Coronavirus Australia: AFP on trail of trace app hoaxers

Hoaxers who tried to frighten users of the COVIDSafe contact tracing app through fake texts face up to five years in jail.

The tracking app 'COVIDSafe' has been installed by many Australians. Picture: AFP.

Hoaxers who tried to frighten users of the COVIDSafe contact-tracing app through fake texts have been told to be “afraid of the law” and could face up to five years in jail.

The Australian Federal Police is investigating the texts, which told COVIDSafe users that they had been caught breaking lockdown rules. One cybersecurity ­expert warned the mass hoax could be a springboard for a larger cyber-criminal operation.

Health Minister Greg Hunt on Tuesday accused the hoaxers of playing life-and-death games and said they faced serious charges if and when they were caught. “Any misuse of telecommunications for a hoax is illegal,” Mr Hunt said.

“This case has already been referred to federal police for investigation, and that investigation has begun, and anybody found responsible will be charged with a significant criminal offence. This isn’t a game. This is about life and death. This is about saving lives and protecting lives. Whoever it is, they should be afraid of the law.”

More than 2.24 million Australians have downloaded COVIDSafe. The app is a key weapon in the pandemic war, and Scott Morrison said its widespread use would allow Australia to better suppress coronavirus cases and lead to the wider lifting of social-distancing restrictions.

Government sources said the hoaxers could face a number of different criminal offences under the Criminal Code 1995.

Impersonating a commonwealth official, or pretending to act on behalf of a federal body, carries a maximum penalty of two years’ jail. Dishonestly obtaining or dealing in personal financial information leads to five years in jail.

State and territory offences may also apply.

The sophisticated hoax emerged late on Monday after two million people downloaded the app. Some users received a fake text claiming to represent the federal government and asking them to register their reasons for non-essential travel.

The number attached to the fake text is the phone service for Centrelink. When presented with a number of options including Job-Keeper and JobSeeker, the automated message does not mention the coronavirus app or social-distancing restrictions.

Macquarie University cybersecurity expect Dali Kafaar said take-up of the app was an opportunity for hoaxers to target less tech-savvy users, and warned it will be difficult to catch the perpetrators. “There are a lot of unknowns. There is the possibility that the hoaxers are preparing the ground for even bigger cyber-criminal activity,” he said.

“The launch of the app is very appealing to cybercriminals because there are many users not be very cyber-literate and the more people who click links, the more phones or laptops they could put viruses on. It is very difficult for police to catch these kinds of criminals. They operate anonymously and they jump from server to server when cybersecurity finds and blocks them.”

ANU infectious diseases expert Peter Collignon, who led Australia’s response to SARS, said fake texts posed a serious threat to the COVID-19 public health response.

“It undermines trust. The harm is people don’t follow health advice or lockdown rules once that trust is broken,” Dr Collignon said.

“There is a broader problem with hoaxes and misinformation with COVID-19, be it fake text messages or people pushing untested medicines or practices.”