COVID-Safe Contact Tracing Application

GoSource partnered on the rapid delivery of the COVID-Safe back-end administration portal, enabling Australian contact tracing teams to operate at national scale during the pandemic.

Challenge

In mid-March 2020 the Department of Home Affairs needed a way to manage self-quarantine for international arrivals. Within weeks the border closed, managed quarantine replaced self-quarantine, and the problem changed to contact tracing. Responsibility moved from Home Affairs to the Department of Health and the Digital Transformation Agency while the work was in flight.

What carried across was the team. AWS and GoSource had built the quarantine prototype quickly enough that the same group was kept on the new problem rather than rebuilt around it.

Solution

Australia was not the first country to face this, so the team looked for something reusable before writing anything. Singapore’s BlueTrace framework became the basis for the Australian app. Its design used two separate native applications, Android and iOS, to get proper access to the Bluetooth radio.

The delivery group then grew to bring in CSIRO and other partners for specific strengths, and the Australian Cyber Security Centre joined on the customer side. GoSource moved to the back-end administration portal that contact tracing officers would actually use, and ran a 24-hour capability using staff in its European region. Stand-ups twice a day held the thing together.

The front-end app was a customised version of Singapore’s. The administration portal was not: AWS and GoSource built it from nothing, to be ready the day the app shipped.

Outcomes

A working prototype inside weeks. A tested, security-hardened production system in the Apple and Android stores before the end of April 2020. About 5 million downloads in the first week, which made it the most popular app in the country at the time.

Two things outlasted the app. The round-the-clock model across Australian and European time zones proved a delivery capability we had not needed before. And the collaboration itself, across GoSource, AWS, CSIRO, the ACSC and three government departments, turned out to be repeatable.

Technologies

BlueTrace, Singapore’s open-source contact tracing protocol. Native Android and iOS apps, built by partners. A custom back-end administration portal from GoSource and AWS on AWS infrastructure. Twice-daily stand-ups and continuous iteration. Security hardening alongside the ACSC.

Privacy, under time pressure

The app existed to protect people during a public health emergency, and it collected data about where they had been. Bluetooth proximity was chosen over location precisely to keep that collection narrow.

Delivering at that speed and hardening properly pull in opposite directions. Having the ACSC inside the team rather than reviewing at the end was how both happened.