Over 600k users installed TraceTogether, app to be made open source

A mobile application developed by the Government Technology Agency (GovTech) that helps in contact tracing for Covid-19 has been installed by more than 620,000 users since its launch last Friday.

With a decision to make the technology behind it available to developers around the world, even more people could stand to benefit.

Developed in collaboration with the Health Ministry (MOH), the TraceTogether mobile app works by exchanging short-distance Bluetooth signals between phones.

Users need to submit only a Singapore number to MOH when they register, and each phone will then be given a random, anonymised user ID.

At regular intervals, a temporary ID is generated based on this user ID, and it is the temporary ID that is exchanged over Bluetooth when users come into contact with each other.

The app uses Bluetooth signal strength to estimate the distance between users and the duration of their encounters.

A record of this is stored on each user's phone in an encrypted form for 21 days. No other personal information or location data is collected.

The records can be deciphered only by MOH, and users need to grant access to MOH when contacted as part of contact tracing investigations.

Even then, MOH can see only the other users' phone numbers, and contact tracers would still have to interview each contact.

While the app has not been used in actual contact tracing here so far, there is already interest from governments and companies around the world to adapt it for their communities.

As a result, the decision was made to make the app opensource, which means anyone will be able to examine, modify and redistribute it.

Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan said on Facebook yesterday that GovTech is working around the clock to finalise documents so others can deploy their own versions of the app.

Said Dr Balakrishan: "We believe that making our code available to the world will enhance trust and collaboration in dealing with a global threat that does not respect boundaries, political systems or economies."

Open-sourcing

Cyber security experts said opening up the app's source code allows people to verify that it does what it says on the tin.

[[nid:481625]]

"Open-sourcing TraceTogether is a really good step since it shows that the developers have nothing to hide," said Synopsys Asia-Pacific client services manager Ian Hall.

With thousands of eyeballs scrutinising the code, bugs and weaknesses can be quickly identified and fixed. But at the same time, it is easier for malicious hackers to exploit.

Said Group-IB senior threat intelligence researcher Feixiang He: "It is a game of speed, and hopefully, the good guys are going to outpace the bad guys. The concern is how frequently fixes are released to the public."

During a radio show yesterday, Minister-in-charge of GovTech Janil Puthucheary urged Singaporeans to install the app so we can all be better protected.

For the latest updates on the coronavirus, visit here.

This article was first published in The New Paper. Permission required for reproduction.