Two Australian University Students make a better Census in 54 hours

I know this is a popular way to look at things around here, but no. It's not about cloud / no cloud. People with sensitive data welcome VMs and cloud deployment - as long as the cloud is in a very separate datacentre with only local people handling it.

Look at the actual rules and what risks they want to protect from: http://www.abs.gov.au/websitedbs/D3310114.nsf/4a256353001af3...

Here are some of them:

    2. an audited linking environment, involving staff activity being logged, monitored and, if
    inappropriate activity is found, investigated. Any misuse would result in immediate
    termination of access for the staff member, with further sanctions imposed if necessary;
    3. ABS staff and in-posted officers sign legally binding Undertakings of Fidelity and Secrecy to
    ensure they are aware of their obligation to protect confidential information, and the
    consequences of disclosure (which include criminal penalties);
    4. enforcement of the clear desks and clear screen policy;
    5. access on a ‘need to know’ basis;

How do you enforce those rules on AWS / Azure / whatever provider's staff? How do you make sure only people with appropriate clearance access the servers?

    7. Vulnerability Assessments are carried out on all new IT Systems by specialised staff in IT
    Security trained in the field of Ethical Hacking;

How do you get those providers to agree to internal pentest exercises?

At that point, it's just easier to stuff some more servers in the government datacentre - completely isolated from other projects. And whether it's cloud or not is a completely separate thing - it may as well be on OpenStack.

> Older people are suspicious of cloud. The younger generation are more savvy.

So no, this is complete bullshit. (and so is putting this as us-vs-them - I'm part of a fairly young generation in the CS, working on cloud infrastructure, and I still would not want to see census data processed anywhere outside of "no phones in the building" government environment)

That's great, but you are trusting AWS. If someone has access to the server hardware thay can completely own you and all your TLS data. End to end encryption is one way, but my understanding is that achieving this in browser with javascript isn't a good idea.

The younger generation are more gullible, lacking awareness of data security, oblivious to data sovereignty, and easily distracted by squirrels.

An Australian census is never going to take place in hardware controlled by a foreign national on foreign soil, especially not in a country where cloud servers have been seized in the past for simply having the possibility of containing data associated with a person associated with a crime.

One thing you will learn as you gain real world experience is that there is no such thing as "too paranoid" when it comes to IT projects handling sensitive data.

You think IT guys in ABS do not know about AWS? It is about what the management thinks. And management needs code.gov like initiative desperately. Otherwise we will keep bleeding money to IBM time and time again.

A benchmark doesn't mean anything unless it's benchmarked with all features and requirements accounted for.

I have all sympathy for the argument that you could do things better and cheaper than the government and IBM, but while banter isn't productive, neither is a benchmark of a bare hosted web form.

Edit: and as another poster below me pointed out, lower downs in the ABS are well aware of AWS. Inability to get new tools and methods in was one of the reasons I left (also the philosophy that tech pay basically tops out at the APS six level, and they don't want tech experts at EL1 / EL2 levels, they want "managers". Also, the government has been pretty explicit that they don't value or respect the ABS: efficiency dividends, job cuts, left without a head for a long time, moving jobs too Geelong!?!, and low levels of pay for technical experts).

Edit 2: also I just want to stare that I in no way think AWS is necessarily the right platform on which to be conducting a national census.

> The purpose was to show that it can be done better and cheaper than what IBM and the Australian Government came up with in FIVE years vs 2 students in 24ish hours.

Sure, they made a nice little prototype -- or MVP, if you will. I'll certainly give them credit for that.

But did they really do it "better and cheaper ... in 24ish hours" when they didn't come anywhere near meeting all of the requirements of the project (most of which probably aren't even public/published)?

> scalable ways to host a web form

That's the trivial part. You seem to imply ABS spent 5 years doing just the web form and that's a false premise just there. Once they match the privacy requirements you can read about here:

http://www.abs.gov.au/websitedbs/D3310114.nsf/4a256353001af3...

Let me know how much time it took them (including getting security clearance to do it, all the post-processing, hardware management, etc.)

Thank you. I'm surprised where this discussion has headed.

Of course the kids didn't rebuild the ABS census system in 50-some hours, and I don't think the sensationalism in this article is meant to be taken so literally. The purpose of the hackathon project and of the article is more likely to help the average person understand that the ABS could have built this in a fraction of the time, at a fraction of the cost, and given the technically trivial task at hand, it shouldn't have failed.