Hackers to blame for Census chaos, ABS says

Masquara said :

It was quite disheartening to see supposed professional journalists participating in a gratuitous “gotcha” twitterfest on this without raking through the issues. Thank goodness for Grog’s Gamut and his considered response – a call to see the ABS funded properly.

At least they’re not let it go quietly into the night. They’re going to investigate and then find that they screwed up the funding and constraints on hiring finding themselves at blame and then silently dropping it.

It was quite disheartening to see supposed professional journalists participating in a gratuitous “gotcha” twitterfest on this without raking through the issues. Thank goodness for Grog’s Gamut and his considered response – a call to see the ABS funded properly.

Amidst the Keystone Cops chaos, most (ironically) amusing of all is the dogged, unblushing pretence that government decisions about the location and funding of services etc. etc.is based solely and rationally on Census data – ha, bloody ha, guys.

aleayr said :

I personally find the religion section to be loaded and difficult to answer; being baptised in a particular church is not necessarily the same as belonging to or believing in it.

Then put no religion, or another one. I was baptised into a particular church, but I haven’t felt I belonged to it since late teens, and have never seen myself as belonging to that church as an adult. Being baptised into a church as a baby is sort of irrelevant and of no consideration for me.
I found the ethnic question personally impossible to answer, as only two ancestries could be listed, when I have three. How can I discriminate? So I put Australian, as I refused to discriminate.

I did mine on Sunday afternoon in under ten minutes on Telstra ADSL2+. No problems at all. Perhaps they need to have a Census week instead of one Census night in order to spread the load a bit. Blind Freddie could have seen this coming…

Chaser also had a good take on it today: “Govt claims census triumph: ‘we are a proud nation of 4 million people’” – http://www.chaser.com.au/2016/census/

I tried at 11pm last night when I got home, it refused to even recognise my browser Vivaldi, even though it’s basically a Chrome browser (webkit engine) and works same as everything else Chrome. So I fired up proper Chrome, and of course it worked fine. But the site then tells me to try again in 15 minutes.

Note this was apparently 4.5 hours after the ABS took the site offline, and the message still said at that point “try again in 15 minutes”. Well I did NOT fall for that one, and gave up immediately and started trolling the ABS on twitter instead and reading all the other funny tweets about it.

Tweet: ABS rep Duncan Young said online census would save more than $100 million for taxpayers… by spending only $1 on the website. #CensusFail

I also tweeted a “how to automatically scale cloud services” document link from the microsoft azure website, I figured their techs could use the advice on that.

Epic fail all round. Bring on online voting? Heh, maybe not.

The cited reason ‘external DDoS’ is just a convenient excuse. LARGE web sites crash all the time upon new releases of games or software, Sony has heaps of experience with millions of Playstations out there and THEY don’t cope well with a few hundred thousand simultaneous logon attempts (and suffer from actual DDoS attacks from recognised groups like Anonymous) … the POLITICAL excuse machine is in full swing, and the POLITICAL blame game is afoot; the waters were already considerably muddied by the furphy of Name and Address (which has always been a requirement of Census forms and Always Kept for at least 18 months), the various senators (Xenaphon etc) citing they will not supply name and address information is borderline criminal ‘advice’ and absolutely stupid. The name/address information isn’t tied to Census data so you can’t look up ‘Nick Xenophon’ and find out his income or number of offspring or whatever from -Census- data lookup, it just isn’t possible. The census web site is a great idea, the implementation was always going to be problematical and the ‘single attack vector’ (“abs.gov.au”) is a key part of why it’s a problem. There are very few robust workable solutions for massive access to single-points-of-internet-interest. qv the SlashDot effect or more contemporaneously, the reddit factor …

caveat; retired goverment IT worker with excellent knowledge of communications and network topologies.

dungfungus said :

JC said :

People seriously calm down and the media need to stop creating hype. Like every other census held previously, you can complete it after the date and within a reasonable timeframe -usually into September. You just complete it “as at 9 August”. The old paper based forms didn’t have someone coming around to your place on the evening of 9 August to check that you had done it. The electronic version is no different.

I did the return for my address on Monday night in 20 minutes using ADSL2 on copper wire.
Only problem was in the religious section. We identify as Christian but there was no specific choice for this so I used the “other” section.
My only other complaint was the overuse of the word “submit” when “send” would have been sufficient.
I hope this census is the forerunner of a bullet-proof ID card like the Australia Card. We really need something like this in place ASAP.

As with many online forms, “submit” is more appropriate as the data is not actually sent anywhere – it’s not an email attachment.

When it comes to Christianity, the religion question can become complex – there are so many Christian denominations that it would be a very long form if all were listed. I believe that’s one of the reasons why they have the “Other” section. I personally find the religion section to be loaded and difficult to answer; being baptised in a particular church is not necessarily the same as belonging to or believing in it.

Also, what do you mean by the “bullet-proof” ID like the (failed) Australia Card? Why do we really need something like that?

I had no trouble. About 7 the penny dropped about the census, so fired up this thing and away I went.
Very easy to fill out. No problems or delays and received a email receipt a little later.

dungfungus said :

Leaving aside the issue of whether a DDOS is actually included in the definition of ‘hacking’ – how easy was it for hackers to gain access to the information submitted on the paper form? And how useful was that information to identity thieves and other ne’er-do-wells when it wasn’t attributable to any particular person by name or address?

Well these are the unknowns to the public. When the paper data was scanned and put into electronic systems, you could do it on systems potentially that are closed or at least have very limited public interface. Necessarily when you have an online census, you have internal systems linked to publicly facing systems.

As for how useful the information is, that would depend on at what point the information is made unattributable. You have all this data being fed into the system, is it being cached together, then separated and identity blanked out? We don’t know. But last night would have been the logical time to make an intrusion attempt because heavy traffic and data flowing through different points between public and private systems.