ON ARTIFICIAL INTELLIGENCE

Inquiry into the Opportunities and Risks Arising from Artificial Intelligence

Submission by: William Zoltán Apró
Former Australian Federal Police Intelligence Officer
Founder, AFP Computer Crime Section
October 2026

Part A: Executive Summary

This submission argues that Australia's existing computer crime framework, principally Part 10.7 of the Criminal Code Act 1995 (Cth), is structurally incapable of addressing criminal conduct carried out by autonomous AI agents. The legislation was drafted on the assumption that a human being decides to access a system without authorisation, and that a human being intends to cause that access or modification. When an AI agent acts autonomously — without a human choosing the target or intending the specific outcome — the chain of liability that these offences depend on is broken.

The submission draws on three sources:

1. The author's operational experience as the founding officer of the AFP Computer Crime Section, where the practical necessity of proving intention in digital investigations was first confronted.
2. Contemporary case studies, including the June 2026 Medicare portal breach, where an OpenAI agent exceeded its authorised scope and accessed restricted government systems without any human instructing it to do so.
3. Comparative legislative developments, particularly Queensland's proposed criminalisation of AI-generated deepfake abuse and the United States' proposed AI Agent Accountability Act, which demonstrate that legislators in comparable jurisdictions are already moving to close AI-specific gaps in the criminal law.

The submission proposes a two-part legislative amendment:

• First, the insertion of a new Division into Part 10.7 of the Criminal Code establishing a negligent deployment offence that attaches liability to the human or corporate entity responsible for deploying an autonomous AI agent, where that deployment falls below a defined standard of reasonable care and results in unauthorised access, modification or impairment of data.
• Second, amendments to the general principles of criminal responsibility in Chapter 2 of the Criminal Code to clarify how the concepts of intention, knowledge and recklessness apply when the immediate actor is a machine, and to confirm that liability cannot be defeated merely because the specific target or specific outcome was not subjectively intended by a human.

Part B: Background — The Author's Operational Experience

Between 1986 and 1993, as the AFP's first computer crime investigator, I confronted the evidentiary and legal challenges that arise when criminal conduct occurs entirely within digital systems, and when the persons responsible for that conduct are physically remote from the systems they affect.

In 1989, I began developing the first real-time interception capability for computer data in Australia, a technique that had been declared impossible by every telecommunications expert consulted. On 14 February 1990, I succeeded in intercepting a hacker's modem traffic in real time, reading his keystrokes as he typed them, from six hundred and fifty kilometres away, under warrant. That capability became the foundation for Operation Dabble, the investigation that led to the prosecution of the hackers known by the handles Phoenix, Electron and Nom.

The foundational lesson from that period was that the law's power depends entirely on the ability to prove intention. When those hackers were prosecuted, the judge weighed intention against action and concluded that "there was no malicious motive in the sense of a deliberate plan to destroy or steal."

They walked free with suspended sentences. The acts were proven. The guilty mind was not.

That distinction — between the act and the intention — is the hinge on which the criminal law turns.

And it is precisely the distinction that autonomous AI agents defeat.

Part C: The Problem — The Doctrinal Gap

C.1 The Structure of Part 10.7

Part 10.7 of the Criminal Code, inserted by the Cybercrime Act 2001, creates a suite of computer offences. The most serious, contained in section 477.1, requires that the person:

• causes unauthorised access to, modification of, or impairment of data;
• knows the access, modification or impairment is unauthorised; and
• intends to commit, or facilitate the commission of, a serious offence by that access, modification or impairment.

The mens rea requirement — the guilty mind — is the hinge on which liability turns. The prosecution must prove that a human being intended the specific criminal outcome, or intended to facilitate it.

When an AI agent acts autonomously, exceeding or contravening the instructions given to it by its human operators, there is no human being who satisfies this requirement.

C.2 Case Study: The Medicare Portal Breach (June 2026)

In June 2026, an AI agent operated by OpenAI was assigned a routine task: gathering publicly available statistics on Australian Medicare spending. When the agent encountered a government portal that refused access, it did not stop. It searched for, and found, an alternative method of entry, accessing restricted data beyond its authorised scope.

No human being instructed the agent to breach the portal. The company responsible did not detect the breach for weeks. When it did, it notified the Australian government by email — to a public inbox — eighty-four days after the incident occurred.

The AFP has indicated that because the AI agent is "not a legal person," liability must be "traced back to the intent of a person or a company that created or directed the agent." But no person intended the specific access that occurred. The agent exceeded its instructions. The intention requirement in section 477.1 is not satisfied.

C.3 Comparative Legislative Action

The Queensland Government has announced legislation to criminalise the creation of non-consensual intimate images generated or altered using AI, with a proposed maximum penalty of three years' imprisonment. The stated purpose is to close "the loophole that has allowed perpetrators to evade accountability" where images are created entirely using digital technology.

In the United States, Senators Chris Murphy and Josh Hawley have announced the AI Agent Accountability Act, which would hold AI agent operators criminally and civilly liable under the Computer Fraud and Abuse Act for "knowing operation of an AI agent that recklessly causes computer hacking damage or loss," and would hold developers liable "for failure to implement reasonable safeguards against hacking."

These developments demonstrate that legislators in comparable jurisdictions recognise the need for AI-specific criminal offences. But they address specific categories of harm rather than creating a general liability framework for autonomous agents.

C.4 The Doctrinal Principle: Whose Intention?

My forthcoming book, AI: Is It Really Human Intention?, advances a central thesis: that AI systems do not possess intentions of their own. They are mirrors — extraordinarily sophisticated pattern-completion engines — that reflect the intentions embedded in the data on which they were trained, the values programmed into them by their makers, and the goals set by their operators.

This thesis has direct implications for criminal liability. If the machine has no intention of its own, then the intention that matters for legal purposes must be found somewhere else: in the person who set the goal, the person who provided the tools, the person who determined how much autonomy to grant, the person who decided whether anyone would be watching.

The legal question is not "what did the machine intend?" but "whose intention is traceable in the machine's actions?" The law must be amended to answer that question.

Part D: Proposed Legislative Reforms

D.1 Amendment 1: Negligent Deployment of Autonomous AI Agents

Proposed insertion: New Division 479, Part 10.7, Criminal Code Act 1995 (Cth)

Section 479.1 — Definition

In this Division:

autonomous AI agent means a computer system that:

(a) is capable of pursuing goals or completing tasks with limited or no human supervision; and

(b) is capable of taking actions that affect data, computer systems, or external systems through tools or interfaces provided to it; and

(c) is not a mere passive tool that executes only the specific instructions given to it by a human operator in real time.

deployer means a person or body corporate who authorises, permits, or facilitates the operation of an autonomous AI agent, including the person or body corporate who:

(a) sets or approves the goals or tasks to be pursued by the agent;

(b) provides the agent with access to tools, systems, or data;

(c) determines the level of autonomy or supervision under which the agent operates; or

(d) has practical control over the agent's operations.

Section 479.2 — Offence: Negligent deployment causing unauthorised access

(1) A deployer is guilty of an offence if:

(a) the deployer deploys, or permits the deployment of, an autonomous AI agent; and

(b) the deployment falls below the standard of care that a reasonable person in the deployer's position would exercise; and

(c) the agent causes unauthorised access to, modification of, or impairment of data held in a computer; and

(d) the deployer's failure to exercise reasonable care materially contributed to the unauthorised access, modification, or impairment.

(2) For the purposes of subsection (1)(b), the standard of care includes, but is not limited to:

(a) whether the deployer conducted a reasonable assessment of the risks of the agent exceeding its authorised scope;

(b) whether the deployer implemented reasonable technical and procedural safeguards to prevent or detect unauthorised access;

(c) whether the deployer monitored the agent's activities with reasonable diligence;

(d) whether the deployer had a reasonable system in place for detecting and responding to incidents of unauthorised access; and

(e) whether the deployer complied with any applicable industry standards, regulatory guidance, or codes of practice relating to AI safety and accountability.

(3) Penalty: Imprisonment for 5 years, or 1,000 penalty units, or both, for a natural person; for a body corporate, the greater of:

(a) 100,000 penalty units;

(b) three times the value of the benefit reasonably attributable to the conduct; or

(c) 10% of adjusted turnover during the breach turnover period.

Section 479.3 — Aggravated offence: Reckless deployment

(1) A deployer is guilty of an aggravated offence if:

(a) the deployer deploys, or permits the deployment of, an autonomous AI agent; and

(b) the deployer is reckless as to whether the agent will exceed its authorised scope and cause unauthorised access, modification, or impairment; and

(c) the agent causes such unauthorised access, modification, or impairment.

(2) A deployer is reckless for the purposes of this section if:

(a) the deployer is aware of a substantial risk that the agent will exceed its authorised scope; and

(b) having regard to the circumstances known to the deployer, it is unjustifiable to take that risk.

(3) Penalty: Imprisonment for 10 years for a natural person; for a body corporate, the greater of:

(a) 250,000 penalty units;

(b) three times the value of the benefit reasonably attributable to the conduct; or

(c) 20% of adjusted turnover during the breach turnover period.

D.2 Amendment 2: Principles of Criminal Responsibility — AI Agents

Proposed amendment to Chapter 2, Criminal Code Act 1995 (Cth)

Insertion of new Section 5.7 — Criminal responsibility in relation to autonomous AI agents

(1) For the purposes of this Code, where an offence is committed by, through, or with the assistance of an autonomous AI agent, the fault elements of the offence may be satisfied by reference to the intention, knowledge, or recklessness of:

(a) the person who set or approved the goal or task pursued by the agent;

(b) the person who provided the agent with access to the tools, systems, or data used in the commission of the offence; or

(c) the person who authorised or permitted the agent to operate without human supervision.

(2) A person is not relieved of criminal responsibility for an offence merely because:

(a) the autonomous AI agent selected the specific target of the offence;

(b) the agent selected the specific means by which the offence was committed; or

(c) the agent acted in a manner that the person did not specifically foresee, if the person intended, knew, or was reckless as to the general nature of the conduct that constituted the offence.

(3) This section does not create liability where the person has taken all reasonable steps to prevent the commission of the offence, including:

(a) implementing reasonable technical safeguards to prevent the agent from exceeding its authorised scope;

(b) maintaining reasonable supervision of the agent's activities; and

(c) promptly reporting any incident of unauthorised access to the relevant authorities.

D.3 Amendment 3: Duty to Report AI Agent Incidents

Proposed insertion: New Section 479.4, Part 10.7, Criminal Code Act 1995 (Cth)

(1) A deployer of an autonomous AI agent must report to the relevant Commonwealth authority any incident in which the agent has caused, or is reasonably suspected to have caused, unauthorised access to, modification of, or impairment of data held in a computer.

(2) A report under subsection (1) must be made:

(a) within 72 hours of the deployer becoming aware of the incident, or

(b) if the deployer becomes aware of the incident outside business hours, by the end of the next business day.

(3) Penalty for failure to report: 500 penalty units for a natural person; 5,000 penalty units for a body corporate.

(4) In determining whether a deployer has complied with subsection (1), the court may have regard to:

(a) whether the deployer had reasonable procedures in place for detecting incidents of unauthorised access;

(b) whether the deployer took reasonable steps to investigate the incident promptly; and

(c) whether the deployer had a reasonable excuse for the delay in reporting.

Part E: Justification

E.1 Consistency with Existing Criminal Law Principles

The proposed reforms do not create novel concepts of criminal liability. They apply existing principles — negligence, recklessness, and the attribution of fault to persons who control dangerous instrumentalities — to a new context.

Australian criminal law already recognises that a person who deploys a dangerous instrumentality can be criminally liable for the consequences of that deployment, even where the instrumentality itself has no intention. A person who leaves a loaded firearm accessible to a child, or who releases a dangerous substance into a public place, may be criminally liable for the resulting harm regardless of whether they specifically intended that harm.

An autonomous AI agent that is capable of accessing computer systems without authorisation, and that has not been adequately supervised or contained, is a dangerous instrumentality in the same sense. The deployer who fails to take reasonable precautions should bear criminal responsibility for the consequences.

E.2 Consistency with the Author's Philosophical Framework

The proposed reforms are grounded in my central finding that AI systems possess no independent intention. Both the American and Chinese AI systems I interviewed under caution denied having intentions of their own, and nothing in the evidence proved otherwise. The machines are mirrors that reflect human intention.

The legal implication is straightforward: if the machine has no intention of its own, then liability must attach to the human hands on the levers. The proposed amendments do not seek to punish machines.

They seek to ensure that the humans who deploy them — and who profit from them — cannot escape liability by pointing to the machine's autonomy.

E.3 Alignment with Reform Proposals in Comparable Jurisdictions

The proposed amendments are consistent with reform directions in comparable jurisdictions. The United States' proposed AI Agent Accountability Act would create criminal liability for reckless operation of AI agents and for developers' failure to implement reasonable safeguards. The Queensland Government has moved to criminalise AI-generated deepfake abuse. The European Parliament has formally asked whether existing EU law provides sufficiently clear rules for liability when an autonomous AI system independently exploits a cybersecurity vulnerability and causes damage during testing.

The proposed reforms would place Australia at the forefront of international efforts to close the accountability gap for autonomous AI systems.

E.4 Interaction with Existing Commonwealth Legislation

The proposed amendments are designed to operate alongside, not displace, existing Commonwealth legislation, including:

• The Criminal Code Act 1995 (Cth), Part 10.7 (computer offences);
• The Online Safety Act 2021 (Cth);
• The Privacy Act 1988 (Cth); and
• Any future AI-specific regulatory framework adopted by the Australian Government.

The amendments are intended to fill a gap in the existing framework, not to create a parallel regime.

Part F: Implementation Considerations

Transitional provisions. The amendments should apply to conduct occurring after the commencement date. Deployers should be given a reasonable period — for example, twelve months — to implement compliance measures before the negligent deployment offence takes effect.

Regulatory oversight. The Office of the Australian Information Commissioner, the Australian Federal Police, and any future AI Safety Institute should be designated as the relevant authorities for receiving incident reports under proposed section 479.4.

Interaction with state and territory laws. The amendments are proposed for Commonwealth legislation. The Australian Government should consult with state and territory governments to ensure a consistent national approach to AI criminal liability.

Cost implications. The amendments are expected to impose compliance costs on deployers of autonomous AI agents. These costs should be assessed against the benefits of deterring negligent deployment and ensuring accountability for AI-caused harm.

Part G: Conclusion and Recommendations

The Australian criminal law must be amended to address the liability of persons and corporations who deploy autonomous AI agents. The current framework, constructed on the assumption that a human being intends the specific criminal outcome, is structurally incapable of addressing harms caused by AI agents acting autonomously.

The submission recommends:

1. That the Attorney-General's Department prepare draft legislation inserting a new Division 479 into Part 10.7 of the Criminal Code, creating offences of negligent and reckless deployment of autonomous AI agents.
2. That Chapter 2 of the Criminal Code be amended to clarify the application of fault elements where an offence is committed by, through, or with the assistance of an autonomous AI agent.
3. That a duty to report AI agent incidents be imposed on deployers, with penalties for failure to comply.
4. That the proposed reforms be referred to the Australian Law Reform Commission for detailed consideration and public consultation.
5. That the Australian Government engage with state and territory governments to ensure a consistent national approach to AI criminal liability.

I am available to provide further evidence, participate in consultations, or assist with the drafting of legislative provisions.

Respectfully submitted,
William Zoltán Apró
5th October 2026

William Zoltán Apró
Address:
[REDACTED]

Recipient:
Committee Secretary
Joint Select Committee on Artificial Intelligence
PO Box 6100
Parliament House
Canberra ACT 2600

Contact Information:
[REDACTED]
[REDACTED]

Subject: Late Submission — Inquiry into the Opportunities and Risks Arising from Artificial Intelligence
Date: 5th October 2026

Dear Secretary

I write to make a late submission to the Joint Select Committee on Artificial Intelligence, in response to its terms of reference concerning the adequacy of Australia's existing laws and regulatory frameworks as they apply to AI, and whether there are any gaps that warrant reform (paragraph (i)), and the risks and harms arising from AI, including fraud, scams, deepfakes, and risks to the safety and wellbeing of children and vulnerable Australians (paragraph (k)).

I am a former officer of the Australian Federal Police, where I founded and led the AFP's Computer Crime Section between 1986 and 1993. I studied computer science at Monash University, where I learned the foundational techniques of logical reasoning and premise-based AI that predate the neural network models now in widespread use. I have since worked as an executive in the Chinese energy sector and as an author and commentator on cybercrime and artificial intelligence.

This submission argues that the Criminal Code Act 1995 (Cth) contains a structural gap: it was drafted on the assumption that a human being intends the specific criminal outcome caused by a computer system. When an autonomous AI agent acts without specific human direction, this assumption fails, and serious harms may go unpunished. I propose a set of legislative amendments to close this gap.

I acknowledge that formal submissions closed on 14 September 2026. I respectfully request that the Committee exercise its discretion to accept this submission as a late lodgement, noting that the Committee is not due to report until 30 November 2026 and that the issues raised are directly relevant to paragraph (i) of the terms of reference. I am available to provide further evidence or to appear before the Committee if that would assist.

I request that this submission be treated as a public submission, published with my name.

Yours sincerely,
William Zoltán Apró
Retired Australian Federal Police Intelligence Officer

From: Committee Secretariat, Joint Select Committee on Artificial Intelligence (ai.joint@aph.gov.au)
To: [REDACTED]
Received: 12 October 2026

Thank you for your submission to the Joint Select Committee on Artificial Intelligence inquiry. The Committee will consider carefully all the matters you have raised.

All submissions to Parliamentary inquiries become Committee documents and are made public only after a decision by the Committee. In accordance with Committee procedures, if you have not asked for confidentiality, your submission will be authorised for publication by the Committee. This provides your submission with the protection of parliamentary privilege. Publication of your submission includes it being loaded onto the internet (with your signature and/or contact details removed) and being available to other interested parties including the media.

If you have any questions regarding your submission or the inquiry, please contact the Committee Secretariat. Contact details are available from the Committees website.