Police in Australia co-opted COVID-19 apps to fight crime

CANBERRA, Australia (AP) — Biker boss Nick Martin’s murder at a speedway in Perth, Australia, left police a trove of evidence that led them to the culprit: a thrill-seeker turned gun-for-hire. But they wanted more.

The coronavirus pandemic provided it in the form of an electronic dragnet: QR code check-in data from contact tracing apps of 2,439 fans who attended the December 2020 race. A government order requiring people to provide contact tracing information in case of a COVID-19 outbreak meant that anyone who checked in at the raceway that day left their name, phone number and arrival time through the SafeWA COVID-19 app or on paper. Police issued an “order to produce” the information to the state Health Department two days after Martin was shot and killed.

Police accessed the data despite Western Australia Premier Mark McGowan’s promise that the data would only be accessible to contact tracing personnel.

“They’ve breached the trust of the West Australian public and they have let everybody down,” Mia Davies, leader of the state’s opposition National Party, said in a written statement blaming the government for not legislating safeguards from the start.

Western Australia police didn’t respond to requests for comment from The Associated Press.

Unable to negotiate a solution with police, McGowan’s government ultimately passed laws in June 2021 that banned law enforcement from accessing such QR data. Multiple other Australian states and territories also introduced laws to prevent police from accessing contact tracing data.

Some critics blame Australia’s lacking privacy regulations for the way police have leveraged information collected for a health emergency. Comparable countries – including New Zealand and the United Kingdom – have QR check-ins that don’t collect and house information about individual whereabouts in central databases, said cryptographer Vanessa Teague, an Australian National University privacy researcher.

An alternative is to store contact tracing data on people’s individual phones, so the app user’s information is only accessed when they have been in close contact with someone who tests positive for COVID-19.

Michelle Falstein, assistant secretary of the New South Wales Council for Civil Liberties, said Australia’s 1988 Privacy Act was enacted before the internet was widely used and long before virtually every adult citizen and teenager had a smart phone.

“Privacy by design is something that legislators or certainly government doesn’t think about in Australia,” Falstein said.

In Perth, the QR check-in data tapped by police hasn’t been shown in court to have anything to do with arresting Nick Martin’s killer, who has since pleaded guilty. Identified in court documents only by the initials B.L.J., the shooter crawled in through a hole in the fence and fled the same way, presumably avoiding the QR check-in. His name is being withheld by authorities because he’s a cooperating witness against the man who he alleges hired him for the hit.

Ordinary cell phone data placed B.L.J. at the spot ballistic experts calculated the bullet was fired from. CCTV showed him at the track earlier that day wearing Fila running shoes similar to those that left footprints at the shooter’s vantage point.

More evidence fell into police hands when B.L.J. took his rifle to a gunsmith to replace the barrel. The tradesman recorded the alteration in a firearms database, which quickly came to detectives’ attention. Police retrieved the original barrel from the gunsmith and ballistics proved it fired the shot that killed Martin.

B.L.J.’s girlfriend also told police he admitted committing the murder and he has since pleaded guilty.

Contact AP’s global investigative team at Investigative@ap.org or https://www.ap.org/tips/