Sydney man charged in NSW courts data breach case involving AI-generated scraper code

A Sydney man charged over a massive data breach involving a NSW courts website allegedly used generative AI to create "scraper" computer code for bulk downloading before asking ChatGPT for legal advice, a court has heard.

Prosecutors will seek to rely on ChatGPT conversations and forensic expert testimony in the case against Christopher John Duff, 40, which is believed to be one of the first of its kind in Australia.

Mr Duff has pleaded not guilty to four counts of accessing restricted data held in a computer which were laid after the Department of Communities and Justice discovered a data breach in March last year.

Police previously said cybercrime detectives investigated the alleged unauthorised access of 8,769 restricted documents held by the department's online registry website between January and March 2025.

A three-day hearing in Downing Centre Local Court this week stalled after the judge was told of the extraordinary volume of material involved in the matter.

Lawyers have expressed doubt about the hearing being completed, even if a week was allocated.

Defence counsel Daniel McMahon gave a rough estimate that there were some 10,000 or more pages of proposed exhibit material.

On Wednesday, he told the judge that there may not be a dispute, in general terms, that his client was responsible for some of the alleged conduct.

The case centres on the use of the online registry, which court users can access with a login.

The court heard Mr Duff was assisting a friend involved in complicated bankruptcy proceedings.

According to police prosecutor Sergeant Andrew Maldigri, the crux of the allegation is that Mr Duff used ChatGPT to code and employ scraper python scripts designed to bulk download data.

"It's a piece of code that a user can run against a website to essentially circumvent the usual navigation process," he told Judge Lisa Graham.

"It means a user has used computer coding to obtain data that they weren't authorised to. That's, in a nutshell, what this matter is about."

"If I can use this analogy: it's our case the defendant was throwing out a fishing net in the ocean, drawing it back in, and then hauling up the catch onto the deck to see whether any of the catch that he pulled up from the ocean was what he was after."

Mr McMahon described the prosecution's task as "prodigious" and said it would be a difficult case to present.

He said the offence requires proof that the accused knew at the time that any access he was causing was unauthorised, as opposed to being reckless.

AI evidence marks possible Australian-first

Sergeant Maldigri said the case would raise an issue that he believed was yet to be canvassed in courts in Australia — generative AI being used by the prosecution to prove motive and as evidence of the alleged offending itself.

He cited some examples from legal cases in the US, including proceedings in New York where a man facing fraud charges unsuccessfully objected to the use of AI assistant Claude records in the case.

The prosecutor said Mr Duff had allegedly sought legal advice from ChatGPT prior to being charged at a point when his login for the website had been shut down, and made enquiries about what police would be doing in the situation.

Mr Duff also sought "coaching" from the platform in relation to what to say if he was approached and ultimately refused to answer questions in a police interview, Mr Maldigri added.

Mr McMahon said the tenor of the ChatGPT conversations, if they were asked by his client, was more suggestive of a post-fact "realisation".

He said the queries included asking whether authorities knew if "it was even a crime yet?" And "was what was done unauthorised?"

The case was adjourned for a fortnight when a new, longer hearing may be scheduled.

Mr Duff was granted bail in April last year on conditions including surrendering his passport and possessing only one "dumb phone" with only call or text functions.