Key Takeaways

  • Australian federal courts were warned in December 2014 that Auscript had allowed court-transcription data to be accessed from India without prior approval.
  • Later allegations involving VIQ Solutions and e24 Technologies indicate that supplier oversight problems may have extended beyond a single contractor.
  • Contractual restrictions alone offer limited protection without audit trails, subcontractor controls, and technical enforcement.

Newly revealed correspondence has renewed scrutiny of how Australian federal courts supervised companies entrusted with sensitive recordings and transcripts.

An ABC News investigation reports that court officials were alerted in December 2014 that Auscript had accessed court-transcription data from India without obtaining prior approval. The Family Court subsequently described the failure to disclose the offshore work as "technical, minor and inconsequential" and took no significant action.

Auscript reportedly characterized the India operation as a controlled pilot that ran for about seven months. According to the reporting, audio was encrypted while being transferred and deleted within 48 hours. The pilot was ultimately discontinued because the resulting transcripts did not meet quality requirements.

Those safeguards matter, but they do not resolve the central governance issue. Auscript's contract required approval before information could be transferred outside Australia or accessed overseas. If a supplier proceeds without that approval, encryption and deletion schedules do not cure the underlying control failure.

Data residency is not simply a question of where a server sits. Remote access from another jurisdiction can create many of the same legal, security, and oversight concerns as physically moving the files. Courts handle material involving family disputes, criminal allegations, witnesses, and other highly sensitive matters. Even temporary access can therefore carry substantial consequences.

The historical disclosures have gained added weight following separate ABC News reporting that VIQ Solutions allegedly allowed employees of Chennai-based e24 Technologies to access thousands of sensitive court files from India. The reported access allegedly breached Commonwealth contractual and legal obligations.

Together, the Auscript and VIQ Solutions episodes suggest a broader weakness in outsourced transcription governance. A procurement team may contract with one supplier, but the actual work can pass through subcontractors, offshore personnel, and remote technology environments. Who verifies that the approved delivery model matches what happens operationally?

Current Federal Circuit and Family Court leadership said it was unaware of the historical correspondence until ABC inquiries. It has also stated that offshore access to transcript data is now prohibited. That is a clearer boundary, although enforcement will depend on more than written instructions.

The Office of the Australian Information Commissioner identifies the Privacy Act 1988 as a central part of Australia's privacy framework. For agencies and contractors handling court information, privacy obligations sit alongside contractual clauses covering data residency, access permissions, incident reporting, and subcontractor approval.

Security guidance also provides an important operational layer. The Australian Government's Information Security Manual, maintained by the Australian Signals Directorate, sets out controls for protecting government systems and information. Applying those controls to outsourced transcription can include identity management, access logging, data classification, secure transfer processes, and monitoring of privileged activity.

That said, compliance checklists can create false comfort. Supplier attestations are useful, but independent evidence is stronger. Agencies can require logs showing where users connected from, records of every subcontractor with access, proof that data was deleted when promised, and alerts when geographic restrictions are breached.

Procurement contracts can also reserve audit rights and require approval whenever delivery arrangements change. Those provisions work better when paired with technical controls, such as location-aware access policies and tightly limited user privileges. Otherwise, a prohibition may be discovered only after a whistleblower raises concerns or a journalist finds old correspondence.

The renewed scrutiny is therefore about more than a seven-month Auscript pilot. It raises a practical question for courts and other public bodies: can they demonstrate, rather than merely assume, where sensitive information is being accessed? For organizations relying on external providers, the lesson is fairly blunt. Trust in a supplier should be supported by verifiable controls, durable records, and escalation procedures that treat unauthorized offshore access as a governance event, not a minor administrative detail.