foreign
[Music]
welcome back everyone now this afternoon
we've got Jeffrey Huntley with what is
clearly quite a topical subject
considering how big helpful the room is
now Jess the software engineer who lives
a minimalist lifestyle in a van that's
slowly working its way around Australia
now today Jeffrey's going to talk about
covert safe which is the Australian
government's phone app that was designed
to help with the pandemic he's going to
cover the technical reasons that the app
failed to help and the security problems
that it caused please welcome Jeffrey
hello everyone thanks for coming here
today my acknowledgments is everyone
here in attendance and original owners
of the land and also to linuxconf
Australia for actually making it
possible for me to be in attendance
throughout the talk there's going to be
a whole bunch of QR codes there were so
many things that went wrong with this
application and as I go through it I
would encourage you to actually have a
look at the things that are cited
so first this is kind of personal right
if you remember what it was like back in
2012.
um
so what it was like back in 2020
um
this is my story
I was coming out of a long relationship
and I it just figured out it wasn't
working so
it was also the start of the pandemic
that's another reason why it's like to
me it was a huge point
so early February I was camping with a
whole bunch of hippies down in Tasmania
and if you ever wanted to learn about
the e-force of Open Source I encourage
you go back to the origins I understand
the gift-based economy
this is really cool so here I was
camping like early 2000s and like in
January and wood was starting getting
out that over in Babylon the world was
changing like love was free everyone was
hugging and everything was there was no
there was no like social distancing it
was strange love and hugs were free and
plentiful everywhere
and every day I would go out check in my
parents let them know that I'm safe and
the call was made like well it's uh
getting a little bit hectic so got on a
plane from Scottsdale Scottsdale has
more than potatoes by the way and um
that's what that's what it's like back
in January
January like
Society was starting to fall apart
like all the flights have been canceled
there were signs everywhere that the
cafes are shut down social distancing
and
Society kind of entered into a point
where like time had no meaning if you
remember back back then when the
pandemic was first rolling through
like everyone was just kind of sitting
at home and time was bleeding into each
other myself I started building a van
with my father
and that was quite great
but there was a problem
I'd recently separated and myself my
kids
were in New South Wales I'm in
Queensland this is why it's personal
so the borders were shut and I was
separated by by two governments who just
really couldn't get their act into gear
at all
like I went into this in my blog post
and how much this personally affected me
everyone has their story but it was 13
weeks since I last saw my children
because of these lockdowns
I missed both of their birthdays
and Mr School holiday period this is
really personal
and I was separated by two governments I
never really thought much about state
and federal until covert covert really
showed the differences of how the
Australian government is constructed
and every time I went across that border
it was five thousand dollars
every time I entered back into
Queensland so if I was to venture down
quickly to see my children
that's five thousand dollars and 14 days
Hotel isolation
it was pretty Grim times everyone has
everyone has a story this is mine so the
government launched this covert safe
application I'm sitting at home
and
I'm faced with that I want to see my
kids
so they launched this application with
grand affair
it was essentially the idea that a
mobile technology could fix all our
problems there's some application could
open back up Society
and well sitting there had nothing else
to do I jumped straight at it right I
just want to get back and see my kids
and the government spent 21 million
dollars on this application by the way
21 million dollars only a fraction was
done on the software development and
it's not even worth mentioning how much
would spend on the security assessment
that was all spent on advertising and
marketing
ludicrous
so the application itself was based upon
the Singapore application
now the Australian government
the Australian government publicly said
many times that the Australian
application was based off the Singapore
application blue trace and it would fix
all the problems that blue Trace had
and we're like how's that possible
because the problems that Singapore is
having is like it's a userland
application if it goes into the
background it doesn't work that's how
the application life cycle works on
iPhone how could they fix that
it was so strange so the Australian
government got a drop of source code
from the Singapore government
and many weeks went by and the Singapore
government is updating its source code
they're fixing they're fixing problems
in the source code and it turns out the
what had actually happened in the
procurement the Australian government
had been given like essentially a table
and I've just been emailed around
various agencies
meanwhile the Singapore government is
releasing their stuff open source and
it's possible to contact and work with
the engineers and we're working off an
old table
and we'll we've actually started looking
at this source code I'll get into that
and there were fixes in the Singapore
source code that we just didn't have so
some of these claims didn't just didn't
make sense
and to make matters worse we started to
um we started to get like corporate
entities pushing have you installed the
application we had foxtel saying you
should install the application we had uh
fast food fast food stores sending push
notifications from the macca's app
saying have you installed the app
install the app we want to get back to
into business
and even though it was a complete breach
of legislation
we started to get like real estate
agents saying You must have the
application installed to be able to do a
property inspection
so strange the legislation specifically
said you cannot require someone to
install the application
yet we started entering into that
territory
and if you're wondering how we got to
this place I think one of the things
first was we can start with was this
application was launched with no
technologists
right it was
a medical tool
like with all due respect to people in
health
they had a need
they've gone to the market the market is
the digital transformation agency and
saying we need a nut built
and they did this big launch in the
launch there was just they're talking
about the health benefits but there was
no one there that was actually technical
at all
and that's wrong
because what happened was we got some
absolute numpty step up in the absence
in the absence of a technologist being
provided at these press conferences who
could explain how it worked we got
people who should have known better they
just signed a petition without even
looking at how the application worked
like a sure at this time the source code
wasn't available
but like you can take a pile an
application you can see how it worked
people started blindly advocating to
install the application without any
technical due diligence
we had people who just outright when we
decompiled the application just blocked
us like we're explaining how it worked
and just absolute dumpties
and meanwhile we had ministers talking
about this application and they're
putting all their blame on Apple and
Google
now covert safe worked as a userland
application
on mobile phones particularly iPhone
what happens is a userline application
when it goes into the background
terminates after 10 minutes
it's actually worse than that when it
terminates it takes a screenshot of the
application so what happened was the the
end user the General Public
where they actually thought the
applications running it was just a
screenshot
so all this blame was being put onto
Apple and Google meanwhile they weren't
using the devices as they're intended
like the life cycle was wrong
so with a little bit of coaxing from for
Paul Fenwick
he was saying like there's a few people
they're talking about the application
and I'm like hey
I'm going to start pulling it apart
decompile the application
and with Reckless about abandon I
compiled the application and dumped it
so decompiled the application and dumped
it on GitHub
like licensing whatever just dumped it
there
because source code is truth right we've
got all these people talking about this
application we've got these companies
saying download the app before you
connect before you can come into the
workforce and what else have you
and so I decompiled the application and
put together a report of the findings
and um we held our own press conference
right we held our own press conference
we explained how the application worked
and we started talking primary from fact
now this is something anyone here in
this room or anyone watching this talk
can do
right if you ever see such such
circumstances a lack of technical
expertise like
if you if you know something you should
say something because there's a good
chance of what you know someone else
might not know
and the absence of that knowledge you
get numpties right
absolute numpties
so
would you believe
in the year 2000
we launched a national product to all
the consumers of Australia and there was
no monitoring on social media none
like we've got this thing you must
download and install the application
but there's no one monitoring social
media
so was myself and a bunch of other
people we started collecting some of the
the problems that people are having
and sure Twitter is a little subsection
but it was it was really weird times
like
for example you couldn't install the
application if you had you were
traveling from the UK
like if you had if you the app wasn't
available into the international App
Store it was only available in the
Australian App Store
strange okay that's simple just switch
your app location but you can't you
would have to cancel all your
subscriptions with that account to be
able to switch
and
we just started collecting these these
faults right we started just collecting
these faults
and the application itself like there
were sections on launch that actually if
you tapped in the wrong area it actually
said you have covered it was literally a
button that said you have covered
and on launch we started communicating
publicly and collating working the Press
because there was no real way to engage
with government agencies and we said
look this is going to cause hysteria and
what do you know a week later nine news
some person in Frankston here in
Melbourne went into complete lockdown
because she thought that the app had
diagnosed her we've covered
anyway
yeah so
up there you'll see everything we've
been reading through bad reviews on the
App Store
that's how the general public of
Australia was working they were doing
tech support on App Store reviews
[Music]
there was just a support at inbox no
customer would be no social media
support politicians Gathering every day
we're in a pandemic and the Australian
public is left doing App Store support
reviews and one of the things we found
was well you could only register the
application if you were on 4G
what so everyone's trapped at home and
they can't register for covert safe
because they're on the Wi-Fi
it turned out that there were firewall
rules on the back end that blocked
connectivity if it was not an Australian
IP address
so if anyone does anything with block
lists with ipe ranges you know that
they're notoriously bad
so
we've got people sitting at home unable
to register the application the
government's saying please download the
app to be able to do and resume Society
and we had that wasn't it it wasn't just
like Wi-Fi what about people from
Norfolk Island Norfolk Island start with
a 6-4 phone number
right so it mandated that you needed a
plus six one phone number so Australia
is made up of many different areas and
it's not just Norfolk Island it's like
what about all the Backpackers all the
fruit Pickers or the borders are shut
the borders are shot and people can't
register this application
and times going by and we're becoming
even more vocal on social media and
actually contacting the agencies
the uh this is a classic I can't believe
this one the support contacts to direct
people how to fix their problems was
only displayed if you could register
yeah so people couldn't register the
application because they had a non-6-1
phone number they're on they're sitting
on a Wi-Fi because they're at home and
under isolation
and
even worse is we're finding all these
problems and security art is an alias of
support at
so there's no real way to really engage
like we found problems with the actual
application but there's no way to engage
with them because like we're stuck there
with all the people who try to configure
that application it's not properly
triaged no real way to engage with the
government
and
for studying of the source code it was
determined that the application was in
reach of the legislation and also the
privacy policy
like identifiers they were meant to be
private that are meant to rotate was
constant
so that meant that it was possible to
identify who someone was and your
proximity to that person
ouch
some safety issues there
so
we started emailing ministers
we started emailing media contacts got
on the phone and called I was like Hey
we're going to be I'm doing an interview
shortly about our findings they have
awareness of us
and nothing
absolutely nothing from ministers to
media contact to privacy like we even
contacted a law firm that was named on
the privacy policy
absolutely nothing what is the point of
privacy policy if the people who offered
it ordered it and implemented it are
uncontactable and unaccountable
right
all the players
were completely mad
we found an implementation error in the
Singapore application
think of that engineer fixed it same day
we can link to the GitHub commit where
they fix that and that because we're
based off that source code
nothing
so
this is the part where it gets very
interesting
the application was in serious breach of
the privacy policy and legislation
people can't register for the
application
and
the various media contacts because your
journalism you asked for a right of
reply and a quote it's like oh we're
following agile
we're following our job
he said we will fix it
so meanwhile myself and a bunch of
researchers we were decompiling the
application we actually automated to
actually decompile the application and
we're looking at the source code
and they shipped their first iteration
they're in complete awareness that this
application like people having issues
being diagnosed with covert and they tap
the wrong location
and they shipped a new coat of paint
the first release of the application
was a brand new logo and a brand new
look and fresh look they didn't fix the
privacy policy issues the thing that
actually even made it possible to
actually exist or in breach of
legislation new coat of paint they're
doing agile or capital a
so
we took our findings took it to the ABC
7 30 a.m slot Radio National
we've expressed our concerns that
critical faults have are not being
resolved we've got no way to engage with
the government our only choice is
essentially drag the government for the
media that's not really great that's not
great at all
so
this is probably the best summary I can
give of the attitude of Australian
government it's really unfortunate if
you contrast at say a New Zealand
government or other governments through
appearing on uh appearing on Radio
National I got some backdoor contacts
to the Federal pmo
and essentially this was the attitude
because you're speaking with the media
first you can go f off
like if I if I had a spoken women
directly and gone to them and before
speaking with the media they probably
would have accepted our help
but because we spoke with the media but
we wouldn't have had these contacts
unless we spoke to the media
get lost
so a couple good things came from
ABC Radio National was we created this
thing called Oz open Tech
and Oz open Tech is a collective of
Engineers so one of the engineers is
here in the room today is Jim
hopefully and uh Vanessa Richard and
myself
and basically we started pulling apart
the application a lot more and we
started looking at various other aspects
so like Jim is a Bluetooth engineer
right and this is uh application that's
meant to be off Bluetooth not a single
like Bluetooth engineer was consulted
about its usage of radios not so ever so
Jim started pulling it apart and we
started really just publishing research
so Aus open Tech is inspired by the
sunflower movement we're just a bunch of
Aussies pushing the status quo and just
think that better technology should
exist in the public sector
you'll find us over here in GitHub so
github.com ozopentech
and right now we're a little bit dormant
but the point being is if something pops
up like the for example each of the each
of the different governments started
pushing these QR code apps and they
started saying that Holograms are
security and like a hologram was an
animated gif right like
so we started pulling that apart so
anytime you see the Australian
government doing something and you're
wondering like this doesn't smell right
come join us we're probably already
picking it apart or it's very easy to
call or call a rally to come pick it
apart
so
we published our own report
with no way to actually work with the
government we just had to keep working
within the media and that's not great
for confidence in the application
so this is our report I won't have
enough time to get into the inner
details of all our findings but I really
recommend reading that that goes all the
way into the privacy policy
violations some of the problems are
Bluetooth the engagement model
and also I recommend
this series by Royce
Royce looks into the procurement of the
application you can't just look at
technology and isolation of its
implementation its flaws you have to
understand where it came from what were
the circumstances
like a lot of this a lot of this was
created by contracts subbed out by
digital transformation agency
now these contracts are all commercial
and confidence
now commercial and confidence is a
fantastic way to hinder Freedom of
Information requests
so you probably guess why they quite
like this approach
caught up with Jim the other day and he
said the stakes of in Bluetooth for
covert safe were
obvious and predictable
obviously predictable
while pen tests were done on really
basic things such as checking SSL so
it's append
a technology that hinged upon the usage
of radio no one actually really looked
Weber radio could actually do what it
was said to do
now the way covered safe Works in
general is you have a mobile mobile
operating system iPhone or Android and
the application runs in userland
and what happens is the application is
divided two parts client and server
and the server advertises hey I'm
covered safe
and then the client goes hey are you
covered safe
and if there's an agreeance because it
you trust what the client says right
this client the server says it does a
Bluetooth pairing
yeah
so this was meant to be the application
that we were told download the app and
you can go to the footy
when I said that no real
fundamentals from a radio perspective
were done or looking at from if from a
time and space complexity this is
essentially the N handshake problem
right it's a stateful based protocol
where it's going around and it's doing
Bluetooth pairing with all the different
devices in the stadium it's a no end
problem right the more people you're
around the worse it performs which is a
complete opposite of what we actually
needed what we needed was a stateless
broadcast protocol so the more people
around the better performed we're
covered safe as it was
just on a time and space basis is on
right doesn't make sense now
you probably caught something
remember I said are you covered safe
you should never trust the client ever
and you never should the client should
never trust the cert so the server
should never trust the client and server
should earns vice versa
so it works by going are you covered
safe
you see the problem
yeah
so this is one of the research findings
by Jim
it's a 9.8 CV
and what happens is if
someone says that they're covered safe
the phone if it's running covered safe
would certainly pair
do a Bluetooth pairing
with that device
so anyone could just walk around and say
I am covered safe and your phone would
pair to it
now the thing about how Bluetooth works
is Bluetooth has profiles
and a different type of profiles
headphones
mice
keyboards network adapters you name it
all the capabilities so once you've done
a Bluetooth pairing you switch the
profile
so in the midst of a map it emits of a
like a mass cyber scare about telerate
controls and all the rest of you
remember back then
we had the Australian government
advocating everyone to download the app
install the app and it just allowed
anyone to just silently pair with you
and then switch the Bluetooth profile
wild now
there was a talk a couple of days ago
they were talking about I think it was
on terminals and people implement the
spec
and they they aren't aware of cves that
reflect that spec this is something here
this is not just covered safe I see uh
there's uh someone working in the active
business space they want to do a
mesh-based SMS type being well this type
of CB still exists if you use Bluetooth
to randomly pair with random people
you're going to have this cve keep it in
mind anytime someone says Bluetooth and
they're starting using Bluetooth in this
manner you're going to run against this
the same problem the Australian
government had
and
essentially
one of the things that's really sad is
the Australian government focused on
kind of like an All or Nothing approach
they they focused on that the
application should be centralized
right it must be centralized because
because the health professionals need a
centralized system but that focus on a
centralized system lost trust in the
community it spawned media Cycles
about whether like where is the data
stored it's stored in AWS Etc that
entire thing that eroded public
confidence could have been avoided with
a decentralized system
and by focusing on centralization
that constrained what they could
actually do to be essentially running as
a user-led application Google and apple
came across came with an alternative
approach which was broadcast based and
other countries deployed this system and
it allowed for the ability for people to
actually opt in and communicate with
health professionals but by focusing all
on centralized they lost the trust of
the Australian public
and they got nothing
and it was just really just a missed
opportunity
because
we started to see the individual State
departments the state departments don't
develop their own individual
applications and they started saying you
need to register for this application
you need to scan the QR code if you
wanted to go to the cafe
and the missed opportunity is well I'm
traveling around Australia in a van and
let me tell you I had to install all
these apps
and the registration flow for each one
of these apps was all completely
different
and I'm technically literate like they
they were
on the borders with New South Wales in
Victoria there was gray Nomads like
creating little Villages either side and
they're trying to get the apps installed
they couldn't get it installed
and this could have been a federal
system this could have been the QR codes
could have been in the federal
application
New Zealand did this that one app that
worked everywhere in Australia we had
each individual each individual state
had their own individual implementation
and the implementations weren't
protected by by strong privacy and
legislation so for example Western
Australia the police started using the
collection centralized collection of
data
to go after criminals which further
eroded trust in the application this
could have been a centralized
application
and what we got was
an addiction to press conferences
[Music]
right
like we're in Melbourne this says enough
this says enough
right wow
and it wasn't just Melbourne it was
every state
now
it's now 2023. entire generations of
people have been raised without
television they don't know who Molly
Meldrum is they don't watch the Oscars
they don't know anything but for some
reason
for this particular thing they need to
turn on this TV and they'd find the coax
cable and plug in their TV or find some
way to connect
and it's such a missed opportunity
because everyone had an app on their
phone
the app on their phone could have been
like a weather report it could have
shown all the information of relevance
and need to allow them to convey the
information instead they do press
conferences
and from then it turned into Chinese
Whispers people would
like report upon what was said they had
the power of distribution it was on
everyone's phones
but press conferences that makes no
sense
like we just got a bunch of Bin chickens
on television
and it's just so sad because the
underlying problems that affected covert
and covert safe are still here today
like I can talk about the technology
problems and all the implementations
launches never go right
but the underlying problems have not
been resolved
for one
the Australian government is still not a
CNA
now the CNA is responsible for the
numbering when you raise a cve if you
have a product
your and you want to be involved in the
process and someone raising a security
defect
then you should be a CNA
in this case we raised the cve there was
a 9.8 and the Australian government
tried to actually get it downgraded
because it didn't look politically great
so
you're still not a CNA
we should be a senior
we still don't have a vulnerability
disclosure program
right
the uh the ASD
so 1300 cyber one you try calling and
they're like oh yeah thanks for your
report and goodbye I don't even know if
like some of the stuff we were working
on like it was it was strange like that
that vulnerability Jim was like on
LinkedIn sending messages to governments
in Morocco and all these other company
countries that use this application
we've got no security clearances and
we're just randomly connecting with
different countries like we're in murky
Waters right we've got no security
clearances we don't even know if it's
safe what we're doing we just want to
help the general public and what we
found in Australia affected other
countries as well
we sort of have a vulnerability
disclosure program some people focus on
the bug Bounty which is the idea of
payout payouts Etc but Bounty is not it
it's actually about a process to engage
the government and to coordinate
releases we still don't have that and
that's sad
there Still Remains no way to build
software openly with the government
the example I'd like to give here is the
Dutch government that's why we've got
windmills
the Dutch government
they were stuffing up as hard as the
Australian government
now they decided they're going to fix
their problems by holding a hackathon
with pizza
Innovation Theater now what they got was
in that competition they held they got
they got companies re-badging the
Singapore application as if it was their
own application
they got
so many things that just would not be
compliant it was essentially pizzaware
now this is the part that's wild
the
the intelligence organization in the
Netherlands actually did their own
assessment they leaked it to the Press
that's how they managed to change their
the the political landscape in there
they were going in a bad place
they were going in a bad place as a
result of that leak a wise idea came up
let's build in the open like all the
software Engineers are just sitting here
like time is meaningless and they all
want to help out
so they started they opened the GitHub
repo and the minister for health
actually committed a git commit
first get commit and it was essentially
top to bottom of the application being
open source and inviting people to come
build it with them
they started doing sprints where you
could anyone in Australia I was here in
Australia dialing into a Dutch call and
were just sharing knowledge backwards
and forwards it was lovely
um the ux was designed by the engineer
of uber here's Dutch right and all these
people started contributing their Time
pro bono
there's no such thing to be able to do
that here in Australia at this stage and
that's really sad
now
something that was good that came out of
the Dutch government was they actually
held a symposium at the end end of it
and they between different governments
of different countries with the public
sector workers
and they actually shared Lessons Learned
the UK were there and a few other
countries noticeably absent was
Australia
I was there
so we need to fix that
hmm
because the status quo that we have now
is essentially if you know something you
say something you could drag the
government for the media and that's not
that really doesn't help
so we were pushing very hard for source
code to be released very hard to source
code to get released
and in the end they did start releasing
source code it was nice kinda
kinda this probably sum up the attitude
and like skill set that we have here
um essentially what they were doing
every release was unzipping a tar ball
on top of the repo and then committing
that that repo that that was that was
great and the software license that it
was released under was not open source
whatsoever
it contained this absolute Corker
and this was quite alarming
buried down in a couple paragraphs it
says by viewing this source code I am
responsible for any costs of third-party
claims associated with my access to this
source code
and must pay those claims on request
what
it's right there on the repo you can go
have a look so meanwhile this software
is being built commercial and competence
by all these business by all these
corporations and we're a bunch of
technologists talking about this
application and the problems right
well there's Rites of Remedy right like
what happens are we what legal place are
we as researchers are we causing damage
to them and by viewing that source code
can they come after us
so we never looked at the source code we
just kept looking at our decompiled
source code because that that worked for
us
anyway so now the application is
scrapped it cost us 21 million and a lot
of the a lot of the things that cause
the application to be a failure are
still here because we don't have a way
to publicly engage
we're from the Department
now one thing I can ask is check your
parents phone check your grandparents
phone they're probably still got the app
installed I come along I come along a
lot of people in my travels and they
still have the app installed
so
help them get rid of the app delete the
app
and I suppose one of the underlying
things of why really personally got
involved apart from like trying to see
what I can do to expedite seeing my kids
Etc because this was meant to be the app
that's going to open up the economy Etc
the idea is if the app you had the app
you maybe you could cross the border
sooner hell yeah I'm in now medical
professionals deserve tools that work
right this this is a product that is
launched without any technology
represented representation we had an
absolute numpty's talk up but turn up
and talk about how the app worked
without actually looking at how the app
worked we had media continually like
they're on the trail like the the
speaking with us and they're going we
know it's not working right and they
said it started creating this forceful
feedback cycle back to Medical
practitioners saying hey is the app
working can I get a comment it got
really politicized and it just really
sad because like
if they're getting this this pressure to
actually you must use the application
essentially what's happening is they're
being forced to use a tool that doesn't
work
and if you've got only eight hours a day
and you've been forced to use a tool
that we know is ineffective but they're
doing anyway for political reasons
that's robbing over time that they could
be better spent contract tracing through
traditional methods
and there are there were other
techniques that could have worked it's
just sad
anyway these days I'm building a little
hacker pad down in Kangaroo Island if
you're ever down that area in Adelaide
um please say hello just a nice little
place where you can come hack on open
source and a little bit later I'd like
to encourage you to get on the beers
um thank you so much for being here
um please have a look at these two
reports on the left is our independent
report that went into all the problems
we've and with timelines of how and when
and how it all went down over right
looks at the commercials and how all
these agreements between the DTA and the
rest of the organizations worked thank
you
thank you
we've got about five minutes so if
anyone's got some questions that would
be relative to be heard in this
environment please do put your hand down
frighten them all
you've not have been carrying this app
around in your pocket you must have
questions
thank you
um you said that uh you kind of I guess
wish the government had more of an
approach to kind of doing collaborative
open source development around things
like this and it should be a model for
that and how do we do that and I I guess
if you're having worked in the
government previously that that's
normally possible the government doesn't
really know how to do that it doesn't
have trust in community
do that for them but we have a huge
wealth of talent in a country and I I
guess it was perhaps a lost opportunity
that people didn't come together to
maybe try to build something like this
at the start of the pandemic
independently yeah and kind of deliver
that solution maybe in tandem or you
know as an example
and I guess I wonder how do we
how do we make sure we engage those
communities or you know stay in touch
with those communities to make that
stuff happen because ultimately to build
public good you need you need a
community around it that's what these
you know conversation and all this is
really about
um you know I just wonder how we how do
we do that do you have ideas yeah sure
so the question is how do we essentially
engage and build in public so
I attended peers talk yesterday that was
lovely she has some ideas
[Music]
um
as for engaging Community it was it was
such a missed opportunity everyone was
just sitting at home right the Dutch
government understood this eventually
um
the minister who was responsible for
that is now the head of the Dutch
minister of the Innovation he did quite
well out of it
um
what can we can do
I don't know
I honestly don't know
um I can recommend coming joining the Oz
open Tech Discord or if you see
something the government's launching
something
just come start a discussion in there
because we've so far we've pulled apart
everything from how voting machines and
election work through Vanessa's work to
the contract tracing apps to myself I
did a little application called jab
maker.com and it would generate a
covered vaccination certificate because
authenticity in Australia is apparently
just a PDF
yes but the point being is we've got a
whole bunch of essentially troublemakers
there who are technically confident will
pull apart the application so
it's been good because it's brought
together like like-minded Minds but like
throwing crap in the Press it's not the
best way to engage so something I hope
someone here or someone who watches this
talk or does have you there needs to be
change because there are a lot of people
who are technically competent they know
what you're speaking about they're
starting to organize and the alternative
is you get dragged in the media
like it's just it's not it's not going
to work like the literacy is continually
to improve and people are able to see
something's wrong
like it it it was such a wasted
opportunity that like you look at the
Zoomers and all the rest and
they they've got no free to wear TV and
yet they had to tune in to free aware TV
it was weird
so that we need proper digital uh
engagement techniques and I'm not sure
how or what that's needed to be changed
but looking forward to it
which I enjoyed that mentally
um my question is maybe more practical
do you ever get a response from the
government or from the covert safe
people through their support team or did
you get any interaction at all
yeah so that's an interesting question
through appearing on so the question was
do we ever get into contacts with the
government as a result yes
uh one connection to the federal pmo
office that basically told us to go get
EFT
um and the other one was we got a
contact in the didn't Transformer and it
didn't transform anything Department
um
yeah
yeah there's some story there
um and yeah uh I suppose if you're in
that department you're in that
government and credible people who were
expert in their domain come up and speak
your one job if you're in that public
sector is essentially is connect your
agency with those knowledgeable
incredible people and help work towards
a good public outcome so yeah we've got
a contact there at a director level
looked at our our findings and then they
shipped a new coat of paint and at which
point we would like not stop this we're
just going to keep publishing our own
stuff
because
I encourage you to catch up the gym
hallway track myself and I can go into a
little bit more but essentially it was
all falling on deaf ears it was just a
stain
um
yeah they were for all this they've
never actually launched a initiative
direct to Consumer the agency
essentially they engage contracts to
between different Departments of the
government or they work with like
Enterprise wisdle the idea of a brand
new mobile phone release is something
that they've never done before
um and the fact there was no customer
support or all the rest it just wasn't
even thought of
um so fundamentally something needs to
change on that department so yeah we got
some contacts uh but we very quickly
discarded those contacts when they
discarded us
yes please Jim okay just I'll bring you
a microphone and then that's going to be
there and thank you Jeff there's
wonderful talk and also thank you for
all the work you did at the time and
subsequently I actually did get
contacted by the DTA much later in the
process and at this point the iPhone app
still doesn't work and despite all of
what Jeff has just told us
they actually came to us and asked for
help because they weren't able to make
the iPhone at work and I'm not an iPhone
developer and it wasn't
I was I was just trying to help convey
the technical details and mediate that
but Richard was another person yeah and
what was incredible to me and probably
one of one of a thousand different
moments that completely blew my mind was
that even in that moment asking for help
they seemed to be unable to figure out
how to engage with us properly and
because we wanted to we helped we wanted
to make the app work in whatever build
the credit that we needed to have them
listen
and in that process we still couldn't
seem to get across the line and get the
problem fixed and and it was incredible
how difficult they made even even when
they were on the back foot they still
made it hard to work with us
yeah and then subsequently all of the
things that involved reporting security
issues and things like that and there's
a lot of contacts that came a lot later
um this is kind of nine months into the
into the into the thing they still were
very selective about what they replied
to in emails they still were very
unclear what they wanted us to do and
how they wanted us to communicate so Jim
the problem was we're not a commercial
entity we're a collective community and
like a collector Community you can't put
that in a statement of work or paper
around it
um and
yeah so we we would have had more
success if we were
Oz open Tech as an as an entity that
could have like had some sort of joined
a like legal contract of like the
Liberals Etc they just didn't know how
to engage with a whole bunch of people
who are subject matter experts in their
own particular way like they just no
Playbook at all
foreign
[Music]
but it sounds like actually people would
hate it's your break you want to keep
talking
[Music]
so someone asked a question over there
how do we do this differently well it's
not a technical solution it's a
community solution and we can yeah
that's the wonderful thing about this
community
that's why you're here yeah so on behalf
of the people here it's a little gift
from thanks to you and thank you I hope
you've managed to spend time with your
children since then yep thank you