The TraceTogether contact tracking application.
Photographer: Lauryn Ishak / Bloomberg
Photographer: Lauryn Ishak / Bloomberg
Sign up here to receive our daily coronavirus newsletter on what you need to know and subscribe to our Covid-19 podcast for the latest news and reviews.
In early 2020, when the coronavirus started to bounce around the world with dire consequences, Harish Pillay decided to do what he could to help stop the spread.
The software engineer, who lives in Singapore, heard that the government was developing an application to track the virus, so he sent an email to the minister in charge and asked how he could help. He was part of a pool of developers and engineers who offered their services, ready to offer a solution.
“The problem was being solved by creating this tool, but there were aspects of trust and confidentiality that also needed to be addressed,” said Pillay, who has worked on Red Hat open source software for much of his career and believes fervently in transparent technologies . “We understand all of these things. Let the community help you do the right thing. “
At first, Singapore was considered a model for other nations. As the government encouraged people to lower the TraceTogether app for your smartphones, published the source code and promised strict limits on data usage. Developers from around the world collaborated to improve and debug it in real time.
Now the initial optimism is disappearing. Public support was reached after authorities revealed in January that the police had used the app’s data in a murder investigation – just months after the responsible minister promised that it would be used only for the containment of Covid. The government issued a rare apology. But instead of backing down, it plans to formalize the police’s ability to access such data in specific cases, presenting the proposed legislation in parliament on Monday.
Pillay had set aside his policy as a member of the opposition Schedule the Singapore Party to be part of the TraceTogether campaign, but he is concerned.
“ME felt disappointed, ”he told Bloomberg News. “The trust factor that was there was reduced.”
Now Singapore can become a very different type of model. After countries like the United States, Australia and Israel collected reams of data during the pandemic, largely with public support, they can begin to see uses for that information beyond their original intent.
“Singapore is telling other governments, with a wink and a nod, that we did it and you can do it,” said Phil Robertson, deputy director of Human Rights Watch in Asia. “Many countries see Singapore as a success story, so they think that everything Singaporeans do must be good, and that is a problem.”
Singapore tried to explain the changes. The legislation would allow access to contact tracking data in seven categories of serious crimes, including murder, rape and drug trafficking. In response to questions, a government spokesman referred to Minister Vivian Balakrishnan’s comments in January.
“The police must be given tools to bring criminals to justice and protect the safety of all Singaporeans,” he said at the time. “Especially in very serious cases, and where lives are at risk, it is unreasonable to say that certain classes of data should be out of the reach of the police.”
It added that TraceTogether data is automatically deleted after 25 days and that the entire program will be removed as soon as the Covid-19 pandemic ends.
Singapore proposes law to allow tracking of serious crime data
A government minister said in January that TraceTogether is used by about 78% of Singapore residents, or about 4.2 million people. A smartphone app and token use Bluetooth technology to measure the distance between users, allowing the government to notify them if they have been in contact with someone who has tested positive for the virus.
Initial acceptance by the general public was slow, with app downloads hovering around 20%. The slow pace was paralleled by a general caution that ran through the region, amplified by data security breaches that governments in other countries struggled to resolve.
In South Korea, private sector contact tracking apps have become increasingly invasive – one providing the exact location of each workplace or home visited in a positive case – and government officials are able to review hundreds of hours footage from surveillance cameras and go through cell phone and credit card transactions to track people.
In China, one digital website reported last December that hackers managed to breach Beijing’s health code system, access government identification numbers and sell them online; these ID numbers are used to access a person’s Covid-19 test records.
There was resistance from the public. In Thailand, the the government was forced to back down, a threat from the government pandemic center spokesman that anyone who tested positive without downloading the virus-tracking app would face jail time.
A medical worker collects a nose swab from a migrant worker from Myanmar at a test site near Bangkok on 10 January.
Photographer: Lillian Suwanrumpha / AFP / Getty Images
In Malaysia, the Ministry of Health The obliged companies destroy the personal records of visitors to their facilities within six months of the end of government-mandated tracking.
In Israel, the Supreme Court banned the country’s intelligence agency from using technology to track Covid-19 cases.
In Australia, Federal legislation has been passed to prevent data collected from the country’s Covid application from being used for any purpose other than contact tracking.
Apple and Google bring Covid-19 contact tracking to 3 billion people
The World Health Organization issued guidelines for governments on “ethical” considerations in using tracking technologies for contact tracking. Member states are obliged to develop surveillance systems to capture “critical data” to monitor the virus, “ensuring that such systems are transparent, responsive to community concerns and do not impose unnecessary burdens, for example, breaches of privacy,” the guidance issued in May 2020 reads.
A major risk for governments looking to expand the use of Covid-19 tracking data is that people will be deterred from participating.
“Is this one of the laws with unintended consequences, where it reduces the rate of use and is worse for society?” said Troy Hunt, an information security expert and creator of data breach aggregation service, “Have I Been Pwned.”
He points out that governments can present virus technologies as benign and subsequently reverse legislation or regulations. The risk of Singapore’s change is to show not only governments, but also citizens, how easily changes can be made.
“There is a slippery slope, where data retention periods increase because it adds value to law enforcement and, suddenly, the scope of privacy risk changes much more,” he said.
Singaporeans tend to be optimistic about such movements when it comes to their government, but unusually strong arguments have emerged about the proposed legislation. When a location posted online that he thought concerns were overblown and privacy overestimated, he provoked a strong counterattack.
“The government is using Covid-19 as an excuse to implement social engineering and public surveillance platforms and policies that would normally never be considered or publicly palatable,” he said. wrote Andy Wong, a 27-year-old freelance defense writer and risk analyst. “I wonder how many healthy foreigners are going to want to work in a country like this.”
He wrote that Singapore, with its high quality of life and tough government, is sometimes described as Disneyland with the death penalty, but he fears it will become “North Korea with a smile”.
The episode is “a massive betrayal of trust for ordinary citizens like me,” he told Bloomberg News.
Jonathan Kok, an intellectual property lawyer in Singapore, said the data that the police could obtain from the contact tracking application for their investigations was limited. A person’s history of interaction provides, at best, circumstantial evidence, he said.
“So, the data really has limited use. I’m just surprised that the police want to have all this work to collect data, when it just shows who that person was with in the past few weeks or so, ”he said.
“Many people wrote that they would only turn on the device when they needed to leave, instead of leaving it running all the time. This will not help the national effort to contain the virus, ”he added.
As for Pillay, he spent his mandatory national service as a police officer, so he understands the context of using the data in rare and exceptional cases. But the police have many other ways to obtain data for your investigations, including CCTV footage and cell phone tower logs.
“It is less than ideal to have specific instances where TraceTogether data can be accessed,” he said. “This will be a tarnished gold standard.”
– With the help of Yoolim Lee, Philip Heijmans and Joyce Koh
(Updates with the introduction of legislation in the fifth paragraph)