Gov’t to release MyTrace source code to allay privacy fears

The government will soon release the source code for its MyTrace contact tracing app to allay privacy concerns, said Science and Technology Minister Khairy Jamaluddin.

This would enable those tech-savvy to verify the government’s claims regarding its privacy protections, he told an interview on BFM radio station yesterday.

“We will be publishing the source code so it will be open for people to have a look, to make sure we are not storing your name, your geolocation. We want to be as transparent about this as possible.

“We should be publishing that soon so that at least those who are technically inclined can make sure that the codes will confirm what I am saying,” he said during the Evening Edition segment.

During the segment, host Lee Chwi Lynn told the minister that BFM had ran a poll that morning to ask whether people would use the app, and more than half of respondent cited privacy concerns to say they would not.

Khairy (photo) repeatedly assured that the app only keeps an anonymised log of other devices running the app that has come into proximity, about 10 metres or less, if stationary, and over a certain period.

The log is kept on the users’ phone rather than a centralised server. If a user subsequently tests positive for Covid-19, Health Ministry officials would have to obtain consent during contact tracing interviews to access the data.

If the user consents, health officials can then call potential close contacts and ask them to either take a self-assessment or undergo Covid-19 tests.

In previous interviews, Khairy had said the data is only kept for 21 days.

For Android phones, the minister said the app does request access for location data, but he said this is merely a feature on Android phones and is required to access Bluetooth functions.

The location data won’t be stored although the app has access to it, he said.

The app will also be made available on iOS devices soon, which would only require permission to use Bluetooth functions to operate normally.

However, he said the app will need to be kept in the foreground to function and will stop when users switch to another app. He said the government is working with iOS developer Apple to resolve the matter.

Not mandatory

To a question, Khairy said he has decided against making the app mandatory for all Malaysians because this would erode trust and exacerbate users’ privacy concerns.

Instead, he said he hopes to foster a voluntary community movement by encouraging Malaysians to contribute to contact tracing efforts, which he believes would lead to a better adoption rate for the app.

The Health Ministry hopes at least 60 percent of mobile phone users would use the app.

“The assurance I want to give Malaysians is that we are not collecting any data that identifies your name.

“It’s anonymised, it’s kept on your phone and phones of people using MyTrace, and can only be accessed with your consent so we can send a message to people around you just in case you test positive for Covid-19,” he said, imploring for more people to download the app.

On Wednesday, activist Jac SM Kee had also voiced privacy concerns over another government app that has contact tracing functions.

She said Malaysians have very little legal protection for preventing the abuse of their data, and the Gerak Malaysia app’s data retention policy of six months after the end of the movement control order period is too long.

Unlike MyTrace, Gerak Malaysia is centralised and collects location data. - Mkini