The Government’s contact-tracing app COVIDSafe aims to help track down people. Who may have been shown to COVID-19?

But like any smartphone app, it raises privacy and security questions. Especially because data the platform collects.

Downloading the app is voluntary. But the Government has previously said. 40 per cent of Australians — or 10 million people — need to take up the contact-tracing app. For it to be a success (although they have not shared the modelling behind this number).

The Government hasn’t yet released the app’s source code and new legislation governing its use has yet to be shared. But that hasn’t stopped researchers from digging into both the technical and legal implications of this unprecedented bit of software.

We’re sure to find out more in the coming days. But let’s take a look at what we know about the app for now, and where any issues may arise.

What data does the COVIDSafe app share and collect?

First things first: COVIDSafe does not collect your location.

When you sign up for the app. You will enter your name (it can be a pseudonym), age range, postcode and phone number.

This creates an encrypted code. Which is then shared over Bluetooth with other COVIDSafe apps. You come into close contact with.

These IDs are encrypted and stored on the app for 21 days.

The app will also make a record of the date and time that digital “handshake” occurred. Its duration and the proximity of contacts.

“My personal view is that the data is being captured. It is suitably anonymised, suitably protected and access to it is reasonably restricted,”. Said Paul Haskell-Dowland, associate dean for Computing and Security at Edith Cowan University.

“The opportunity for misuse is incredibly small.”

But it’s also sharing your phone make and model?

Software engineer Robert Merkel has taken a look at the app. (You can dig into some more analysis by Dr Merkel and colleagues here.)

In the Bluetooth messages that are sent to other phones. He found COVIDSafe also shares the phone’s make and model.

This information about phone model appears to be sent unencrypted over Bluetooth. Which means it could be intercepted and create a certain level of privacy risk. If someone was determined to track you (He said, this is not a huge risk).

“The protocol transfers your phone make and model ‘in the clear’ to everyone,” he said. “It doesn’t have to be the official COVIDSafe app to receive it.”

Singapore’s app TraceTogether also collected this data, and unlike in Australia, it explained why in its terms of service.

“In order to measure distance, information about the phone models and signal strength recorded. It is also shared. Since different phone models transmit at different power,” it said.

A spokesperson for Government Services Minister Stuart Robert did not comment on Dr Merkel’s analysis. But said “the exchange of the encrypted user ID uses a standard Bluetooth exchange”.

“The Government has been quite clear around the level of work. That has gone into ensuring security for the app and information stored.”

Is it safe to have Bluetooth on all the time?

Nothing digital is 100 per cent secure, and neither is Bluetooth.

This technology opens a channel for two devices to communicate — your phone and a wireless headset. Now, two phones with the COVIDSafe app.

But this communication can also allow vulnerabilities to creep in.

Often these issues are fixed in software updates. So, before using COVIDSafe and turning on Bluetooth. Dr Merkel advised people to make sure their phones are using the latest operating system.

In general, the likelihood of Bluetooth attacks being used against random individuals is low. He suggested, but everyone who downloads the app will have to decide that risk for themselves.

Who can see my data if I’m diagnosed with COVID-19?

If you’re diagnosed with COVID-19. Health officials may ask you to upload 21 days’ worth of the anonymised IDs. Your app has stored for contact tracing to a central server.

The people you’ve been in close contact with won’t be told your name. But health officials may then call your close contacts and advise them to isolate or get tested.

On Sunday, Health Minister Greg Hunt shared a determination under the Biosecurity Act. To protect people’s privacy and restrict access to app information. To state or territory health authorities only for the purpose of contact tracing.

But legal experts said that should be a stopgap only. As a “determination” can be amended or repealed at any time.

“Legislation would be better than a non-disallowable instrument. But it is better than no law at all,” said Graham Greenleaf. Professor of law and information systems at the University of New South Wales.

“Legislation should be enacted by Parliament as soon as possible.”

The determination also bars law enforcement or other federal agencies from being able to access the app’s information, but some questions remain about the strength of this prohibition.

Chief Medical Officer Brendan Murphy said on Monday that the Federal Government had no access to any of the data.

“We have locked this down so completely, so thoroughly with the biosecurity bill and legislation that is coming,” he said.

“This app will only ever be used by public health officials [for] the purposes of contact tracing.”

In a statement, however, Law Council of Australia president Pauline Wright warned there was some potential legal ambiguity around whether laws authorising the law enforcement and intelligence warrants “could override” the determination’s prohibition on access.

“The determination under the Biosecurity Act 2015 applies despite any other law,” Mr Robert’s spokesperson said.

Minister Hunt has indicated legislation concerning. COVID 19 Safe introduced in May. When Parliament resumes.

Who makes sure the app is used properly?

The Government has encouraged all Australians to download COVID 19 Safe. But according to the Law Council of Australia. The determination “makes no provision for oversight and reporting on its use”.

There is no clear oversight of COVID 19 Safe, agreed Kimberlee Weatherall, technology law professor at the University of Sydney.

“There is no oversight and no reporting built in,” she said.

“So no mechanism by which we can see how it is used, or get reports on whether it is effective.”

However, an individual with a complaint about their privacy could potentially go to the Office of the Australian Information Commissioner.

When will the app be switched off?

While you can delete the app at any time, it’s unclear when it will be officially switched off.

The Government says users will be prompted to delete the app from their phone. At the end of the Australian pandemic”.

The data held on the central storage database. It will also be destroyed then. But it’s unclear whether this will be mandated by the May legislation.

If you’ve had data uploaded from the app to the central server, you can also request that be deleted here.

Will my data be kept in Australia?

Last week, the ABC reported that data from the contact tracing app would be stored by the American technology giant. Amazon Web Services.

Mr Hunt’s determination through the Biosecurity Act prohibits transferring data to any country other than Australia.

Article courtesy: ABC News (www.abc.net.au)