Australian coronavirus-tracing app will be less private and effective than other options, experts warn
It’s already the most talked-about app in Australia but the forthcoming coronavirus-tracing app will not be based on the best tech available, security experts warn.
Coronavirus
Don't miss out on the headlines from Coronavirus. Followed categories will be added to My News.
Australians risk missing out on the safest, most private and most efficient coronavirus-tracing technology on the market, security experts have warned, as the Federal Government instead stores personal information in a central database, harvests data without warning users each time, and employs a system that may not work with Apple iPhones.
App developers and academics told News Corp there were better virus-tracing options available than the model proposed by the Government and advised it was “not too late” to use more effective technology or make changes to protect users’ privacy.
But a Government spokesman rejected the experts’ claims, saying they were “mistaken,” that the government’s creation would be “the safest version” of a virus-tracing app, and information would only be provided to state health officials if users agreed.
The expert warnings also came even though the Government’s forthcoming app received in-principle support from Cyber Security Cooperative Research Centre last week and Prime Minister Scott Morrison said the app, which he called an “important tool” in getting Australians back to work following the COVID-19 outbreak, would be released “soon”.
The Australian app will reportedly be based on TraceTogether code created and deployed in Singapore that uses Bluetooth information to record every the details of all users who make close contact for at least 15 minutes.
When a user is diagnosed with COVID-19, that encrypted information is passed on to state health authorities, along with the names, phone numbers, age ranges, and postcodes of people they were near for the past 21 days.
But University of Melbourne computing and information systems lecturer Dr Suelette Dreyfus warned the technology was not the best way to track cases of COVID-19 while protecting users’ privacy.
She said the Government’s app, as it had been described, would store personal information in a centralised database, putting it at greater security risk when there were better options available.
Other coronavirus-tracing technology, including systems proposed by a group of 300 security experts, advised storing data in users’ smartphones and recording only the Bluetooth communications they had sent to others.
“There’s no doubt that one of the decentralised versions is better for privacy and still gives you coronavirus-tracking,” Dr Dreyfus said.
“If Scott Morrison is so keen for 40 per cent-plus Australians to sign up to this app, why would you not choose the most privacy-enhancing option that also tracked the spread of the virus? You need trust if people are going to voluntarily download it.”
Optus Macquarie University Cyber Security Hub executive director Dali Kaafar said a centralised system may be quicker to build but it would also leave Australians’ information “more vulnerable to a breach”.
But he said a series of small but important changes could still be made to the Singaporean TraceTogether code to reduce risks and increase user privacy.
MORE NEWS
Will COVID-19 kill off the business trip?
Why America looks to Australia for hope
Parents turn to live tutors as teachers fail to show online
UK lockdown: How restrictions could be eased
An analysis of the TraceTogether technology showed informing users directly about potential coronavirus contact and requesting information each time it was required, he said, could improve trust in the app.
“It’s not too late to make these changes,” Professor Kaafar said.
“We need individuals to trust this app, opt in and accept tracing so the app becomes widely adopted.”
Veteran app developer Quentin Zervaas said the Australian Government would also be wise to consider using app software being developed by Apple and Google as their technology, which could be available within weeks, would get around Bluetooth restrictions in phone software.
The Singaporean app will not work on Apple iPhones, for example, unless it is actively open and in the “foreground”.
Mr Zervaas said Apple’s software would also use a private, decentralised model and should not be dismissed as an option.
“(The Government) should be in talks with Apple and Google. That should have been their first port of call. Why not speak to the people who make the phones?” he asked.
But a spokesman said the Government was in talks with Apple and Google, pointing to later changes planned for their smartphones’ operating system, and slammed the experts’ assessments as “mistaken”.
He said an app users’ information would only be “sent to the central data store if you test positive and you agree,” would only be shared with “state health officials” and the data would be stored securely.
“It is the safest version of the app,” he said.
“The storage system is the same that is used by many government agencies, including the intelligence agency the Australian Signals Directorate.”
Originally published as Australian coronavirus-tracing app will be less private and effective than other options, experts warn