Last week, the ACS Ethics Committee examined some of the issues raised by the government’s roll-out of the COVIDSafe app.

The committee concluded there were areas of concern, and addressing them would be necessary if the Australian public is to adopt the app with confidence.

The rapid roll-out of the system over the weekend has however, precluded detailed examination and resolution of all technical and ethical aspects by independent experts.

Whether or not any contact tracing solution for COVID-19 is actually useful for managing the current pandemic is a matter for epidemiologists and public health experts, rather than IT experts, except that if it is not that useful because of its functionality or uptake it may be ethically dubious to deploy.

It is important to look at the overall system and this includes the app, data storage, associated infrastructure and cyber security, policies, processes and procedures, along with the oversight, legislative and regulatory environment.

Some of the concerns raised by privacy advocates, technology policy experts, and the general public may not have been able to be addressed before we were asked to decide whether or not we download the app as the government presses on with deployment, but it is important they are examined.

While the adoption of the least intrusive protocol that still achieves the aims of the contact tracing regime is to be preferred, the decision to deploy a centralised system based on the TraceTogether app deployed in Singapore has been made.

Many of the arguments for and against the contact tracing system illustrate the tension between the common good, that is, wanting to help the community stay safe, and concern for the dignity and rights of the individual, both valid and both important.

As the proposed system runs only on iPhones and Android mobiles, there is also a concern that the tracing system is far more likely to benefit younger, more urban populations rather than older and disadvantaged groups who may lack access to smartphones, but who may be more susceptible to COVID-19 infection.

The complexity of the issues, and in communicating them, along with the range of different voices expressing their views has also led to some misunderstanding about what is being deployed.

The system is not designed to track the movement of individuals but to help other users of the system understand whether they may have come in to contact with an individual confirmed with a COVID-19 diagnosis; mobile phone numbers of users are stored by the Health Department.

This confusion has amplified a more general lack of trust in government institutions with respect to the implementation of technology in some segments of society.

Key to widespread adoption of the app is that it is on a voluntary basis and the government embraces the idea of continuing informed consent, which allows users to opt out at any time with accompanying data deletion.

Coercion, actual or perceived should not be used by the government to increase adoption of the app.

This includes politicians or officials making statements pondering a possible compulsory uptake requirement. or assertions that restrictions will continue until and unless the public embraces the app.

The following minimal set of points were felt by the ACS Ethics Committee to be important for any system deployed in Australia, and should be taken into consideration by both the Australian Government in deploying the system and by individuals considering downloading the app:

1. Any system should be minimally intrusive and privacy-preserving as far as possible.

2. Data collected by this system should be the minimum required set and should not be aggregated with data from other sources (no data sharing with other agencies or organisations).

3. Claims for the app and supporting system must not misrepresent the case:

a. The system is as secure as claimed to be, and that these claims are verifiable;

b. The system, app and any data have a finite period of deployment, and these claims are verifiable (eg. a sunset clause and published data deletion schedules); and

c. Utility of, and need for, the system and the app are as claimed to be, and published data evaluates and verifies this.

4. As far as possible the app should be able to be used by those with low levels of digital literacy and with basic data access.

5. The tracing system and app are easily understood to allow for informed consent to use by as large a percentage of the population as possible. There must be clear communication of its voluntary nature, mechanisms, and benefits and risks in plain English, translated into community languages.

6. The system must not be used to punish or discriminate against any segment of society (eg. used as evidence for a back to work passport or access to services).

7. Judicial or statutory (eg. Ombudsman or Privacy Commissioner) oversight should be implemented in order to prevent misuse and promote trust in the system.

8. Any system to be deployed be available for scrutiny by experts in cybersecurity and technology ethics.

Dr Michael Wildenauer is Chair of the ACS Ethics Committee.