Are we stuck with Covid-19 surveillance? — Join the democracy classroom

The following is adapted from a Twitter thread I wrote on 21 April. This issue has been emailed to all Milo Peng Funders, and made public via the website for everyone else.

tl;dr The democracy classrooms are back. This time, we're going to talk about Covid-19, privacy, surveillance, and how we feel about all this. Join in.

If you're keeping up with the daily Covid-19 updates, or looking at the Ministry of Health's situation reports, you'll see how the situation in Singapore is now much more stable and safe than it was this time last year. Back then, we were grappling with hundreds of new Covid-19 cases every day, mostly among migrant workers living in dormitories. Today, there are far fewer cases, most of them imported and quickly identified as people serve stay-home notices upon their arrival into the country.

Of course, this, plus our ongoing vaccination programme, isn't enough for us to start celebrating the end of Covid-19. There are new strains to be wary of, and other countries have demonstrated that complacency can always lead to new waves of Covid-19 that will undo loads of good work.

That said, we should absolutely be asking why Singapore is leaning so much into Covid-19 technology and surveillance. We should also ask ourselves if we're okay with it.

Why is it that surveillance is increasing, or getting entrenched, even though the numbers have gone down?

Early last year, the government introduced TraceTogether, which uses Bluetooth to ping contacts. Then came SafeEntry, which made it a requirement for people to scan QR codes to register entry into all sorts of places. Over the past year, we've got used to scanning QR codes multiple times a day, everywhere we go.

Then the government started talking about merging the two systems to create TraceTogether-only SafeEntry (TT-only SE), and mandating it at certain venues. This basically undercut assurances that Singaporeans had been given about TraceTogether being privacy-focused; while it's true that the TraceTogether app or token doesn't track your location, SafeEntry does. By merging the two systems, the government can collect not just data of our movements from place to place (via SafeEntry), but also access lists of close contacts off our phones or tokens if they want.

While they at first assured Singaporeans that data collected via digital contact-tracing systems would only be used for contact-tracing, this turned out to not be the case. Under the Criminal Procedure Code, the police could access TraceTogether (and SafeEntry) data for their investigations, and had in fact already done so, even before Minister Vivian Balakrishnan made his promises at a press conference in June 2020.

The ensuing public outcry led to the government acknowledging their "error" in not stating earlier that the data collected via TraceTogether and SafeEntry was not exempt from the Criminal Procedure Code. Parliament passed a new law to keep police from obtaining contact-tracing data except in investigations into seven types of serious offences. This limited access, but also legitimised something the government had originally told Singaporeans wouldn't happen.

Did this TraceTogether debacle slow us down and make us think more about surveillance and the wisdom of rushing head-long into "tech solutions"? Did we stop to think about whether Singaporeans have really been able to give informed consent to the ways tech is used in our country?

Although it's been delayed, the government is continuing with its plan to make TraceTogether, a previously voluntary contact-tracing system, compulsory. SafeEntry Gateways are now being rolled out; these gateways work by having people tap their phones (with the TraceTogether app open) or tokens against the gateway box.

Even venues that aren't using this gateway (at least, not yet) are adopting more permanent-looking check-ins. There are gantries that require you to scan the SafeEntry QR code, then hold your phone screen with the SafeEntry successful check-in page open, for the gantry to detect. Meanwhile, thermal facial scanners take your temperature. It's never very clear if facial recognition is actually turned on, although these thermal facial scanners could certainly be used to track people's faces, and have been advertised as having that capability.

Such gantries, as well as the SafeEntry Gateway rollout, aren't cheap. Significant amounts of resources are being spent on putting these things up all over the place. It suggests that this sort of Covid-19 surveillance is not going away any time soon.

I understand that contact-tracing is important during the pandemic, as do all the privacy conscious activists and friends I know. We're all aware of the necessity of being able to trace and test people. So this isn't about denying Covid-19, its effects, or the importance of getting this virus under control. But there are very important questions about surveillance and privacy that have been not only neglected, but bulldozed in this relentless enthusiasm for more, more, more tech, and more, more, more data collection.

In many ways, this has to do with how privacy has never featured very heavily in public discourse in Singapore. Singaporeans might very well think all this technology is necessary and important, and be fine with the trade-offs. Or we might want changes to be made. The point is, we've never had a proper chance to talk.

This needs to change. Which is why I'm finally back with the democracy classrooms, and this is precisely what we'll be discussing in this edition.

This democracy classroom will be held online on 30 April, from 7–9pm (I'll send out the link for the video call closer to the date). Spaces are limited because discussions go better when we don't exceed 20–25 people.

Sign up here.