Census 2016: Attack ‘not work of hackers’ says minister
Senator Nick Xenophon has panned the census debacle as a “monumental failure of government”.
Bill Shorten has demanded a moratorium on fines for anyone who doesn’t fill out the census as he lashed out at the Turnbull government’s “lackadaisical approach” to the 17th national survey on housing and population.
The Opposition Leader also urged the government to reconsider storing people’s names and addresses for 18 months — as had been practice at the previous two censuses — instead of four years, citing “legitimate” privacy concerns from the community.
He joined his assistant treasury spokesman Andrew Leigh in labelling the 2016 census the “worst-run” in Australian history after the Australian Bureau of Statistics was forced to shut down the site because of DDoS (distributed denial of service) attacks last night.
“It has taken us 100 years to build confidence in the census. It has taken Malcolm Turnbull one Tuesday night to see this bungle undermine confidence in government institutions,” Mr Shorten said.
“It is humiliating when the government asks millions of Australians to fill out the census and the government can’t even get that task right.
“Most importantly, we think that the Senate needs to inquire into how this has happened and how can we make sure this doesn’t happen again.
“Labor wants to see this census conducted properly but it is an indisputable fact that if the government can’t tell Australians what’s gone wrong and how it’s happened and how they are going to fix it, how can Australians trust this government?
“This is an incompetent exercise. If they were handing out gold medals at Rio for incompetence, this government would be on the winner’s podium absolutely.”
Independent Senator Nick Xenophon, who last week called for the Census to be delayed because of growing concerns about its roll-out, security and the readiness of the ABS, said the census was “a monumental failure of a government program of the first order’’.
“In response to my calls for a delay the Government and the ABS were dismissive of my concerns. They said everything was OK,’’ he said.
“It is now apparent that the Government and the ABS were a bit like the captain of the Titanic as he sailed into the ice pack — saying the Census was unsinkable. I note my concerns were also dismissed by the Labor Party.
“This is a monumental failure of a government program of the first order. It is a failure by the ABS, by the relevant minister, and the government. And it is a catastrophic failure of the government’s information security framework when a key government program is effectively shut down by overseas hackers.
“For the ABS, for the Government to say this is not a cyber-attack is a bit like Monty Python’s Black Knight saying he just copped a flesh wound.’’
Senator Xenophon said he would be moving for an urgent Senate inquiry into the episode as soon as the Senate sits.
“In the meantime, the Government needs to provide a much great level of assurance of the security of the Census than was provided in their press conference earlier today,’’ he said.
“If they cannot do so in the next 24 hours, they need to seriously consider putting the Census on hold until an urgent and rigorous Inquiry is conducted.’’
Your data is safe: PM
Malcolm Turnbull sought to assure Australians their census data was “safe” and had not been “compromised” but admitted that some of the Australian Bureau of Statistics “defences” had clearly “failed” last night.
He said the ABS’ decision to close down the census online site was “taken out of an abundance of caution”.
There has been no confirmation as to when the ABS site will be restored but Treasurer Scott Morrison, who stood alongside the PM at a press conference in Canberra this morning, said there would be an opportunity to complete the form online “in the not too distant future”.
“I want to say also that the site will be restored as soon as the Australian Signal Directorate and the ABS and IBM are satisfied that it can be restored with all of the necessary defences against denial of service and other attacks are in place,” the Prime Minister said.
“The public will be advised as soon as that is done.”
Mr Turnbull said there would be a “very thorough review” of the census, as there is after every national survey headed by the PM’s adviser on cyber security, Alastair MacGibbon, and supported by Treasury, the ABS and the Australian Signals Directorate.
Mr Morrison said he had received advice there was “no need for any statistical reasons” for a census re-run.
“I would just simply remind people, as the minister has, to complete that form as of August 9th because that is the census date,” he said.
Embattled minister speaks
Moments earlier Michael McCormack, the minister in charge of the bungled census, declared there was no “attack” or “hack” of the ABS online survey but merely an “attempt to frustrate” the collection of data.
Fronting the media for the first time since the census website was shut down last night, Mr McCormack said four events had occurred “simultaneously” leading to the system being closed.
His insistence there was no “attack” came just hours after the head of the ABS, David Kalisch, blamed the overnight outage on a “malicious” attack and as Mr MacGibbon, continued to use the word “attack’’ to describe last night’s events.
The bureau was forced to shut down the survey last night after four separate “denial of service attempts” on the site.
The first three caused “minor disruption” and two million forms were still able to be submitted but the fourth one, which occurred after 7.30pm as scores of Australians tried to log on to complete their census forms online, caused the bureau to close its system.
“There was a large scale denial of service attempt to the census website and online form. A denial of service is an attempt to block people from accessing a website. Following, and because of this, there was a hardware failure,” Mr McCormack said.
“A router became overloaded. After this, what is known as a ‘false positive’ occurred. This is essentially a false alarm in some of the system monitoring information. As a result the ABS employed a cautious strategy which was to shut down the online census form to ensure the integrity of the data already submitted was protected.
“I will be clear from the outset, this was not an attack. Nor was it a hack but rather, it was an attempt to frustrate the collection of bureau of statistics census data. ABS census security was not compromised. I repeat, not compromised and no data was lost.”
Just minutes after Mr McCormack’s statement Mr MacGibbon said the “attack” had been no more significant than the types of attacks seen “all the time” on Australian government systems.
“It’s just that there was a confluence of events,” he said.
“In terms of the motivation of people, it is important, as the minister said, to note that a denial of service is not a breach, it’s not designed to take data. A denial of service is designed to frustrate.
“If I can use an offline analogy, it’s equivalent to me parking a truck across your driveway to stop vehicles coming in and out. That is all a denial of service is. It led to other systems failing, absolutely. But it does not compromise the integrity of data.”
Mr MacGibbon said he had spent the last 15 years trying to clarify that a denial of service was not a hack, breach, compromise or “exfiltration” of data.
At the time of the denial of service attempt Mr MacGibbon said most of the traffic was coming from the United States.
Mr McCormack said he was not using the word “attack’’ to explain what happened last night because hackers had not been able to retrieve information from the site and use it for “malicious purposes”.
An inevitable development on @australian's 404 page pic.twitter.com/YYBRXSTjGo
— James Jeffrey (@James_Jeffrey) August 10, 2016
Labor on the attack
Labor blasted the Turnbull government for overseeing the “worst run census in Australia history” and one of the “worst IT debacles” on record.
Mr Shorten said it “broke his heart” as the minister responsible for the 2011 census to see the government’s bungling of the survey.
“To see such a lackadaisical approach from the government and we’ve even see the poor old assistant minister (Mr McCormack) blaming other people — saying he has been in there for 3 weeks, what would he know — the buck stops with the Treasurer and the Prime Minister.
“They need to explain how this important exercise has been so comprehensively mismanaged in such incompetent style.”
The opposition assistant treasury spokesman Andrew Leigh added: “Make no mistake, from here the data from the 2016 census will never be as good as the data from previous censuses. And that’s because the Turnbull government has botched the handling of the 2016 census.
“Millions of Australians were affected. Millions of hours of Australians’ time has been wasted dealing with a census whose management was botched.
“The date for the 2016 census has been set for many years. They’ve known the census was coming and yet they failed to do the proper planning. Even after the ABS had taken down the website the government was still urging Australians to log on to do the census. That’s how incompetently managed this was.”
Mr Leigh said the government’s failure to anticipate “hacking attempts” was a something the Prime Minister and Treasurer must take responsibility for, slamming successive Coalition ministers responsible for the census— Kelly O’Dwyer, Alex Hawke and now Mr McCormack — for “doing nothing”.
“(Mr McCormack’s) been dismissing Australians’ concerns about the census as much ado about nothing. Frankly, what we’ve seen today has suggested what a laughable response that is,” Mr Leigh said.
“The government is talking about denial of service attacks. It’s been absolutely clear the first denial of service attack occurred in the year 2000, it was absolutely predictable that the census which had been publicised widely and about which the government had boasted on their data impregnancy would be the target of hacking attempts.”
If you can’t run the Census, you can’t run the country.
— Bill Shorten (@billshortenmp) August 10, 2016
Earlier this morning Defence Industry Minister Christopher Pyne says nobody could have expected the first census to go largely online would take place “without hitches”.
Mr Pyne, who is responsible for the signals directorate, said the ABS needed to be left to do its job as “professional public servants” and rejected calls for Mr McCormack’s resignation and a Senate inquiry as “playing politics”.
“Nobody could expect such a big national endeavour as putting the census online to occur without hitches, especially when there was a malicious attempt to hack into it and to stop it,” he told FIVEaa Adelaide radio.
“The hackers weren’t trying to steal information, they were simply trying to wreck the census. For whatever reason they thought that would be fun and it’s unhelpful.
“These international criminals are quite adept at this kind of activity but if anybody can find them it will be the Australian Signals Directorate.”
Amid speculation the cyber attackers may have been Chinese, Mr Pyne warned against an “orgy of anti-Chinese xenophobia”.
“Let’s not have an orgy of anti-Chinese xenophobia because of claims being made about this or that, particularly on the internet. Government needs to be sensible and calm. We want to get on with the job in a stable way,” he said.
The Fallout
Attorney General George Brandis said both the ABS and the government’s own privacy commissioner, Timothy Pilgrim, had informed the Coalition “all of the protections” to census data were “more than sufficient to protect individual privacy”.
The Cyber Security Operations Centre, established by the Australian Signals Directorate, had been “engaged overnight” to investigate the matter but the government has indicated it will be “very difficult” to determine the source of the assaults.
“At this stage there doesn’t appear to have been any impact except a disruption in the process,” ABS chief David Kalisch told ABC radio.
“It has been very unfortunate but that’s what we’re dealing with and we’re looking to have the system up and running ASAP but also in a way we can be assured of its security.
“The scale of the attack, it was quite clear it was malicious.”
We apologise for the inconvenience. The 2016 online Census form was subject to four Denial of Service attacks of varying nature & severity.
— Census Australia (@ABSCensus) August 9, 2016
Mr Kalisch, who is on a total salary package of $705,000, said the ABS had become aware of the attacks during the day. The bureau does have steps in place to counter attacks, he said, but there was one “breach” that did get through via a third party.
Fines will not be imposed for completing the Census after Census night.
— Census Australia (@ABSCensus) August 9, 2016
“We believe we’ve plugged that gap,” he said.
It is the first largely digital census with two thirds of Australian households expected to complete their surveys online, up from one third in 2011.
Mr Pilgrim said he was commencing an investigation of the ABS over the cyber-attacks and his first priority would be to “ensure that no personal information has been compromised”.
“My office will continue to work with the ABS to ensure they are taking appropriate steps to protect the personal information collected through the census,” the Australian Privacy Commissioner said.
We apologise for the inconvenience. The 2016 online Census form was subject to four Denial of Service attacks of varying nature & severity.
— Census Australia (@ABSCensus) August 9, 2016
Former defence minister and ambassador to Washington, Kim Beazley, and Labor’s defence spokesman, Richard Marles, said it was too early to tell if China was behind the hacking.
Mr Marles said the census had been a “shambles from beginning to end” and the online form would have been an “obvious target” for a cyber-attack.
“Contingencies should’ve been put in place, there should have been an understanding of the amount of volume that was going to be on the system last night. It’s been impossible to make contact with the census bureau through ringing the public phone line over the last two days,” he told Sky News.
“This has been absolutely hopeless and chaotic and the census of course is a critically important exercise for Australia’s public policy. The government has a lot to answer for here.”
Labor frontbencher Anthony Albanese backed Senator Xenophon’s call for an inquiry into the “debacle”, saying the process from start to finish had been “handled appallingly” and the government had to take some responsibility.
He said leaving the census to a “very junior guy” like Mr McCormack didn’t help, pointing to one of his recent press conferences explaining the census changes as a “train wreck”.
Mr McCormack was promoted in Malcolm Turnbull’s ministry reshuffle last month and appointed to the role of Small Business Minister.
“I congratulate whichever of my colleagues has been able to work out who is in charge of this (census),”
“It was not clear which minister was responsible for this whole process,” Mr Albanese told FIVEaa radio. “This has been a debacle from go to whoa, this has been going on for weeks where the government has failed to come out and explain why the changes are being made, explain how last night would work and quite clearly were unprepared.”
History of cyber assaults
The ABS had enjoyed a proud record of securing census data seems since the first national census in 1911. It’s not a record shared globally. Last year, hacktivists from Anonymous leaked thousands of usernames, passwords and email addresses from the US Census Bureau, although there was no evidence of breaches of respondents’ details.
Then there was the case of census data being used to disclose Japanes nationals in the US in World War II It took more than 60 years but in 2007, after decades of denials, the US Government confirmed it handed over the names and addresses of Japanese-Americans collected from its census to the US Secret Service.
How the night unfolded
Confusion turned to anger on census night as the Australian Bureau of Statistics’ website failed multiple times, despite assurances the system would be able to handle the estimated 16 million people filling in their forms online.
Angry users took to social media to vent their frustration, describing the $470 million census as a “farce” that had been “grossly mismanaged”.
Many said they could not access the site or were being directed to pages with error messages. Some users got to the end of the questionnaire and received the message: “All unsaved information was lost.”
Late last night the ABS issued a statement saying its website and the census site were unavailable.
“The service won’t be restored tonight,” the statement said. “We will update you in the morning. We apologise for the inconvenience. There will be no fines for completing the census after August 9. There’s still plenty of time to complete the census. Thanks for your patience.
“ABS staff will not be available for media interviews. A further statement will be issued in the morning.”
Barely an hour after Prime Minister Malcolm Turnbull boasted about the “ease” of filling out his census, the website was producing error messages and asking people to “try again later”.
We filled in the @ABSCensus tonight online - v easy to do. And so important for planning better Govt services & investment for the future
— Malcolm Turnbull (@TurnbullMalcolm) August 9, 2016
The ABS had promised it could handle the demand and taxpayers spent $325,000 testing the load on the system.
But hundreds of angry Australians took to social media reporting that the site has either failed to load completely, or users have gotten to the end of the questionnaire and been unable to submit their answers, receiving a frustrating message that reads: “all unsaved information was lost”.
Others said they were told to switch to a different browser in order to complete the census, or to download a new one as what they have was too outdated.
Some received the message that their request to get onto the site “could not be completed as a problem was encountered” and if they “continue to receive this message, please call the Census Inquiry Service”.
The ABS asked callers to wait until Wednesday to contact the hotline “when (they) expect calls to reduce”, assuring people they would not be fined if they do not complete their census tonight.
At 9.30pm it was still running ads on TV urging people to “complete your census tonight”.
Opposition frontbencher Katy Gallagher said the Census was “not agile, innovative or exciting” as others on social media noted the 2011 census under Bill Shorten as the responsible minister had proceeded without problems.
Labor frontbencher Shayne Neumann signalled the Opposition would attack the government over the census failure. “Just wait till #estimates #questiontime and other forms of Parliament to resume. @ABSStats What a fiasco!”
Just completed #MyCensus online. Great to play my part in shaping Australia's future, just like millions of Aussies. pic.twitter.com/krYWcq5YDR
— Michael McCormack MP (@M_McCormackMP) August 9, 2016
Mr McCormack, posted a message and photo on Twitter earlier in the evening - before the crash - saying he had completed his census online. “Great to play my part in shaping Australia’s future, just like millions of Aussies.”
While the census was supposed to be a snapshot of the nation, a spokesman for the minister said if people could not get on the website they had until September 23 to complete the census questions.
The ABS & Census websites are currently experiencing an outage. We're working to restore the service. We will keep you updated. Thank you.
— Census Australia (@ABSCensus) August 9, 2016
The online chaos came amid warnings that the quality of the 2016 census is at risk from “unnecessary fears” fanned by the privacy concerns of crossbench senators and a poor sales job by government.
Statistical Society of Australia president John Henstridge said the national snapshot of housing and population was “among the best in the world” but criticised the handling of the changes.
“The public whose co-operation is critical for a successful census does not appear to have been adequately involved, and the reasons for the changes are even now not well publicised,” he said.
The SSA worried that controversy around the census “may impact upon the quality of the data”.
National chief statistician David Kalisch said the Australian Bureau of Statistics had an “unblemished record” of keeping census data safe and had resisted all hacking attempts. He expressed disappointment with public figures who raised security concerns.
Under changes to the census, names and addresses will be retained for four years — it was 18 months after the two previous censuses — and turned into encrypted keys to link data and better determine life expectancy trends and population flows.
Bill Shorten and cabinet minister Christopher Pyne have blasted crossbench and Greens senators who announced they would not be putting names on their census forms following changes to the retention personal data system.
Senator Xenophon was the first politician to declare he would not put his name on his census form but Mr Pyne accused him of “tinfoil hat kind of politics” and said his non-compliance could “damage” their home state.
The ABS was forced yesterday to make a “hand on heart” promise that private information provided in the questionnaire would remain confidential.
It is guaranteed to remain so if people are unable to access the website instead of filling out paper forms.
About 24 million people from 10 million households were expected to complete the compulsory survey.
#census2016. Great to be a Luddite. I filled in the paper version in ten minutes. Mailing tomorrow.
— Derryn Hinch (@HumanHeadline) August 9, 2016
Computer says no #census2016
— Brendan O'Connor (@BOConnorMP) August 9, 2016
I think it was a good idea to take a perfectly good & proven process of census collection & dramatically change it just because you can.
— Tom Koutsantonis (@TKoutsantonisMP) August 9, 2016
The PM is having trouble logging on as well everyone... pic.twitter.com/wM5bpja2bD
— Peter van Onselen (@vanOnselenP) August 9, 2016
Additional reporting: Phillip Hudson/Joe Kelly/AAP
More Coverage
Miners change tune on climate change
Peak mining industry body The Minerals Council of Australia has joined the fight on climate.
Labor to turn up heat on Taylor
Labor will use the final two weeks of parliament to heap pressure on Energy Minister Angus Taylor.