ABS Census Online

Australian Census 2021. Great idea. Important for planning and analysis. Now any online service can have challenges, and the Aust Bureau of Statistics certainly had its fair share with the census fail 2016 when they didn't handle spike traffic, mistook volume for a denial of service attack, and ultimately pulled the entire system offline so no Australian could interact with it for quite some time on census night. Not their finest hour to be sure, and irritated millions of Aussies. But anyone can make a mistake.

You would hope though, that in 2021, a government website that largely just accepts answers to a form (not quite deserving of the phrase 'You had one job' but really...) would be easy to login, and easy to communicate with if not.

Ahem. Australia, your 2021 Census site access and communication may need some work. Ok it completely sucks, but I am struggling to be nice here. And I AM giving advise on where and how to fix it in this campaign.

The Australian Bureau of Statistics requires SMS, to interact online. www.census.abs.gov.au/help/faqs

SMS is widely known to be very insecure. Search and hundreds of security sites report this, and specifically advise against using SMS for any security purpose anymore, and all banks are moving away from SMS towards authentication apps.

See www.krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now for one of hundreds of such links.

I advised ABS I was overseas and complained that SMS was not appropriate for security, and the requirement was an unnecessary and insecure barrier to communicate about the census. The response I got back from ABS support staff via email was to go online and advise I was not in Australia on census night.

This email was irritating given I was specifically advising their system is not built to facilitate users who do not own a mobile phone number at all, let alone an Australian one, so the advice was clearly not appropriate, even though they actioned my request re not being home

Please ABS, get with the times, drop SMS like the fax, and note that SMS is less secure than fax. Users should be able to email authenticate, or, if you must, use an Authenticator app like my.gov.au (or even this gov identity service)

I have a data only SIM which can't accept SMS, and more folk will do this in time as we live in Zoom and FB IM world now.

COMPLAINT 1

ABS Census require SMS to interact online. SMS Sucks. Insecure. It’s nearly dead like the fax. An unnecessary barrier.

COMPLAINT 2

ABS Census only allow AUSTRALIAN mobile phones for SMS. So doubly hard for Australian users overseas. See complaint 1 (SMS sucks).

COMPLAINT 3

The Australian government has a my.gov.au website that has a login facility for many federal government services like tax and social security. It used to only allow SMS based login, but has been moving away from SMS and supports the far more secure Authenticator system, which requires no mobile phone or SMS of course.

ABS, you are a national government service. Why on earth can’t we login to the MAIN federal government website, and click Census. Can’t you be accessed this way? Even as an additional option? Why on earth… surely?!

COMPLAINT 4

Census password rules suck. You give a complex temp one, but them make it hard (and less secure) to create your own password.

https://www.census.abs.gov.au/doing/online-form/login_password_help#set-your-password

These antiquated password are not secure, according to global advice and security best practice. They use the OLD ‘complex password is best’ rules, and have missed the memo that these are less secure, and strongly discouraged.

Because it makes it easier for hackers to breach, and harder for humans to use legitimately, and also makes it more likely humans will save their password more accessibly, or write down, or reuse from other sites and so on. All making it LESS SECURE. ABS Census, really, please get with the times.

SEE HERE for the password campaign, with numerous links to government cyber security advice. Tip: The ABS is not following security best practice in it's password complexity rules.

www.tesla.tours/campaigns/password-rules

COMPLAINT 5

You are spamming users with your silly top tips.

So a tip, rather than give users extremely complex TEMPORARY passwords, and then give EXTREMELY ANNOYING spam advice to ‘help’ users enter these impossibly complex passwords… maybe make it more secure by following global best practice advice on passwords.

And take a tip from Facebook, which accepts your entire password regardless if you have all caps on, or not, OR if the first letter is capitalised. Because that is easier for users, and is not less secure. Really. Read up on entropy and security and user behaviour how the infinitely small cost in entropy for accepting a first letter capital (for users whom you sent a temp password that has a lower case to begin) is worth it. Because you are spamming every Australian with these ‘top tips’. Crikey ABS, after the 2016 disaster, can’t you get the security right? With SMS best practice AND with password best practice?

Here’s some top tips for you Australian Bureau of Statistics:

1. Be like Facebook and accept passwords regardless if the first character is capital or not, or if all are caps reversed.

2. Create passwords that do not start with a lowercase letter to begin with. Not as good as the smart option #1, but it points out the pointlessness in telling all Australians a mindless top tip about capitalisation of the first letter of temporary password that YOU issued, IF it was lower case AND the user made a first case error.

3. Do not create passwords that MAY be corrected at the users device. Then you don’t need to issue spam advice about autocorrect that may affect 0.001% of people anyway. (Being generous I mean)

4. Only bother the user with this Top Tip advice IF they make an error. Showing these mindless top tips to all users is spam. The temporary password ‘tips’ are only relevant if the user got it wrong the first time.

COMPLAINT 6

Your online feedback service won't accept text being pasted into the form unless only a few words. Really? Are you trying to make it hard to complain?! I have so much to complain about, and wrote it all separately, even being mindful of the 2000 character limit, but to no avail, It won’t work.

I can’t paste in more than a few words, and not a whole paragraph. Sigh. It was less effort to retype the whole thing in the input box than to copy and paste dozens of sentences...

COMPLAINT 7

I pressed send on my complaint form on your site, but it refused as I had not entered my title. A title? You really want to force users to enter Mr or Miss? Isn't this sexist? I am title agnostic. Why do you force users to disclose a title in order to complain? Just drop this field, or make it optional for goodness sakes! Forcing me to enter a title IS a complaint! It says ‘Enter title’ on the form. I note that it does allow the entry of the word title itself if you feel oppressed by the title police. Title=”Title”. Happy now?

Really, I want to be titleless. I want to be title neutral. I just want to be me. My preferred title is “<NULL>”. Or will my many, many complaints about the ABS online service receive more attention if I put a more prestigious title Dr perhaps? Will you really void my complaint if I put Baron? Why won’t you accept my valid title of <NULL> though? There is no shame in being a titleless peasant.

And the spam message that all fields are required unless marked optional. So helpful. Not. What nonsense spam. Does this message actually help anyone? ABS Hello?! It’s from the internet dark ages, and nobody realised it can be removed. Unnecessary. Spam. Unhelpful. And as for making title mandatory… who’s job is it in the ABS, who made this requirement. That Australians without a title are not permitted to submit a Census. We want names ABS… Names… Who was it? Let’s shame them on social media for being so classist.

So I fixed my title and entered Mr for no other reason than fear, that if I actually entered ‘title’ as my title, or Baron or Internet Mogul, that my BIG COMPLAINT might not be accepted. So I became a sheep, and accepted my lot in life, as a Mr. It’s not who I am, it’s not who I aspire to be. I resent the patriarchy.

The label, the sheer … pointlessness in the ABS even caring that I absolutely MUST have a valid title, or else they will refuse service, their form will not accept it. So I dutifully entered ‘Mr’ while the hair on the back of my neck began to bristle… But at least the webform ‘accepted’ my complaint, with some difficulty. But still, my complaint is GET RID OF TiTLE, at least as a forced requirement ABS!

COMPLAINT 8

An email I got back from ABS support began with:

Dear ENTER TITLE/SURNAME,

No, I mean really. REALLY. I kid you not. It actually said this. See screenshot. So AFTER I got annoyed by the site not accepting my complaint SOLELY because I had not entered anything into the title field when I pressed submit, THIS is the email response I got back. It was as if they knew. The spies online had detected my irritation at being title oppressed, and really wanted to turn the knife lol… to really make a point. You dare to try and hide your title from us? We will make life very difficult for you if you don’t follow all the rules, even if they make sense, and even if they DON’T WORK! Ha ha

So not only do they prevent users submitting a form without a title being entered, they don't have the courtesy to even use it properly in correspondence.

COMPLAINT 9

So I received the email back from ABS about my complaint re SMS preventing me interacting online, but the email advised me to go online to notify ABS I was overseas on census night. Hello!!!! Echo… Echo.... Did you read that I was complaining I can’t login without an SMS, but you advise me to login online anyway, after I told you I can't?

COMPLAINT 10

So after fixing the title ‘problem’ I then pressed submit. Again. But the ABS Census complaint service said it has a problem and won't accept my complaints. See screenshot. The feedback service sucks. I try to submit valid feedback and it fails. Would it allow my complaint if it was all praise? Was there too many complaints? Were they too harsh? Is this HALL 9000, where the AI says ‘This guy is causing trouble… just say there is a generic problem with the site, and hopefully he will give up and we won’t need to bother with making any changes at all. We don’t even need to report the complaint to our regulators, because we cleverly REFUSED to accept it Muahahahaha.

No really, you need to watch AI. This behaviour is exactly the very clever response that AI WILL FIND. Because showing messages of ‘System error. Try later’ will absolutely reduce the number of complaints received, so if AI is trained to goal seek a reduction in complaints… this is a valid strategy. Like AI is now cheating in games https://www.theregister.com/2018/03/02/ai_qbert_bug/

Or https://www.newscientist.com/article/2216410-ai-learns-to-defy-the-laws-of-physics-to-win-at-hide-and-seek

Is this it ABS? Your AI Support response model has learned to cleverly report errors from the more annoying complaints, and thus be rewarded for reducing the ABS Census support workload?

COMPLAINT 11

So the ABS Census support email did not make any mention that I had made a FORMAL complaint about the login service requiring SMS, and an Aust SMS too. No acknowledgement. It got missed. So I went to reply to COMPLAIN that my complaint was not acknowledged, as an ADDITIONAL complaint that I could not login, and on top of the complaint that my complaint response told me that I could go online to notify the ABS I was away. So I had another reason to complain.

COMPLAINT 12

I replied to the ABS Census support email, to ask them did my complaint actually get acknowledged. Just to be sure. Because it seems not. The person who wrote to me seemed sort of nice. Surely they would reply to thank me for my constructive criticism complaint, and to reassure me it was ‘handled’ and that someone would at least consider the issues raised.

I waited for a reply from my complaint response. The reply never came. I checked later. Still no reply.

Then I noticed that the support email from ABS Census comes noreply.census@abs.gov.au. So I had replied to this address, and of course got no further response, or even a response saying it was no reply. Really? REALLY?! Goodness, ABS Census don't make it easy for users to complain, or reply to support emails? Can't a reply to an email be accepted like any other government body? Do I really have to move to Facebook because ABS doesn't allow email for either login authentication OR for any complaints? Well, ABS allows the convenience of emails to send messages to Australians, but does not allow Australians the same level of convenience to reply also via the same email channel. I mean such as complaining about the ABS complaint facility itself for example. NoReply? Who’s clever idea was this? It’s like playing tag as children, and saying ‘Can’t tip the butcher back!’ It’s like playing Knock and Run.

The ABS sends you an email, but then runs so you can’t communicate back. What is this noreply email address nonsense? And if ABS Census IS silly enough or irritating enough to send support messages via a no reply email address, you would think they would set up an autoresponder to say you emailed the wrong address, and this address is not monitored. Of course it would be nicer that the email wasn’t just turfed in the bin, but without any warning?

Am I the only one waiting for hours, impatiently for the ABS Census to reply to my helpful email? I was going to go make a cup of tea, but didn’t want to miss it, though after hours I realised it just wasn’t going to happen. So I made my tea, and then came back to research further and discovered I got tagged, but was not able to tag the ABS back. Sigh… all those hours wasted. Surely there must be some other way to login to fill your census, or some way to complain to the ABS about the online census facility, or it’s complaint service?

I want to complain even more, but think a dozen complaints is probably enough. I doubt many other Australians would be as motivated to help the ABS Census with such detailed feedback… God I hope somebody listens, about the extremely irritating census support, census login and census complaint facility. I will update this post if there is any rational, reasonable response from the Census about these ELEVEN complaints.

Meanwhile, for any others in the same position, my advice is don’t hold back. Go and make your tea. Maybe don’t even bother. If things are just so hard, maybe just don’t bother doing them. Or maybe, just maybe, it’s worth mounting a CAMPAIGN to help improve the world! God knows the Census online needs improvement. Let’s hope the response is less ‘Yes minister’ or ‘Catch 22’ and more ‘Goodness we are sorry, and we will work to fix these issues promptly’.

Thank you for listening.

Chris

P.S. If there is any reasonable, rational response to these complaints from the Australian government, I will be sure to update this post. Don’t hold your breath, but maybe… just maybe this campaign can result in some.. Even slight improvement. For a site that is used by millions of Australians, you would hope that the ABS will act promptly to address the concerns. Fingers crossed. Your move ABS!

Update 1: I messaged ABS Census 2021 via Facebook, and got at least an acknowledgement thank you of these issues. Why does ABS have better engagement using social media than it's own website. Anyway, watch this space.