No Commonwealth access to Australia’s COVID-19 contact tracking app

April 21, 2020 TH Author

Prime Minister Scott Morrison has said the government is carefully working through the security concerns and technical assurances of Australia’s soon-to-be launched COVID-19 contact tracing app.

“We have not been rushing to this solution, we’ve been listening carefully since we first indicated that we’d be moving to use this app, to the various concerns that have been raised and ensure that they’re being addressed,” Morrison said during a press conference on Tuesday.

With former leader of the National Party Barnaby Joyce concerned the app would have the potential to be hacked, and public chatter on the intrusive surveillance capabilities the app would extend to the government, Morrison said no Commonwealth entity will have eyes on the data.

“The app only collects data and puts it into an encrypted national store, which can only be accessed by the states and territories,” he said.

“The Commonwealth can’t access the data, no government agency at the Commonwealth level, not the tax office, not government services, not Centrelink, not Home Affairs, not Department of Education — the Commonwealth will have no access to that data.”

He said the data will be locked in an encrypted data store that can only be accessed by state health “detectives” — those currently performing tracing efforts.

After failing to rule it out last week, Morrison tweeted over the weekend that the app would not be made mandatory.

The app, which is “coming soon”, will be a rework of Singapore’s TraceTogether.

TraceTogether app taps Bluetooth signals to detect other participating mobile devices in close proximity to allow them to identify those who have been in close contact when needed.

The app is able to estimate the distance between TraceTogether smartphones as well as the duration of such interactions.

It identifies participating TraceTogether users who are within two metres of each other for more than 30 minutes. The data then is captured, encrypted, and stored locally on the user’s phone for 21 days, which spans the incubation period of the virus.

Singapore has only had a 20% buy-in, and Morrison said Australia needs to at least double that for the initiative to work.

Former Shadow Minister for the Digital Economy and Human Services Ed Husic said in order to reach a successful buy-in, more assurances around privacy need to be given.

“If the government can’t get its own members to use it, what faith would the broader public have in using this tracing app,” he said.

“It needs to ensure the data that is generated through the app is only used for the purpose that everyone’s been told it’s being used for and that is to help prevent the spread of coronavirus in Australia and that we can track where people have been infected so that we can better deal with those outbreaks.”

According to Husic, in addition to adequately addressing privacy, the government should also provide assurance through “ironclad commitments” that none of the data generated through the app will be on-sold to third parties, and that if anyone else is going to use the data, for example health researchers, there is also a guarantee that the data is anonymised.

“There’s a whole range of different applications stemming, or uses of that data, stemming right from the app itself. It would need to have some detail provided. But again, the government hasn’t done it and they don’t really have the best track record when it comes to digital,” he said.

“If Stuart Robert’s the person that’s overseeing all this, I think a lot of us are going to need convincing that this is going to work properly.”

Robert — who in October 2018 was found to have spent 20 times more than other MPs on his home internet, clocking up more than AU$2,000 a month, and blaming “connectivity issues” for the high costs — on Monday said downloading the app would bring Australia closer to having restrictions loosened, allowing the nation to get back to the footy and get back to the beach sooner.

“We’re gonna have to encourage Australians to say if we want to loosen our restrictions, this is a core part of that step to do it,” he said later on Monday.

“If we want to get back to the footy and the beach this is a core part of that, and also to give them confidence that because the source code will be published and the privacy statement will be out there that people will know exactly what information is there to protect them, so they’ll have confidence to download it.”

The minister last month said that the government’s online portal myGov had suffered a distributed denial of service (DDoS) attack, when it was simply that thousands flocking to sign up for welfare in the wake of job losses caused by COVID-19 had pushed the portal past its 55,000 concurrent users limit.

Shortly after, Morrison asked for patience.

“We’ve gone from 6,000 to 50,000 to 150,000 all in the space of, a matter of a day. And tonight, they’re working to boost it again. I would say to Australians, yes, we are terribly sorry, but at the same time, we are asking Australians, even in these most difficult of circumstances, to be patient. Everyone is doing their best,” he said at the time.

MyGov has since been boosted to allow for 300,000 concurrent users.

“There are 79,114 concurrent users as at five minutes ago,” Robert said on Monday.

“Three weeks ago … it could take sort of 6,000 concurrent users, we’ve now built it for 300,000 concurrent users. That is the amount of investment we’re putting in there, 55,130 people right now on the Centrelink Express Plus app, and you can claim for JobSeeker through both of those platforms right now.”

At the time of writing, the World Health Organization reported that there have been over 2.3 million confirmed cases, with nearly 158,000 fatalities as a result of the virus. Australia has reported around 6,600 cases and 71 deaths.

More than 434,000 tests have been conducted across Australia.

MORE FROM AUSTRALIA