Information has begun to emerge about the confluence of events that led the ABS and IBM to take the site down on census night, which show IBM and ABS staff misinterpreted data and were spooked by fears of a damaging data breach following a fairly standard security threat known as a distributed denial of service (DDoS) attack.
The website problems were initially blamed on the DDoS attack, which would have made the site inaccessible to users by bombarding it with thousands of logins at once.
However, it was later confirmed that the ABS and IBM decided to take the site down due to security concerns
IBM has failed to explain publicly what happened. It put out a statement on Thursday evening simply saying it regretted the inconvenience concerned, thanking the ABS for its support and saying no data had been compromised.
Security insights
Security industry insiders have meanwhile flooded social media with insights into what went wrong.
Well-respected technology security specialist publisher Patrick Gray detailed a chain of events whereby IBM and the ABS are claimed to have declined the offer of DDoS prevention services from their networking provider NextGen Networks, believing they wouldn't need them.
The site was subsequently hit by DDoS attacks. However, it is said that IBM's systems analysts were later mistaken in believing they had detected census data being stolen by overseas hackers, when in fact it was either people logging in from overseas or simply using VPNs.
They believed the earlier DDoS was a tactic by hackers to distract them from the data theft and shut everything down.
Lawyers spoken to by The Australian Financial Review said legal action against IBM was a possibility, but it would likely be a tough fight for the ABS or the government to prove it was entirely culpable.
"The census site failing does not necessarily mean IBM's service was valueless and that money has to be repaid, but depending on the agreements with IBM and other contractors, there may well be liability if they failed to meet their obligations around system security and stability," Roland Müller of Parke Lawyers said.