ASD vetting code on Australia’s future COVID trace app

Government services minister Stuart Robert says Australia’s future COVID-19 contract tracing app is being developed with “very strong cyber assistance” now being provided by national security agencies, as questions around the vague detail of the software continue to swirl.

Despite a raft of preparatory scene setting and selective backgrounding, key specifics of how the health surveillance software operate remain an open question as the government tests the waters for public acceptance.   

Robert on Thursday sought to reassure the public that the app, which was unofficially announced earlier on Tuesday after weeks of talk, would only exchange mobile phone numbers in “highly encrypted form”.  

“[The app is] in the final stages of a Privacy Impact Assessment, with very strong cyber security assistance with Australian Cyber Security Centre and the Australian Signals Directorate,” he told FiveAA Adelaide.

The app, which he said remains “some weeks away”, will help expedite and simplify the contact tracing process undertaken by Department of Health officials, and could ultimately lead to fewer restrictions.

It is widely expected to be modelled off source code from the Singapore Government’s TraceTogether app, which uses bluetooth to identify when two people with the app installed come into contact. 

Robert said Australia’s app would work by exchanging the mobile numbers of two people who have the app installed if they stand one-and-a-half metres apart for 15 minutes or more.

He said the phone numbers would be exchanged in a “highly encrypted form” and securely stored on an individual's device for periods of 21 days, in the same way that TraceTogether does.

The simplified description did not make it clear whether an anonymous ID would be assigned to users like on Singapore's app.

The app could then be used by health professionals, granted a person who has tested positive to COVID-19 consents to the data being accessed, to contact people that might have come into contact with the virus.

This proposed consent process has been criticised by a group of Australian researchers from the University of Melbourne and Macquarie University, as it allows the identities of users to be viewed when their data log is decrypted.

However, Roberts played down arguments that the app will interfere with an individuals privacy, describing it as “not that intrusive”.

Roberts said any future COVID trace app would be available for both Apple and Android devices, though would not give a concrete timeframe for its introduction.

He said “options” would be presented to the national Cabinet in a “couple of weeks” and that it would then need to give the app the tick of approval.

“The intent is it will be downloaded from the Apple or Google Store. And that you would consent to use it and you would have it running,” he said.

He also said that the government was not working with Apple and Google on the app, despite the pair announcing plans to work together to create contact tracing technology last week.

As indicated by Prime Minister Scott Morrison earlier this week, around 40 percent of Australia's population will need to download the app in order for it to be effective.

But even a month after Singapore released TraceTogehether, only around 20 percent of the population is using it. 

“We would like a whole bunch of Australians as many as possible to download it knowing full well that the strongest privacy is involved, the strongest security, no one can see any numbers, and all it is doing is replicating a manual tracing process,” Roberts said.

(How likely are you to download an Australian version of Singapore’s TraceTogether app? Let us know.)

The government is also in the process of developing a Facebook Messenger channel to sit alongside its coronavirus information app and WhatsApp chat services.