Australia’s visa program contracted to China state-linked company

The Canadian and New Zealand government arrangements have raised questions about the security of biometric data and the potential for Chinese authorities to be alerted to residents attempting to leave the country over concerns for their safety.

Those fears have been heightened by Australia’s deteriorating relationship with China, the detention of dual citizens who have been critical of the government, a crackdown on ethnic groups including the Uighurs, and new national security laws in Hong Kong which have seen dozens of activists arrested on subversion charges.

Loading

The Home Affairs review found no issues with the local subcontractor, despite its ties to the Chinese government, and reported that the checks and balances in place had ensured no data had been compromised.

“The [company] does not have access to visa application data or personal information of visa applicants provided to VFS in China in support of Australian visa applications,” a Home Affairs spokesperson said.

Beijing Dongfang Tianxiao company is part-owned by the CITC Group, China’s largest state-owned investment company. It performs a data entry role in Australian visa application centres in China. The Home Affairs review found the company has no ability to transmit data out of the application centre.

VFS’ chief communications officer Peter Brun said that virtually all foreign companies in China operate with locally owned or state-owned facility management companies. He said the local companies provide office space and administrative staff.

“Their owners or investors have absolutely no access to any data at these visa application centres and no IT infrastructure access,” he said. “VFS Global does not have any servers in China, where applicant data is stored.”

Brun said applicants’ data was transferred via a fully encrypted private network tunnel managed by VFS Global. This data is then transferred to respective client government servers.

“VFS Global welcomes this scrutiny,” Brun said. “It is essential that client governments and visa applicants have full confidence in the integrity and security of their government’s programs and services.“

The former director of the Canadian Security Intelligence Service, Ward Elcock, told the Globe and Mail in February that using companies connected to China’s security forces or its governments “represents a lazy abdication of our standards to those of a police state”.

Loading

Dominic Tse, the pastor of North York Chinese Community Church, said Chinese applications should be brought back within the department.

“We’re handling sensitive personal data that could mean life and death for people,” he told Canada’s Standing Committee on Citizenship and Immigration. “We must bring it back home.”

In Hong Kong, VFS runs its operations through private subcontractor Glory Visa Consulting.

Jane Poon, who left Hong Kong in 2017 and now runs the Victorian Hongkonger association, said the relationship between VFS and state-owned enterprises in the mainland had raised concerns about information being processed by the Chinese government.

“But there is no other choice if this is the only way to apply,” she said.

Abul Rizvi, the former deputy secretary of the Department of Immigration who dealt with VFS when it was processing paper-based applications a decade ago, said: “VFS would be taking a big risk if it starts using that data in a nefarious way.”

“Unless the subcontracting agency is itself involved in some sort of fraud then I don’t see it as an issue, but the risk is always there.”

He said the company was used to expand Australia’s ability to attract visitors from China, allowing the government to process more applications than could have been handled by traditional consular services.

“Prior to COVID-19, China was our biggest tourist market,” he said. “As long as the decision-making is retained entirely within the department I don’t see a problem.”

The Department of Home Affairs scrapped a $1 billion overhaul of Australia’s internal visa processing system in March last year over procurement risk and data security concerns. Two consortium bids from Accenture and Australia Post, and a separate pitch from Ellerston Capital, PwC, Qantas, National Australia Bank and Pacific Blue Capital were rejected.