Months after becoming largely redundant with the end of COVID-19 restrictions, ServiceWA has been given a new lease on life.
Amid a range of new features, the state government-run app will now be able to provide real-time, location-based alerts for bushfire emergencies.
To enable that function users will be asked to allow their phones to send location updates back to state government-managed servers, where they will be stored for between 90 minutes and just over 24 hours.
But after recent examples of issues with access to, and retention of, state government data, including SafeWA check-ins and G2G passes, it is news that has cybersecurity experts concerned.
Revamped app a 'game changer'
Speaking to the ABC, Innovation and the Digital Economy Minister Stephen Dawson described the new functionality as an important tool to keep people safe.
Mr Dawson said the aim was to keep West Australians "as safe as possible during bushfire season".
"We want people to have bushfire plans in place, but this new access to bushfire information I think will be a game changer," he said.
He noted that the app was "just another tool that we have available" to keep West Australians and local communities safe.
Mr Dawson explained that once users opt into the service, location information would be sent to state government-managed servers run by Amazon's AWS hosting service.
"It will be kept for a period of between 90 minutes and just over 24 hours," he said.
"So if you're moving then it'll be kept for 90 minutes, but it's kept for 24 hours if your phone is stationary, and that's just to make sure that if you've put it down, you're asleep at night for example, that the information is still available when you wake up the next day. After that, then it is discarded."
A government spokesperson said the feature had been specifically designed with privacy in mind.
In a statement, Mr Dawson also said that "use of and disclosure of data is as per the ServiceWA mobile app privacy policy".
After opening the updated app and enabling the option to receive EmergencyWA alerts, users are given a summary of how their information might be used.
It includes "investigating the effectiveness of warning message systems", as well as where "required or authorised by law".
Looking at the privacy policy gives little more information, only listing examples of who might be authorised or required by law, including "a court or tribunal, or another government body".
The policy also explains data may be held by the government "for its compliance and monitoring purposes", as well as where required by law "such as state records laws".
Vague wording a concern to security expert
Edith Cowan University's associate dean of computing and security, Paul Haskell-Dowland, said sending location data to government servers seemed "perfectly reasonable", but the vague wording of the privacy policy was concerning.
"It talks about those with legal access, but it really wouldn't be too much effort to list those individuals or groups to make it absolutely clear to the end user what it is that they're signing up to," he said.
"It could be as simple as saying this data could be shared with police if a court order, for example, were provided.
"We just need a little bit more clarity over the exact scenarios under which that data may not be deleted at the date when it is allegedly meant to be removed from various systems."
Earlier this year it was revealed G2G pass data collected during the pandemic would be kept for more than a quarter-of-a-century, despite a promise it would be "destroyed" after 30 days.
Last year the state government was forced to rush legislation through parliament to prevent police accessing SafeWA check in data, after officers refused to stop despite government assurances the information would only be used for contact tracing.
"It's quite clear the value of that [location] information for the police, in particular, related to the movement of individuals," Professor Haskell-Downland said.
"So clearly, the ServiceWA app with location-based data could be a valuable asset in a law enforcement situation."
When asked if the data would be deleted after no more than that 24 hour period, Mr Dawson reiterated that was the government's promise.
"The commitment is that the data will be kept for a period of between 90 minutes and just over 24 hours and that is to help people if they are in a bushfire-prone area or if there's a bushfire nearby."
WA 'leading cybersecurity' across Australia
In the wake of multiple cyber attacks, including on Optus, Woolworths and Medibank, Mr Dawson said the government had "significant safeguards" in place to protect users' data from attacks.
"We've made a significant investment into a Cybersecurity Centre as part of the Office of Digital Government, and so we've got rigorous policies in place to guard that," he said.
It was a point Professor Haskell-Dowland agreed with the minister on.
"Western Australia is actually doing really well in this particular area and is very much seen as leading cybersecurity across the whole of Australia," he said.
"There is a whole of West Australian [government] approach to cyber that not only provides a sort of oversight and an overarching framework, but also provides direct support to all of those departments across the whole of WA."
Mr Dawson gave little indication of what would be next for the ServiceWA app, only saying the government was "committed to making it as usable and as useful for Western Australians as possible".
Questions asked by Daylight Saving Party MP Wilson Tucker in parliament early this year showed the app cost $570,000 to develop.
Contracts which were due to expire between November 2022 and January 2024 added $2.75 million in ongoing costs.
Recent updates have also added links to the SharkSmart website and information from weather stations, with plans to include the state's unclaimed money register in upcoming releases.
