Question:

apply the PAPA framework for ethical issues to the following article:

Experts raise concerns about security of coronavirus tracing app COVIDSafe

updatedWed20May2020at3:39pm

Australia's state health authorities now have access to what they hope will be a vital tool to help them fight COVID-19.

Contact tracing teams cannow start making use of datacollected through the COVIDSafe app.

A bill regulating the collection of personal informationthrough the app passed the Parliament on Thursday morning.

But there are still some questions about the app's effectiveness and safety.

The COVIDSafe app can be voluntarily downloaded onto Australians' smartphones. The app relies on Bluetooth to detect other users of the app that are within Bluetooth range.

When it detects another user, it exchanges an encrypted package of information containing a unique identifier for the user, as well as the Bluetooth signal strength of the contact and date and time of the interaction.

That identifier can be used by health authorities to determine the name, age range, postcode and mobile number that was used in the app's registration process by each contact.

Thedata is stored on a user's phone for up to 21 days. If a user tests positive for COVID-19, they can upload their stored contacts to a central repository held by the federal Health Department.

That data is then made available to state health authorities for contact tracing.

LIVE UPDATES: Read our blog for the latest news on the COVID-19 pandemic.

Here's what the COVIDSafe app looks like and what it wants to do

As Australia looks to implement an app that will help ease coronavirus restrictions, privacy concerns remain.

Read more

A known issue with Apple's operating system is that the app will not function well if it is on in the background.

In a parliamentary hearing last week, the Digital Transformation Agency acknowledged that on iPhones the app "progressively deteriorates and the quality of the connection is not as good as you get to a point where the phone is locked and the app is running in the background".

The app is most useful for situations where people are in public, such as commuting to and from work. Given that this is also the time when many would also be on Facebook or Instagram, the background issue will limit the usefulness of the app for contact tracers until this issue is resolved.

Apple is going to release a workaround for the issue.

"Apple themselves are working through that matter and in coming weeks there will be an improvement," the Deputy Chief Medical Officer Paul Kelly said.

Breaking down the latest news and research to understand how the world is living through an epidemic, this is the ABC's Coronacast podcast.

Read more

Internationally, concerns are being raised over the emergence of similar tracing apps on a global scale. Their swift rollout increases the risk that technical bugs could allow users' devices to be exploited and attacked and risks exposing more personal information.

The release of Apple's fixes to allow Bluetooth tracing apps to work on iPhones will be a significant new technical update to millions of phone users around the world. That update may mean it becomes a target for cyberattacks that could create vulnerabilities in devices.

"We're going to see a lot of attacks because this is going to be software that's running on every single phone," Ashkan Soltani, a former chief technologist for the US Federal Trade Commission, said.

"And if that's not a honeypot for anyone, I don't know what is."

There are concerns about how long data gathered from the app will be retained.(Supplied)

Some privacy law professionals believe the current version of the COVIDSafe bill does go a long way to protecting the use and disclosure of personal information collected by the app. The Australian Human Rights Commission also acknowledges thatthe bill contains several important protections.

Those protections appear to prevent the data from being used for purposes beyond contact tracing by Australian authorities.

The bill also cancels out other laws that could be used to access the data. And it will go a long way in deterring attempts by individuals or corporations to coerce people into using the app.

The Labor Opposition agrees.

"In many ways the privacy protections included in this bill are to use the word of our times unprecedented in Australian law," the shadow assistant communications minister Tim Watts said in Parliament.

But it places no time limit on the retention of the collected data.

There is a requirement for it to be deleted when it is no longer likely to be effective in fighting the pandemic, but no clear sunset clause.

"At the moment the bill creates a fairly open-ended storage of that data, in that it will be kept until essentially the end of the pandemic, the end of the usefulness," Katherine Kemp, a privacy law academic at the University of New South Wales, said.

"But it's by no means clear that that retention is necessary for contact tracing."

Dr Kelly has guaranteed that the information will only be used for its intended purpose.

"It's a promise we've made to the Australian people about the privacy and security elements of the app," he said.

"It's for contact tracing by disease detectives in state and territory health departments and they are the only people that can use it."

Concerns have also been raised by the crossbenchover the potential risk of US Government gaining access to the vast repository of data collected in the national data store, which will be held by Amazon cloud subsidiary Amazon Web Services.

The Government released the source code for the app on Friday. Releasing this publicly allows security researchers to scrutinise the app and search for any vulnerabilities.

However, there was an omission the server code that accompanies the source code was not released.

This would allow further scrutiny of how stored data is encrypted. The approach is also a departure from the Singapore Government, which has released both the app and server code.

apply the PAPA framework for ethical issues to the following article: