Government ministers and senior public servants will be sent to "cyber bootcamp", while chief statistician David Kalisch will effectively be put on probation, following a damning review into the 2016 census debacle by the Prime Minister's cyber security chief.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
In an excoriating report, Alastair MacGibbon said the Australian Bureau of Statistics had failed to adequately prepare for predictable cyber security issues with the 2016 census, mishandled the subsequent crisis and has refused to take responsibility.
Prime Minister Malcolm Turnbull has said the review will determine "which heads will roll and when" as a consequence of the debacle, which saw the census website deliberately shut down at peak hour on census night and left millions unable to complete their forms.
In a statement acknowledging the review, Small Business Minister Michael McCormack revealed the Turnbull government had reached a commercial-in-confidence settlement with contractor IBM after the tech giant apologised for the census outage.
"One of the government's most respected agencies - the ABS - working in collaboration with one of the technical world's most experienced companies - IBM - couldn't handle a predictable problem," Mr MacGibbon's report concluded.
He also took aim at the organisation's culture and reaction to the crisis, declaring: "The ABS's actions since only underscores the importance of culture: it has steadfastly refused to own the issue and acknowledge responsibility."
Mr MacGibbon recommended ABS boss Mr Kalisch be required to report to the minister every month on how the ABS was redressing its faults. Meanwhile, ministers and public sector executives should be sent to "cyber bootcamp" to learn the basics of cyber security.
Mr MacGibbon concluded a lack of awareness about cyber security went far beyond the ABS and was a systemic issue across government agencies that must be addressed. "More of the same is not enough," he wrote.
All the recommendations were accepted by the government, Mr McCormack said.
Mr MacGibbon conceded Mr Kalisch's decision to shut down the website at about 7.30pm was justified, and the outcome "could have been worse". The events of August 9 stemmed from decisions taken "well before then" and also reflected problems with the Bureau's culture and skills, he said.
The ABS had become "locked in" with its long-time supplier IBM and did not seek independent verification on critical aspects of the online census, Mr MacGibbon concluded. In particular, it failed to ensure an appropriate security assessment of the system took place, which would likely have detected errors.
"The ABS did not have a formal process for accepting responsibility for system security," he wrote, a conclusion he noted was disputed by the ABS.
Mr MacGibbon was highly critical of the ABS's communications strategy after the meltdown. It "severely under-utilised social media as a communications tool", was largely absent from the media and slow to provide updates, and "struggled to win back the trust of the public in the following days".
The report also said the Bureau lost public trust early by failing to commission an independent review of its plan to retain the names collected with the census and then calling for public comment on its internal review shortly before Christmas. When it received only three public submissions it "accepted this" rather than see it as as a sign that its public engagement was inadequate.
As a result it was ill-equipped to manage the avalanche of concerns on social and mainstream media about privacy and security which "far outweighed" the concerns expressed about difficulties with the website.
Its regular surveys of public attitudes to the ABS gave it a "false sense of security" about its decision to retain names and meant it failed and fails "still at the time of writing" to grasp the significance and power of social media groundswells.
It recommended the ABS ensure future changes to personal information handling procedures are subject to independently-conducted privacy assessment followed up by broad-ranging consultation.
The review came as a Senate inquiry produced its own report into the census debacle. The Labor-dominated committee declared the ABS made a "justifiable, understandable and entirely correct" call in shutting down the census website, but accused it of "manifestly inadequate" consultation about changes to data retention, and took aim at Mr McCormack for failing to take responsibility.
Labor senator and committee chair Chris Ketter said the debacle was a symptom of "chaos and dysfunction" in the Turnbull government.
