S. R. Howell

Committee Secretariat Senate Standing Committees on Economics PO Box 6100 Parliament House Canberra ACT 2600 e: [email protected]

Submission to Senate Economics References Committee Inquiry into the 2016 Census My name is Stephen R. Howell. I make this Submission as an individual with expertise in evidence- based decision making. The Submission is not to be associated with a charity that I assist in a pro bono capacity. I am prepared to give evidence in person if that would assist the Committee.

1. My qualifications and standing I am now retired. From the 1970s I used Census data professionally, as a member of the then Royal Australian Planning Institute (RAPI) and the then Royal Australian Institute of Parks and Recreation (RAIPR). This work was usually commissioned by government and undertaken to assist government in making decisions for the allocation of public funds for conservation, recreation, road and other projects, as well as the allocation and management of Crown land and other public resources.

2. Standing of Bureau of Statistics (ABS) The ABS is an essential element in decisions by government at all levels as well as business, trading interests, local communities and others. Until the past decade the ABS developed and maintained superior skills and expertise. These were maintained in-house, providing an organisational memory and continuity of effort which are essential to the stewardship of time-series data.

3. Diminution of the ABS The ABS requires superior skills and expertise to be maintained in-house. Regrettably these essential skills and expertise have been diminished – even stripped – by recent governments. In August 2016 the Australian Financial Review drew attention to ‘a long-term degradation’ in the ABS’s capacity ‘a ‘spectacular diminution’ of the ABS, indicating ‘neglect – even contempt’.1

1 Australian Financial Review (2016) ‘ABS census shows spectacular diminution of our once mighty public sector’, by Laura Tingle. Go to: http://www.afr.com/opinion/columnists/laura-tingle/abc-census-shows- spectacular-diminution-of-our-once-mighty-public-sector-20160811-gqpx3v “... the ABS has been the subject of a long-term degradation in its capacity under both sides of politics. A sign of the neglect – even contempt – in which the bureau seemed to be held by the Abbott government was that the job of chief statistician was left empty for almost a year until it was filled by David Kalisch in December 2014. It has lost hundreds of millions of dollars from its budget in recent years and hundreds of people over the best part of a decade. In January 2014 it sought a $300 million bailout, arguing that its financial position left it "with barely enough cash to keep the lights on". 4. Need to rebuild the in-house skills and expertise of the ABS I have observed with growing concern this diminution of the ABS and degradation of its in-house capacities. In the interests of evidence-based decision making, the ABS needs to be rebuilt so that superior skills and expertise can be maintained in-house and continuity of stewardship maintained.

5. The proposal for data matching breaches a social contract From its inception, the Census has offered a social contract with Australians, which I state as follows: In return for citizens providing their personal information, the Census would protect privacy and confidentiality and deliver information that could be used for community purposes. The 2016 Census broke this contract. The 2016 Census provides for data matching of personal identifying information with data from sources outside the ABS. This proposal was not publicised by the former Ministers (Alex Hawke and Kelly O'Dwyer). There is no basis for the changes made to this social contract, by virtue of failure to obtain community consent and with respect to cyber security.

6. Community consent: In 1985, Australians rejected data matching At the ‘Taxation Summit’ held in July 1985, a national identification card (an Australia Card) was proposed for Australian citizens and resident foreigners. The Australia Card Bill 1986 proposed data matching of identity, tax, social security and other information.2 It was silent regarding the Census. The proposal was rejected by a Joint Select Committee (established on 13 November 1985).3 According to the Bills Digest, the proposal was rejected by across party lines (rejected by one member from the A.L.P., two Liberals, and one member each from the National Party and the Democrats).

7. Data matching by the Census requires community consent Proposed data matching by the Census raises issues similar to the failed Australia Card proposal. If government wishes to initiate data matching, this should be subject to debate in context of an identity card proposal; and community consent obtained through parliament before being implemented. Such consultation happened in 2005, with respect to collection of name information, viz.: ‘The ABS commenced using names and addresses to enhance Census data through data integration in the 2006 Census. This change followed community consultation in 2005, and has been transparently communicated through media releases, public submission papers, privacy impact assessments, published research, stakeholder consultation and the ABS website.4 This sort of consultation did not occur in preparation for the 2016 Census. Given that government imposed cutbacks, responsibility for the failure to communicate rests with the several Ministers.

2 The Australia Card Bill accorded privileges to the Commissioner of Taxation, the Health Insurance Commission, Departments that dealt with defence or administered the Social Security Act 1947, the Veterans’ Entitlement Act 1986, the Student Assistance Act 1973, the Australian Citizenship Act 1948 or the Migration Act 1958 3 Parliament of Australia (1986) Bills Digest No. 159 1986: Australia Card Bill 1986. Go to: http://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/bd/bd1986/1986bd159 4 Australian Bureau of Statistics (2016) Privacy, confidentiality & security. Go to: http://www.abs.gov.au/websitedbs/censushome.nsf/home/privacy?opendocument&navpos=130 Inquiry into the 2016 Census. Submission by S. R. Howell 3

8. Ongoing Government failure to communicate explain and enlist support There was a failure by government to communicate in advance the proposed arrangements for the 2016 Census and a monumental failure to discuss with communities, let alone to garner informed consent and to enlist public support. Regrettably this failure continued through September 2016. On 9 September 2016, I telephoned the office of Minister McCormack, the Minister for Small Business. I set out the bases for my concerns that the reputation of the Census was being damaged. I asked that the Minister pro-actively explain certain decisions and give assurances re data matching. No public statement by the Minister about these matters has reached me or my networks.

9. Data matching and cyber security Parliament’s own e-mail system was hacked in 2011.5 This was not an isolated incident of hacking.6 Other sensitive and or personal information, supposedly protected by government, has also been hacked. The attack on the Bureau of Meteorology7 and the WA Parliament8 are noted in this Submission because they occurred after the national cyber security system was strengthened and despite government documents which recognised particular cyber threats.9

10. Can we rely on government assurances regarding cyber security? Quite simply, no. Proposals for data matching introduce new risks, not accounted for by the ABS.10

• Australia’s cyber security arrangements are segmented and fragmented.11 Further, exposure of data through back-door attacks is an acknowledged risk. In similar circumstances, in Britain:

5 Australian Financial Review (2014) Chinese spies may have read all MPs’ emails for a year, by Christopher Joye and Aaron Patrick . Go to: http://www.afr.com/news/policy/defence/chinese-spies-may-have-read-all- mps-emails-for-a-year-20140427-if7ag “The Chinese intelligence agencies that penetrated Australia’s parliamentary computer network in 2011 may have been inside the system for up to a year and had access to documents and emails that reveal the political, professional and social links across the political world, according to seven sources with knowledge of the breach. Security and parliamentary sources said Chinese agencies obtained remote, system administrator access to the Parliament’s computer network, which “effectively gave them control of it". 6 Australian Institute of Criminology (2005) Hacking offences. Go to: www.aic.gov.au/media_library/publications/htcb/htcb005.pdf 7 Computerworld (2016) Prime minister confirms Bureau of Meteorology was hacked, by Rohan Pearce. Go to: http://www.computerworld.com.au/article/598441/prime-minister-confirms-bureau-meteorology-hacked/ 8 Delimiter (2016) Trojan takes down entire WA Parliament IT, phone system. Go to: https://delimiter.com.au/2016/02/17/trojan-takes-down-entire-wa-parliament-it-phone-system/ 9 Department of the Prime Minister and Cabinet (2016) The Australian Cyber Security Centre Threat Report 2015. Go to: https://acsc.gov.au/publications/ACSC_Threat_Report_2015.pdf 10 The ABS web site asserts that it does 'comply with the Privacy Act 1988 (Privacy Act) and handle your personal information in accordance with the Australian Privacy Principles (APPs).' Go to: Australian Bureau of Statistics (2016) Privacy, confidentiality & security. http://www.abs.gov.au/websitedbs/censushome.nsf/home/privacy Inquiry into the 2016 Census. Submission by S. R. Howell 4

‘The National Audit Office has issued a damning report of the UK government's approach to digital security. The central teams and departments dedicated to protecting information were found to be operating without cohesion and governance. There are 73 teams and 1,600 staff across government with data security responsibilities.’12 • In any case, the ABS’s interaction with the community depends on security steps being taken by members of the community. The ABS recommends steps such as up-to-date security software and regular scans:13 This approach expresses one of the flaws identified in the British Inquiry – namely that individual are made responsible for addressing systemic failures. The British Inquiry argued that the re-design of public services, and introducing technology to support changes, require that ‘the centre of government provides clear principles and guidance and departments increase their capacity to make informed decisions about the risks involved.’ This Submission encourages government to recognise risks, to avoid quick fixes and slogans, and to support the ABS with sufficient ongoing resources to rebuild essential skills and experience in-house. 11. The problem(s) of out-sourcing ABS functions This Submission has already asserted the need for ABS to maintain skills and experience in-house, in order to maintain continuity of stewardship over our time series data and personal information. A second group of reasons for retaining the Census in-house has to do with

• Responsibility • Accountability • Transparency • Governance and ethics The ABS is a statutory body, reporting to Parliament. Over decades in the past, it did employ staff who upheld the highest standards of integrity, skill and solid, workmanlike performance. The Census requires public trust. It is not an enterprise to be undertaken on a least-cost basis. Nor is it to be outsourced to any external body whose ethics and or standards are less than we expect. Aspects of the 2016 Census were outsourced to a commercial entity, IBM. In this regard, it is noted that a recent report by the ABC, based on Edwin Black's book, ‘IBM and the Holocaust’, asserted that IBM had provided services to the Nazi government of Germany in the guise of a census but in fact enabling the identification of Jewish persons and their subsequent ghetto-isation and transport.14 Clearly, a non commercial in-house Census is also to be preferred on grounds of governance and ethics. End of Submission

11 Baker McKenzie Lawyers (2015) Australian Government Cyber Security Infrastructure, August. Go to: http://www.bakermckenzie.com/files/Uploads/Documents/Publications/AP/al_australia_governmentcybersec urity_aug15update.pdf 12 BBC News (2016) 'Government data security slammed in new report', 13-14 September 2016. Go to: http://www.bbc.com/news/technology-37348019 13 Your online security is extremely important to us. Go to: http://help.census.abs.gov.au/security#backtotop 14 Rear Vision (2016) 'The dark side of census collections', ABC , Wednesday 21 September 2016. Go to: http://www.abc.net.au/radionational/programs/rearvision/the-dark-side-of-census- collections/7860908