Australian digital transformation without the Authority
Vanessa Teague, 1 Jan 2021
It has been another disappointing year for the Australian tech community, and I feel that we need a new strategy.
Taiwan’s Sunflower movement opened in 2014 when the pro-unification Kuomintang Party signed a secret “Service and Trade agreement” with the Chinese Communist Party, and a group of Taiwanese students and technologists conducted a nonviolent walk-in, occupied the parliament and talked them out of ratifying it. Since then, it has developed into a wonderful example of how democracy and technology fit together. They build software that strengthens their democracy, improves human rights, and actively involves citizens in decisions so they can “live democracy day by day.”
Added note, given the appalling situation in the US today (Jan 7) - I am absolutely not advocating literally or physically taking over the Parliament or otherwise undermining democracy. This is about using technology to enhance and protect Australia's democracy.
Here in Australia, the complete exclusion of Australians with technical knowledge from decision-making and development of public technology is so normalised that the minister in charge of digital transformation can get away with describing as a “sovereign Australian app” a system that was ported from Singaporean code, improved with some tricks from the UK, uses completely secret server-side algorithms probably from the Boston Consulting Group, stores detailed information about Australians on the Amazon cloud, and didn’t work when Australians needed it.
I do not have a complete plan for turning things around, but this situation has to change, and those of us who understand technology are the ones who have to change it.
Inspired by Taiwan’s Sunflower movement, I want to start thinking about how we could get an Australian knock-off started. This essay is an opinionated list of my preferred priorities, biased towards the projects I already know and care about – please join the discussion and add your own alternatives and plans.
COVIDSafe is bad, but it’s not unusual
First a little background about COVIDSafe. Based on Singapore’s TraceTogether, with some imported tricks from the UK’s (now abandoned) centralised contact tracing app, the COVIDSafe app attempts to gather lists of contacts via Bluetooth, which can be uploaded to a server for processing and notification if the person tests positive for COVID-19. Since its release in April, COVIDSafe has suffered from numerous privacy and functionality problems, almost all of which were first identified by the tech community and hence corrected by the authorities. Unfortunately, just as the app code was reaching a stage where most of its functionality seemed to be about as good as could be expected, the DTA decided to start again with a new Bluetooth communication layer called Herald. There is no clear evidence about whether Herald improved or downgraded functionality, but it certainly re-introduced a number of the privacy and interference problems that had been corrected.
We are well past the number of free hours of work from the Australian tech community that could have been spent successfully completing an app that works on the Google/Apple Exposure Notification system.
If you are one of the many people who gave up their spare time to find and fix bugs in COVIDSafe, only to find them re-introduced by the Herald update, then I am really sorry. That is not how this is supposed to go. You have still performed an important role by telling people the truth about the technology, which matters to ordinary people’s decisions about using it. Ironically, by making calm and careful technical analyses of the system and helpfully suggesting corrections, we won the propaganda war.
But the important point is this: Not one thing that has dismayed the tech community about COVIDSafe is unique to COVIDSafe.
Rejection of superior technology to select an inferior design for political reasons? Consider the Trusted Digital Identity Framework’s rejection of a public key infrastructure. Lying to Parliament? When an official from the commonwealth Department of Health was asked by a Senate committee about the easy re-identification of patients in Medicare-PBS data published by her department, she denied it was easily re-identifiable and admitted only that “it was asserted to be possible to access some very limited encryption,” despite patient re-identification being a simple matter of basic database querying that had nothing to do with encryption. Dismissing concerns even after they were conclusively demonstrated? Misleading users? Pressuring a university into silencing open discussion of its flaws? None of these are COVIDSafe-related innovations.
Not even the decision to throw out months of free expert labour and corrected bugs, and start again from scratch, is unique to COVIDSafe. Elections ACT did exactly the same thing last year, replacing an open-source version of their counting code that had been extensively reviewed and corrected, with a hastily-implemented buggy version just before the election.
If anything, COVIDSafe is a little more transparent than other comparable projects and, therefore, probably less incompetent than the ones we cannot see. Most of the bug-fixes were actioned, not counting those reintroduced by Herald. When Ben Frengley and I found a code proxying attack on the myGovID system, the ATO characterised it as a “user education problem” and still refuses to fix it.
Does it have to be this way?
There is nothing natural or universal about the exclusion of people with technical knowledge from decisions about and development of government tech.
In Switzerland, when we discovered a serious cryptographic problem in their e-voting system, the Federal Chancellery funded us and Swiss experts to collaborate on an open, in-depth reassessment of the entire program. The NSW iVote system had the same bugs, but there was no serious reassessment and there is no plan to change their approach.
In Taiwan, the technologists who started the Sunflower movement were invited in to government.
The community that has grown up around the public examination of COVIDSafe can be a catalyst for better technology policy and practice across Australia’s public sector. I am delighted that a community of geeks is suddenly outraged by the things that I had given up hope of changing. After years of wondering why nobody else seemed to care, a whole community of people want change. Please write your best ideas for government tech change into the government technology discussion.
First, my most-urgent legislative change.
Legislation/politics: democracy is the thing we must not sacrifice
We can see COVIDSafe’s app code and identify mistakes. We can download the myGovID app and examine its behaviour. But years of effort by democracy activists and even a Senate motion have failed to bring any details about the Senate scanning and counting code to light.
Update, December 2021: the Australian Parliament recently passed bill mandating an audit of the digitised preferences against the paper Senate ballots.
The bill is here and it will improve the real and perceived security of Australian elections by ensuring that scrutineers can see evidence that Senate ballots are accurately digitized. More details at EFA.
So improvements are possible - think of the next one we need.
Please add your preferred priorities to the legislation/politics discussion.
Communication: first, people have to care
Some of the best successes have been the simplest. #notmydebt wasn’t just a hashtag – it was also a highly effective program for aggregating stories from those who had been unjustly accused of owing money. The combination of effective communication and useful tech made for a historic win.
One of the most effective tools for supporting Australian democracy is righttoknow.org.au, which provides a simple public interface for Freedom of Information requests. It doesn’t let you do anything you couldn’t already do, yet their advice, support, coordination, and publication is tremendously powerful.
Digital Rights Watch, Electronic Frontiers Australia and AccessNow all do a wonderful job of communication to both ordinary people and decisionmakers. We should always work hard to inform formal democratic processes.
However, I think we made a mistake by working only through the official “consultation” process on issues such as TOLA, the anti-encryption legislation passed in 2018, and the various followups that undermine Australian security and privacy further. We need to think about how to make technically-literate protest visible and appealing to non-geeks. What would a security-and-privacy version of the climate protests or black lives matter protests look like? Who would join us? How would we invite them in? Conversely, what technology would support democratic expression on those other issues?
Please add your ideas for better coordination and communication to the communication discussion.
Outside-government public technology
We are the people who know how to build things.
I know of lots of Australians - both inside and outside government - building valuable technology that supports Australian democracy. Michelle Blom’s election auditing software, specifically designed for Australian-style preferential elections, has been used in San Francisco but not (yet) here. Australian open-source implementations of STV counting software could be used immediately instead of the often-secret, often-foreign code many of our electoral commissions use. Flux has a terrific sub-project on encoding legislation.
So many other good things have been, are being, or could be built by the open source community without needing official endorsement.
Please add your ideas (or existing projects) to the outside government technology discussion.
It doesn’t have to be this way
Nothing about COVIDSafe surprises me except the active involvement of a wonderful community of interested independent people.
I do not have a complete solution, but I hope this site can become a forum for focusing discussion on a better way our country can build public-sector technology.
... that whenever people feel anger, they no longer turn their anger into helplessness, but rather into social outrage, which is an impulse for co-creation, and so my main suggestion is not to take this personal[ly], but take it social.
--- Audrey Tang
License
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
