Census 2016: Online attack poses problems for Malcolm Turnbull, his ministers and the ABS

The Australian Bureau of Statistics website last night which became the subject of denial of service attacks.

The Census has become a test of basic government competence. At this stage, Malcolm Turnbull and his ministers are failing badly.

After years of planning, the project is crumbling under the weight of concerns over privacy, fears about security and now the alarm over foreign attacks on the Census website.

The Australian Bureau of Statistics has been too complacent about building community support for this huge and necessary stocktake of the nation. Worse, the responsible ministers were invisible until it was too late to settle the worries over personal privacy.

Yet there is only so much the ABS and its staff can do in the face of a denial of service attack from unknown sources abroad. The criticism of the ABS needs to be kept in check. Some DDoS (denial of service) attacks are almost impossible to prevent. The real test for the ABS and its ministers is how they respond from now on.

Public trust in the ABS is being strained and the agency’s own statements are not helping. ABS chief David Kalisch took until Wednesday morning to explain why he had taken down the Census site — which meant Australians were left in the dark on Tuesday night when they had been asked to set aside time to fill in the online form.

The ABS may come to regret the lack of clarity about the nature of the attacks on its site. Some of the media reports have called this a “hack” of the ABS but the actual attack appears to have been a DDoS attack instead — something that stops a long way short of hacking into a system.

In other words, the attackers may have blocked access to the ABS site rather than ram-raided the store and stolen anything from inside.

Six years ago, online activists from Anonymous launched DDoS attacks on several government sites to protest against Labor’s proposal for an internet filter to curb the trade in child pornography and other material. Back then, security expert Alastair MacGibbon likened the attacks to “parking a truck across the driveway of a shopping centre”. MacGibbon is now the special adviser to the Prime Minister on cyber security.

The ABS needs to be as open as possible with Australians about the nature of these new attacks. Fortunately it is assuring people that no data was lost and their personal privacy is safe. Even so, throwing around phrases like “foreign hackers” will not help. To some people it sounds like the ABS is trying to find someone to blame. To others it undermines confidence in the ABS’s ability to protect personal information.

Even so, the online lynch mob now lined up against the ABS is a sight to behold. Australians do not normally blame shop owners who are the victims of an attack. Should we blame the ABS for an internet attack that would be incredibly hard to stop? This is not a movie: there is only so much the ABS staff could have done as they tried to deal with a DDoS attack in real time.

Senate estimates hearings are certain to probe every aspect of this affair, which means the ABS will be held to account over the way it responded.

Online voting, always a risky prospect, is certainly dead after this affair. If the privacy worries were not enough, the prospect of a DDoS attack on a federal election makes online voting a reckless idea at this point.

Mission creep is a key part of the problem here. The ABS used to keep the personal information for 18 months but has pressed to change that to four years for this year’s Census. Government agencies cannot help themselves from wanting more. The ABS seemed stung that some Australians pushed back.

Ministers cannot expect to get off lightly, either. It takes years to prepare for the Census yet the Turnbull government did very little to prepare the ground.

The assistant minister given responsibility for the Census last September, Alex Hawke, did little before the election to build up support for the project or deal with the concerns over privacy. He was shifted to border protection in the post-election reshuffle.

The new minister responsible, Michael McCormack, has only had a few weeks to get across the issues. Why did Turnbull chop and change ministers with the Census imminent? McCormack’s

approach to the privacy concerns has been to fob them off. His office had nothing to say on Tuesday night even as the Census website failed and Australians justifiably asked for an explanation.

Turnbull promised stability and strong management when he went to the July 2 election. The Census is a serious test of that rhetoric but the Prime Minister did not seem engaged yesterday, limiting his public support to a single tweet.

Now it is time he and his ministers took control.

We filled in the @ABSCensus tonight online - v easy to do. And so important for planning better Govt services & investment for the future

— Malcolm Turnbull (@TurnbullMalcolm) August 9, 2016