Dear Australian Bureau of Statistics,

I request to know more about the preparedness of the ABS (Australian Bureau of Statistics) from a) DDoS (Distributed Denial of Service) attacks, and b) the exfiltration of user submitted 2016 Census web form data.

COMPROMISED:

Within the Senate Inquiry into the handling of the 2016 Census, the Prime Minister's Special Adviser on Cyber Security (Alastair MacGibbon) submission contained the following quote:

“there was outbound traffic from the eCensus system, and the fear was it was 'potentially malicious'”

Contrary to this, on the 9th of August 2016, a government spokesperson reported by the ABC (Australian Broadcasting Corporation) said:

“No census data was compromised and no data was lost”

I request the following:

- What metrics were used to determine that the outbound traffic could have been “potentially malicious"

- What system(s) were able to detect that the outbound traffic from the eCensus system was “potentially malicious"

- Did this “potentially malicious” outbound traffic contain some user submitted 2016 Census web forms data

- Which countries were the “potentially malicious” outbound traffic destined to

- How much traffic (in bytes) was measured for the “possibly malicious” outbound traffic

- Email correspondence between ABS and ASD (Australian Signals Directorate) and/or ACSC (Australian Cyber Security Centre) in relation to said detected “potentially malicious” outbound traffic

DDoS TRAFFIC:

News reports by the ABC state that the ABS online monitoring systems:

“detect[ed] a significant increase in traffic”

I request the following:

- What metrics and/or thresholds were used to determine that the 2016 Census web form needed to be taken offline

- Could I have a copy of all documents that state said metrics and/or thresholds

- Graphs of aggregated (i.e total and anonymised) web request counts, at a resolution of per minute, to the ABS website servers, between the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) request bytes transferred, at a resolution of per minute, to the ABS website serversbetween the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) web request counts, at a resolution of per minute, to ABS’ DDoS Mitigation provider(s) between the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) request bytes transferred, at a resolution of per minute, to ABS’ DDoS Mitigation provider(s) between the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) web response counts, at a resolution of per minute, from the ABS website servers between the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) response bytes transferred, at a resolution of per minute, from the ABS website servers between the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) web response counts, at a resolution of per minute, from ABS’ DDoS Mitigation provider(s) between the 1st of June 2016 to the 28th of September 2016

- Graphs of aggregated (i.e total and anonymised) response bytes transferred, at a resolution of per minute, from ABS’ DDoS Mitigation provider(s) between the 1st of June 2016 to the 28th of September 2016

- Email correspondence between ABS staff and ABS’ DDoS Mitigation provider(s) in relation to the detection(s) of significant increase in traffic between the 8th of August 2016 to the 28th of September 2016

- Email correspondence between ABS staff in relation to the detection(s) of significant increase in traffic between the 8th of August 2016 to the 28th of September 2016

- Email correspondence between ABS and ASD (Australian Signals Directorate) and/or ACSC (Australian Cyber Security Centre) in relation to the detection(s) of significant increase in traffic between the 8th of August 2016 to the 28th of September 2016

- Email correspondence between ABS staff in relation to taking the 2016 Census web form offline between the 8th of August 2016 to the 28th of September 2016

DDoS MITIGATION:

The ABS submission to the Senate Inquiry quotes:

"DDoS protection systems were not independently tested"

I request the following:

- Could I have a copy of the Statement of Work, and Master Service Agreement, between the ABS and ABS’ DDoS Mitigation provider(s)

- Email correspondence between ABS and ABS’ DDoS Mitigation provider(s) regarding "independent testing" of the DDoS protection systems as mentioned in the above Senate Inquiry, between the 1st of January 2016 to the 28th of September 2016

- Email correspondence between ABS and ABS’ DDoS Mitigation provider(s) about “operational preparedness and resilience to DDoS attacks” as mentioned in the above Senate Inquiry, between the 1st of January 2016 to the 28th of September 2016

- Any evidence of load/performance testing performed on the ABS web servers between the 1st of January 2016 to the 28th of September 2016

Yours faithfully,

Alfie John

Dear Christina Hill,

I have narrowed the initial scope of my FOI:

COMPROMISED:

Within the Senate Inquiry into the handling of the 2016 Census, the Prime Minister's Special Adviser on Cyber Security (Alastair MacGibbon) submission contained the following quote:

“there was outbound traffic from the eCensus system, and the fear was it was 'potentially malicious'”

Contrary to this, on the 9th of August 2016, a government spokesperson reported by the ABC (Australian Broadcasting Corporation) said:

“No census data was compromised and no data was lost”

I request the following:

- What metrics were used to determine that the outbound traffic could have been “potentially malicious"

- What system(s) were able to detect that the outbound traffic from the eCensus system was “potentially malicious"

- Did this “potentially malicious” outbound traffic contain user submitted 2016 Census web forms data

- Which countries were the “potentially malicious” outbound traffic destined to

- How much traffic (in bytes) was measured for the “possibly malicious” outbound traffic

DDoS TRAFFIC:

News reports by the ABC state that the ABS online monitoring systems:

“detect[ed] a significant increase in traffic”

I request the following:

- What metrics and/or thresholds were used to determine that the 2016 Census web form needed to be taken offline

- A graph of aggregated (i.e total and anonymised) web request counts to the ABS website servers, between June 2016 to at least the 15th of September 2016

- A graph of aggregated (i.e total and anonymised) request bytes transferred to the ABS website servers between June 2016 to at least the 15th of September 2016

Note: The above graphs will already exist within the ABS' web team's, or their NOC's (Network Operations Center), server monitoring systems, so this should take minimal time to retrieve.

DDoS MITIGATION:

The ABS submission to the Senate Inquiry quotes:

"DDoS protection systems were not independently tested"

I request the following:

- Could I have a copy of the Statement of Work, and Master Service Agreement, between the ABS and ABS’ DDoS Mitigation provider(s)

Yours sincerely,

Alfie John

Dear Wolfgang Hertel,

Thank you for reminding me that I'm supposed to be requesting documents rather than asking for questions to be answered.

I have narrowed the initial scope of my FOI request. I request the following.

HIGHEST PRIORITY:

- Email correspondence created or received by ABS staff between the 8th of August 2016 to at least the 15th of September 2016 containing the words "malicious", "hack", "hacked", "Russia", or "China"

MEDIUM PRIORITY:

- A graph of aggregated (i.e anonymised) web request counts to the ABS web servers, between June 2016 to at least the 15th of September 2016

- A graph of aggregated (i.e anonymised) web request byte counts to the ABS web servers between June 2016 to at least the 15th of September 2016

Note: These graphs already exist within the ABS' web team's or their NOC's (Network Operations Center) server monitoring systems. As such, this should take minimal time to retrieve

LOW PRIORITY:

- Statement of Work, and Master Service Agreement, between the ABS and ABS’ DDoS Mitigation provider(s)

Again, thank you.

Sincerely,

Alfie John

Dear Emily Covington,

"we need your agreement today (14 October 2016) in order to extend the consultation period to 21 October 2016"

Yes, please extend the consultation period.

Yours sincerely,

Alfie John

Dear Australian Bureau of Statistics,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Australian Bureau of Statistics's handling of my FOI request 'ABS preparedness of 2016 Census from DDoS attacks and exfiltration of user submitted data'.

Unless I have received the wrong information, it is my understanding that each FOI request is allocated 5 hours to gather the requested resources. If the estimated time to gather the requested resources is over the 5 hours, a refusal is made.

It is of my opinion that the MEDIUM and LOW parts of my request should take no time at all as there is nothing to censor, and nothing needs to be generated as the resources already exist in their requested form.

As for the HIGHEST PRIORITY section, a quick search of the ABS email store would also take no time to gather.

In my opinion, the longest time to process my FOI request would be in the censoring of any personally identifying information that is not of the public interest. Now unless there were so many internal emails about hacking (which suggests an even bigger problem), this would in no circumstance that I could conjure, take the allocated time for the request. This is why I am requesting an internal review of my FOI request.

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.righttoknow.org.au/request/a...

Yours faithfully,

Alfie John