Census spies (part 2)

Following on from my surprise finding that New Zealand’s 2018 online census website is infested with third-party spies, I decided to look at it from the perspective of another browser add-on.

The NoScript Security Suite is a free Firefox extension that stops executable scripts from running on your browser. It blocks JavaScript, Java, Flash, Silverlight, and other plugins, only running them if you give it express permission to do so.

So what does it make of the online census site?

Visiting www.census.govt.nz throws up three alerts in a row:

Choosing, “Allow this request” three time in a row finally allowed me to view the target site.

From there I began the online census and tried to enter the access code I’d received in the mail.

I couldn’t sign in. After a couple of attempts, I realised that some background process was missing. I could type more than three characters in each box and the start button appeared to go nowhere:

I quickly realised NoScript had blocked something and clicked its icon:

If you don’t “trust” Google Analytics, you can’t do your 2018 census online.

Clicking the Temporarily Trusted button …

… allowed me to proceed.

So what is Google Analytics?

At its simplest, GA tracks and reports a website’s traffic. It runs a tracking code in the client’s browser, then collects and sends the data to Google.You’ll find it mentioned on the census site’s Privacy and Confidentiality page:

Do you use Google Analytics?

Yes, we use Google Analytics to collect information about when the site is being used, for how long, on what devices and which pages are being visited.

But there are privacy concerns. Back in 2015, Associated Press reported on US government health insurance website.

The scope of what is disclosed or how it might be used was not immediately clear, but it can include age, income, ZIP code, whether a person smokes, and if a person is pregnant. It can include a computer’s Internet address, which can identify a person’s name or address when combined with other information collected by sophisticated online marketing or advertising firms.

The same applies with NZ’s online census. Why the cluster of advertising sites around its main access page, as I revealed in my earlier post? Why even use Google Analytics at all?

Webmasters who seek to mitigate Google Analytics’ specific privacy issues can employ a number of alternatives having their backends hosted on their own machines.  [source]

This seems at odds with the Statistics Department’s Information privacy, security, and confidentiality policy which states:

Public willingness to provide data and information is central to achieving our goals, and is enabled by the high level of trust and confidence in the way we manage and secure this information. We must be mindful of public expectations about privacy, security, and confidentiality in order to maintain this critical level of trust and confidence. [my emphasis]

After this brief investigation, I no longer have a “high level of trust and confidence” in the way the online census site is being managed. The only option seems to be to request a paper form. Unfortunately, you can’t even do that unless you allow Google to look over your shoulder.

Leave a Reply