IANAL, but I think your interpretation goes beyond what they're after.
The determination is clearly aimed at data usage and prevents people from trying to decrypt the reports from other users. The whole fragment of the interview is about the data produced by the app and how it should be protected as sensitive information. I can't see anything there that would prevent you from reverse engineering "to see how any of the app is running."
It's not even obfuscated or protected from decompilation in any way, so it's trivial to look at with static analysis tools. (i.e. without trying to run it)
Even the headings don't mention the code: "Collection, use or disclosure of COVID app data", "Treatment of COVID app data", "Decrypting COVID app data", "Coercing the use of COVIDSafe".
> IANAL, but I think your interpretation goes beyond what they're after.
Perhaps more than the intent, but this is a government that doesn't deserve the benefit of the doubt.
Circumventing any "access control technical protection measures" is currently a crime under Australian law (Section 116, Copyright Act). They may well consider any decompiling tools to fall under that particular law, as well as use of said tools.
In March, they pressured a university in firing someone researching into their own data breach to see how bad it is. [0] There isn't a law against de-identifying, especially when it is in the public interest, but they went ahead and threatened severe legal action anyway. Whilst simultaneously claiming that said data breach doesn't contain any personally identifiable information.
They had to be taken to the High Court to be shown that an algorithm cannot be used as evidence that a debt exists, and that decision makers actually need to do more than just trust the system. [1]
If it embarrasses them in any way, then they are not above twisting laws to suit them. [2]
The determination is clearly aimed at data usage and prevents people from trying to decrypt the reports from other users. The whole fragment of the interview is about the data produced by the app and how it should be protected as sensitive information. I can't see anything there that would prevent you from reverse engineering "to see how any of the app is running."
It's not even obfuscated or protected from decompilation in any way, so it's trivial to look at with static analysis tools. (i.e. without trying to run it)
Even the headings don't mention the code: "Collection, use or disclosure of COVID app data", "Treatment of COVID app data", "Decrypting COVID app data", "Coercing the use of COVIDSafe".