Sydney court data breach case tests use of AI conversations as evidence

A Sydney man accused of accessing thousands of restricted documents on a New South Wales court website will face a longer hearing after prosecutors outlined a case involving computer scripts, generative artificial intelligence and conversations with ChatGPT.

Christopher John Duff, 40, has pleaded not guilty to four counts of accessing restricted data held in a computer. The charges followed the Department of Communities and Justice’s discovery of a breach affecting the NSW Online Registry in March 2025.

Police have previously alleged that 8,769 restricted documents were accessed without authorisation between January and March 2025. The allegations have not been proven, and Mr Duff remains on bail.

Prosecution alleges scripts enabled bulk downloads

The Downing Centre Local Court heard that the prosecution case centres on Mr Duff’s alleged use of Python “scraper” scripts to collect information from the registry in bulk. The online service ordinarily requires users to log in and navigate individual records.

Police prosecutor Sergeant Andrew Maldigri told the court the scripts were allegedly designed to bypass the usual navigation process and obtain data the user was not authorised to access. He compared the method to casting a wide fishing net and then examining the catch for the material being sought.

The court heard that Mr Duff had been helping a friend involved in complex bankruptcy proceedings. Defence counsel Daniel McMahon said there might not be a broad dispute that his client was responsible for some of the alleged conduct. However, he said the relevant offences require the prosecution to prove that Mr Duff knew the access was unauthorised at the time, rather than merely being reckless.

That distinction is expected to be central to the case. The defence described the prosecution’s evidentiary task as substantial and difficult, while the court was told the proposed exhibits may run to 10,000 pages or more.

ChatGPT conversations may become key evidence

Prosecutors allege Mr Duff used ChatGPT both to help create the scraper code and, later, to seek information about his legal position. Sergeant Maldigri said the Crown intended to rely on conversations with the AI system as evidence of the alleged conduct and motive.

The court heard that, after Mr Duff’s registry login had been disabled, he allegedly asked ChatGPT what police might do and sought guidance about how to respond if approached. Prosecutors said he subsequently declined to answer questions during a police interview.

Mr McMahon offered a different interpretation of the exchanges. He argued that the tenor of the questions, if they were asked by his client, could indicate a realisation after the event rather than prior knowledge that the conduct was unlawful. The defence referred to questions about whether authorities considered the activity a crime and whether the access had been unauthorised.

Case raises new questions about AI evidence

The prosecution has described the matter as potentially one of the first Australian cases in which generative AI records are used both to explain how alleged offending occurred and to help establish a person’s state of mind.

Courts routinely consider digital evidence such as search histories, messages and device records. AI conversations add a newer layer because they may include technical prompts, generated code and questions about consequences, all of which must be placed in context and connected to a particular user.

The hearing had originally been allocated three days but stalled because of the volume and complexity of the evidence. Lawyers expressed doubt that even a week would be enough to complete it.

The matter was adjourned for two weeks while arrangements for a longer hearing are considered. Mr Duff’s bail conditions, imposed in April 2025, include surrendering his passport and possessing only a basic phone capable of calls and text messages.

Source: Proceedings reported from the Downing Centre Local Court by ABC News.

Leave a Reply

Your email address will not be published. Required fields are marked *