Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dissection of COVIDSafe (Android): Australian government's contact tracing app

docs.google.com

Post reply on HN
Print view View original

211–220 of 271 posts

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#211

Post by devjam »

sfpibx wrote: post #187
mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Deletion is not enough. Destruction is instead required. They need to release their server side code as the mobile app could be just the tip of a very big iceberg. They should also provide details of the platform ecosystem and how it’s secured; trust boundaries, IAM, PAM, audit, etc. Point being that Snowden is right when he warns that the architecture of oppression is being built in the name of COVID-19. We need a t…

> some wannabe tyrants They're not wannabes - they're actual tyrrants.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#212

Post by sjy »

tzs wrote: post #84
zelphirkalt wrote: post #32

Earlier quoted context omitted.

For this specific case, it would be a grave mistake to license under anything, which does not contain a copyleft to make sure they release the source code as well and grant the 4 freedoms.

If I'm understanding this right, this app was written by the Australian government. Does the license for any libraries or other outside code they have included even matter? Generally, governments have what is called "sovereign immunity" when it comes to civil lawsuits. They can only be sued if they decide to allow it. Some countries waive their sovereign immunity for specific laws. For example US copyright law waives…

This is a pretty old-fashioned and US-centric perspective. The Wikipedia article explains that sovereign immunity never really worked like this in Australia, and the United Kingdom passed a Crown Proceedings Act to overcome it in 1947: https://en.wikipedia.org/wiki/Sovereign_immunity

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#213

Post by pca184 »

shakna wrote: post #154
pca184 wrote: post #95

Earlier quoted context omitted.

Interpreting legislation without any common law / precedence is difficult. However as a general rule, if there are two laws that are conflicting (such as previous anti-privacy laws vs the proposed safeguards) the most recent enacted law applies, especially if it is specific. So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective an…

> So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Currently, they are empty words, legally speaking. The legal text that contains the safeguards is here [0]. It doesn't have most of the safeguards that Hunt announced. They're a pipedream. For example, the minister said th…

> For example, the minister said that even in the event of a crime, the data could not be used. However, two parts combine that show actually, they can.

That's incorrect. The only crime that could be a valid reason for using the data is a breach of the emergency biosecurity laws [6(2)(d)] (also see s477 of the Biosecurity Act 2015 (Cth)).

Two common legal 'tools' are inclusive clauses and exhaustive clauses. An inclusive clause lists examples of what a section of legislation or a contract applies to, but it's not a complete list. You may have seen something like this in an employment contract, where the contract lists out your roles and responsibilities with a list that starts with "including, but not limited to: ". E.g the items listed definitely apply but there may be more other items that are not listed. Exhaustive clauses are the opposite, if it's not expressly stated in the list, it doesn't apply.

Part 2 limits how the data can be collected and used by using an exhaustive clause, i.e. section 6(2).

Breaking it down, section 6(1) states: 'A person must not collect, use or disclose COVID app data except as provided by subsection (2).' So unless the reason is expressly listed under subsection 6(2), it cannot be used/collected.

Very roughly paraphrasing the reasons in 6(2):

- 6(2)(a): The person is a State/Territory HEALTH official (i.e. not law enforcement) AND the reason for is contact tracing only

- 6(2)(b): The person is an employee/officer/contractor of the Health Department or Digital Transformation Agency (DTA) to help a Health employee with contact tracing, or to ensure the app / data store is functioning properly. E.g Devs bug fixing the app, API etc

- 6(2)(c) Moving encrypted data from a mobile to the CovidSafe database

- 6(2)(d) Investigating an offence of the emergency biosecurity laws

- 5(2)(e) Using data for 'de-identified' statistics

So going back to the grandparent comment, it's not correct say that the regulation has no effect due to the previous laws that weaken privacy. In fact the wording for the valid uses is refreshingly restrictive. E.g using '..[for the] purpose of, and only to the extent required for the purpose of' and not just 'for the purpose of' is a cue for the courts to interpret the use case quite restrictively.

With all that said, this may be all well and good in theory, but it remains to be seen if the Government can enforce these restrictions in practice. There are some very valid concerns about that. However that's for another conversation/thread.

[edit: formatting]

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#214

Post by hp35 »

cmroanirgo wrote: post #204
femto wrote: post #192

Earlier quoted context omitted.

My feeling is that they are getting it right this time, as science and medicine is still trumping politics in Australia's COVID response. (Though that's beginning to change.) Getting it right this time means the Government doesn't have any excuses going forward. Overall Australia is genuinely doing a great job in relation to COVID, mainly because the Government had the good sense to put the experts center stage and g…

Requiring a phone number may be in breach of existing legislation, particularly that which resulted from the No vote to the Australia Card in the 80's. Those anti-id laws were ratified in 2005/2006. https://www.aph.gov.au/About_Parliament/Parliamentary_Depart... This tech can and should be using crypto random hashes rather than phone numbers. The authorities don't need to call anyone, let the app and the fully anonym…

See s477(5) of the Biosecurity Act 2015.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#215

Post by sjy »

crispinb wrote: post #20
maxden wrote: post #11

Earlier quoted context omitted.

The ABC is reporting that the server must store data in Australia and the data cannot be transferred overseas.

Unless they've done some independent investigation, that's just federal government speak. The feds have been at pains to present COVIDSafe as having stringent privacy safeguards, but they have such an appalling record that few will believe them without trustworthy independent scrutiny. I can't see how that can be possible until (at a bare minimum) the app's source code is released. I really hope they do, and that the…

A “privacy impact assessment” was performed by an independent law firm, reviewed by an independent statutory authority responsible for privacy protection, and published before the app was released. https://www.oaic.gov.au/updates/news-and-media/privacy-prote...

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#216

Post by shakna »

pca184 wrote: post #213
shakna wrote: post #154

Earlier quoted context omitted.

> So while I’m by no means a fan of the erosion of privacy that this government has done previously, the proposed safeguards would be effective and not just empty words (at least legally speaking). Currently, they are empty words, legally speaking. The legal text that contains the safeguards is here [0]. It doesn't have most of the safeguards that Hunt announced. They're a pipedream. For example, the minister said th…

> For example, the minister said that even in the event of a crime, the data could not be used. However, two parts combine that show actually, they can. That's incorrect. The only crime that could be a valid reason for using the data is a breach of the emergency biosecurity laws [6(2)(d)] (also see s477 of the Biosecurity Act 2015 (Cth)). Two common legal 'tools' are inclusive clauses and exhaustive clauses. An inclu…

> That's incorrect. The only crime that could be a valid reason for using the data is a breach of the emergency biosecurity laws

You haven't fully understood what I tried to convey. Whilst it is true that the data can only be copied from the data store for a restrictive reason, such as ensuring the security of the data store, once it is outside that store, it is no longer protected by the limitations.

So this sequence of events is possible, and legal:

+ Data store data is taken off site for a legitimate reason, such as validation, by the correct department.

+ The police upload from a suspect's CovidSafe app, as a matter of policy, to help protect the public.

+ The police issue a data request, such as under the recently passed AABill law, from the Health Department.

The protections around the data only refer to it in two ways: App data, when it is on the phone, or when referencing it in regards to the Data Store in Canberra. Once it leaves, it is no longer protected.

The definitions refer to the data in terms of location, if that location changes, then it's out of those protections.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#217

Post by justinclift »

jfoster wrote: post #101
justinclift wrote: post #87

Earlier quoted context omitted.

If they're not producing reproducible builds, they're not really being serious are they?

You're seeking completely perfect solutions in a time of crisis where a "good enough" solution might save a lot of lives. Cut them some slack for trying to stem the harm of the pandemic. This situation affects every human.

Reproducible builds are not a "perfect" solution.

They, and the source code to build them, is the baseline requirement for any trust in what is being provided to people.

---

The Australian government has a history of extreme incompetence with IT projects, using PR to try and effect adoption, then bullshitting about their failures.

If there's evidence this project is going to be any different, then great. :)

In the meantime, I'm judging them based on their historical actions.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#218

Post by jamesjansson »

rstuart4133 wrote: post #148
shermozle wrote: post #52

Earlier quoted context omitted.

Nope. Why is it normal to take a few weeks to release the source? If it's good enough to release its good enough o publish openly. This government has ample form. If you want my recommendation you need to open it up.

Firstly, it is not normal in the open source world. Hell, it's not even normal open source projects owned large companies that are the foundation for a major product - like Android. Secondly, as the story points out, it is a fork of an open source app that is already on github. It's not like the infrastructure for it isn't already set up - they just had to do a git clone, and then use standard CI techniques Maybe the…

If the source code is ALREADY released, what is the harm in immediately releasing the fork? Immediate public release of forks IS common practice.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#219

Post by dghcrypto »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

It's easy to fix the app so that it does not need the phone number and to have the app notify the user of the need to get a test instead of having a contact tracer having to double handle the information and ring the user. I believe the fact the app is doing this more about its heritage than any design here, however as an "Australian innovation" we could fix this and avoid the prospect of vulnerable people being rung up by people pretending to be contact tracers, which will happen, and will not be good when it does. Interestingly if the phone number is not stored, the need to store any potentially personal information will probably disappear as well.

There's no need to see the source code to recognise this is a problem. Could we at least lobby them to fix this? It would make life easier for the contract tracers and it would mean that people could rely on the app's secure channel, so if a scammer does call them they could confidently tell them where to get off.

Re: Dissection of COVIDSafe (Android): Australian government's contact tracing app

#220

Post by crypto2me »

mcannon wrote: post #35

I believe the government, PM and various ministers have said the code will be released. My sources also say exactly the same. They’re obviously operating with extreme urgency to get the app out. For you. Give them a few weeks to clean up code and release it (which is very normal) - but in the meantime, here are some tips: - Turn the HN angry mob mode off - it’s not helpful. We’re all in this together. - Commend the g…

Doesn’t meet their own privacy impact assessment.

Source code not released.

Source code can be changed at anytime with no notice or need to re-consent data usage.

Protections not legislated.

Using centralised instead of decentralised and anonymised architecture.

Data on the central server has no purging policy. Only local data deleted after 21 days.

De encryption keys stored on the same server as the DB.

Unlike free adware crap games, governments have the power to legislate and enforce laws. Google Facebook amazon whomever other crap freeware games you refer to don’t.

Normalises government mass surveillance and tracking

Can be viewed in line with metadata retention, encryption laws and now this as a path toward digital dictatorship.

Raiding journalists to get the names of government whistleblowers.

Post reply on HN