Published on 2020-04-06 as a Twitter thread

Australia's #COVIDsafe tracing app doesn't match the better privacy protections that Apple, Google and groups like @TCNCoalition have been working on, but it does have some level of privacy effort put into it.

If 50-70% of Australians agreed to install it, there's a good chance it would have significant public health benefits vs. coronavirus, allowing more reopening sooner & more safely.

But worried the launch hasn't sent the right signals to the tech and privacy communities to be on track for that outcome. The rush to launch before new Apple and Google APIs were available is not helping.

Old APIs mean Android users get a location permission request (which Android requires for bluetooth) that is causing mass foreseeable and avoidable confusion -- the app doesn't collect mobile location data, but everyone will naturally think it does and that the gov't is lying.

The thing that would be reassuring would be a course correction in a few weeks to not collecting any data besides the anonymized IDs from Google+Apple's new encrypted API.

The UI for exposed individuals can warn them about the exposure and then offer to schedule a call with a public health official to discuss. From within the app, that wouldn't even need the Australian gov't to have users' phone numbers.

Most people will say `yes' to the call, and then can decide what tracing questions to answer or not. If they say `no', the app can give them advice on safe isolation, testing, & counselling.

A huge challenge here is that public health experts and "cipherpunk" computer security communities think about privacy in very different ways. But for high levels of adoption, these apps need the confidence and backing of both groups.

PS -- @DTA and @MaddocksLawyers , please update the privacy policy & impact statement to say whether & how long you retain IP address logs for. Those are location data too ;)

PPS-- the government's controversial record with metadata & "assistance and access" anti-privacy legislation really isn't helping in this crisis. Reconsidering those bills might be the signal of privacy sincerity that is needed right now.