Census Spies 2023

The 2018 New Zealand census was a disaster, attracting just an 83% response rate, well short of the 94% target. One in seven Kiwis, 700,000 people, failed to complete the census. I was one of them after highlighting my concerns about its potential for online spying in a couple of posts, (starting here). This time I naively imagined Stats NZ, who conduct the census, would have taken such concerns into consideration.

Nope.

But before we begin, a quick note about the tools I used. Both are free addons for the Firefox browser. The NoScript Security Suite blocks potentially malicious web content, while Lightbeam uses interactive visualizations to show the relationships between third parties and the sites you visit. (You can read more about it here.)

Now let’s look at both in action on this year’s census…

Visit the Census 2023 website and the NoScript icon immediately changes from benign to an alert that there are three trackers on this site. Clicking the NoScript icon shows what they are:

Note how NoScript defaults the three trackers to “Untrusted”. As most users don’t use NoScript and will be unaware of their presence, I set them to “Temp Trusted”:

But doing that and then refreshing the page lets in a whole new pack of nasties:

WTF? Up the top there is DoubleClick, a notorious advertising data harvester owned by Google. It seems I have a four more websites to “Temp Trust”:

Now I click “Start your census”. That leads to a page containing only three of the nasties…

…but those links have already been forged, as we’ll see in a moment.

Time now to enter my 12-character access code and click Start. There’s a comforting Welcome message…

…but Google Analytics stays with me…

… and sticks like glue throughout the following screens where I’m supposed to enter all manner of personal data as:

A Higher Level View

Now let’s look at where I am using Lightbeam to provide a graphical overview of the interconnected nature of this site. Here’s what it looks like by the time you start entering your personal data:

After just two website visits, I now have 10 third-party connections (one is apparently duplicated). Here’s an animated what’s what:

Notice, for example, how www.youtube.com, (also owned by Google), is now connected to the page where I enter all my personal data. The picture gets more complicated if I actually visit the YouTube site. There now seems to be a direct connection between my census data page, Census HQ and YouTube (highlighted):

The GA Connection

To me, the most worrying aspect of the online census is how Google Analytics follows every page of personal information that’s entered:

What’s that all about? Well, according to Wikipedia:

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic, currently as a platform inside the Google Marketing Platform brand. [My emphasis]

https://en.wikipedia.org/wiki/Google_Analytics

In short, it’s part of Google’s global advertising data collection platform. Selling itself as providing useful analytics for website owners, GA quietly collects data from unsuspecting users including:

• Recent and frequent searches 
• Location history
• Visited websites
• Used apps 
• Videos and ads viewed 
• Personal data like age or gender 

Google freely admit it’s all about advertising:

Google uses the information shared by sites and apps to deliver our services, maintain and improve them, develop new services, measure the effectiveness of advertising … and personalize content and ads you see on Google and on our partners’ sites and apps.

https://policies.google.com/technologies/partner-sites?hl=en-US&hl=en_US

Stats NZ describe their use of Google Analytics on the census site’s Privacy and Confidentiality page where they state specifically that;

• We cannot discover your identity with Google Analytics information.  
• We cannot link your browsing behaviour to your name, IP address, or exact location.  
• We cannot link Google Analytics information with your census answers. 

and I’m sure they can’t. But those “We cannot”s are just weasel words. The real question is, can Google? The answer to the first two statements in unquestionably “yes”, and the jury’s still out on the third. Even if GA tracking were perfectly benign, (which it isn’t), its presence on a government website demanding a great deal of personal information from its citizens is deeply concerning.

The poor results of the 2018 census cost the Government Statistician her job, so you might have thought Stats NZ would take a bit more care this time. Apparently not. It makes a mockery of their opening Privacy and Confidentiality statement that, “Stats NZ considers the protection of your information to be extremely important.” To which one might add, “Yeah, right!”

A 2022 report from the Global Data and Marketing Alliance entitled Global Data Privacy: What the Consumer Really Thinks found 71% of global consumers had a “high level of concern with the issue of online privacy” and that “77% of global consumers claim that transparency around how data is collected and used is important to them when sharing their personal information.”

Census data is important, there’s no denying that. So isn’t it time that Stats NZ started treating the suppliers of that data with the respect they deserve?

---

Footnote 1: Where-are-they-now? The former Government Statistician, Liz MacPherson, who resigned after the 2018 census disaster, is now a Deputy Commissioner in the Office of the Privacy Commissioner. That site, I’m happy to report, manages to get by without any hint of needing Google Analytics.

Footnote 2: Is it possible to construct a government website without all that google-shit? Absolutely. As you might expect, the Government Communications Security Bureau (GCSB) knows a thing or two about data security. A Lightbeam visit to their website shows it stands alone:

---