Where are the bug bounty programs? That's easy. It's a crime to see how any of the app is running. Reporting a security flaw would likely see you receive a $5000 fine, and potential jail time atop of that.
They didn't bother to get the servers running before pushing out a gigantic advertising campaign shaming anyone for not using it.
... Despite it having obvious flaws from day one, that showed it was mostly a cut 'n paste of Singapore's GPL app. (Though you can't access the source. National security trumps freedom of information and promises.)
It isn't actually a law yet - that happens later this month. Instead, we've received a determination by the minister [0], which will act as a kind of back-date for when those laws are passed.
> A person must not decrypt encrypted COVID app data that is stored on a mobile telecommunications device.
That video shows them looking into how the data bundle is assembled, but I don't believe they actually touch it or run it in an emulator, which would very much breach the determination - because unless you're one of the exceptions, you're not legally allowed to run the software outside of tracing.
Exceptions are given for those in employ of the health department, or other government bodies.
Whilst that might vaguely not mean decompiling the app, the minister's own press conference is clearer on the intent [1]:
> It cannot leave the country, it cannot be accessed by anybody other than a state public health official, it cannot be used for any purpose other than the provision of data for the purposes of finding people with whom you have been in close contact, and it is punishable by jail if there is a breach of that.
Decompiling the app steps outside the provisions for looking at the data, and yes, you don't have permission to look at your own data.
IANAL, but I think your interpretation goes beyond what they're after.
The determination is clearly aimed at data usage and prevents people from trying to decrypt the reports from other users. The whole fragment of the interview is about the data produced by the app and how it should be protected as sensitive information. I can't see anything there that would prevent you from reverse engineering "to see how any of the app is running."
It's not even obfuscated or protected from decompilation in any way, so it's trivial to look at with static analysis tools. (i.e. without trying to run it)
Even the headings don't mention the code: "Collection, use or disclosure of COVID app data", "Treatment of COVID app data", "Decrypting COVID app data", "Coercing the use of COVIDSafe".
> IANAL, but I think your interpretation goes beyond what they're after.
Perhaps more than the intent, but this is a government that doesn't deserve the benefit of the doubt.
Circumventing any "access control technical protection measures" is currently a crime under Australian law (Section 116, Copyright Act). They may well consider any decompiling tools to fall under that particular law, as well as use of said tools.
In March, they pressured a university in firing someone researching into their own data breach to see how bad it is. [0] There isn't a law against de-identifying, especially when it is in the public interest, but they went ahead and threatened severe legal action anyway. Whilst simultaneously claiming that said data breach doesn't contain any personally identifiable information.
They had to be taken to the High Court to be shown that an algorithm cannot be used as evidence that a debt exists, and that decision makers actually need to do more than just trust the system. [1]
If it embarrasses them in any way, then they are not above twisting laws to suit them. [2]
So far as I can tell, the legal instrument that sets the requirements for the app is the Biosecurity (Human Biosecurity Emergency) (Human Coronavirus with Pandemic Potential) (Emergency Requirements—Public Health Contact Information) Determination 2020:
They didn't bother to get the servers running before pushing out a gigantic advertising campaign shaming anyone for not using it.
... Despite it having obvious flaws from day one, that showed it was mostly a cut 'n paste of Singapore's GPL app. (Though you can't access the source. National security trumps freedom of information and promises.)