4 ms·

It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would b

by ferros 6y ago

It was interesting to hear a lead story on the nightly news talking about data privacy issues related to where the data was stored, saying that the data would be stored on “American company Amazon’s Servers”. No mention of Australian regions or GovCloud etc.

maxden 6y ago
The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.
- crispinb 6y ago
  Unless they've done some independent investigation, that's just federal government speak. The feds have been at pains to present COVIDSafe as having stringent privacy safeguards, but they have such an appalling record that few will believe them without trustworthy independent scrutiny. I can't see how that can be possible until (at a bare minimum) the app's source code is released. I really hope they do, and that they make any necessary improvements subsequently recommended. Contact tracing is a fantastic potential use of mobile technology. It would be a pity for it to be undermined by the usual impulse towards contemptuous patrician secrecy.
  - sjy 6y ago
    A “privacy impact assessment” was performed by an independent law firm, reviewed by an independent statutory authority responsible for privacy protection, and published before the app was released. https://www.oaic.gov.au/updates/news-and-media/privacy-protections-in-covidsafe-contact-tracing-app/ https://www.oaic.gov.au/updates/news-and-media/privacy-prote...
- justinclift 6y ago
  Except if it's stored on AWS, then the US "CLOUD" act means US federal - eg the three letter ones, probably others too - have access to the data anyway: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- mkj 6y ago
  https://www.legislation.gov.au/Details/F2020L00480 https://www.legislation.gov.au/Details/F2020L00480 7(3) If COVID app data is uploaded from a mobile telecommunications device to the National COVIDSafe Data Store, a person must not: (a) retain the data on a database outside Australia; or (b) disclose the data to a person outside Australia.
hmwhy 6y ago
I was in a casual virtual meeting with a group of highly educated audience last week, and the question of whether or not we will install the app came up. As far as I know none of them has a background in computer science or anything related to software development. At least a third of the group immediately said that the won't install the app exactly for the “American company Amazon’s Servers” reason. I hadn't researched into the topic but I tried to offer an alternative explanation to why those choices were made, but I felt that nobody was even slightly interested in why it might not be as evil as they have been made to think it is. From irresponsible journalism to untrustworthy governments with hidden agenda, there are too many things that I think lead to people making uninformed decisions. Just throwing this opinion out there because it's something that has been on my mind for a long while, and perhaps something that may resonate with someone else. Edit: typo (explain --> offer).
- NewLogic 6y ago
  The concerns are still very much valid no matter region or GovCloud. What protects Australian citizens from powers granted to the US intelligence machine via the Patriot Act?
  - hmwhy 6y ago
    Agreed. I care about privacy very much, and I do as much as I can to protect it with what little technical knowledge I have—I think most people I know would consider me an alarmist when it comes to protecting myself from "bad" things. I think the point I failed to point point clearly earlier is that this is the first, if not one of the firsts, pandemic where we are well-connected enough to properly attempt the tracking app(s) proposed. At the end of the day, would it not depend on what data (particularly those that are identifying, if any) is stored, whether or not other infrastructures that meet compliance requirements are readily available, if there are reliable contractors that already know these other infrastructures and can deliver quickly, etc.? And that's what I wanted to throw out there: I consider myself very slightly more knowledgeable in these things that are out of my domain expertise compared to my colleagues, and I still find it very difficult to make an informed decision.
lukevdp 6y ago
PM said it would be stored by Amazon in Australia.
- dathinab 6y ago
  But does that matter? There is still the CLOUDE act (I think it was called). And secret courts.
  - lukevdp 6y ago
    Doesn't matter to me personally, but I think some people feel more comfortable with the data being held in Australia. I only mention it because the news story that parent saw did not mention it. I agree with you about the other issues, but they are separate to this imo. The determination that was released under the biosecurity act yesterday made it pretty clear what the data can legally be used for.
- ferros 6y ago
  To his credit the PM seemed quite knowledgeable about AWS as far as a non tech person/politician when he answered questions in a press conference. Used the correct terminology and was able to explain in minor detail.
  - lukevdp 6y ago
    Yeah I was pleasantly surprised.

by ferros 6y ago

maxden 6y ago

The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.

crispinb 6y ago
Unless they've done some independent investigation, that's just federal government speak. The feds have been at pains to present COVIDSafe as having stringent privacy safeguards, but they have such an appalling record that few will believe them without trustworthy independent scrutiny. I can't see how that can be possible until (at a bare minimum) the app's source code is released. I really hope they do, and that they make any necessary improvements subsequently recommended. Contact tracing is a fantastic potential use of mobile technology. It would be a pity for it to be undermined by the usual impulse towards contemptuous patrician secrecy.
- sjy 6y ago
  A “privacy impact assessment” was performed by an independent law firm, reviewed by an independent statutory authority responsible for privacy protection, and published before the app was released. https://www.oaic.gov.au/updates/news-and-media/privacy-protections-in-covidsafe-contact-tracing-app/ https://www.oaic.gov.au/updates/news-and-media/privacy-prote...
justinclift 6y ago
Except if it's stored on AWS, then the US "CLOUD" act means US federal - eg the three letter ones, probably others too - have access to the data anyway: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
mkj 6y ago
https://www.legislation.gov.au/Details/F2020L00480 https://www.legislation.gov.au/Details/F2020L00480 7(3) If COVID app data is uploaded from a mobile telecommunications device to the National COVIDSafe Data Store, a person must not: (a) retain the data on a database outside Australia; or (b) disclose the data to a person outside Australia.

hmwhy 6y ago

I was in a casual virtual meeting with a group of highly educated audience last week, and the question of whether or not we will install the app came up. As far as I know none of them has a background in computer science or anything related to software development. At least a third of the group immediately said that the won't install the app exactly for the “American company Amazon’s Servers” reason. I hadn't researched into the topic but I tried to offer an alternative explanation to why those choices were made, but I felt that nobody was even slightly interested in why it might not be as evil as they have been made to think it is. From irresponsible journalism to untrustworthy governments with hidden agenda, there are too many things that I think lead to people making uninformed decisions. Just throwing this opinion out there because it's something that has been on my mind for a long while, and perhaps something that may resonate with someone else. Edit: typo (explain --> offer).

NewLogic 6y ago
The concerns are still very much valid no matter region or GovCloud. What protects Australian citizens from powers granted to the US intelligence machine via the Patriot Act?
- hmwhy 6y ago
  Agreed. I care about privacy very much, and I do as much as I can to protect it with what little technical knowledge I have—I think most people I know would consider me an alarmist when it comes to protecting myself from "bad" things. I think the point I failed to point point clearly earlier is that this is the first, if not one of the firsts, pandemic where we are well-connected enough to properly attempt the tracking app(s) proposed. At the end of the day, would it not depend on what data (particularly those that are identifying, if any) is stored, whether or not other infrastructures that meet compliance requirements are readily available, if there are reliable contractors that already know these other infrastructures and can deliver quickly, etc.? And that's what I wanted to throw out there: I consider myself very slightly more knowledgeable in these things that are out of my domain expertise compared to my colleagues, and I still find it very difficult to make an informed decision.

lukevdp 6y ago

PM said it would be stored by Amazon in Australia.

dathinab 6y ago
But does that matter? There is still the CLOUDE act (I think it was called). And secret courts.
- lukevdp 6y ago
  Doesn't matter to me personally, but I think some people feel more comfortable with the data being held in Australia. I only mention it because the news story that parent saw did not mention it. I agree with you about the other issues, but they are separate to this imo. The determination that was released under the biosecurity act yesterday made it pretty clear what the data can legally be used for.
ferros 6y ago
To his credit the PM seemed quite knowledgeable about AWS as far as a non tech person/politician when he answered questions in a press conference. Used the correct terminology and was able to explain in minor detail.
- lukevdp 6y ago
  Yeah I was pleasantly surprised.