This needs some nuance. The agencies were 'not caught', they responded to an audit from the Office of the Inspector-General of Intelligence and Security

This needs some nuance. The agencies were 'not caught', they responded to an audit from the Office of the Inspector-General of Intelligence and Security (IGIS). Of the six "TLA" Australian Inteligence orgs that fall under the the IGIS' remit to check and audit them, those that work with firehose type data all reported that they were aware that their feed might/did include Covid app data and that they had procedures in place to deal with the privacy requirements under Part VIIIA of the Australian Privacy Act of 1988. As with a lot of government communications it is often what is not said (and/or the way they are said) that matters more than what the TLDR reveals. The 6 Agencies are as follows: Australian Security Intelligence Organisation; Australian Secret Intelligence Service; Australian Signals Directorate; Australian Geospatial-Intelligence Organisation; Defence Intelligence Organisation; and the Office of National Intelligence. It is entirely feasible that those types of agencies would receive firehose feeds and that would include Covid app data amongst it. The bigger picture I think is this - there are at least 6 Oz agencies that have the raw data feed ;-) All details in this comment are taken from the publicly released version at [https://www.igis.gov.au/sites/default/files/2020-11/Report%20to%20OAIC%20May-Nov%202020%20%20COVIDSafe%20App.pdf https://www.igis.gov.au/sites/default/files/2020-11/Report%2...]