Stumbling surveillance: the end of the COVIDSafe app

It took a few years of tolerable incompetence, caused fears about security, and was meant to be the great surveillance salvation to reassure us all. Instead, Australia's COVIDSafe App only identified two positive cases of infection during the SARS-CoV-2 pandemic, and failed, in every sense of the term, to work.

Launched in April 2020, this AU$21 million platform was heralded as a great tool for pandemic surveillance. It was one of many such digital responses used by countries to combat viral transmission. China adopted the Alipay Health Code app , which shares location data with police authorities. Users receive various codes denoting status: red for those needing to spend two weeks in isolation; yellow for those needing to self-quarantine; and green for those able to move about freely. India has Aarogya Setu; England and Wales, the NHS COVID-19 app.

As Privacy International observes, the spread of these apps, some voluntarily applied, others not, had a range of consequences. Data might be generated without the user's involvement. Data might also be lifted from the relevant device. Some apps might store data locally or convey it to servers. "And they can leak data to analytics firms and social media platforms."

COVIDSafe relied on Bluetooth signals transmitted at intervals to nearby users, with those testing positive would trigger a process by which state and territory authorities could request access to the phone to identify other potential infections. The close contacts would have to be within 1.5 metres of each other for at least 15 minutes. In principle, this was meant to lead to improved contact tracing, more effective isolation protocols and enable more restrictive measures to be eased.

From the start, the project seemed plagued. There were questions about the exposure window and how viable it was, notably in the face of more infectious variants. There were concerns that user data in the national data store could become accessible to the US government, given the awarding of the data-storage contract to Amazon Web Services (AWS), a cloud subsidiary of Amazon. By the end of April 2020, 3 million Australians had downloaded the app. In total, there were 7.9 million downloads. The measure of success for the program, in other words, became one of downloading an app rather than its supposed effectiveness.

Users were assured that little needed to be done for the app to successfully operate. "Your phone does not need to be unlocked for the app to work," Minister for Government Services Stuart Robert claimed in an unconvincing statement . Users were also encouraged to "have the app running in the background when they are coming into contact with others." This betrayed a lack of technological savvy habitual among cabinet ministers.

In the view of the Minister for Social Services Anne Ruston, the app was part of an effort to empower Australians "to proactively limit the spread of the coronavirus and protect the community." Having such a mechanism in place would "help protect the lives and health of the Australian community to make sure that we are in a position to quickly respond and be able to trace people if they have come into contact with somebody who has the virus."

But the government's own assessments revealed that the app only worked effectively on locked iPhones about a quarter of the time, if that. As of late April 2020, documents from the Digital Transformation Agency found that the app's qualities in communicating between two locked iPhones was "poor". The same finding was made for encounters between locked Android to iOS services and active Android to locked iOS devices.

The rating for unlocked or active iPhone-to-iPhone encounters was, by way of contrast, "excellent", logging in a success rate of 80-100 per cent. But the latter rate was fairly meaningless, given that iPhone users are, for reasons of privacy, encouraged to maintain a default lock setting.

With COVIDSafe's effectiveness coming into question, the strategy of the Morrison government moved from the silver bullet to the general plan. The digital tool was to be but one element in the overall battle against the pandemic, complementing, in Ruston's words, "the existing manual process by which we currently trace and track people." It could be likened to, as Prime Minister Scott Morrison did with trivialising ease, donning sunscreen before heading out the door.

A subsequent government report into the app, released on July 29^th, 2021, chose to avoid some of the more glaring problems in the enterprise. Even then, the authors had to concede that COVIDSafe was "rarely" resorted to by public health officials "except to confirm cases identified through manual processes." This, the reasoning went, was due to low rates of community transmission and formidable manual contact tracing. The app's failure, in other words, was a sign of the country's success.

A less than flattering counter report by software developers Richard Nelson, Jim Mussared and Geoffrey Huntley, along with cryptographer Vanessa Teague, noted a lack of "deep discussion of changes made throughout the app's development which heavily impacted efficacy, and fails to disclose key information such as the number of active users of the application."