Just months from the 2026 census, the statistics bureau is scrambling to prevent a repeat of past digital failures, with internal security ratings flashing red and emergency specialists hired to patch critical vulnerabilities.
A report from the Auditor-General revealed that despite the 2016 website crash, the Australian Bureau of Statistics (ABS) failed to properly plan for security across its wider computer network.
The situation became critical in early 2026 when executives warned that money for vital security contractors was set to run out in March, leaving no extra time in the schedule.
The ABS was forced to significantly expand its reliance on outside help. Specialists originally hired for a short four-week mission had their stay extended to as long as six months because the security problems were so significant.
By mid-February 2026, the bureau had to bring in even more cyber support to protect the $726 million digital rollout.
These actions were taken as the bureau prepared for the continued online shift in how the public interacts with the government.
It predicted that about 85 per cent of forms for the 2026 census would be completed online, up from the 58.8 per cent in 2016 and 78.9 per cent in 2021.
Despite the high stakes, the effort to fix the wider ABS security environment was designated red, meaning emergency action was required to get the project back on track.
The overall risk to the agency's broader network was rated medium-high as late as March 2026.
The Auditor-General found that although the ABS built a strong defence for the specific census website, it left a back door open by not securing the rest of the agency's systems.
A key chance to find these problems early was lost in August 2024 when ABS head David Gruen cancelled a planned census test because the government decided not to change the survey topics.
Later reviews found that risks to the broader network were not being clearly tracked or included in the overall census security plan.
Though officials were struggling with these basic security gaps, they continued to approve high-profile new technology.
In December 2025, the bureau approved an artificial intelligence (AI) chatbot called Claire to answer public questions.
At the same time, the agency's own checks showed it was failing to meet the Essential Eight, which are the government's basic rules for cyber security.
These problems were made worse by poor oversight. The main program board only received updates on risks rated as high or extreme, which meant several vulnerabilities were not flagged.
A dedicated security council to fix these monitoring gaps was not even established until June 2025 and was only officially made part of the census management structure in March 2026.
Furthermore, the bureau failed to document who was actually in charge of several major cyber risks, and some risks were never assigned an owner at all.
The audit also found that the internal checks the bureau used to track its work were often incomplete.
Some tasks were approved as complete even though required signatures were missing or there was no proof the work was done.
Documentation for how systems were built was also found to be poor, leaving security experts without enough detail to know if the designs were actually safe.
The previous two censuses had their difficulties. In 2016, the online form was shut down for 40 hours after cyber attacks, leading to a legal settlement with IBM, the company hired to build the system. Before the 2021 census, another audit warned that security measures were only partly appropriate.
The ABS has agreed to all four recommendations from the Auditor-General to fix these continuing issues before the 2026 census.
Dr Gruen said the bureau "reassesses cyber threats and risks, prioritises control for critical systems, actively adjusts sequencing and investment as vulnerabilities emerge, and integrates planning across census and non-census systems."
"The ABS is confident that its multi-layered assurance and continuous reassessment of the threat environment mean we will be ready to deliver the 2026 census," Dr Gruen said.
.png?w=600)
