COVIDSafe App: Advice for Survivors
Last updated: 21 July 2021
Please note that WESNET will be updating this advice on a regular basis and we urge readers to check back at regular intervals if you are sharing this advice. There may be updates to the app that will mean our advice needs to be updated.
The following advice was developed in relation to Android Version 1.0.17 and IOS version 1.2 (released on 13 May 2020)
Update July 2021
Our understanding is that use of the CovidSafe app has all but been abandoned by Australians. For advice about State/Territory QR Check in risks please see our new advice here.
The purpose of this advice is to help survivors of domestic and family violence or stalking to make an informed decision about whether or not to download the Covidsafe App which was rolled out in Australia from 6pm AEST on Sunday 26 April.
WESNET had computer scientists examine the Australian version of the App shortly after it was released by the Australian Government. This followed earlier advice that was based on an analysis of the Singaporean version of the App (TraceTogether).
This handout is designed to help survivors make an informed decision about whether or not to download and use the COVIDSafe App. WESNET has been working in collaboration with relevant government departments around this advice.
TLDR: for some survivors who have abusers with sophisticated skills with technology, you may wish to consider this advice before downloading the COVIDSafe app.
What is it?
The Covidsafe App is designed to help trace contacts between people who may have come into contact with someone who tests positive to the COVID-19 virus. The App is part of a public health response to try and minimise the spread of the coronavirus over the coming weeks and months.
How does it work?
COVIDSafe is designed to aid contact tracing of people who have tested positive to the coronavirus by logging information exchanged via Bluetooth between phones running the app. If the user subsequently tests positive for the coronavirus, the information collected is then made available to health authorities with the consent of the app user, so that others can be alerted that they may have been in contact with someone who has tested positive for the virus.
Should I download it?
Our advice, based on what we have seen in the Australian version, is that for those survivors who have abusers who have sophisticated technical abilities you may wish to consider your own personal circumstances before downloading the COVIDSafe App.
If this is your situation and you need to keep who you meet with private and your abuser has physical access to your phone or you suspect the abuser has already put some kind of surveillance app (spyware or stalkerware) on your smartphone it may not be safe for you to download the COVIDSafe App.
We emphasise that the abuser would need physical access to an unlocked phone in advance or to already have installed spyware on it. At the time of writing, they would also require a medium-to-high level of technical skill to be able to interpret the data stored locally on the user’s phone by the COVIDSafe App.
If you wish to download the App for public health reasons, but wish to keep certain meetings secret from your abuser, you may wish to:
- leave your phone at a safe distance from those you are meeting with, or consider leaving it behind if it is safe to do so.
- Turn off BlueTooth, if it is safe for you to do so.
- Turn off the phone, temporarily, if it is safe to do so.
Trust your own instincts about whether or not it is safe for you to turn off Bluetooth, turn off the phone or leave it behind, based on your situation,
The App will obviously not work in the scenario where you test positive to the coronavirus, or, vice versa, if they have the tracking App and they test positive.
What data does it collect?
Our expert advisors have examined the Australian app and found that it stores up to 21 days information on the following:
- approximately how many close contacts the user of the phone had.
- when those contacts occurred.
- how long they occurred for.
- the make and model of the phone of those close contacts.
In many circumstances, the make and model of the phone of a close contact may be enough to provide an abuser with a strong clue as to the identity of the close contact. This is particularly the case if there are multiple simultaneous close contacts – for instance if an abuser knows a survivor’s mother has an iPhone 7 and her father a Samsung Galaxy S8, if those two phone models appear simultaneously in the log files, the abuser could be confident that the survivor had visited their parents.
We emphasise that to get access to this information, the perpetrator would need physical access to an unlocked phone in advance or to have installed spyware on it, At this moment, they would also require a medium-to-high level of technical skill to interpret it.
The information stored on the Australian version of the App is not encrypted and can be read by someone who has access to the phone and a medium-to-high level of technical knowledge about how to access hidden folders that store the information. Our advisers also warned us that there are some other vulnerabilities in App which could be exploited but they would need a high level of technical expertise and access to the unlocked phone. While the information sent back to the central server if you test positive is encrypted in transit, the information is not encrypted while ‘at rest’ on the device. It is difficult to access but is not impossible.
What about at the Government storage end of things? Will my data be safe?
The Government has stated that only health authorities will be able to access the data. The government has a master list mapping the codes to phone numbers.
WESNET will continue to monitor the App and update this advice if anything changes.