According to the CVE-2020-12860 technical documentation, COVIDSafe through v1.0.17 "allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them" [1].
A separate vulnerability, CVE-2020-12856, discovered by researchers Jim Mussared and Alwen Tiu, describes a "silent pairing issue" where "the bonding process involves exchanges of permanent identifiers of the victim phone: the identity address of the bluetooth device in the phone and a cryptographic key called Identity Resolving Key (IRK)" [3].
A critical detail: According to a Twitter thread by security researcher Matthew Rocklin (@matthewrdev), "the app *does not* broadcast the device name" in the standard operation of the app [4].
However, the CVE-2020-12860 vulnerability allows attackers to extract phone model AND device name information through BLE role misuse, meaning the device name IS accessible through exploitation of this vulnerability, even if not broadcast in normal operation [1][2].
Regarding the claim that this wasn't mentioned in the privacy policy: The QUT academic research on COVIDSafe implementation found that the government provided a Privacy Impact Assessment focusing on Bluetooth data collection [5].
However, the specifics of what information could be extracted through BLE vulnerabilities may not have been explicitly detailed in consumer-facing privacy policy documentation [5].
The privacy policy did note that "a Bluetooth scan can be used to gather information about the location of the user" [6], but may not have detailed the specific vulnerability of device name/model extraction [5].
While the claim presents a scenario where "a domestic violence abuser can tell whether the victim is at home and their house-mates are not," this appears to be a **theoretical vulnerability rather than documented evidence of actual exploitation** [1][3].
The CVE documents discuss the technical capability for "long term tracking" through BLE identifier extraction [3], but there is no evidence in the published vulnerability disclosures, academic literature, or media reporting of actual instances where this vulnerability was exploited for domestic violence tracking [2][3].
This is a **legitimate security concern** that researchers identified and responsibly disclosed, but characterizing it as a known exploitation method without documented instances is an extrapolation beyond what the evidence shows.
Rather, they are exposed through BLE technical vulnerabilities (role misuse) that allow attackers to extract this information from the device's Bluetooth stack [1][2].
This is a meaningful distinction because it affects threat modeling—an attacker would need to actively conduct a technical exploit, not merely be in Bluetooth range [3].
However, the claim does reference legitimate security vulnerabilities (CVE-2020-12860 and CVE-2020-12856) that are well-documented in official sources.
The underlying CVE disclosures and academic research are from credible sources:
- **CVE-2020-12860**: Published by MITRE/NVD (National Vulnerability Database), official vulnerability tracking [1]
- **CVE-2020-12856**: Discovered and disclosed by Jim Mussared (George Robotics) and Alwen Tiu (ANU), published on GitHub with technical documentation [3]
- **QUT Academic Research**: Peer-reviewed article on COVIDSafe implementation from Queensland University of Technology [5]
These sources are credible technical disclosures, not partisan sources.
**Did Labor have equivalent technology privacy failures?**
Search conducted: "Labor government technology privacy failures contact tracing"
Labor's involvement with contact tracing technology was limited during this period, as the Coalition government held power (2013-2022) and developed COVIDSafe.
However, broader technology privacy concerns existed across both parties:
- Both Labor and Coalition governments have faced criticism for inadequate privacy protections in digital government services [8]
- Privacy reform efforts in Australia have been cross-party issues, with concerns raised about government data handling practices generally, not specific to one party [8]
- The broader privacy framework issues that necessitated special COVIDSafe legislation are systemic to Australia's fragmented privacy law regime, not unique to Coalition implementation [5]
In essence, there is no direct Labor equivalent because Labor was not in government during the COVID-19 pandemic and did not develop contact tracing apps.
The claim is **correct that a genuine technical vulnerability existed** in COVIDSafe that could theoretically expose device model and name information, and that this information could potentially be used to track someone's location/presence [1][3].
The app also included additional privacy protections compared to comparable apps like Singapore's TraceTogether, including criminal penalties for unauthorized data use [5].
The leap from "a technical vulnerability exists that theoretically could expose device information" to "domestic violence abusers can exploit this" is not supported by evidence.
The government may not have explicitly detailed BLE vulnerability risks to general users, though privacy professionals would expect such risks to be part of security threat modeling [5].
Given that:
- The vulnerability was patched relatively quickly (within ~3 weeks) [3]
- The app remained voluntary and had low uptake (never reached government targets) [5]
- The exploitation would require technical sophistication beyond casual surveillance [3]
- No documented cases of exploitation for domestic violence exist [1][3]
The **actual practical harm appears limited** compared to the severity the claim implies.
The claim is correct that: (1) a genuine technical vulnerability existed allowing device model/name extraction, and (2) this information could theoretically be used to track presence.
However, the claim is misleading in: (1) characterizing theoretical vulnerability as documented exploitation for domestic violence, (2) using "broadcast" imprecisely, and (3) omitting that the vulnerability was patched quickly and responsibly disclosed.
The claim is correct that: (1) a genuine technical vulnerability existed allowing device model/name extraction, and (2) this information could theoretically be used to track presence.
However, the claim is misleading in: (1) characterizing theoretical vulnerability as documented exploitation for domestic violence, (2) using "broadcast" imprecisely, and (3) omitting that the vulnerability was patched quickly and responsibly disclosed.