On consent and technology

Wah lau eh, what a week. Between work deadlines and early morning workshops and sleep deprivation and the #FixSchoolsNotStudents protest and the investigation into the protest, it’s been hectic.

I spent about 2.5 hours on Wednesday afternoon sitting in a police station being interrogated about the protest, even though I didn’t participate in it and was just covering it as a journalist. (You can read my piece for Xtra Magazine here!) I'm not sure if I'm just a witness or if I'm actually under investigation myself, but I guess I'll find out eventually. 😶

I was going to leave the TraceTogether stuff to the weekly update, but had more to say about it so thought it might be best to break it out into a special issue.

I occasionally facilitate workshops on sex ed and relationships with teenagers. In these workshops, whenever we talk about consent, we emphasise that it needs to be freely given, reversible, informed, enthusiastic, and specific. What we mean is that people need to be fully equipped with both the capability and the information to understand the implications and consequences of what they’re getting into, then actively, without coercion or threat, decide to agree to or participate in something (and not necessarily anything else beyond that). Also, they should be allowed to change their minds at any time before or during this activity/action/event.

While consent is often talked about in the context of sexual activity — particularly in an era of #MeToo and discussions about sexual assault and harassment — at these workshops facilitators like myself emphasise that consent needs to apply to all our relationships. And the more I talk about this to batches of teenagers, year after year, the more I’ve started thinking about how these principles of consent apply to citizens’ relationship and interactions with our governments.

Democracy and consent in the Singaporean context

When talking about decision-making and policy at scale, it’s difficult to insist upon the same level of specificity and granularity that exists in discussions about boundaries within a romantic relationship, or a small group of friends. It’s not feasible for a government to ask every citizen for consent for every specific policy they want to implement, every action they want to take. That’s why, in democratic countries, citizens (ideally) scrutinise party manifestos and policies, and elect representatives they generally trust to represent their interests and concerns, to vote on major decisions and scrutinise the government.

But that doesn’t mean that consent isn’t important when it comes to citizen-government relations, nor does it mean that a single vote once every five years equates to consent for everything the government of the day does. It’s why democracy isn’t just about elections; it’s also about citizens having civil and political rights, and the space to be involved in national conversations and decision-making processes on an ongoing basis.

Let’s be honest: I don’t think we can say that this is the case in Singapore. Despite the multiple Our SG Conversation-esque state-organised “dialogues”, decisions are often made in a top-down fashion, and the average Singaporean often has very little say. The PAP’s supermajority in Parliament allows them to pass and amend laws — even the Constitution — as they please, without having to worry about being blocked or stymied by the opposition. And even though Singaporeans recently voted for a greater opposition presence in Parliament in the last general election, it’ll likely be quite some time yet before the PAP has to start worrying about actually having to negotiate or compromise to get its bills through the House.

This state of affairs has created a context in which things like accountability and checks and balances have fallen to the wayside. By extension, in this “ownself check ownself” political culture, the question of consent from citizens has also been reduced to little more than the once-every-five-years vote, leaving us with very little control over and safeguards from boundaries being overstepped and power being abused.

Very often, we aren’t even really able to give consent (nor is it truly sought from us); there might be coercion, or a lack of information, not to mention misinformation.

The TraceTogether mess: an updated round-up

The recent TraceTogether saga makes this clear. As covered in a previous special issue, after multiple reassurances that data collected from digital contact-tracing programmes like TraceTogether will only be used for contact-tracing, Singaporeans were finally told in early January that this was actually not the case. Instead, the Ministry of Home Affairs confirmed that, under Section 20 of the Criminal Procedure Code, the police has always had the power to obtain data from systems like TraceTogether. The next day, Vivian Balakrishnan, the minister in charge of the Smart Nation initiative (i.e. all this tech stuff), revealed that the police had already obtained TraceTogether data in a murder investigation.

Over the past week, as Parliament debated and then passed amendments to the COVID-19 (Temporary Measures) Act that restricted the use of personal contact-tracing data to contact-tracing and investigations into seven categories of “serious offences” — such as rape, kidnapping, murder, or drug trafficking offences that attract the death penalty — more details emerged. And these details revealed serious lapses and weaknesses in our governance.

In January, Vivian Balakrishnan admitted that, when he had confidently promised Singaporeans at a 8 June 2020 press conference that contact-tracing data would “purely” be used for contact-tracing, he had overlooked the Criminal Procedure Code. (Although he’s taking a lot of the flak, it’s also worth noting that he wasn’t the only minister who had made such reassurances. Teo Chee Hean, a senior minister and coordinating minister for national security, made similar statements in Parliament days before the press conference.) Speaking in Parliament this week, he reiterated this stance, saying that he takes “full responsibility” for this error.

“Perhaps I was so enamoured by what I thought was the ingenuity and brilliance of this that I got blindsided. I regret the consternation and anxiety caused,” he said.

The problem, though, is that the police had requested, and obtained, TraceTogether data way back in May 2020 — even before Teo Chee Hean and Vivian Balakrishnan made their statements. So not only were these promises false, but the data had already been retrieved by law enforcement on one occasion. (Fat lot of good it did, though; investigators weren’t able to get any useful data since the suspect didn’t have TraceTogether on his phone. But they must have got evidence through other existing investigation tools, since they charged the accused in court a week after the incident anyway).

According to Balakrishnan, it was only in October 2020, after a citizen had written in with questions, that he realised that he might have been wrong. He then got someone to check the law, which was when he learnt that not only did the Criminal Procedure Code apply, but that the police had already successfully obtained TraceTogether data.

He then engaged his fellow Cabinet ministers to talk about whether contact-tracing data should be carved out of the Criminal Procedure Code. At this point, Singaporeans were still not apprised that the situation had changed, and that the assurances we’d received were void. Instead, we were told that widespread adoption of TraceTogether would be a precondition for entering Phase 3, and that the government was planning to make it mandatory soon.

Some have lauded Balakrishnan for eating humble pie — although “wow, this is a rare instance of a PAP minister admitting that he made a mistake!” is not quite the ringing endorsement they might think it is — and say that we should forgive him and move on.

I don’t think I’m in a position to come to any conclusions about whether Vivian Balakrishnan had really just made an honest mistake under the dazzling glare of TraceTogether’s brilliance, or if that’s a butt-covering story he’s come up with. But even if we accept what’s said at face level, there’s still plenty to be troubled by.

Governance and processes

Vivian Balakrishnan stressed that, as a doctor and a tech optimist, the issue of police accessing the data hadn’t crossed his mind. "What we had in mind was digital contact tracing. We were not at all trying to create a surveillance tool. I say this so that you understand my state of mind when I said what I said in June."

But even if there was no nefarious intent, we still have a problem on our hands. Vivian Balakrishnan isn’t just anybody; he is the minister in charge of the Smart Nation initiative, which means he’s at the forefront of efforts to develop and implement technology in Singapore. These technologies have very real and direct impacts on our lives, yet we almost never talk about these effects.

The top-down imposition of technology is already a problem that we haven’t had much opportunity to address. What this TraceTogether episode shows us is that even the “top” that’s doing the imposing hasn’t fully thought things through. Balakrishnan’s job is to lead Singapore’s transition into a Smart Nation; it’s his job to be aware of and upfront about the implications of the things we’re getting ourselves into. Yet his recent comments show that he’d bought vast quantities of his own koyok; instead of a clear-eyed leader, we got a techbro who was too caught up in the hype.*

We now see the problems in relation to the TraceTogether roll-out; what about all the other tech that’s already permeated our lives, or the tech that’s on the way?

*What happened to everyone else? Vivian Balakrishnan’s comments at the June 2020 press conference were widely reported; didn’t the police, or the Ministry of Home Affairs, think to correct him right away and reveal that they’d already obtained TraceTogether data? Do they just not talk to each other? Why was he uninformed about the police investigation until October?

Technology and consent

I began this piece by talking about consent and all its necessary ingredients. It’s clear by now that, when it comes to TraceTogether, many of these ingredients were missing.

Even though it was left voluntary for the most of last year — and is technically still not mandatory yet — Singaporeans can’t be said to have truly consented to it. Until January 2021, we were repeatedly told that the data wouldn’t be used for anything other than fighting the pandemic. (Those of us who were sceptical and worried were pooh-poohed and dismissed.) The users who downloaded TraceTogether, then, can only be said to have specifically consented to their data being collected and used to fight the pandemic, and nothing else.

Now, we’re more fully apprised of the situation, but consent might soon become moot, since TraceTogether is going to be made mandatory. Instead of having the opportunity to enthusiastically and freely give consent, Singaporeans are aware that it’ll soon be a case of “you’re going to need this if you want to participate in society”.

As I acknowledged earlier, it’s not possible for governments to seek consent on every single thing from every single citizen. But that’s why I’m so troubled by how easily Vivian Balakrishnan seemed to be blindsided by the technology his own office was rolling out; because individual consent-giving isn’t possible at this scale (especially when we need things to move quickly, as is the case in a pandemic), citizens have to rely on and trust our elected representatives to be thoughtful and deliberate. We need them to be able to clearly and accurately set things out, and to actively solicit feedback (that they actually listen to and take on board, instead of simply paying lip service).

Public trust can’t be achieved or earned just because someone says “I didn’t mean to”, or because we pass legislation to live up to about 80% of our previous promise (which, while better than 0%, is still a notable step back from our starting point). And public trust is important, because we need, as much as possible, for people to feel comfortable consenting to policies and roll-outs, even if there isn’t an opportunity for them to have a direct say.

This time, it’s TraceTogether and contact-tracing data. But TraceTogether and SafeEntry aren’t the only digital programmes in Singapore. There’s so much more out there (with even more to come). One example: many venues appear to have adopted facial recognition temperature scanners, but Singaporeans never got the opportunity to talk about the implications and whether we consent to such systems, what data is being captured, how the data is stored, and how it’s managed and secured.

There are many ways in which technology can make things more convenient and improve our lives — and this is the side that we often hear about. But it’s just as important to talk about all the other things, because the ability to truly give consent requires that we face up to the pitfalls as well as the benefits.