COVIDSafe is no ‘gold standard’ for govt tech

The COVIDSafe app should not be viewed as a gold standard for government digital service delivery, with a need to overlook the hype to acknowledge a series of issues with its development and implementation, according to Centre for Digital Business managing director Marie Johnson.

The contact tracing app was launched a month ago and has been touted by a series of federal ministers and some members of the tech community as a huge success in government IT and an example of what the new normal should be.

A recent piece in the Australian Financial Review labelled COVIDSafe as the “golden standard” that “rewrites the rules for government services”, pointing to the speed of its development, rapid adoption of the app and cross-agency cooperation that led to its release.

But others have called out issues with the app’s functionality and privacy, the use of private consultants, and the lack of evidence or any information that would determine whether the app will be effective or not. These are good reasons to not necessarily believe the hype, the critics say.

Ms Johnson, who was the chief technology architect of the Health and Human Services Access Card and former head of the NDIS Technology Authority, urged caution in the plaudits being handed to COVIDSafe, saying there are a number of areas that can been improved.

“This particular hype at the moment is absolutely overdone. There appears to be this zeal for apps without really understanding how they are going to be used and evaluated, and the impact on people – particularly vulnerable people,” Ms Johnson told InnovationAus.

“There was this rush to get this app out and there were no options considered, and the advice of the experts has come in a very chaotic way. For me, this is a case for how government services should not be done in the future.”

A proper concept of operations needed to be established around the app before its launch, along with consideration of other options, such as the recently released Google and Apple contact tracing framework, Ms Johnson said.

“My continuing concern is that there doesn’t appear to have been a thought through concept of operations for the app,” she said.

“Everybody is getting very excited about this app and what was involved, and there’s almost a tech glitterati rush of enthusiasm and self-marketing. But beyond that, there doesn’t appear to have been coordinated thought given to the concept of operations.”

“When there is political pressure to do things or political preference or instruction given to use a particular solution, like this app, that always causes problems because the other options have not been evaluated.”

The Opposition has been supportive of the concept of a contact tracing app and passed the legislation underpinning privacy safeguards around it unammended. But Labor MPs, including shadow assistant minister for cybersecurity Tim Watts and Ed Husic, have pointed out some of the functionality and privacy issues around it, and the use of AWS to store the data.

Labor government services spokesperson Bill Shorten told InnovationAus the opposition is supportive of a tracing app, “but it has to actually work.”

“The government needs to sort out major glitches with the app and clarify to the public what the benchmark is for it to be effective,” Mr Shorten said.

“So far we have been told it is 40 per cent of the population, and then 40 per cent of the adult population and then 40 per cent of adult smartphone users, and we are still below that threshold. More recently the Prime Minister said the percentage didn’t matter. Which is it?”

There is no clear measure of success for the app beyond that 40 per cent target, which many government ministers and Department of Health officials have since renounced.

The government regularly touts how many people have downloaded COVIDSafe, which is now above six million, but does not plan to reveal the number of people accurately and actively still using it.

“They say we’ve got six million downloads as if that in itself is a performance measure. It’s not. These downloads can actually hide a lot of things and it doesn’t actually get underneath that and talk about what’s needed and what’s not been thought through,” Ms Johnson said.

For Digital Rights Watch chair Lizzie O’Shea, COVIDSafe did mark a step forward in government digital service delivery, but many of the positive elements about it should be considered as baseline measures, and much more could be improved around its development.

“The government did take some laudable steps forward in their digital development processes, but the rollout of the COVIDSafe app falls short of a ‘gold standard’,” Ms O’Shea told InnovationAus.

“In the future we hope to see the government incorporate and improve upon the processes they used in this case,” she said.

“We also hope to see an end to the simplistic moralising used by the government in an effort to try and get people behind a tech solution to a social and political problem. It’s foolish and unhelpful, and it also ended up not being effective.

“The app is not going to be useful in the way the government had hoped, and it is the government that bears responsibility for that, not its critics.”

Improvements could be made to COVIDSafe’s privacy policy and the app’s source code and legislation enshrining privacy protections in law should have been revealed publicly before it was launched,” Ms O’Shea said.

“A single, coherent privacy policy relating to the app is not a gold standard, it is an absolute minimum requirement. The new policy falls short in declaring precisely what information is gathered, stored and shared,” she said.

“There is no clear standard for when the app will stop gathering data, or when the gathered data will be securely destroyed.”.

“And we’re yet to see that the government’s centralised design approach has been effective. The decentralised model supported by Apple and Google is more reliable and is much more privacy friendly,” Ms O’Shea said.

“At no time was any adequate explanation or evidence presented as to why the Australian government took a different path to other countries all over the world.”

Responsibility for COVIDSafe was originally handed to the Department of Home Affairs, which brought in a number of contractors and began work on a prototype.

It was then passed to the Digital Transformation Agency which completed the bulk of the development work in collaboration with AWS and its contractors.

The announcement of the app and a series of media interviews were led by government services minister Stuart Robert, but by the time COVIDSafe was actually launched, health minister Greg Hunt was the public face of the service.

“Information about government digital projects should come unprompted from one consistent and digitally-literate spokesperson, not piece by piece in response to media questions over several weeks,” Ms O’Shea said.

Ms Johnson also questioned the use of outside contractors to assist with the build of the app, with more than $2 million dished out to private companies, including the Boston Consulting Group, which was paid nearly $700,000.

“Having such a prominent presence of major consulting firms when you’ve got a population-wide system like this, without a concept of operations, means there is a lack of clarity and transparency around the governance of this,” she said.

The future of government service delivery should involve internal skills in the APS, not rely on outside consultancies, she said.

“It won’t be the consulting firms that are left, they’ll have run off into the sunset with their profits. It’s the people in the APS that the future of government services is dependent on, and that means having a far more creative and forward-looking perspective,” Ms Johnson said.

“There’s this current hype around rewriting government services, but over the last 20 years across government there has been a loss of expertise within government about the certain processes of government,” she said.

“There are still some phenomenal people within government but more and more there is this reliance on consultants.”

Do you know more? Contact James Riley via Email.