18 ms·

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the government on some smart privacy and security choices (data deleted after 21 days, open source code, AWS in Australia, sensible sec practices etc). They won’t get it all right - and we as a tech community can help them. Find a bug & help get them closed. - When asked by non technical people “Should I install this app? Is my data / privacy safe? Is it true it doesn’t track my location?” - say “Yes” and help them understand. Fight the misinformation. Remind them how little time they think before they download dozens of free, adware crap games that are likely far worse for their data & privacy than this ever would be! Thank you

bad_user 7y ago
You can easily deny location data to games and people that are concerned about these apps will not share their location lightly. I have no app on my iPhone with the ability to use my location in the background, not even Waze or Google Maps. Also I don't care about deletion policies. That data should not be collected in the first place. I don't know about any specifics, but if the data isn't anonymized somehow, on the client side, such that the government can never trace it back to you, then I'd rather catch the virus personally. I agree about turning the angry mob mode off, but in times of crisis we would do well to remember that our freedoms are being traded for a little security and in many cases it isn't temporary. And Australia in particular doesn't have a good track record in preserving those freedoms. Therefore it isn't unreasonable to ask for source code. This isn't even about the GPL, people need the ability to review the code, especially if it's a public service paid by taxpayers. In my opinion such projects should be developed in the open, always.
- mcannon 7y ago
  Did you know that on iOS it doesn’t even ask for location, and on Android that’s required for Bluetooth? The source code will show you what is done with that (as others who have decompiled it already have shown it doesn’t use the location anywhere). You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else.
  - NewLogic 7y ago
    This is more a stand on principles against governments rather than if the app is actually malicious in nature. People are rightly making a stand that a project of this nature should require at the bare minimum for source code to release concurrently with protection laws. Blame successive governments if individuals aren't overly welcoming to putting their blind faith in promises of a government that has let them down in the past.
    - lysp 7y ago
      Exactly this. The Aus Gov - especially the current one is massively lacking in trust. Encryption laws, metadata laws. Scope creep on metadata access (ie local councils, horse racing bodies). Lack of transparent reporting when these laws are in use. Raids on journalists. Not to mention their lack of transparency over bushfires, sports grants, angus taylor's family connections with mining / paying $90m? for water to associated company. Ministers failing to declare gifts granted by airlines because they fell into previous parliament and not current one. Climate change vs mining interests. Loading the grid management team so they simply push renewables down the road instead of taking action to get wind/solar take up. Marking spin vs real substance in every single press conference from all the top federal ministers. The PM waiting for states to take charge of quarantine measures so he didn't get the blame for bringing those in (and get bad PR) early in the covid-19 crisis before we knew how bad it was. School closures. Ruby Princess. So after all that they want to trust us with an privacy breaching app because it's the right thing to do? I wouldn't install a hello-world built by current government even if my life depended on it.
      - NewLogic 7y ago
        To put it in words they will understand "Nothing to hide, nothing to fear"
      - pfortuny 7y ago
        You may be right (probably are, as I am from Spain). But you should not focus on this specific government: the dangers of overstepping are great whatever the color or the chirality or even the deeds of a government.
- mickotron 6y ago
  CovidSafe is based off OpenTrace which is GPLv3. The Aus govt have to release the code. They said they would 2 weeks after the launch of the app. I have reviewed the client side source code for OpenTrace. It doesn't store location information. Also, read the BlueTrace whitepaper, it will answer a lot of questions you might have. The data is anonymised. You are identified by a TempId that is changed every 15 mins, that is based on your UserId and some other data (see white paper). If someone were to decrypt this value, it would reveal your UserId, but not your phone number. The attacker would need access to the server side storage to gain this information, as I believe the client side does not store this.
Buckgw 7y ago
Well said
- lkpl 7y ago
  https://www.youtube.com/watch?v=j7TnRQQ1V4k https://www.youtube.com/watch?v=j7TnRQQ1V4k
joshisme 7y ago
Great Advice Mike! Need more leaders in the industry, like yourself, in the media fighting the bad press and lies around this.
discordance 7y ago
I would love to trust them more, but the Australian government does not have a good track record with regards to privacy. Two such recent examples: - Australian's browser history is being provided to law enforcement even though that practice was excluded from the original intent and law [0] - Australia passed laws in 2018 which enable law enforcement to compel tech companies into inserting backdoors into their software [1] 0: https://www.theguardian.com/world/2020/feb/07/web-browsing-histories-are-being-given-to-australian-police-under-data-retention-powers https://www.theguardian.com/world/2020/feb/07/web-browsing-h... 1: https://www.wired.com/story/australia-encryption-law-global-impact/ https://www.wired.com/story/australia-encryption-law-global-...
- jfoster 7y ago
  Do you honestly believe that they are trying to do something other than stem the harm from this pandemic, or are you just protesting about something they did in the past that you're not happy about? If it is the latter, have you considered the harm that your protest may be doing?
  - healsjnr1 7y ago
    It is a combination of their previous behavior plus the behavior of the various agencies. For example: https://www.theguardian.com/australia-news/2020/apr/23/government-rules-out-police-having-any-access-to-australian-coronavirus-contact-tracing-app https://www.theguardian.com/australia-news/2020/apr/23/gover... The fact that law enforcement even asked for this would be to many people completely unacceptable. It's why, despite their efforts to assuage people, so many people will not trust this government. The backdoor legislation means that at a later date, after the code is released, they could request a backdoor to the app and _no one_ could talk about it. All the legal provisions are there.
    - GordonS 7y ago
      This just goes to show that the police and security services will stop at nothing to increase surveillance of the general population. It beggars belief that the police see COVID-19 as an opportunity in such an overt manner - but you can bet the security services see it as an opportunity in a much more circumspect manner.
alensw11 7y ago
Hey Mike, Great work. But why do they need to store user data in the server anyway? Couldn’t that all be stored on the persons phone and then when someone tests positive, only send that person’s data to everyone’s phone and do the contact matching locally?
PudgePacket 7y ago
Aus gov has a terrible track record with information systems. Data leaks & breaches, flaky IT services, mass robo-debt claims of which 600,000 needed to be re-evaluated. Not to mention rushing through privacy destroying laws citing "Islamist terrorism, paedophile networks and organised crime". If you are who I think you are you're probably more knowledgable of the particular 2018 law than me. And now they're "rushing out" an app that is intended to track everyone in the country's precise location and who they interact with? I'll wait for the source thank you. The gov only has themselves to blame for this reputation. Apple and Google are releasing official APIs for this, we're doing amazingly well in Australia, can it not wait a week? > Remind them how little time they think before they download dozens of free, adware crap games that are likely far worse for their data & privacy than this ever would be! Isn't it an interesting point that these people would rather trust foreign companies they've never heard of with their location, rather than their own gov? https://www.theguardian.com/australia-news/2016/jul/29/australian-bureau-of-statistics-reports-14-data-breaches-since-2013 https://www.theguardian.com/australia-news/2016/jul/29/austr... https://www.abc.net.au/news/2016-08-09/abs-website-inaccessible-on-census-night/7711652 https://www.abc.net.au/news/2016-08-09/abs-website-inaccessi... https://www.theguardian.com/australia-news/2019/nov/22/pay-the-money-back-robodebt-the-coalitions-backflip-and-how-it-hounded-welfare-recipients https://www.theguardian.com/australia-news/2019/nov/22/pay-t... https://www.techdirt.com/articles/20181208/14440541184/australian-government-passes-law-forcing-tech-companies-to-break-encryption.shtml https://www.techdirt.com/articles/20181208/14440541184/austr...
- lysp 7y ago
  Assistance and Access Bill: https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/ https://www.zdnet.com/article/whats-actually-in-australias-e... Telecommunications (Interception and Access) Amendment (Data Retention) Bill: https://www.bbc.com/news/world-australia-32061421 https://www.bbc.com/news/world-australia-32061421 Peter Dutton's proposed "give me your password" law: https://www.sydneycriminallawyers.com.au/blog/peter-dutton-proposes-prison-for-refusing-to-provide-passwords/ https://www.sydneycriminallawyers.com.au/blog/peter-dutton-p... > Under the proposals, people who are not even suspected of a crime would face a fine of up to $50,000 and up to five years’ imprisonment for declining to provide a password to their smartphone, computer or other electronic devices. > Furthermore, anyone (an IT professional, for example) who refuses to help the authorities crack a computer system when ordered will face up to five years in prison. If the crime being investigated is terrorism-related then the penalty for non-compliance increases to 10 years in prison and/or a $126,000 fine. > Tech companies who refuse to assist authorities to crack encryption when asked to do so, will face up to $10 million in fines. What’s more, if any employee of the company tells anyone else they have been told to do this, they will face up to five years in gaol.
TJA1 7y ago
Hey Mike, I've attended a few cyber security conferences and spoken to a number of active people in those communities and it amazes me how backwards the Australian government is regarding cyber security. There seems to be less incentive for them to invest, both financially and in developing governance, than say industry. If a Google, Telstra, NAB had a severe breach, customers would be up in arms, fines would be handed out, financially there would be a big impact. Government just issues an apology and false promises to improve processes and accountability. Then a month later you see more reports in the news about more data safety breaches and unauthorised access from obscure government bodies like the RSPCA. Uploading the code is one way to show some transparency, but trusting them to make good on their promise of appropriate handling of data and retention is questionable.
shermozle 7y ago
Nope. Why is it normal to take a few weeks to release the source? If it's good enough to release its good enough o publish openly. This government has ample form. If you want my recommendation you need to open it up.
- rstuart4133 7y ago
  Firstly, it is not normal in the open source world. Hell, it's not even normal open source projects owned large companies that are the foundation for a major product - like Android. Secondly, as the story points out, it is a fork of an open source app that is already on github. It's not like the infrastructure for it isn't already set up - they just had to do a git clone, and then use standard CI techniques Maybe the OP isn't familiar with the modern software engineering techniques we now use to improve quality.
  - jamesjansson 7y ago
    If the source code is ALREADY released, what is the harm in immediately releasing the fork? Immediate public release of forks IS common practice.
- barbs 7y ago
  Especially since the upstream project appears to be GPL-licensed. Sure, they could have contacted the original developer and obtained a different license, but why would they do that? As far as we can tell, it looks like a breach of the license.
neximo64 7y ago
How do you realistically use this app if you have to keep it open. You and everyone else are so focussed on convincing everyone that it’s safe, etc and totally ignoring the practical aspects of it. For someone to have the app open for 15 mins within 1.5m all day.. how will that be done, it requires a large conscious commitment. You might as well just ask the person who is in your personal space for 15 consecutive minutes If it worked in the background that’s more useful and realistic.
- dragonsky 7y ago
  This is my problem with the app. The only reason I'm going to be in public for a 15 minute period at the moment is either being on or waiting for public transport or eating in a food court. In those cases I'm going to be using my phone to browse the net or watch a video meaning that this app won't be functional. At least on iOS, so what is the point?
  - jeromegv 7y ago
    That's why an OS solution is the only viable solution. Asking for the app to be open is the most ridiculous thing ever.
    - dTal 7y ago
      That doesn't follow at all. Open or not has nothing to do with it. It simply means the app is badly designed.
      - jeromegv 7y ago
        No, you can't keep an app permanently running in the background on iOS. The operating system does not allow it.
- rstuart4133 7y ago
  > If it worked in the background that’s more useful and realistic. It does work in the background on Android, and I gather background scanning is coming on iOS. As someone above said, don't get the perfect be the enemy of the good. Get it out the door, get it tested while you wait for Apple to get their act together is not only reasonable - it's the by far the best forward as an engineering strategy.
crispinb 7y ago
Turn the HN angry mob mode off Funny how, to the rich and powerful, any amongst the lower orders who dare to ask questions are always an 'angry mob'. We’re all in this together That would have been nice. Too late.
- pfortuny 7y ago
  Forcing togetherness or “unity” is the best way to turn me away from anything. Silly? No, just suspicious of judgements and valuations like those.
  - Talanes 7y ago
    I've never heard a call for "unity" that wasn't really saying "abandon your principles for mine."
- dang 7y ago
  Please don't post in the flamewar style to HN, regardless of how provocative another comment was or you feel it was. I can understand how that bit could have rubbed some commenters the wrong way (it affected me that way too), but confirming the point is not a good way to respond to it. By HN standards, let alone internet standards, the thread was unusually mild. Of course that provocation made it angrier, but I'm sure it was unintentional.
  - crispinb 7y ago
    Unintentional? Are you blind? Nah, just a member of the elite boys club. Bye.
sizzlersaladbar 7y ago
This app records everyone you have been in contact with for more than 15 minutes and there is no timeframe as to when the government will stop needing it. There is no evidence a vaccine will ever exist, which means the government will want people to use this application potentially forever. This is authoritarianism plain and simple. The government's solution to the virus is to track everybody, all the time. This is the path governments have been going down for a long time, and I personally am sick of it. I don't want them to know where I am, who I associate with, or anything else. They have already encroached too far into my life. Way too far. Your company is also terrible and barely even hires Australian workers. You and your company represent a lot of what I hate about the path the world has gone down. For anyone who wonders why people use JIRA, despite it being a pile of garbage - it isn't for developers, it is for managers to enable them to micromanage you and show upper managers the reports. I can see why you would love this tracking software, you will probably get asked to analyse the data. JIRA on a global scale.
metta2uall 7y ago
IMHO, the fact that they app is unobfuscated and can thus be easily decompiled is even better than released source code since one can't be sure that the released source code truly matches the actual build in the app store (unless they also go to the effort of having 'reproducible builds' - which would be quite impressive). Also it's good to keep in perspective that the 'government' can already track people to a great extent, e.g. via cell towers and face recognition.
- m4rtink 7y ago
  IIRC, Fdroid rebuilds all the Android apps they host from source so they can be sure their source really matches the app. Actually, this is also what all good Linux distros do with all their software.
  - lern_too_spel 7y ago
    I'm not aware of any Linux distros with 100% reproducible builds, though Debian is actively working on it and getting closer.
    - doubleunplussed 7y ago
      The distros can be sure without full reproducibility, since they built it. The users are still required to trust the distros built what they said they would though.
      - sjwright 7y ago
        The end user isn't the distro though.
- justinclift 7y ago
  If they're not producing reproducible builds, they're not really being serious are they?
  - 7y ago
edav 7y ago
I am no expert but I have two points relating to concerns about data security / privacy - well food for thought: Our existing medicare data - have we thought about where's it stored? Many make health claims through the Medicare app also. It tracks way more about our health (who we visited, when, what for, pathology tests and more etc.) than this app ever will. I'd bet it's stored on something like AWS also as until recently it was pretty much the only public cloud provider with the necessary PROTECTED certifications in Australia. I understand mobile phones track our location even if you have zero apps installed and / or location services off. It does this via triangulation off the cell phone towers. If you know the IP address of a mobile device you can put it into any number of publically-available websites and in many cases you can find its general location - and sometimes with a fair degree of accuracy. If these are concerns for us we are best to discard all our devices asap! So to me this app seems to track nothing much new at all - it just seems to join a couple of important and potentially life-saving dots.
qqssccfftt 7y ago
"Stop critiquing"
vorpalhex 7y ago
My recommendation is that when a non-technical person asks you a question, especially if that person is a friend, is to not lie. To tell them the app preserves their privacy without seeing the source is a lie. The truth is "I don't know". It is not normal to clean code before releasing it. That would suggest the code either has technical flaws or other deeply rooted problems that you are not comfortable releasing. That's a warning sign, not normal. We may be in this together but do not assume this is a gesture of good will towards the world. It may be, or it may be a gross invasion of civil rights, and we need to be studious in our analysis to make those determinations on an ongoing basis. The road to hell is paved with good intentions. Calling everyone here an angry mob and waving off valid concerns by sticking your head in the sand is naive, not mature or brave. Fear is a great tool of oppressors.
- jfoster 7y ago
  Wouldn't you then be telling them the same thing for every app? How many apps & platforms have you reviewed the code for prior to providing your assessment of the risks involved?
  - vorpalhex 7y ago
    That's why I don't typically give recommendations. Even with apps like Signal, we should communicate what we can verify and can't. We owe it to other people to communicate honestly.
basilgohar 7y ago
tl;dr Please trust these proven untrustworthy entities because they say it's good for you. I think the HN privacy concern is well placed. They are not advocating covering our ears and screaming to ignore the pandemic, just that this phone-based contact-tracing plan has all the makes of a bad idea. It's the perfect way to shift the needle further towards acceptance of mass contact tracking. These institutions have all shown us if we give them an inch, they'll take a mile. Meanwhile, experts still say this is no substitute for proper, interview-based contact tracing, so it's almost a moot effort anyway. My most charitable interpretation is that Google and Apple are scrambling for SOMETHING to do with their respective holds on the mobile market, and this is something. It still doesn't mean it's a good idea.
salan781 7y ago
Even if the government has the best intentions in this instance, it doesn’t matter. They have already created a set of laws that clearly dictate that this app and this data can be used how ever intelligence communities desire. They have burned all goodwill and trust with the public. It doesn’t matter what they say today unless they repeal AABill etc. Otherwise they’re just saying empty words.
- pca184 7y ago
  Interpreting legislation without any common law / precedence is difficult. However as a general rule, if there are two laws that are conflicting (such as previous anti-privacy laws vs the proposed safeguards) the most recent enacted law applies, especially if it is specific. So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Also I’m being pedantic, but you repeal Acts, not bills. A Bill is proposed legislation that isn’t law yet
  - shakna 7y ago
    > So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Currently, they are empty words, legally speaking. The legal text that contains the safeguards is here [0]. It doesn't have most of the safeguards that Hunt announced. They're a pipedream. For example, the minister said that even in the event of a crime, the data could not be used. However, two parts combine that show actually, they can. Firstly, possession rather than ownership, controls who can upload data: > A person must not upload COVID app data from a mobile telecommunications device to the National COVIDSafe Data Store except with the consent of the person who has possession or control of the device. Secondly, whilst there are controls around who can use that data once it has been uploaded, once it is transferred somewhere for that purpose, there are no restrictions around who can access it once it is outside the data store. [0] https://www.legislation.gov.au/Details/F2020L00480/Html/Text https://www.legislation.gov.au/Details/F2020L00480/Html/Text
godelski 7y ago
> - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. I actually believe this is helpful. Just in any democratic setting you want different types of players. You want the "burn the system down" people, because they provide harsh critiques and don't hold back. You want the "okay, but I have reservations" people, because they will push forward but also consider what they are doing (and will likely whistleblow if things get out of hand). You want the loyalists because they will push forward despite criticism. The trick is that you need a balance of these people (and the unmentioned players). Specifically here I don't think we've even answered the question of "should we have contact tracing apps?" Because of this, I do think having that angry mob is helpful. They loyalists will push forward building it but the mob will help us decide if we even want that technology in our society. If we decide we do, we'll have it. If we decide we don't, well we'll know better how they would be designed. __Being critical of those in power is a keystone to democracy.__
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- davros 7y ago
  The Australian governments track record is bad and we should be critical of that. But I have yet to see important problems with this particular app identified. Lets stick with the facts here rather than 'it must be bad'. People have decompiled the kotlin code and so far I haven't seen anyone report anything bad. Am I missing something?
  - chillfox 7y ago
    That’s a massive understatement. More accurate words describing the government’s track record would be “screwup, coverup, deceit, malicious”. At every single point in the past where they have had the chance to deal with technology they have done one or more of the following: 1. Screwed up, and then tried to cover it up. 2. Outright lied. 3. Created malicious laws that mandate violating privacy and makes it illegal to tell the truth about it. Basically they have proven numerous times that they can’t be trusted with technology or privacy.
chippy 7y ago
Your account was created almost a decade ago. Is this really the first and only comment? Why is this? Another user called you "mike" in their comment. Are you famous or noteworthy in relation to this story somehow? Why should your comment have weight behind it?
- dang 7y ago
  You can answer your questions by looking at the OP, which will take you to https://twitter.com/mcannonbrookes/status/1254376884332228609 https://twitter.com/mcannonbrookes/status/125437688433222860..., which will take you to https://en.wikipedia.org/wiki/Mike_Cannon-Brookes https://en.wikipedia.org/wiki/Mike_Cannon-Brookes. Given the timestamp on your comment I'm guessing that you're not in Australia. I'm not either, so it took some time to piece together the context. Given that the thread was mostly during Australian hours, most commenters probably already had it in cache.
emaz1ng 7y ago
Interesting that the top comment is pure misinformation as explained by the 2nd and following comments. Nice try government :)
tmpz22 7y ago
“The choice for mankind lies between freedom and happiness and for the great bulk of mankind, happiness is better.” ― George Orwell, 1984
nathan_ldrivo 7y ago
TOTAL AGREE MIKE. WELL SAID!
dna_polymerase 7y ago
Australia is a member of the five eyes. Whatever their government cobbles together will be used to build out the surveillance state. So if asked, by anyone: Tell them to stay at home and never install the app or trust their government with their data. Contact tracing is their wet dream and it will enable them to roll out much more serious measures in the future.
petre 7y ago
This isn't the government brought to you by the same people who claimed the laws of maths didn't apply down under, is it? They call themselves liberals. https://www.google.com/amp/s/www.independent.co.uk/news/malcolm-turnbull-prime-minister-laws-of-mathematics-do-not-apply-australia-encryption-l-a7842946.html%3famp https://www.google.com/amp/s/www.independent.co.uk/news/malc...
missosoup 7y ago
This attitude is anti-democratic and harmful. Please stop. > They’re obviously operating with extreme urgency to get the app out. For you. Extreme urgency is the perfect justification for governments to destroy the rights of the constituents. Never let a crisis go to waste as they say. Right now is exactly the time to be watching everything the government does with a lens of critical analysis. > Commend the government on some smart privacy and security choices The government has passed laws that make these choices irrelevant and has a history of botching anything to do with data/privacy even when well intentioned. This government has one of the worst privacy positions in the entire developed world. No one should be commending them for this. > When asked by non technical people “Should I install this app? Is my data / privacy safe? Is it true it doesn’t track my location?” - say “Yes” and help them understand. Fight the misinformation. Saying yes to those questions would be disinformation. The answer is maybe at best, probably not. You sound like you have best intentions in your mind, but the road to hell is paved with good intentions. Under existing laws, the data and privacy of anyone who downloads this app is NOT safe. If the government is truly well intentioned and wants to help, they need to roll back the insane sweeping anti-privacy laws they rushed through while ignoring the constituents. What you're calling 'HN angry mob mode' is simply these same constituents having the natural, rational reaction to the actions of our government that border on totalitarian. It's not the fault of the constituents, it's the logical outcome of the government's actions. Turning it around like you did is nothing short of victim-blaming. I'm not going to cover up the sins of this administration by lying to my non-technical friends about the real dangers associated with this app like you ask, sorry. The irony is that due to public mistrust in the government due to things like AABill, more people may die now than the various agencies ever saved through the systemic destruction of domestic privacy in the name of anti-terrorism or saving the children or whatever other nebulous excuse. Maybe AFP and co can stop their unilateral self-righteous anti-privacy rampage and actually think about the greater good in light of this?
- alfiedotwtf 7y ago
  Correct. Extreme urgency is how the US got the PATRIOT Act.
danieltillett 7y ago
Mike my concern as a scientist about this app is it may not help much at this point. If it is only picking up people you spent more than 15 minutes talking to it is going to miss a lot transmission events. Do we have the contact tracing people to actually make use of this data? Even if we did I can’t see how we are going to avoid the need to interview each positive case to find all the people they came into contact with for less than 15 minutes. How much value is being added? I am not installing it purely because I am social distancing and won’t be spending 15 minutes talking to anyone face to face outside of my immediate family.
- lbeltrame 7y ago
  > 15 minutes talking to it is going to miss a lot transmission events. Honest question (as a scientist myself): is there any serious non-preprint literature on the time needed for a transmission event (I assume estimates will vary wildly)?
  - danieltillett 7y ago
    Not that I know of as this is hard to study. What we have is a lot of case studies that transmission can occur in much less time than this including cases where there was no contact between the parties. The best write up on this I have seen on this topic has been in Quillette [0]. I know Quillette gets attacked here from those on the left, but they do cover a wide range of topics (not all articles I agree with). They are pro-science and generally provide good references. 0. https://quillette.com/2020/04/23/covid-19-superspreader-events-in-28-countries-critical-patterns-and-lessons/ https://quillette.com/2020/04/23/covid-19-superspreader-even...
    - lbeltrame 7y ago
      Thanks. An interesting and fascinating read. I hope more research is done on the topic: from my semi-untrained (I work in oncology, not in virology, although I studied the immune system for about four years in my career) there far more models around than experimental data (which is obviously far harder to gather correctly).
alfiedotwtf 7y ago
> - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. After the abuses of Metadata Retention, and how AABill passed, no. History shows that the Australian Government will and continue to abuse people. The Australian Government cannot be trusted, and if you do, you're naive.
- endgame 7y ago
  Don't forget censusfail and robodebt. This government does not have a good history with tech. I will say that this determination from the Health Minister was a breath of fresh air, but it needs to be made law when Parliament sits: https://www.legislation.gov.au/Details/F2020L00480 https://www.legislation.gov.au/Details/F2020L00480
friendlybus 7y ago
I don’t get the privacy implications. Making a few assumptions here. Government can already get your location data and internet data from telco’s and Microsoft, your identity from bank purchases and social circle from fb/inferences from data. What’s left that a phone could provide, encrypted chat? Coronavirus app is the least to worry about.
inshadows 7y ago
Government fan cries: Leave government alone!
wavegeek 7y ago
> open source code The promise of open source code. Which is a very different thing. Note that this government also promised to get rid of the budget deficit. But did not do so. They have told many other lies and have earned the right to be distrusted. With this app, if I get the disease and authorise disclosure, it will disclose to government agents the people I have been in contact with. Or, to put it another way, the people who have been in contact with me. Without their consent or knowledge. TLDR it is not confidential safe or secure.
justatdotin 7y ago
reap: ass access bill sow: scepticism
- __d 7y ago
  I think that should be reversed: they "sowed" the Assistance and Access Bill, and then "reap" (harvest, get) the scepticism? But yes. Combined with the census, the "robodebt" project, etc, etc, there's not a lot of trust in government-run IT in Australia ...
sfpibx 7y ago
Deletion is not enough. Destruction is instead required. They need to release their server side code as the mobile app could be just the tip of a very big iceberg. They should also provide details of the platform ecosystem and how it’s secured; trust boundaries, IAM, PAM, audit, etc. Point being that Snowden is right when he warns that the architecture of oppression is being built in the name of COVID-19. We need a tracing system that can only be used to serve the people, and not some wannabe tyrants.
- devjam 7y ago
  > some wannabe tyrants They're not wannabes - they're actual tyrrants.
jonstribling 7y ago
Considered and smart response. Thanks!
__d 7y ago
Why is time needed to "clean up the code"? Why not just develop the code on GitHub, in the open, with full transparency?
- Joakal 7y ago
  It could be obfuscation and/or developing a compiler to add "extra features". For security reasons.
dghcrypto 7y ago
It's easy to fix the app so that it does not need the phone number and to have the app notify the user of the need to get a test instead of having a contact tracer having to double handle the information and ring the user. I believe the fact the app is doing this more about its heritage than any design here, however as an "Australian innovation" we could fix this and avoid the prospect of vulnerable people being rung up by people pretending to be contact tracers, which will happen, and will not be good when it does. Interestingly if the phone number is not stored, the need to store any potentially personal information will probably disappear as well. There's no need to see the source code to recognise this is a problem. Could we at least lobby them to fix this? It would make life easier for the contract tracers and it would mean that people could rely on the app's secure channel, so if a scammer does call them they could confidently tell them where to get off.
- fuckthehumanity 7y ago
  This is an extremely good point. The potential for misuse through ignorance and misinformation is high. How many "ATO" phone calls have we all received? This service could be genuinely anonymous, although of course under existing laws the government may already have created a back door, and as long as we're using authenticated app stores, nothing is truly untraceable. Having said that, this might very well help us in the right against the virus. I'm quite willing to wait for the source code before installing.
  - dghcrypto 7y ago
    On the ATO calls, too many! It's interesting to note a news article about someone spoofing messages to phones claiming they are due to the app already. I actually think the idea of the app isn't a bad one (well at least once the blue tooth issues are properly fixed), but mixing the phone number and the app as a communication channel is already showing how it can cause problems.
crypto2me 7y ago
Doesn’t meet their own privacy impact assessment. Source code not released. Source code can be changed at anytime with no notice or need to re-consent data usage. Protections not legislated. Using centralised instead of decentralised and anonymised architecture. Data on the central server has no purging policy. Only local data deleted after 21 days. De encryption keys stored on the same server as the DB. Unlike free adware crap games, governments have the power to legislate and enforce laws. Google Facebook amazon whomever other crap freeware games you refer to don’t. Normalises government mass surveillance and tracking Can be viewed in line with metadata retention, encryption laws and now this as a path toward digital dictatorship. Raiding journalists to get the names of government whistleblowers.
andrewstuart 7y ago
Sorry but you're coming across as telling people what to do - it's somewhat patronising. There's a key principle here - no application with such scope should be closed source. It is in no-ones interest that it be closed source. In fact the software becomes more secure when many eyes are on it. And, once the government has it out there - with the blessing of people like you - then they will have no urgency to make it open source. Now is exactly the right time to say "we'll use this BUT only if it's open source."
Jaffa58 7y ago
1. I trust this government no more than Mr Turnbull was father of the internet in Australia because he was the legal counsel for Ozemail, or many other denial-of-service attacks & census design (IBM) failures they have presided over. 2. What was this App developed in? Is the user interface UX. Is the back-end Xmarin, C++, Java, Objective-C, Swift or what? What API/s &/or Pods were used to achieve encryption and bluetooth handshake? 3. Source code? Really? What do you expect to see. Most usage of APIs and Frameworks explicitly hides the implementation details from the App. These libraries of independently compiled software can be enormous. People are asking for specifics but will be delivered a haystack. Good luck with that. 4. The open source code will be ripped off and repurposed for school / work attendance rolls or dating App hook-ups. Surest way to expose software to malevolent hackers is to give them the source code. 5. Careful what you wish for.
phaynes 7y ago
+1 mcannon. -1 Silly misinformation below. The country is also in the midst of a health induced financial crisis. I advise on both cyber and health. The tracking App is essential to helping the health workers and getting people back to work. It is benign as you can make such a thing. Let's get behind it. Beers over video are just not the same as those in the pub.
AussieCit 7y ago
Before telling non technical people Yes the app is safe wouldn't it be prudent and ethical to rather say probably but wait until the legislation is passed and the source code is out?
RicFre 7y ago
Thanks for allaying some of the privacy concerns around the place Mike..... But to be honest, I will wait for the Apple/Google contact tracing app to be released (because it will be soooo open and better and with a generic name can be used beyond the current pandemic). It will not only tell me I've just sat next to someone with Covid19 on my train ride to work, but that they also updated their status to single this morning with a broken heart emoji. They've also been up all night watching relationship expert advice videos and about to start their 10 hour shift (since they socialize online under different pseudonyms, their employer is none the wiser) as an open heart surgeon... And if i’m inclined and would like to take up a limited special offer, I can get a 50% rebate on my 21yo gold plated private health fund if I can convince the Covid19 case to co-isolate immediately in the seat in front of me with the other Covid19 case. A full rebate if I can convince both of them to get off at the next station!!
sfpibx 7y ago
“Give them a few weeks to clean up code and release it (which is very normal) ” In the world of security critical systems, this is completely abnormal.
alfiedotwtf 6y ago
So now it turns out that your company may have been involved in the development of COVIDSafe. Are you actually kidding me? Turn off the HN angry mod mode off? I'm even more pissed now. https://www.innovationaus.com/atlassian-and-the-covidsafe-team/ https://www.innovationaus.com/atlassian-and-the-covidsafe-te...
jcomper 6y ago
Beautifully put. I am hoping you know how to send bug reports to someone who can act on them to improve COVIDCare.

bad_user 7y ago

You can easily deny location data to games and people that are concerned about these apps will not share their location lightly. I have no app on my iPhone with the ability to use my location in the background, not even Waze or Google Maps. Also I don't care about deletion policies. That data should not be collected in the first place. I don't know about any specifics, but if the data isn't anonymized somehow, on the client side, such that the government can never trace it back to you, then I'd rather catch the virus personally. I agree about turning the angry mob mode off, but in times of crisis we would do well to remember that our freedoms are being traded for a little security and in many cases it isn't temporary. And Australia in particular doesn't have a good track record in preserving those freedoms. Therefore it isn't unreasonable to ask for source code. This isn't even about the GPL, people need the ability to review the code, especially if it's a public service paid by taxpayers. In my opinion such projects should be developed in the open, always.

mcannon 7y ago
Did you know that on iOS it doesn’t even ask for location, and on Android that’s required for Bluetooth? The source code will show you what is done with that (as others who have decompiled it already have shown it doesn’t use the location anywhere). You can choose to get the virus - but that’s a pretty silly choice IMHO. And if you do, please stay home and don’t give it to anyone else.
- NewLogic 7y ago
  This is more a stand on principles against governments rather than if the app is actually malicious in nature. People are rightly making a stand that a project of this nature should require at the bare minimum for source code to release concurrently with protection laws. Blame successive governments if individuals aren't overly welcoming to putting their blind faith in promises of a government that has let them down in the past.
  - lysp 7y ago
    Exactly this. The Aus Gov - especially the current one is massively lacking in trust. Encryption laws, metadata laws. Scope creep on metadata access (ie local councils, horse racing bodies). Lack of transparent reporting when these laws are in use. Raids on journalists. Not to mention their lack of transparency over bushfires, sports grants, angus taylor's family connections with mining / paying $90m? for water to associated company. Ministers failing to declare gifts granted by airlines because they fell into previous parliament and not current one. Climate change vs mining interests. Loading the grid management team so they simply push renewables down the road instead of taking action to get wind/solar take up. Marking spin vs real substance in every single press conference from all the top federal ministers. The PM waiting for states to take charge of quarantine measures so he didn't get the blame for bringing those in (and get bad PR) early in the covid-19 crisis before we knew how bad it was. School closures. Ruby Princess. So after all that they want to trust us with an privacy breaching app because it's the right thing to do? I wouldn't install a hello-world built by current government even if my life depended on it.
    - NewLogic 7y ago
      To put it in words they will understand "Nothing to hide, nothing to fear"
    - pfortuny 7y ago
      You may be right (probably are, as I am from Spain). But you should not focus on this specific government: the dangers of overstepping are great whatever the color or the chirality or even the deeds of a government.
mickotron 6y ago
CovidSafe is based off OpenTrace which is GPLv3. The Aus govt have to release the code. They said they would 2 weeks after the launch of the app. I have reviewed the client side source code for OpenTrace. It doesn't store location information. Also, read the BlueTrace whitepaper, it will answer a lot of questions you might have. The data is anonymised. You are identified by a TempId that is changed every 15 mins, that is based on your UserId and some other data (see white paper). If someone were to decrypt this value, it would reveal your UserId, but not your phone number. The attacker would need access to the server side storage to gain this information, as I believe the client side does not store this.

Buckgw 7y ago

Well said

lkpl 7y ago
https://www.youtube.com/watch?v=j7TnRQQ1V4k https://www.youtube.com/watch?v=j7TnRQQ1V4k

joshisme 7y ago

Great Advice Mike! Need more leaders in the industry, like yourself, in the media fighting the bad press and lies around this.

discordance 7y ago

I would love to trust them more, but the Australian government does not have a good track record with regards to privacy. Two such recent examples: - Australian's browser history is being provided to law enforcement even though that practice was excluded from the original intent and law [0] - Australia passed laws in 2018 which enable law enforcement to compel tech companies into inserting backdoors into their software [1] 0: https://www.theguardian.com/world/2020/feb/07/web-browsing-histories-are-being-given-to-australian-police-under-data-retention-powers https://www.theguardian.com/world/2020/feb/07/web-browsing-h... 1: https://www.wired.com/story/australia-encryption-law-global-impact/ https://www.wired.com/story/australia-encryption-law-global-...

jfoster 7y ago
Do you honestly believe that they are trying to do something other than stem the harm from this pandemic, or are you just protesting about something they did in the past that you're not happy about? If it is the latter, have you considered the harm that your protest may be doing?
- healsjnr1 7y ago
  It is a combination of their previous behavior plus the behavior of the various agencies. For example: https://www.theguardian.com/australia-news/2020/apr/23/government-rules-out-police-having-any-access-to-australian-coronavirus-contact-tracing-app https://www.theguardian.com/australia-news/2020/apr/23/gover... The fact that law enforcement even asked for this would be to many people completely unacceptable. It's why, despite their efforts to assuage people, so many people will not trust this government. The backdoor legislation means that at a later date, after the code is released, they could request a backdoor to the app and _no one_ could talk about it. All the legal provisions are there.
  - GordonS 7y ago
    This just goes to show that the police and security services will stop at nothing to increase surveillance of the general population. It beggars belief that the police see COVID-19 as an opportunity in such an overt manner - but you can bet the security services see it as an opportunity in a much more circumspect manner.

alensw11 7y ago

Hey Mike, Great work. But why do they need to store user data in the server anyway? Couldn’t that all be stored on the persons phone and then when someone tests positive, only send that person’s data to everyone’s phone and do the contact matching locally?

PudgePacket 7y ago

Aus gov has a terrible track record with information systems. Data leaks & breaches, flaky IT services, mass robo-debt claims of which 600,000 needed to be re-evaluated. Not to mention rushing through privacy destroying laws citing "Islamist terrorism, paedophile networks and organised crime". If you are who I think you are you're probably more knowledgable of the particular 2018 law than me. And now they're "rushing out" an app that is intended to track everyone in the country's precise location and who they interact with? I'll wait for the source thank you. The gov only has themselves to blame for this reputation. Apple and Google are releasing official APIs for this, we're doing amazingly well in Australia, can it not wait a week? > Remind them how little time they think before they download dozens of free, adware crap games that are likely far worse for their data & privacy than this ever would be! Isn't it an interesting point that these people would rather trust foreign companies they've never heard of with their location, rather than their own gov? https://www.theguardian.com/australia-news/2016/jul/29/australian-bureau-of-statistics-reports-14-data-breaches-since-2013 https://www.theguardian.com/australia-news/2016/jul/29/austr... https://www.abc.net.au/news/2016-08-09/abs-website-inaccessible-on-census-night/7711652 https://www.abc.net.au/news/2016-08-09/abs-website-inaccessi... https://www.theguardian.com/australia-news/2019/nov/22/pay-the-money-back-robodebt-the-coalitions-backflip-and-how-it-hounded-welfare-recipients https://www.theguardian.com/australia-news/2019/nov/22/pay-t... https://www.techdirt.com/articles/20181208/14440541184/australian-government-passes-law-forcing-tech-companies-to-break-encryption.shtml https://www.techdirt.com/articles/20181208/14440541184/austr...

lysp 7y ago
Assistance and Access Bill: https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/ https://www.zdnet.com/article/whats-actually-in-australias-e... Telecommunications (Interception and Access) Amendment (Data Retention) Bill: https://www.bbc.com/news/world-australia-32061421 https://www.bbc.com/news/world-australia-32061421 Peter Dutton's proposed "give me your password" law: https://www.sydneycriminallawyers.com.au/blog/peter-dutton-proposes-prison-for-refusing-to-provide-passwords/ https://www.sydneycriminallawyers.com.au/blog/peter-dutton-p... > Under the proposals, people who are not even suspected of a crime would face a fine of up to $50,000 and up to five years’ imprisonment for declining to provide a password to their smartphone, computer or other electronic devices. > Furthermore, anyone (an IT professional, for example) who refuses to help the authorities crack a computer system when ordered will face up to five years in prison. If the crime being investigated is terrorism-related then the penalty for non-compliance increases to 10 years in prison and/or a $126,000 fine. > Tech companies who refuse to assist authorities to crack encryption when asked to do so, will face up to $10 million in fines. What’s more, if any employee of the company tells anyone else they have been told to do this, they will face up to five years in gaol.

TJA1 7y ago

Hey Mike, I've attended a few cyber security conferences and spoken to a number of active people in those communities and it amazes me how backwards the Australian government is regarding cyber security. There seems to be less incentive for them to invest, both financially and in developing governance, than say industry. If a Google, Telstra, NAB had a severe breach, customers would be up in arms, fines would be handed out, financially there would be a big impact. Government just issues an apology and false promises to improve processes and accountability. Then a month later you see more reports in the news about more data safety breaches and unauthorised access from obscure government bodies like the RSPCA. Uploading the code is one way to show some transparency, but trusting them to make good on their promise of appropriate handling of data and retention is questionable.

shermozle 7y ago

Nope. Why is it normal to take a few weeks to release the source? If it's good enough to release its good enough o publish openly. This government has ample form. If you want my recommendation you need to open it up.

rstuart4133 7y ago
Firstly, it is not normal in the open source world. Hell, it's not even normal open source projects owned large companies that are the foundation for a major product - like Android. Secondly, as the story points out, it is a fork of an open source app that is already on github. It's not like the infrastructure for it isn't already set up - they just had to do a git clone, and then use standard CI techniques Maybe the OP isn't familiar with the modern software engineering techniques we now use to improve quality.
- jamesjansson 7y ago
  If the source code is ALREADY released, what is the harm in immediately releasing the fork? Immediate public release of forks IS common practice.
barbs 7y ago
Especially since the upstream project appears to be GPL-licensed. Sure, they could have contacted the original developer and obtained a different license, but why would they do that? As far as we can tell, it looks like a breach of the license.

neximo64 7y ago

How do you realistically use this app if you have to keep it open. You and everyone else are so focussed on convincing everyone that it’s safe, etc and totally ignoring the practical aspects of it. For someone to have the app open for 15 mins within 1.5m all day.. how will that be done, it requires a large conscious commitment. You might as well just ask the person who is in your personal space for 15 consecutive minutes If it worked in the background that’s more useful and realistic.

dragonsky 7y ago
This is my problem with the app. The only reason I'm going to be in public for a 15 minute period at the moment is either being on or waiting for public transport or eating in a food court. In those cases I'm going to be using my phone to browse the net or watch a video meaning that this app won't be functional. At least on iOS, so what is the point?
- jeromegv 7y ago
  That's why an OS solution is the only viable solution. Asking for the app to be open is the most ridiculous thing ever.
  - dTal 7y ago
    That doesn't follow at all. Open or not has nothing to do with it. It simply means the app is badly designed.
    - jeromegv 7y ago
      No, you can't keep an app permanently running in the background on iOS. The operating system does not allow it.
rstuart4133 7y ago
> If it worked in the background that’s more useful and realistic. It does work in the background on Android, and I gather background scanning is coming on iOS. As someone above said, don't get the perfect be the enemy of the good. Get it out the door, get it tested while you wait for Apple to get their act together is not only reasonable - it's the by far the best forward as an engineering strategy.

crispinb 7y ago

Turn the HN angry mob mode off Funny how, to the rich and powerful, any amongst the lower orders who dare to ask questions are always an 'angry mob'. We’re all in this together That would have been nice. Too late.

pfortuny 7y ago
Forcing togetherness or “unity” is the best way to turn me away from anything. Silly? No, just suspicious of judgements and valuations like those.
- Talanes 7y ago
  I've never heard a call for "unity" that wasn't really saying "abandon your principles for mine."
dang 7y ago
Please don't post in the flamewar style to HN, regardless of how provocative another comment was or you feel it was. I can understand how that bit could have rubbed some commenters the wrong way (it affected me that way too), but confirming the point is not a good way to respond to it. By HN standards, let alone internet standards, the thread was unusually mild. Of course that provocation made it angrier, but I'm sure it was unintentional.
- crispinb 7y ago
  Unintentional? Are you blind? Nah, just a member of the elite boys club. Bye.

sizzlersaladbar 7y ago

This app records everyone you have been in contact with for more than 15 minutes and there is no timeframe as to when the government will stop needing it. There is no evidence a vaccine will ever exist, which means the government will want people to use this application potentially forever. This is authoritarianism plain and simple. The government's solution to the virus is to track everybody, all the time. This is the path governments have been going down for a long time, and I personally am sick of it. I don't want them to know where I am, who I associate with, or anything else. They have already encroached too far into my life. Way too far. Your company is also terrible and barely even hires Australian workers. You and your company represent a lot of what I hate about the path the world has gone down. For anyone who wonders why people use JIRA, despite it being a pile of garbage - it isn't for developers, it is for managers to enable them to micromanage you and show upper managers the reports. I can see why you would love this tracking software, you will probably get asked to analyse the data. JIRA on a global scale.

metta2uall 7y ago

IMHO, the fact that they app is unobfuscated and can thus be easily decompiled is even better than released source code since one can't be sure that the released source code truly matches the actual build in the app store (unless they also go to the effort of having 'reproducible builds' - which would be quite impressive). Also it's good to keep in perspective that the 'government' can already track people to a great extent, e.g. via cell towers and face recognition.

m4rtink 7y ago
IIRC, Fdroid rebuilds all the Android apps they host from source so they can be sure their source really matches the app. Actually, this is also what all good Linux distros do with all their software.
- lern_too_spel 7y ago
  I'm not aware of any Linux distros with 100% reproducible builds, though Debian is actively working on it and getting closer.
  - doubleunplussed 7y ago
    The distros can be sure without full reproducibility, since they built it. The users are still required to trust the distros built what they said they would though.
    - sjwright 7y ago
      The end user isn't the distro though.
justinclift 7y ago
If they're not producing reproducible builds, they're not really being serious are they?
- 7y ago

edav 7y ago

I am no expert but I have two points relating to concerns about data security / privacy - well food for thought: Our existing medicare data - have we thought about where's it stored? Many make health claims through the Medicare app also. It tracks way more about our health (who we visited, when, what for, pathology tests and more etc.) than this app ever will. I'd bet it's stored on something like AWS also as until recently it was pretty much the only public cloud provider with the necessary PROTECTED certifications in Australia. I understand mobile phones track our location even if you have zero apps installed and / or location services off. It does this via triangulation off the cell phone towers. If you know the IP address of a mobile device you can put it into any number of publically-available websites and in many cases you can find its general location - and sometimes with a fair degree of accuracy. If these are concerns for us we are best to discard all our devices asap! So to me this app seems to track nothing much new at all - it just seems to join a couple of important and potentially life-saving dots.

qqssccfftt 7y ago

"Stop critiquing"

vorpalhex 7y ago

My recommendation is that when a non-technical person asks you a question, especially if that person is a friend, is to not lie. To tell them the app preserves their privacy without seeing the source is a lie. The truth is "I don't know". It is not normal to clean code before releasing it. That would suggest the code either has technical flaws or other deeply rooted problems that you are not comfortable releasing. That's a warning sign, not normal. We may be in this together but do not assume this is a gesture of good will towards the world. It may be, or it may be a gross invasion of civil rights, and we need to be studious in our analysis to make those determinations on an ongoing basis. The road to hell is paved with good intentions. Calling everyone here an angry mob and waving off valid concerns by sticking your head in the sand is naive, not mature or brave. Fear is a great tool of oppressors.

jfoster 7y ago
Wouldn't you then be telling them the same thing for every app? How many apps & platforms have you reviewed the code for prior to providing your assessment of the risks involved?
- vorpalhex 7y ago
  That's why I don't typically give recommendations. Even with apps like Signal, we should communicate what we can verify and can't. We owe it to other people to communicate honestly.

basilgohar 7y ago

tl;dr Please trust these proven untrustworthy entities because they say it's good for you. I think the HN privacy concern is well placed. They are not advocating covering our ears and screaming to ignore the pandemic, just that this phone-based contact-tracing plan has all the makes of a bad idea. It's the perfect way to shift the needle further towards acceptance of mass contact tracking. These institutions have all shown us if we give them an inch, they'll take a mile. Meanwhile, experts still say this is no substitute for proper, interview-based contact tracing, so it's almost a moot effort anyway. My most charitable interpretation is that Google and Apple are scrambling for SOMETHING to do with their respective holds on the mobile market, and this is something. It still doesn't mean it's a good idea.

salan781 7y ago

Even if the government has the best intentions in this instance, it doesn’t matter. They have already created a set of laws that clearly dictate that this app and this data can be used how ever intelligence communities desire. They have burned all goodwill and trust with the public. It doesn’t matter what they say today unless they repeal AABill etc. Otherwise they’re just saying empty words.

pca184 7y ago
Interpreting legislation without any common law / precedence is difficult. However as a general rule, if there are two laws that are conflicting (such as previous anti-privacy laws vs the proposed safeguards) the most recent enacted law applies, especially if it is specific. So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Also I’m being pedantic, but you repeal Acts, not bills. A Bill is proposed legislation that isn’t law yet
- shakna 7y ago
  > So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Currently, they are empty words, legally speaking. The legal text that contains the safeguards is here [0]. It doesn't have most of the safeguards that Hunt announced. They're a pipedream. For example, the minister said that even in the event of a crime, the data could not be used. However, two parts combine that show actually, they can. Firstly, possession rather than ownership, controls who can upload data: > A person must not upload COVID app data from a mobile telecommunications device to the National COVIDSafe Data Store except with the consent of the person who has possession or control of the device. Secondly, whilst there are controls around who can use that data once it has been uploaded, once it is transferred somewhere for that purpose, there are no restrictions around who can access it once it is outside the data store. [0] https://www.legislation.gov.au/Details/F2020L00480/Html/Text https://www.legislation.gov.au/Details/F2020L00480/Html/Text

godelski 7y ago

> - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. I actually believe this is helpful. Just in any democratic setting you want different types of players. You want the "burn the system down" people, because they provide harsh critiques and don't hold back. You want the "okay, but I have reservations" people, because they will push forward but also consider what they are doing (and will likely whistleblow if things get out of hand). You want the loyalists because they will push forward despite criticism. The trick is that you need a balance of these people (and the unmentioned players). Specifically here I don't think we've even answered the question of "should we have contact tracing apps?" Because of this, I do think having that angry mob is helpful. They loyalists will push forward building it but the mob will help us decide if we even want that technology in our society. If we decide we do, we'll have it. If we decide we don't, well we'll know better how they would be designed. __Being critical of those in power is a keystone to democracy.__

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
davros 7y ago
The Australian governments track record is bad and we should be critical of that. But I have yet to see important problems with this particular app identified. Lets stick with the facts here rather than 'it must be bad'. People have decompiled the kotlin code and so far I haven't seen anyone report anything bad. Am I missing something?
- chillfox 7y ago
  That’s a massive understatement. More accurate words describing the government’s track record would be “screwup, coverup, deceit, malicious”. At every single point in the past where they have had the chance to deal with technology they have done one or more of the following: 1. Screwed up, and then tried to cover it up. 2. Outright lied. 3. Created malicious laws that mandate violating privacy and makes it illegal to tell the truth about it. Basically they have proven numerous times that they can’t be trusted with technology or privacy.

chippy 7y ago

Your account was created almost a decade ago. Is this really the first and only comment? Why is this? Another user called you "mike" in their comment. Are you famous or noteworthy in relation to this story somehow? Why should your comment have weight behind it?

dang 7y ago
You can answer your questions by looking at the OP, which will take you to https://twitter.com/mcannonbrookes/status/1254376884332228609 https://twitter.com/mcannonbrookes/status/125437688433222860..., which will take you to https://en.wikipedia.org/wiki/Mike_Cannon-Brookes https://en.wikipedia.org/wiki/Mike_Cannon-Brookes. Given the timestamp on your comment I'm guessing that you're not in Australia. I'm not either, so it took some time to piece together the context. Given that the thread was mostly during Australian hours, most commenters probably already had it in cache.

emaz1ng 7y ago

Interesting that the top comment is pure misinformation as explained by the 2nd and following comments. Nice try government :)

tmpz22 7y ago

“The choice for mankind lies between freedom and happiness and for the great bulk of mankind, happiness is better.” ― George Orwell, 1984

nathan_ldrivo 7y ago

TOTAL AGREE MIKE. WELL SAID!

dna_polymerase 7y ago

Australia is a member of the five eyes. Whatever their government cobbles together will be used to build out the surveillance state. So if asked, by anyone: Tell them to stay at home and never install the app or trust their government with their data. Contact tracing is their wet dream and it will enable them to roll out much more serious measures in the future.

petre 7y ago

This isn't the government brought to you by the same people who claimed the laws of maths didn't apply down under, is it? They call themselves liberals. https://www.google.com/amp/s/www.independent.co.uk/news/malcolm-turnbull-prime-minister-laws-of-mathematics-do-not-apply-australia-encryption-l-a7842946.html%3famp https://www.google.com/amp/s/www.independent.co.uk/news/malc...

missosoup 7y ago

This attitude is anti-democratic and harmful. Please stop. > They’re obviously operating with extreme urgency to get the app out. For you. Extreme urgency is the perfect justification for governments to destroy the rights of the constituents. Never let a crisis go to waste as they say. Right now is exactly the time to be watching everything the government does with a lens of critical analysis. > Commend the government on some smart privacy and security choices The government has passed laws that make these choices irrelevant and has a history of botching anything to do with data/privacy even when well intentioned. This government has one of the worst privacy positions in the entire developed world. No one should be commending them for this. > When asked by non technical people “Should I install this app? Is my data / privacy safe? Is it true it doesn’t track my location?” - say “Yes” and help them understand. Fight the misinformation. Saying yes to those questions would be disinformation. The answer is maybe at best, probably not. You sound like you have best intentions in your mind, but the road to hell is paved with good intentions. Under existing laws, the data and privacy of anyone who downloads this app is NOT safe. If the government is truly well intentioned and wants to help, they need to roll back the insane sweeping anti-privacy laws they rushed through while ignoring the constituents. What you're calling 'HN angry mob mode' is simply these same constituents having the natural, rational reaction to the actions of our government that border on totalitarian. It's not the fault of the constituents, it's the logical outcome of the government's actions. Turning it around like you did is nothing short of victim-blaming. I'm not going to cover up the sins of this administration by lying to my non-technical friends about the real dangers associated with this app like you ask, sorry. The irony is that due to public mistrust in the government due to things like AABill, more people may die now than the various agencies ever saved through the systemic destruction of domestic privacy in the name of anti-terrorism or saving the children or whatever other nebulous excuse. Maybe AFP and co can stop their unilateral self-righteous anti-privacy rampage and actually think about the greater good in light of this?

alfiedotwtf 7y ago
Correct. Extreme urgency is how the US got the PATRIOT Act.

danieltillett 7y ago

Mike my concern as a scientist about this app is it may not help much at this point. If it is only picking up people you spent more than 15 minutes talking to it is going to miss a lot transmission events. Do we have the contact tracing people to actually make use of this data? Even if we did I can’t see how we are going to avoid the need to interview each positive case to find all the people they came into contact with for less than 15 minutes. How much value is being added? I am not installing it purely because I am social distancing and won’t be spending 15 minutes talking to anyone face to face outside of my immediate family.

lbeltrame 7y ago
> 15 minutes talking to it is going to miss a lot transmission events. Honest question (as a scientist myself): is there any serious non-preprint literature on the time needed for a transmission event (I assume estimates will vary wildly)?
- danieltillett 7y ago
  Not that I know of as this is hard to study. What we have is a lot of case studies that transmission can occur in much less time than this including cases where there was no contact between the parties. The best write up on this I have seen on this topic has been in Quillette [0]. I know Quillette gets attacked here from those on the left, but they do cover a wide range of topics (not all articles I agree with). They are pro-science and generally provide good references. 0. https://quillette.com/2020/04/23/covid-19-superspreader-events-in-28-countries-critical-patterns-and-lessons/ https://quillette.com/2020/04/23/covid-19-superspreader-even...
  - lbeltrame 7y ago
    Thanks. An interesting and fascinating read. I hope more research is done on the topic: from my semi-untrained (I work in oncology, not in virology, although I studied the immune system for about four years in my career) there far more models around than experimental data (which is obviously far harder to gather correctly).

alfiedotwtf 7y ago

> - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. After the abuses of Metadata Retention, and how AABill passed, no. History shows that the Australian Government will and continue to abuse people. The Australian Government cannot be trusted, and if you do, you're naive.

endgame 7y ago
Don't forget censusfail and robodebt. This government does not have a good history with tech. I will say that this determination from the Health Minister was a breath of fresh air, but it needs to be made law when Parliament sits: https://www.legislation.gov.au/Details/F2020L00480 https://www.legislation.gov.au/Details/F2020L00480

friendlybus 7y ago

I don’t get the privacy implications. Making a few assumptions here. Government can already get your location data and internet data from telco’s and Microsoft, your identity from bank purchases and social circle from fb/inferences from data. What’s left that a phone could provide, encrypted chat? Coronavirus app is the least to worry about.

inshadows 7y ago

Government fan cries: Leave government alone!

wavegeek 7y ago

> open source code The promise of open source code. Which is a very different thing. Note that this government also promised to get rid of the budget deficit. But did not do so. They have told many other lies and have earned the right to be distrusted. With this app, if I get the disease and authorise disclosure, it will disclose to government agents the people I have been in contact with. Or, to put it another way, the people who have been in contact with me. Without their consent or knowledge. TLDR it is not confidential safe or secure.

justatdotin 7y ago

reap: ass access bill sow: scepticism

__d 7y ago
I think that should be reversed: they "sowed" the Assistance and Access Bill, and then "reap" (harvest, get) the scepticism? But yes. Combined with the census, the "robodebt" project, etc, etc, there's not a lot of trust in government-run IT in Australia ...

sfpibx 7y ago

Deletion is not enough. Destruction is instead required. They need to release their server side code as the mobile app could be just the tip of a very big iceberg. They should also provide details of the platform ecosystem and how it’s secured; trust boundaries, IAM, PAM, audit, etc. Point being that Snowden is right when he warns that the architecture of oppression is being built in the name of COVID-19. We need a tracing system that can only be used to serve the people, and not some wannabe tyrants.

devjam 7y ago
> some wannabe tyrants They're not wannabes - they're actual tyrrants.

jonstribling 7y ago

Considered and smart response. Thanks!

__d 7y ago

Why is time needed to "clean up the code"? Why not just develop the code on GitHub, in the open, with full transparency?

Joakal 7y ago
It could be obfuscation and/or developing a compiler to add "extra features". For security reasons.

dghcrypto 7y ago

It's easy to fix the app so that it does not need the phone number and to have the app notify the user of the need to get a test instead of having a contact tracer having to double handle the information and ring the user. I believe the fact the app is doing this more about its heritage than any design here, however as an "Australian innovation" we could fix this and avoid the prospect of vulnerable people being rung up by people pretending to be contact tracers, which will happen, and will not be good when it does. Interestingly if the phone number is not stored, the need to store any potentially personal information will probably disappear as well. There's no need to see the source code to recognise this is a problem. Could we at least lobby them to fix this? It would make life easier for the contract tracers and it would mean that people could rely on the app's secure channel, so if a scammer does call them they could confidently tell them where to get off.

fuckthehumanity 7y ago
This is an extremely good point. The potential for misuse through ignorance and misinformation is high. How many "ATO" phone calls have we all received? This service could be genuinely anonymous, although of course under existing laws the government may already have created a back door, and as long as we're using authenticated app stores, nothing is truly untraceable. Having said that, this might very well help us in the right against the virus. I'm quite willing to wait for the source code before installing.
- dghcrypto 7y ago
  On the ATO calls, too many! It's interesting to note a news article about someone spoofing messages to phones claiming they are due to the app already. I actually think the idea of the app isn't a bad one (well at least once the blue tooth issues are properly fixed), but mixing the phone number and the app as a communication channel is already showing how it can cause problems.

crypto2me 7y ago

Doesn’t meet their own privacy impact assessment. Source code not released. Source code can be changed at anytime with no notice or need to re-consent data usage. Protections not legislated. Using centralised instead of decentralised and anonymised architecture. Data on the central server has no purging policy. Only local data deleted after 21 days. De encryption keys stored on the same server as the DB. Unlike free adware crap games, governments have the power to legislate and enforce laws. Google Facebook amazon whomever other crap freeware games you refer to don’t. Normalises government mass surveillance and tracking Can be viewed in line with metadata retention, encryption laws and now this as a path toward digital dictatorship. Raiding journalists to get the names of government whistleblowers.

andrewstuart 7y ago

Sorry but you're coming across as telling people what to do - it's somewhat patronising. There's a key principle here - no application with such scope should be closed source. It is in no-ones interest that it be closed source. In fact the software becomes more secure when many eyes are on it. And, once the government has it out there - with the blessing of people like you - then they will have no urgency to make it open source. Now is exactly the right time to say "we'll use this BUT only if it's open source."

Jaffa58 7y ago

1. I trust this government no more than Mr Turnbull was father of the internet in Australia because he was the legal counsel for Ozemail, or many other denial-of-service attacks & census design (IBM) failures they have presided over. 2. What was this App developed in? Is the user interface UX. Is the back-end Xmarin, C++, Java, Objective-C, Swift or what? What API/s &/or Pods were used to achieve encryption and bluetooth handshake? 3. Source code? Really? What do you expect to see. Most usage of APIs and Frameworks explicitly hides the implementation details from the App. These libraries of independently compiled software can be enormous. People are asking for specifics but will be delivered a haystack. Good luck with that. 4. The open source code will be ripped off and repurposed for school / work attendance rolls or dating App hook-ups. Surest way to expose software to malevolent hackers is to give them the source code. 5. Careful what you wish for.

phaynes 7y ago

+1 mcannon. -1 Silly misinformation below. The country is also in the midst of a health induced financial crisis. I advise on both cyber and health. The tracking App is essential to helping the health workers and getting people back to work. It is benign as you can make such a thing. Let's get behind it. Beers over video are just not the same as those in the pub.

AussieCit 7y ago

Before telling non technical people Yes the app is safe wouldn't it be prudent and ethical to rather say probably but wait until the legislation is passed and the source code is out?

RicFre 7y ago

Thanks for allaying some of the privacy concerns around the place Mike..... But to be honest, I will wait for the Apple/Google contact tracing app to be released (because it will be soooo open and better and with a generic name can be used beyond the current pandemic). It will not only tell me I've just sat next to someone with Covid19 on my train ride to work, but that they also updated their status to single this morning with a broken heart emoji. They've also been up all night watching relationship expert advice videos and about to start their 10 hour shift (since they socialize online under different pseudonyms, their employer is none the wiser) as an open heart surgeon... And if i’m inclined and would like to take up a limited special offer, I can get a 50% rebate on my 21yo gold plated private health fund if I can convince the Covid19 case to co-isolate immediately in the seat in front of me with the other Covid19 case. A full rebate if I can convince both of them to get off at the next station!!

sfpibx 7y ago

“Give them a few weeks to clean up code and release it (which is very normal) ” In the world of security critical systems, this is completely abnormal.

alfiedotwtf 6y ago

So now it turns out that your company may have been involved in the development of COVIDSafe. Are you actually kidding me? Turn off the HN angry mod mode off? I'm even more pissed now. https://www.innovationaus.com/atlassian-and-the-covidsafe-team/ https://www.innovationaus.com/atlassian-and-the-covidsafe-te...

jcomper 6y ago

Beautifully put. I am hoping you know how to send bug reports to someone who can act on them to improve COVIDCare.