The federal government should formally make data collected from its Covid-19 tracing app exempt from use by law enforcement and “decentralise” the way it notifies users about potential contacts with the virus if it wants to allay privacy concerns, digital experts have said.

The government services minister, Stuart Robert, conducted a media blitz on Monday to talk up the proposed app, which he said would be used by state health agencies to speed up the time it takes to conduct contact tracing “from days to minutes”.

Robert has explicitly linked the success of the app with easing lockdown restrictions, saying it would “allow us to get back to life quicker”.

“It will allow us to get back to the footy quicker. It will allow us to get back to work quicker. It will allow us to resume the economic activity of the nation quicker. And we need to do this for the country,” he told the ABC on Monday.

“There are a lot of people unemployed now and hurting. And the prime minister has made this clear – this is one of the key conditions we need to get economic life back into the country.”

But the app has not been universally welcomed. Even government MPs such as the former Nationals leader Barnaby Joyce have ruled out downloading it because of privacy concerns.

Robert has sought to address those by promising to release the app’s source code, and insisting it will not track people’s locations or be available to law enforcement.

“All it will tell me is that you and I were in, for 15 minutes or more, 1.5 metres in proximity to each other,” Robert said.

“[It] won’t tell us where, because that’s irrelevant, or what you’re doing. We don’t care where you are or what you’re doing.”

He said people who downloaded the app would only be asked to add their name, age range, postcode and phone number. Using Bluetooth, the app would record when people were within 1.5m of another user for 15 minutes.

The data would remain “securely encrypted on your phone” unless you tested positive for Covid-19, in which case it would be accessed by state health authorities.

“If I was confirmed positive, my data goes up to a central data store, only to state health officials, no one else, and then they could rapidly call anyone I had been in close contact with,” he said.

But data privacy experts remain unconvinced. Vanessa Teague, the chief executive of Thinking Cybersecurity and an adjunct professor at the Australian National University, said until the source code was released – and the government formally made it inaccessible to law enforcement – there would still be concerns.

“The minister is saying it won’t track your location and that the source code will be openly available, which are both good things that I’m very strongly in favour of, but it’s one thing to say ‘we’re going to give you that information’ and it’s another thing to give it to us.”

She said the “centralised” model proposed by the government, which would mean officials would de-encrypt contact information on the basis of a positive Covid-19 result, “inevitably means the authorities are getting a complete list of your contacts”.

“One thing I really want to be clarified is, if we are using this trace model, how easy is it to omit certain contacts or turn off the logging feature if you choose to not relay the fact you’ve been in contact with certain people?

“The second is, how does that interact with other existing surveillance laws? So for example the laws used against a journalist recently means that under certain circumstances a police officer can demand access to your phone. If your phone has an in-built list of everyone you’ve been near in the last two weeks, will that be excluded from our existing laws?”

Experts such as Teague argue the government should instead use a “decentralised” version of the app, where instead of health authorities gaining access to a person’s encrypted data if they test positive, the app notifies people automatically if they are a close contact of someone who has tested positive. Similar apps based on this design are already being developed.

Other experts have questioned how effective the app would be, and have said its use should not be tied to a rolling back of lockdown laws. Both Robert and the prime minister, Scott Morrison, have said they want 40% of the population to download the app to make it effective.

Hassan Asghar, a lecturer in computing at Macquarie University, said even if the government reached that target it was wrong to explicitly link the two things.

“There is no guarantee it’s going to be that effective in reducing the virus that the lockdown can end – countries like Singapore and South Korea have used similar technology and still have lockdown measures there,” he said.

“It’s not a way to come out of lockdown, it’s more like a support for whatever contact tracing processes they are already using.”

He said a low uptake on the app would make its usefulness very limited.

“Using a very simple scenario it’s only going to be 100% useful if all my friends and family members and everyone I come in close contact with also install it,” he said.

“The more users you have, obviously the better your results. You could say OK, at least if one of my close contacts is using it that would make it faster for the authorities to be able to contact trace that person. You can say that’s better than nothing. But it is also kind of tracing your movements so, you know, what’s better?”



