Government spy app soon mandatory?

[Uncle Fester]

Our experts at it again.


They got the idea from Singapore who only use it voluntarily and only 20% took up on it ...obviously privacy concerns.

We are getting a chance to use it voluntarily but if less than 40%, ScoMo does not rule out to enforce it's use.
To me, based on Singapore's uptake, the decree looks likely in the coming weeks.

I like the way they try to sell it:
"believer in the Australian people making the right decision"
or ScoMo's :
"give Australians the go of getting it right"

Reminds me of the propaganda methods in totalitarian SciFi movies, LOL


So what are your thoughts?

Mine are at this stage:

1. It requires that you have bluetooth on all the time which is a major security risk. Plenty about that on the net, not up to discussion here.

2. My trust in our Gov creating a secure app without flaws and backdoors(wanted or unwanted) is near 0%.

3. My trust in our Gov building in other silent features to access private information on our devices is near 100%.

4. AFAIK no other government forces you to install a tracking/spy app. There is no evidence that such draconian measures will stop the virus.

5. Singapore who has the app have over 3x more cases per cap than us.

6. Where I see the app being useful is having it switched on mandatory at schools to find out if the virus does pass on to teachers and other kids and then their parents, like that is common with the flu and cold.
Unfortunately we can't get that data from Singapore as they have shut down their schools.

Edit: How are they even going to police that, make it compatible with all devices and Android/IOS versions or if my phone uses

[enf]

It's a crock.....

As much as the government has been uber successful dealing with this pandemic, and I for one think they've all done a superb job overall, the deputy chief medical officer says it may become mandatory.

Am I going to get arrested for going out without a phone? I do that all the time....I HATE the fvcking things. I've always regarded mobiles as a rarely necessary ball and chain.

Mine is an old Samsung S4 mini...any app probably wouldn't install anyway.

[WhiteOx]

It won't be mandatory at all.

[Uncle Fester]

It won't be mandatory at all.

...until the next back flip

Edit: Wow I just checked further below on that link:

"It simply swaps phone numbers and names."
NICE... so everybody gets my phone number and name when they stand around a while within 8m.
As mentioned above it is not possible to determine the distance with bluetooth as there are too many variables.

And here was I being so kind just to swap the IMEI.

Apparently they are releasing the source code so that should provide an opportunity for hackers to mess around with the transmissions and maybe tunnel into your phone as it has to be open for these transmissions to work.

[Tiny]

.

Edit: Wow I just checked further below on that link:

"It simply swaps phone numbers and names."
NICE... so everybody gets my phone number and name when they stand around a while within 8m.
As mentioned above it is not possible to determine the distance with bluetooth as there are too many variables.

you edited this while i was writing post below it.
well, I doubt that it would be as simple as everyone getting your phone number & details in their contacts list.
I would think that for security reasons, the data will be encrypted so only the authorities will be able to decrypt the contact info.
If so, that will give you your privacy until you or others you were in contact with give the data to the authorities, if that ever happens.

[Uncle Fester]

I would think that for security reasons, the data will be encrypted so only the authorities will be able to decrypt the contact info.
If so, that will give you your privacy until you or others you were in contact with give the data to the authorities, if that ever happens.

If the source code is open then the encryption algorithm is known.
That is not what I am worried about.
For this to work my device must be transmitting and other phones must be connected to read and vice versa openly without first giving a permission. So anybody should be able to enter your phone through this open port using a modified (hacked) version of this app.
I bet any IT savvy 13 y/o could nut that out.

[SS Dave]

And no we will not track your every movement any time we want. yeah right!

Sound like one of the 3 biggest lies

I will still love you in the morning
I will not !@#$ in your mouth
And the check's in the mail.

[enf]

And no we will not track your every movement any time we want. yeah right!

Sound like one of the 3 biggest lies

I will still love you in the morning
I will not !@#$ in your mouth
And the check's in the mail.

.....jeez ob, your obviously suss....

[shred]

Sound like one of the 3 biggest lies.

“We’re from the government, we’re here to help”

I’ll be interested to see how many of our liberties are not given back when this crisis is over. Just look at what was taken from us forever nearly 20 years ago in “the war against terrorism”.

I’d be interested to see how they propose to track us.

GPS - massive invasion of privacy and tends to run the battery down.

BlueTooth beacons, where it just records who you’ve been close to could be better, but it requires each device transmitting a fixed UUID and/or MAC address.

Early BlueTooth phones did exactly this, but supermarkets and other businesses with a large marketing department quickly learned that they could listen for the BlueTooth MAC address (or UUID if it was beaconing) of each device and use it to track consumers’ buying habits in their stores. The mobile phone makers then evolved the technology to use randomly generated MAC addresses and UUIDs instead, so as to protect our privacy. Most makers only randomise the last three bytes, so the manufacturer portion remains accurate. Apple is “special” and breaks convention in using a completely random MAC address.

I can’t see how these apps can function without broadcasting a fixed identifier and this is a potential invasion of privacy without any GPS tracking.

[Uncle Fester]

“We’re from the government, we’re here to help”

I’ll be interested to see how many of our liberties are not given back when this crisis is over. Just look at what was taken from us forever nearly 20 years ago in “the war against terrorism”.

I’d be interested to see how they propose to track us.

GPS - massive invasion of privacy and tends to run the battery down.

BlueTooth beacons, where it just records who you’ve been close to could be better, but it requires each device transmitting a fixed UUID and/or MAC address.

Early BlueTooth phones did exactly this, but supermarkets and other businesses with a large marketing department quickly learned that they could listen for the BlueTooth MAC address (or UUID if it was beaconing) of each device and use it to track consumers’ buying habits in their stores. The mobile phone makers then evolved the technology to use randomly generated MAC addresses and UUIDs instead, so as to protect our privacy. Most makers only randomise the last three bytes, so the manufacturer portion remains accurate. Apple is “special” and breaks convention in using a completely random MAC address.

I can’t see how these apps can function without broadcasting a fixed identifier and this is a potential invasion of privacy without any GPS tracking.

Most ppl would have already given other apps permission to read and transmit their IMEI often without noticing it.

So this would be how I would do it:
Transmit the IMEI over Blue Tooth and read all the transmitted IMEIs of the phones within the bluetooth range(usually 8m if you are lucky), collect those readings(and other data that might be interesting) over a certain time period and send in packets to the Gov or third party who is contracted to manage this over the net using Data or Wifi when available.

Yes, I have no doubt, once we agree to this privacy invasion it will be here to stay.

[shred]

So this would be how I would do it:
Transmit the IMEI over Blue Tooth and read all the transmitted IMEIs of the phones within the bluetooth range(usually 8m if you are lucky), collect those readings(and other data that might be interesting) over a certain time period and send in packets to the Gov or third party who is contracted to manage this over the net using Data or Wifi when available.

Yes. that'd work. Each phone broadcasting a unique identifier (re)opens the privacy issues around movement of people being tracked by listening for BlueTooth or WiFi beacons or traffic generated by the phone.

Ever had a listen to all the traffic around you using a penetration testing tool like "Kismet"? It's fascinating - particularly when someone is using an older Android device that doesn't have any of the privacy protection. Can very quickly and easily find out things like:

• Name of the phone "Steve's phone"
• Manufacturer (from the MAC addr prefix)
• All the WiFi SSIDs theyve associated with (list of hotels Steve stays in)

I've done quite a bit of work at home, using bluetooth beacons for presence detection. You can buy cheap bluetooth ibeacon devices online (beware, beware dodgy eBay sellers... here be dragons) and then set up devices like the cheap Raspberry Pi and Raspberry Pi Zero W boards to listen for the beacons, or absence of beacons. Put a beacon in each car/on my bike etc and now the house "knows" when a person leaves or enters.

If installing the app becomes mandatory, it'd be pretty easy to accidentally set the security settings on your phone so the app can't access, WiFi, bluetooth, GPS or whatever. "Look, I've installed the app", but for some reason, it doesn't work. Can't figure out why.

[Uncle Fester]

...

If installing the app becomes mandatory, it'd be pretty easy to accidentally set the security settings on your phone so the app can't access, WiFi, bluetooth, GPS or whatever. "Look, I've installed the app", but for some reason, it doesn't work. Can't figure out why.

Pretty sure the app will enable BT on it's own and there will be a big display "do not enable Airplane Mode"

Fine for not having the app installed $1000, you did not know about app but you should have.
Fine for enabling Airplane Mode $2000 and/or 6months prison, as that would be seen as deliberate criminal act.

...which brings me to:
7. Every App I have installed terminates at some point in time. I can't even get the damn VPN clients to stay resident. I am sure this is an Android thing, maybe a background process limit or something but now everybody would be expected to make sure this app is always running 24/7.

[SS Dave]

If they say I must install it I have prepaid I use for online sales that never leave's the house it also has no GPS receiver along with the bluetooth if not working

Try tracking that.

[wotnot]

So don't worry about the chief morons in govt. that people...for some reason... keep voting into office.

I did hear about this, thanks for digging out the bullet-points -- I technically became bemused with the bluetooth must be on point...all I can think of, is they're intending to use that NFC protocol, to flag when 2 people with phones running the same app, get within 1.5m of each other or such and similar?...can't actually be done;



The reference cites ->

The powers that be, won't make the app, write the app, security audit the app or anything else like this -- it's like the link I posted earlier here about speed cameras taking a hit -- they've outsource the whole thing to someone else, and 'trust' that someone else has done everything right, like the speed cameras... which don't do everything right. You probably need to focus on whomever in the gubberment has some financial interest in the company they'll outsource this to ... or something like that.

As for enforcement? "Can I check your phone please sir?" at the next RBT setup I see ; app not there? $180 fine thanks ...I mean, shit, we've gotta make up for all that snap-for-cash we're missing out on with the speed cameras, right?

Good to know you're using custom firmware tho', at least I don't feel all alone =)

[Al Bundy]

So don't worry about the chief morons in govt. that people...for some reason... keep voting into office.

I did hear about this, thanks for digging out the bullet-points -- I technically became bemused with the bluetooth must be on point...all I can think of, is they're intending to use that NFC protocol, to flag when 2 people with phones running the same app, get within 1.5m of each other or such and similar?...can't actually be done;



The reference cites ->

The powers that be, won't make the app, write the app, security audit the app or anything else like this -- it's like the link I posted earlier here about speed cameras taking a hit -- they've outsource the whole thing to someone else, and 'trust' that someone else has done everything right, like the speed cameras... which don't do everything right. You probably need to focus on whomever in the gubberment has some financial interest in the company they'll outsource this to ... or something like that.

As for enforcement? "Can I check your phone please sir?" at the next RBT setup I see ; app not there? $180 fine thanks ...I mean, shit, we've gotta make up for all that snap-for-cash we're missing out on with the speed cameras, right?

Good to know you're using custom firmware tho', at least I don't feel all alone =)

Wow, how quickly you forget

If I thought for one moment that this lot of rswipes could be trusted, or more to the point the bureaucrats that do their bidding, I’d might just consider it, but I am sure we all know that none of them can be trusted, so F#@k Off!!!


​And in conjunction with the “private sector” to boot....

It's much deeper than that, we're a long way behind the curve in these regards down-under. At present, these sort of measures are only being entertained because widespread, integral tracking via 5G networks and telematics ( ..I know someone in the US working in this area), are in their infancy. This technology can rub both ways as well...ie; he was talking about a police radar app that tied in with your dashcam to not only warn you as you approached the radar check, but also used the new AI functionality in silicon to scan whether the radar unit is still parked in the same location or not. All our mobile phones just got lit up with the first real use of the national 0444444444 number - how anonymous was that? Was our privacy protected, or how long before the technology exists to do that, and be able to figure out where every handset actually is, and if the owner should be there or not? What about when your car starts pinging 5G networks and using GPS and letting traffic control systems know that you're coming, or, same systems broadcasting to your car of an accident ahead, and an ambulance coming up from behind about 1 minute away, so pull over now... this is where they're headed.

If the current covid-19 situation is just a prelude of things to come, and there's considerable research and study to suggest this is the case, if the next pandemic of whatever kind involves a virus with a mortality rate running at twice the percentage the spanish flu pandemic exampled, we wouldn't be discussing things here with the talk of 120,000 deaths, we'd be having the same chat with something like 100million people already dead.

Now, I can't speak for anyone else, but, if something like that happened, and the technology existed to check whether or not people were doing as they're told and being where they should be, or alert me that some drongo who'd been in contact with an infected person had used the same petrol pump 3mins earlier that I'm about to use... or in any way helps me avoid getting infected or infecting others, I'm going to welcome it.

[Xplorer]

Interesting. What about the people that work or live in areas of no phone reception.
Yes, some work places restrict phones and some work places have no reception.

And not everyone wants Bluetooth, NFC and GPS turned on all the time; well they shouldn't if they knew what is good for them.

Should this be mandated, I'm sure the next buying frenzy will be cheap $40 service station phones being activated.

[Tiny]

If you look down further in the article that WhiteOx posted, they tell you more about how it supposedly works. See quote below.
Scary thing is they say they are going to publish the source code; brilliant for hackers, served up on a gold platter.

The other thing I gleaned from reading other articles about this app, is that it supposedly does not transmit data live back to base; it simply compiles a list of people you have been in extended close contact with, on your phone, for use at the time when & if you or one of the other people you have been in close contact with, are noted to have been in contact with a positive tested Covid19 person.
Supposedly just to make it simpler to track & trace possible areas of contagion, then you can just give the authorities the data from your app, to help contact the other people that may be at risk of infection or spreading the infection.

What hasn't been made obvious is what compatibility with phones it will have. My S3 has limited compatibility with current apps, can't even use ANZ phone banking app.
I'm not getting a new phone for this unless the gov pays for it.

Senior cyber experts looking at app security

Minister for Government Services Stuart Robert sought to again assure people that the privacy and security of the app would be watertight.
"There is no geolocation, there is no surveillance, there is no tracking," he said.
"The app simply connects with another app if those two phones are within 1.5 metres for 15 minutes.
"It simply swaps phone numbers and names."
He said the Government had enlisted the help of the Australian Signals Directorate and the Australian Cyber Security Centre, as well as other industry partners, to check the veracity of the security measures in place.

Mr Robert also said the Government would be publishing the source code for the app for people to view and comment on, as well as the privacy impact assessment when it was completed.

[wotnot]

Mr Robert also said the Government would be publishing the source code for the app for people to view and comment on, as well as the privacy impact assessment when it was completed.

That will have to happen first, including the privacy impact statement, and before the app is disseminated ; going by how much time is usually involved in an impact statement preparation... 3rd Q of 2021 perhaps?

Also..

The app simply connects with another app if those two phones are within 1.5 metres for 15 minutes

Does that infer that police out there enforcing social distancing laws, have to stand there for 15mins at least, to determine whether people are breaking the law or not?

[Landytrack]

For a start do not have Bluetooth or GPS switched on as do not use them. As well don't always carry my phone with me unless there is a need.

Tend to regard mobiles as a pest at times so only use mine when I want to.

In any case my android is so old would be surprised if a new app would load on it.

[Mr 672A]

I dont have a Phone that connected to anyone so they can go and Jump. My Phone is phone with my Videos, cars, My TV Room and other thing that I like and that it No filth, No Porn, No nothing that is off Also I have my favorite Music On it so at Night I can hear my Music that I like.