Dear Australian Taxation Office,

I request the following information under the Freedom of Information Act 1982:

(1). Source code of the MyGovID iOS and Android apps, and server applications that form part of the MyGovID system, including build scripts, manifests, software license terms, and media assets (icons, audio files, etc).

(2). Technical documentation about the MyGovID system, such as API documentation, architecture diagrams, security assessments, technical presentation slides, "whitepapers" and similar documents.

If it assists in the expeditious processing of my request, source code may be delivered as a "snapshot" or export of source repositories, in ZIP, "tarball" or similar format. However, the full development history is preferred.

Yours faithfully,

Fraser Tweedale

Dear Mr Durnan,

Reference: 1-Q1HU99Q

Thank you for your correspondence dated 28 July 2021, the notice of
intention to refuse access. In particular thank you for outlining
the challenges arising from the scope of my request and the impact
on the ATO's operations.

The scope of my original request was:

1. Source code of the MyGovID iOS and Android apps, and
server applications that form part of the MyGovID system, including
build scripts, manifests, software license terms, and media assets
(icons, audio files, etc).

2. Technical documentation about the MyGovID system, such as
API documentation, architecture diagrams, security assessments,
technical presentation slides, "whitepapers" and similar documents.

I hereby revise my request to the following scope:

1. Source code of the most recent public release of the
MyGovID Android client application, including program source files,
build scripts, manifests, software license terms, and media assets
(icons, audio files, etc).

I will now explain how I believe this revised scope addresses the
grounds for refusal which you outlined.

# Identifying, locating and collating documents within the scope of my request

My request is now limited to source code for a **single release**
of the MyGovID **Android client application**. I have omitted the
iOS client application and all server-side applications from the scope.

With high probability, the source code of the application is stored
in one or a small number of code *repositories* in a
*version control system*. Version control systems track changes to a
software code base over time. In technical jargon the state of the
code base or a branch thereof at a particular point in time is
called a *commit* or a *tag*. A technical employee (such as
a programmer or software project manager) will be able to identify
and produce the source code files identified by the commit or tag
for a particular release in very little time.

It is possible that the identified commit or tag includes files not
of a kind mentioned in my revised request. In particular there
might be "documentation" files of the kind mentioned in part 2 of my
*original* request. For the avoidance of doubt, these documents
are **not in scope** of the revised request.

# Deciding whether to grant access to documents

The scope of my request has been greatly reduced. As a consequence,
to review the identified documents for information that needs to be
redacted will take much less time than your estimate for the
original request. I further expect that by only including source
code and related files in the revised scope, it should be easier and
faster for qualified technical personnel to review these documents
(compared to, say, PDFs, emails, presentations, etc.).

# Impact on the ATO's operations

The same comments about the greatly reduced scope also apply here.
Nevertheless, I am sympathetic to your concern about diverting ATO's
efforts to deal with a FOI request about a soon-to-be-obsoleted
product version.

In light of this information, I propose a further revision to the
request scope: instead of the previous release of the Android app,
the source code for the **upcoming release** (that is, of a recent
test build or pre-release build thereof). With critical security
work already being undertaken (or soon to be), a review of this
*new* code pursuant to my request should require fewer resources, and
such a diversion could less easily be regarded as unreasonable. If
you reach a similar conclusion such that it improves the likelihood
of access to the documents being granted, please consider my request
thus revised.

Yours sincerely,

Fraser Tweedale

Dear Australian Taxation Office,

On 8 September, 2021 I applied for internal review of your access refusal
decision dated 10 August, 2021 on my Freedom of Information Request
reference 1-Q1HU99Q. I sent the request to [email address] and called
the ATO to confirm receipt of my application on the same day.

The 54C(3) 30 day period for you to give notice of a decision expired more
than one week ago. Could you please update me on the status of the internal
review? Did the ATO apply to the Information Commissioner under 54D for
further time to deal with my application?

Yours sincerely,

Fraser Tweedale

Dear FOI,

Right To Know does not support sending attachments, so I resent the internal review
application letter from my personal email address, just a minute ago. The letter has also
been published at:

https://frase.id.au/foi/2021-07_ATO_myGo...

Unfortunately I cannot recall the name of the person who confirmed receipt. It was through the
main switchboard and individual help system. I could not find a way to contact the FOI team
directly or be put through to you. The person I spoke to did confirm that they could see an email
from me, received September 8, 2021 (the same day), in the ATO's systems.

Yours sincerely,

Fraser Tweedale

Dear FOI,

Further to my earlier email of today October 20, 2021, I must correct a mistake and can
now provide additional information.

I sent the internal review application by email on September 8, 2021. In my previous message
I said that I called the ATO on the same day to confirm receipt, but in fact it was the next day
September 9, 2021. I apologise for my mistake and regret any confusion it may have caused.

The ATO's reference for this phone call is 1051898127326. This record shows that I called to seek
confirmation that the ATO had received my email. The record does not state that the person I spoke
to affirmed that she could see that an email from me had been received on either September 8 or
September 9. This satisfied me that the ATO had received my internal review application. Had I not
been satisfied, I would certainly have followed up further. You might be able to use the reference
number to make further inquiries - perhaps to discuss the call with the representative I spoke to?

For the avoidance of doubt, my application for internal review was not sent from Right To Know but
from my personal email address <[email address]>, to <[email address]>.

Yours sincerely,

Fraser Tweedale