Australian Member of Parliament’s Websites: How Secure Are They?

The 2019 federal elections are just around the corner, so we thought it would be an interesting exercise to review the websites of our state MPs and see how they perform against a relatively simple security and best practices check.

Bear in mind that this wasn’t a comprehensive analysis but more of a general overview. If we repeat the same checks now results may well be different. Hopefully better.

As part of the process, we emailed MPs to let them know of our findings and gave them plenty of time to make changes. We put together a PDF covering best practices and included a checklist for them to share with their web developers.

View infographic on LinkedIn, Twitter or Facebook

Researching the websites of 582 MPs

In January 2019, we researched publicly available data from portals such as Parliament of Victoria and Queensland Parliament, making a note of email addresses and URLs of personal websites. If the latter were not listed we tried to find them via Google.

We got our first statistic of relevance at the end of this process: of the 582 MPs we researched, 237 of them had websites, so 41% of the total.

So, with our original list cut in half we checked the following:

  1. Hosting – what company was used and in what country their servers are located
  2. SSL Certificates – whether any were installed and if so, whether there were any errors
  3. Domain registration – checking the details for the Registrant Contact Name and Registrant Contact Email specifically
  4. Performance – using GT Metrix to check homepages size and page load times, taking the average of three checks for accuracy

We didn’t look at what applications were hosted nor the technical specs of the hosting providers.  We also didn’t conduct any vulnerability or penetration testing, as we’ve seen on many public-facing Government websites and applications.

Our findings

1. Hosting

Of the 237 websites, we looked at 49% (115) were hosted abroad. While many Australian businesses host their websites abroad – we don’t think MPs should be doing so:

  • They are hosting their data, and potentially data of Australian citizens, with companies that don’t have to comply with Australian legislation
  • Foreign companies or authorities may have full access to this data
  • There are web hosting providers here in Australia that, just like us, offer a great product, local support and comply with Australian laws

In regards to the above, the Australian Cyber Security Center recently published a Cloud Computing Security Considerations document covering this scenario specifically:

The ACSC recommends against outsourcing information technology services and functions outside of Australia, unless organisations are dealing with data that is all publicly available. The ACSC strongly encourages organisations to choose either a locally-owned vendor or a foreign-owned vendor that is located in Australia and stores, processes and manages sensitive data only within Australian borders. Note that foreign-owned vendors operating in Australia may be subject to foreign laws such as a foreign government’s lawful access to data held by the vendor.

2. Securing communication with SSL

SSL certificates encrypt data as it travels to and from a user’s browser. For example, login details, credit card information and enquiries passed via online forms.

While we didn’t see any form or website function capturing critical data such as credit card numbers we wouldn’t want anyone intercepting our personal information such as our name, phone number and email address.

13% of the websites we analysed either had no SSL certificate in place or it wasn’t installed correctly. That’s 31 out of 237 websites that are at risk of ‘leaking’ data as users interact with them.

There is no excuse for failing to install an SSL certificate considering you can get them for free from most web hosting providers. In fact, of those that do have SSL in place, 133 use a free version. Free SSL certificates are good enough for the type of functions you find on websites that are mostly informational, however, premium versions that come with installation support and warranties typically cost less than $50 a year.

3. Domain registration

We recommend that our customers always use their own details when they sign up for services, including domain registration. If not, they risk losing access to those services, or even worse, someone taking over and using them maliciously.

36% of MPs domain names list third parties as the Registrant contact. In most cases, these are the web developers or agencies that have built their websites. This means any administrative or renewal emails related to the domain could be overlooked and not forwarded to the domain owner.

Premier Scott Morrison was lucky when a prankster registered his expired domain. He just wanted to have a little fun. Someone else could have pointed the domain to somewhere malicious or spoofed his site to capture personal data and send misleading information.

AuDA states “It is necessary for the WHOIS data to include a contact email address for the registrant, for the purpose of contacting the registrant in relation to their domain name. The registrant does not have to nominate their own personal email address, but they must nominate an email address at which they can be contacted.”

As a domain name is the cornerstone of a website, proper management of this digital asset is critical.  Assigning domain management to a third party or unmonitored email account could end in disaster.

4. Performance

Results were in line with the norm with page load speeds averaging 5.8 seconds and an average page size of 3.4MB.

If you’re running an eCommerce store or transactional-based website you will want to boost those figures though, as research shows that visitors tend to drop off in droves if you make them wait any longer than 2 seconds.

MPs publish mostly information about their policies and achievements, so it’s not hard to keep the interface light, page load times low and offer a better user experience. The load time averages are likely higher due to the number of websites hosted overseas on commodity hosting solutions.

Sharing our results with MPs

This proved to be much harder than expected. MPs and their teams must be busy these days and their email autoresponders often said the same thing:

That said, we approached them with some urgency and were able to share informative data relevant to their websites, as well as tips on how to best manage hosting, domains, and digital security.

The sequence was as follows:

22nd February 2019 – First email, sent to all MPs – with versions for those with a website and those without to raise awareness.

Bounced emails: 3.4% (20)
Opens: 25.2% (148)
Human Replies: 0.5% (3)

3rd March 2019 – Follow up sent to all MPs – minus the ones that bounced or indicated that they didn’t want to hear from us anymore.

Bounced emails: 1.3% (7)
Opens: 32.6% (182)
Human Replies: 0.7% (4)

What’s interesting here is that these stats are in line with what you would expect from your typical email newsletter. But looking at the open rates, shouldn’t they be closer to 100%? Surely MPs have staff that check every piece of communication they receive before deciding whether to reply or not?

Results by party

To determine this we flagged all MPs experiencing at least one of the three issues we looked at: hosting their website abroad, not having a properly configured SSL certificate in place or not owning the domain’s Registrant Name and Email details.

The results were…

Total MP Websites Websites with issues Percentage with issues
Labour 87 56 64.4%
Liberals 102 88 86.3%
Green 12 9 75.0%
Other 36 26 72.2%

Of the three main parties Labour performed best, but the with more than half of their websites ‘offending’ they have a lot of work to do too.

Many of the websites are published on the Nation Builder platform, which is owned by US-based 3dna, Corp. They host customers in US-based data centres, including content, files and customer data of Australian MPs using their service. 3dna, Corp. is based in California and therefore abiding by local rules and regulations governing access to their data, and our MPs are effectively disregarding ASCS’s recommendation to store sensitive data within our borders.

Digital best practices: another thing we can accuse our politicians to underdeliver on?

It goes without saying that MPs websites should be leading by example as far as security and user experience is concerned.

They (their staff, at least) should make more of an effort to use local tech and talent too. They should at least glance over all their emails and contract reputable web developers that can advise them on best practices.

Concluding thoughts: our MPs may be putting their websites and data at risk!

This simple exercise has shown us that 76% of MP’s websites we looked at didn’t pass our security and best practices check. If you suspect your local MP is not following best practices, point them to this article.

The Australian Cyber Security Centre is there to remind us too and help us keep safe. We share their mission to make Australia the safest place to connect online.

xosotin chelseathông tin chuyển nhượngcâu lạc bộ bóng đá arsenalbóng đá atalantabundesligacầu thủ haalandUEFAevertonfutebol ao vivofutemaxmulticanaisonbetbóng đá world cupbóng đá inter milantin juventusbenzemala ligaclb leicester cityMUman citymessi lionelsalahnapolineymarpsgronaldoserie atottenhamvalenciaAS ROMALeverkusenac milanmbappenapolinewcastleaston villaliverpoolfa cupreal madridpremier leagueAjaxbao bong da247EPLbarcelonabournemouthaff cupasean footballbên lề sân cỏbáo bóng đá mớibóng đá cúp thế giớitin bóng đá ViệtUEFAbáo bóng đá việt namHuyền thoại bóng đágiải ngoại hạng anhSeagametap chi bong da the gioitin bong da lutrận đấu hôm nayviệt nam bóng đátin nong bong daBóng đá nữthể thao 7m24h bóng đábóng đá hôm naythe thao ngoai hang anhtin nhanh bóng đáphòng thay đồ bóng đábóng đá phủikèo nhà cái onbetbóng đá lu 2thông tin phòng thay đồthe thao vuaapp đánh lô đềdudoanxosoxổ số giải đặc biệthôm nay xổ sốkèo đẹp hôm nayketquaxosokq xskqxsmnsoi cầu ba miềnsoi cau thong kesxkt hôm naythế giới xổ sốxổ số 24hxo.soxoso3mienxo so ba mienxoso dac bietxosodientoanxổ số dự đoánvé số chiều xổxoso ket quaxosokienthietxoso kq hôm nayxoso ktxổ số megaxổ số mới nhất hôm nayxoso truc tiepxoso ViệtSX3MIENxs dự đoánxs mien bac hom nayxs miên namxsmientrungxsmn thu 7con số may mắn hôm nayKQXS 3 miền Bắc Trung Nam Nhanhdự đoán xổ số 3 miềndò vé sốdu doan xo so hom nayket qua xo xoket qua xo so.vntrúng thưởng xo sokq xoso trực tiếpket qua xskqxs 247số miền nams0x0 mienbacxosobamien hôm naysố đẹp hôm naysố đẹp trực tuyếnnuôi số đẹpxo so hom quaxoso ketquaxstruc tiep hom nayxổ số kiến thiết trực tiếpxổ số kq hôm nayso xo kq trực tuyenkết quả xổ số miền bắc trực tiếpxo so miền namxổ số miền nam trực tiếptrực tiếp xổ số hôm nayket wa xsKQ XOSOxoso onlinexo so truc tiep hom nayxsttso mien bac trong ngàyKQXS3Msố so mien bacdu doan xo so onlinedu doan cau loxổ số kenokqxs vnKQXOSOKQXS hôm naytrực tiếp kết quả xổ số ba miềncap lo dep nhat hom naysoi cầu chuẩn hôm nayso ket qua xo soXem kết quả xổ số nhanh nhấtSX3MIENXSMB chủ nhậtKQXSMNkết quả mở giải trực tuyếnGiờ vàng chốt số OnlineĐánh Đề Con Gìdò số miền namdò vé số hôm nayso mo so debach thủ lô đẹp nhất hôm naycầu đề hôm naykết quả xổ số kiến thiết toàn quốccau dep 88xsmb rong bach kimket qua xs 2023dự đoán xổ số hàng ngàyBạch thủ đề miền BắcSoi Cầu MB thần tàisoi cau vip 247soi cầu tốtsoi cầu miễn phísoi cau mb vipxsmb hom nayxs vietlottxsmn hôm naycầu lô đẹpthống kê lô kép xổ số miền Bắcquay thử xsmnxổ số thần tàiQuay thử XSMTxổ số chiều nayxo so mien nam hom nayweb đánh lô đề trực tuyến uy tínKQXS hôm nayxsmb ngày hôm nayXSMT chủ nhậtxổ số Power 6/55KQXS A trúng roycao thủ chốt sốbảng xổ số đặc biệtsoi cầu 247 vipsoi cầu wap 666Soi cầu miễn phí 888 VIPSoi Cau Chuan MBđộc thủ desố miền bắcthần tài cho sốKết quả xổ số thần tàiXem trực tiếp xổ sốXIN SỐ THẦN TÀI THỔ ĐỊACầu lô số đẹplô đẹp vip 24hsoi cầu miễn phí 888xổ số kiến thiết chiều nayXSMN thứ 7 hàng tuầnKết quả Xổ số Hồ Chí Minhnhà cái xổ số Việt NamXổ Số Đại PhátXổ số mới nhất Hôm Nayso xo mb hom nayxxmb88quay thu mbXo so Minh ChinhXS Minh Ngọc trực tiếp hôm nayXSMN 88XSTDxs than taixổ số UY TIN NHẤTxs vietlott 88SOI CẦU SIÊU CHUẨNSoiCauVietlô đẹp hôm nay vipket qua so xo hom naykqxsmb 30 ngàydự đoán xổ số 3 miềnSoi cầu 3 càng chuẩn xácbạch thủ lônuoi lo chuanbắt lô chuẩn theo ngàykq xo-solô 3 càngnuôi lô đề siêu vipcầu Lô Xiên XSMBđề về bao nhiêuSoi cầu x3xổ số kiến thiết ngày hôm nayquay thử xsmttruc tiep kết quả sxmntrực tiếp miền bắckết quả xổ số chấm vnbảng xs đặc biệt năm 2023soi cau xsmbxổ số hà nội hôm naysxmtxsmt hôm nayxs truc tiep mbketqua xo so onlinekqxs onlinexo số hôm nayXS3MTin xs hôm nayxsmn thu2XSMN hom nayxổ số miền bắc trực tiếp hôm naySO XOxsmbsxmn hôm nay188betlink188 xo sosoi cầu vip 88lô tô việtsoi lô việtXS247xs ba miềnchốt lô đẹp nhất hôm naychốt số xsmbCHƠI LÔ TÔsoi cau mn hom naychốt lô chuẩndu doan sxmtdự đoán xổ số onlinerồng bạch kim chốt 3 càng miễn phí hôm naythống kê lô gan miền bắcdàn đề lôCầu Kèo Đặc Biệtchốt cầu may mắnkết quả xổ số miền bắc hômSoi cầu vàng 777thẻ bài onlinedu doan mn 888soi cầu miền nam vipsoi cầu mt vipdàn de hôm nay7 cao thủ chốt sốsoi cau mien phi 7777 cao thủ chốt số nức tiếng3 càng miền bắcrồng bạch kim 777dàn de bất bạion newsddxsmn188betw88w88789bettf88sin88suvipsunwintf88five8812betsv88vn88Top 10 nhà cái uy tínsky88iwinlucky88nhacaisin88oxbetm88vn88w88789betiwinf8betrio66rio66lucky88oxbetvn88188bet789betMay-88five88one88sin88bk88xbetoxbetMU88188BETSV88RIO66ONBET88188betM88M88SV88Jun-68Jun-88one88iwinv9betw388OXBETw388w388onbetonbetonbetonbet88onbet88onbet88onbet88onbetonbetonbetonbetqh88mu88Nhà cái uy tínpog79vp777vp777vipbetvipbetuk88uk88typhu88typhu88tk88tk88sm66sm66me88me888live8live8livesm66me88win798livesm66me88win79pog79pog79vp777vp777uk88uk88tk88tk88luck8luck8kingbet86kingbet86k188k188hr99hr99123b8xbetvnvipbetsv66zbettaisunwin-vntyphu88vn138vwinvwinvi68ee881xbetrio66zbetvn138i9betvipfi88clubcf68onbet88ee88typhu88onbetonbetkhuyenmai12bet-moblie12betmoblietaimienphi247vi68clupcf68clupvipbeti9betqh88onb123onbefsoi cầunổ hũbắn cáđá gàđá gàgame bàicasinosoi cầuxóc đĩagame bàigiải mã giấc mơbầu cuaslot gamecasinonổ hủdàn đềBắn cácasinodàn đềnổ hũtài xỉuslot gamecasinobắn cáđá gàgame bàithể thaogame bàisoi cầukqsssoi cầucờ tướngbắn cágame bàixóc đĩaAG百家乐AG百家乐AG真人AG真人爱游戏华体会华体会im体育kok体育开云体育开云体育开云体育乐鱼体育乐鱼体育欧宝体育ob体育亚博体育亚博体育亚博体育亚博体育亚博体育亚博体育开云体育开云体育棋牌棋牌沙巴体育买球平台新葡京娱乐开云体育mu88qh88

Leave a Reply

Your email address will not be published. Required fields are marked *