Contact tracing: Big brother or cash cow?
Amid the Covid-19 pandemic, are individuals giving up privacy in return for public health safety? As the debate goes on, tech providers are jumping in with their offerings
To uninformed outsiders, Singapore may appear to be a veritable dystopia — a perfect and orderly society run like clockwork by a sinister deep state. The introduction of the TraceTogether app and token to conduct more effective contact tracing has only fuelled this suspicion, with the optics of these devices giving the unfortunate appearance of citizens being microchipped by the state.
Anecdotally, some Singaporeans have expressed dismay at this perceived surveillance and still more have refused to download the app for this reason. In response, the government has taken pains to assure Singaporeans that there is nothing to be afraid of.
“There is neither a secretly installed Covid-19 tracker installed on your phone, nor should you worry about your privacy when you use the TraceTogether app — TraceTogether does not collect your location data and can only show connections between devices, not locations,” says the government’s Gov.Sg website. Yet, the TraceTogether app has been downloaded just 2.4 million times thus far — equivalent to less than half the population and thus not optimally effective for what it is created for.
To address this deficiency, the government on Sept 9 announced plans to give out the TraceTogether token to all Singaporeans. “The more people that are actively on TraceTogether, exponentially, the protective effect increases,” said Dr Vivian Balakrishnan, minister in charge of the Smart Nation Initiative.
So is TraceTogether a plot by the state to spy on its own people? Probably not, argues Kevin O’Leary, field chief security officer, JAPAC, at cybersecurity firm Palo Alto Networks. Perhaps influenced by the recent data breach at the Ministry of Health, TraceTogether data is currently being kept in a decentralised manner on individual devices rather than on a centralised database. Regulators and external parties can access these only if somebody is affected by Covid-19, and all localised data is deleted after 21 days.
In fact, O’Leary believes that the TraceTogether app alone is not effective enough. Contact tracing, he says, needs to tell regulators how long people are standing together and how closely they are standing together. As one of the most unstable phone connectivity technologies out there, TraceTogether is unable to tell how far apart different users are from one another, potentially reporting contact between individuals more than a metre apart due to the different signals and battery power emitted by different phone models.
Is Big Brother watching me?
That does not mean that the TraceTogether app is not worth using — a rough gauge of individuals visiting similar locations can provide useful information for contact tracers. Yet for the system to operate consistently at its fullest potential, a common device and signal such as the TraceTogether token should ideally be used instead. This would allow for a more consistent measurement of distances between users and thus more accurate contact tracing.
A study by a joint team from Macquarie University and the University of Melbourne agrees that the TraceTogether app does a good job of keeping data secure from third parties. But they warn that it provides insufficient data protection from access by a central authority, since the TraceTogether app can link temporary IDs recorded on the app to the real identity of users. They fear that there is no check to ensure that a request for data from the authorities is genuine and no way to prove that data collected by the authorities will also be deleted after use.
Still, O’Leary is prepared to take his chances. “Is [TraceTogether] perfect? No, because there are many ways to collect that data whether you like it or not,” he observes, noting that there will always be a lingering suspicion that the app’s creators are collecting more data than they let on. But in a place like Singapore with strong trust in government as well as the clarity of purpose behind the app, he does not see any problems arising.
In any case, similar levels of surveillance have become ubiquitous in daily life, with cookies and network surveillance par for the course in the digital age. Some mobile apps can even listen into your conversations while unopened. In one infamous episode exposed in 2015, German chancellor Angela Merkel was found to have been the subject of surveillance by the “Five Eyes” intelligence network. As such, full privacy for all, especially in the post-Covid world, will not be a realistic assumption.
However, the optics of compulsory TraceTogether app, or device usage, will likely prove a political minefield for governments. Citizens may feel that they are being “microchipped” or “tagged” despite efforts to protect privacy. Some people have drawn parallels between contact tracing and Black Mirror, a dystopian sci-fi series on Netflix. The show has gained a cult following by drawing attention to the dark and disturbing side of technological innovation such as surveillance.
O’Leary therefore thinks that the present “blended” approach that allows for voluntary use of the app perhaps strikes the best balance between user consent and effective contact tracing. The SafeEntry check-in/out system adds a less invasive level of contact tracing to overcome the lower usage of TraceTogether, with
compulsory usage limited only to vulnerable groups, infected individuals and foreign travellers. Other than that, the only ones who will use TraceTogether will be those that choose to do so.
Corporate panopticon?
But even as citizens are wary of contract tracing apps, private businesses are adopting such technologies within their own organisations in earnest. Laura Becker, an analyst covering employee experience and benefits for IDC, told CNBC that the market for such technologies could reach up to US$4.3 billion ($5.85 billion). PwC has already begun developing its own contact tracing system, which has been launched in Singapore.
“PwC’s Contact Tracer is a solution developed by our South East Asia Experience Centre to automate contact tracing, and social distance monitoring using a smartphone and a Bluetooth Low Energy beacon,” says Andrew Taggart, Experience Consulting Leader, PwC South East Asia Consulting. The idea originated in February 2020, and was inspired by PwC Experience Centre’s bluetooth-enabled access control system.
At offices using the system, all staff are issued a beacon that they will carry on them when interacting with colleagues to ensure safe distancing. Strategically-placed beacons are also installed in select areas like pantries and meeting rooms where staff congregation tends to take place. This information is collected on a dashboard that will allow management to monitor high traffic areas to reduce crowding and track interactions between workers should infection occur.
The app was piloted in a Singapore foreign worker dormitory to help understand the possibilities of infections in confined locations. Tracking the movement of residents within the dormitories was useful in preventing interactions between isolated patients, says Taggart. The app is now deployed by enterprises in Australia, Singapore, and Luxembourg, with close to 10,000 users.
“It does make sense that large multinationals that have the resources to do so would look at apps and other technology to manage government mandated workforce requirements (such as separate shift cohorts to comply with office reopening rules). At the basic level, this mimics the functions of a contact tracing app and uses the information to ensure people are not mixing outside of their designated teams at work,” remarks O’Leary.
Tech start-ups are jumping on the bandwagon. In June, Israeli AI start-up Viziblezone inked a strategic partnership with global analytics firm Verint to create contact tracing solutions for businesses and governments. Singapore and Kolkata-based Internet of Things (IoT) firm Hipla Technologies raised US$357,000 to develop Contatrack.ai, a contact tracing software-as-a-service (SaaS) solution for firms based on facial recognition technology.
Still, there is legitimate cause for concern. Aura, a contact tracing app used at Albion College in Michigan, was found to possess elements in its code that allowed external users to access personal data on its backend and infer the Covid-19 diagnosis status of many of its users. While The Verge reports that these gaps were hurriedly patched, it is perhaps understandable why users remain deeply distrustful of contact tracing apps and their ability to protect personal data.
But then again, is any of this really new? O’Leary says that the technology to track people effectively 24/7 has already existed for some time and has already been used for surveillance. “What is new now is the political will worldwide to leverage such technology across populations to monitor people movements in a bid to control the spread of Covid-19, which may come with a set of unintended and far-reaching consequences,” he muses.