Thread: Why is Singapore doubling down on Covid-19 apps?

Compiled from this Twitter thread.

Unlike this time last year, when Singapore's epidemic curve shot up and we were seeing new cases in the 100s/1000s (mostly within migrant worker dorms), the number of cases have come right down now, and tend to be mostly imported cases.

Of course, this drop in cases + vaccination roll-out doesn't mean that we should get complacent and think that #Covid19 is over, because it isn't.

But what are we doing doubling down so hard on #Covid19 tech and surveillance?

Early last year, the government introduced TraceTogether, a contact-tracing app that works via Bluetooth to ping close contacts. This is a #wethecitizens issue I wrote with support from privacy conscious friends in March 2020:

TraceTogether and emergency measures amid an outbreak
How’s everyone doing? Singapore seems to be moving closer and closer to a lockdown 😬. I’m trying to think of ways that I can be helpful/useful to people with the skillsets and platform that I have—please reach out if you think of something! In the meantime, would you mind taking a little bit of tim…

Adoption of TraceTogether was left voluntary at first; take-up was poor. But that didn't mean that there was no digital contact-tracing, because what quickly became mandatory all over the place was SafeEntry, where you have to scan QR codes to register entry into places.

Over the past year, SafeEntry is *everywhere*. If I need to buy eggs, I need to scan a QR code for SafeEntry into the mall, then a QR code to get into the supermarket. If I need to go to any other shops, I have to scan into each and every shop.

Surveillance in the name of Covid-19
Chong Kai Xiong is usually so conscious of his privacy that he refuses to use ride-hailing apps like Grab or Gojek. An IT professional who has done independent research on surveillance technologies…

Towards the end of 2020, the government started talking about merging the two systems to create TraceTogether-only SafeEntry (TT-only SE), and mandating it at certain venues.

TraceTogether-only SafeEntry check-in to be used at popular venues as Singapore resumes larger-scale activities
SINGAPORE: It will soon be compulsory to use the TraceTogether app or token to do SafeEntry check in at certain venues conducting activities with ...

The government kept assuring people that TraceTogether was privacy focused and that it doesn't track your location. Well, TT-only SE made that promise pointless, because even if TraceTogether doesn't track your location, SafeEntry does. That's the whole point of SE.

So a TT-only SE merge means that the government is collecting not just data of your movement from place to place, but can also access a list of close contacts off your phone or TraceTogether token if they want.

The government at first repeatedly assured Singaporeans that data collected via digital contact-tracing systems would *only* be used for contact-tracing. Here's two ministers assuring Singaporeans in June 2020:

This promise turned out to be false. In January this year, the government admitted that data collected via digital contact-tracing systems like TraceTogether could be obtained by law enforcement for investigations after all.

Whoops, turns out TraceTogether data isn’t only used for contact tracing
I was hoping to ease into 2021 with a somewhat relaxed weekly round-up this weekend, but it turns out we have to hit the ground running… Almost a year after the launch of TraceTogether, Singapore’s Bluetooth-enabled contact tracing system, Singaporeans have finally been told that, hey, the police ha…

Not only did it turn out that the police could obtain the data, Singaporeans were told that they *had already done so*. They did it *before* Minister Vivian Balakrishnan assured us in June 2020 that such data would only be used for contact-tracing.

TraceTogether data was accessed in May 2020 for Punggol Fields murder investigation
Investigators were not able to obtain any useful data as the app was not installed on the suspect’s phone.. Read more at straitstimes.com.

In Parliament, Vivian Balakrishnan admitted that he hadn't been thinking of the Criminal Procedure Code—which gives the police to obtain data for investigations—when he was making promises at the June press conference. 🙃

The ensuing public outcry led to the government acknowledging their "error" in not stating earlier that the data collected via TraceTogether and SafeEntry was not exempt from the Criminal Procedure Code.

S’pore govt to pass law to ensure TraceTogether data can be used only for serious crimes
The Government also acknowledged its error in not stating earlier that such data can be used for criminal probe.. Read more at straitstimes.com.

Parliament passed a new law to keep police from obtaining contact-tracing data except in investigations into 7 types of serious offences. This limited access, but it also legitimised something the govt had originally told SGeans wouldn't happen.

On consent and technology
Wah lau eh, what a week. Between work deadlines and early morning workshops and sleep deprivation and the #FixSchoolsNotStudents protest and the investigation into the protest, it’s been hectic. I spent about 2.5 hours on Wednesday afternoon sitting in a police station being interrogated about the p…

Did this TraceTogether debacle slow us down and make us think more about surveillance and the wisdom of rushing head-long into "tech solutions"? Did we learn any lessons?

via GIPHY

Although it's been delayed, the government is continuing with its plan to make TraceTogether, a previously voluntary contact-tracing system, compulsory. It's already compulsory at some venues, and has already been mandatory for migrant workers living in dorms for months.

The govt has said that this is all necessary because this is an extraordinary period. Okay, we know #Covid19 is a ridic situation. But there's no end date to all this data collection, not even a tentative one (that can be reviewed and extended if necessary).

Instead, #Covid19 tech surveillance is starting look increasingly permanent. The government is now pushing out SafeEntry Gateways for TT-only SE.

New SafeEntry system in use at over 2,700 places across S’pore from April 19
Locations with the new system include malls, cinemas, supermarkets and hospitals.. Read more at straitstimes.com.

Basically, you have to let the SafeEntry Gateway Box ping the TraceTogether app on your phone, or ping your TraceTogether token. It can also tell if your token is working or not; if it isn't, you have to get it replaced.

Graphic from @straits_times

Not all venues are using this gateway. But some are adopting more permanent-looking check-ins. The gantries pictured require you to scan the SE QR code, then let the gantry scan your phone with the check-in page, while a facial recognition temperature scanner takes your temp.

It has never been clear to me at any of these entry checkpoints if facial recognition has been activated on the facial recognition temperature scanner, and if these scanners are taking our photos. But they certainly could do that.

Such gantries + the SafeEntry Gateway rollout can't be cheap. Significant amounts of resources are being spent on putting these things up all over the place. It suggests that this sort of #Covid19 surveillance is not going away any time soon.

I understand that contact-tracing is important during the pandemic, as do all the privacy conscious activists and friends I know. We are all aware of the necessity of being able to trace and test people. So this isn't about denying #Covid19 or its effects.

But there are very important questions about surveillance and privacy that have been not only neglected, but bulldozed in this relentless enthusiasm for more, more, more tech, and more, more, more data collection.

In many ways this is because, as I wrote for @LowyInstitute, privacy has never been at the top of our minds in Singapore, nor featured very much in public discourse.

In Singapore, Covid vs privacy is no contest
The pandemic has shown how easily most people accept surveillance, and the government’s enthusiasm for new forms of it.

What's worrying to me is how much surveillance is getting normalised, and we aren't talking about whether it's necessary, or what the trade-offs are. Why is it that surveillance seems to be going up (or getting entrenched) even thought the #Covid19 numbers have come down?

What are we entrenching in society? How much data collection/surveillance will there be in the "new normal"? Have we really given informed consent to all the data collection that the state undertakes, and will continue to undertake? How will it impact us + our communities?

I'm writing about Singapore here, but I'm sure it's happening elsewhere too. We all need to look out for governments who are using #Covid19 as a perfect opportunity to introduce more surveillance.

To be very clear, this isn’t a thread about how contact-tracing is bad. What I *am* saying, though, is that Singapore is failing to strike the right balance.