The Australian Bureau of Statistics and its computer provider IBM knocked back a proposal for extra defences to fend off a cyber attack.
Patrick Gray, an experienced journalist who hosts the popular Risky Business podcast, said the upstream provider NextGen Networks had offered denial of service (DOS) protection services for the census.
But the ABS and IBM said they did not need it.
However, when the initial DOS attack came on Tuesday morning, NextGen was called in to geoblock traffic coming from outside Australia.
Denial-of-service attacks overwhelm a target with either too many connection requests or too much bandwidth.
The result is to make the target inaccessible but often other parts of the system such as routers suffer collateral damage.
A series of DOS attacks and the failure of a vital router led to the ABS taking down its census site on Tuesday night, which was restored more than 40 hours later.
NextGen declined to comment when contacted by AAP on Thursday.
"Nextgen Group does not comment on any customers' services," a spokeswoman said.
When another DOS attack hit the ABS system from inside Australia, IBM's monitoring equipment sent out alerts which were interpreted as data being at risk of theft, Gray says.
It was feared the DOS attack was a distraction from the data theft, known as an exfiltration, and the system was taken down and the Australian Signals Directorate was called in.
However, Gray says the IBM alerts were "false positives" which incorrectly characterised offshore-bound system information as data being stolen.
Comment was being sought from the ABS.
