TraceTogether and emergency measures amid an outbreak

How’s everyone doing? Singapore seems to be moving closer and closer to a lockdown 😬. I’m trying to think of ways that I can be helpful/useful to people with the skillsets and platform that I have—please reach out if you think of something! In the meantime, would you mind taking a little bit of time to fill out this survey? It’ll help me figure out how best to develop this newsletter.

Recently, the Singapore government launched a new app called TraceTogether, which—like our overall response to COVID-19—has been praised. Personally, I’m still trying to work through how I feel about such an app, and the use of tech and surveillance amid the outbreak. So I thought this would be a good time to reach out to some more tech-y friends and get their views on it.

First, caveats: I don’t have the knowledge or expertise to fully evaluate an app and how it works or how it’s been coded, and no one I’ve spoken to has had the chance to really scrutinise how TraceTogether works yet. The points raised here are things that have leapt out at tech/IT friends based on new reports on TraceTogether, as well as the TraceTogether website. Hopefully more information will emerge about this app soon.

If you have anything that you’d like to add, please leave a comment!

What is TraceTogether?

TraceTogether is a new app developed by the Ministry of Health and GovTech to complement existing contact tracing measures during the COVID-19 outbreak in Singapore.

The app can be downloaded on iOS or Android phones. On Android phones, the app can work in both the background and foreground. For iOS, though, the app works best in the foreground, so you’re asked to keep the app on in crowded places and during meetings.

Users are asked to install the app and turn on Bluetooth. With Bluetooth on, phones that have the TraceTogether app will ping one another when in close contact—that is, within two metres of each other for at least 30 minutes—and swap anonymised IDs. In the event that the owner of one phone tests positive for the coronavirus, contact tracers can then ask for access to the app’s data logs. The Ministry of Health will be able to decrypt those data logs and get the mobile numbers of people who have been in contact with the confirmed case, allowing them to get in touch with those people for isolation and testing.

Downloading the app is voluntary. You’re able to revoke consent for data collection by emailing the relevant authorities at support@tracetogether.gov.sg; according to the website, they will then delete your mobile number and user ID from their server. However, if you’re contacted by the contact tracers (in the event of you testing positive for COVID-19) and asked to share your data logs, you are obliged by law to comply.

Hmmm… a contact tracing app doesn’t seem like a bad thing. What’s the worry?

Contact tracing has been a key part of Singapore’s success in containing the coronavirus outbreak so far, and many countries around the world have been looking into technological solutions or aids in dealing with this global pandemic. Privacy International is keeping track of this.

For many, making some concessions in terms of personal privacy through actions like downloading the TraceTogether app might seem like a small price to pay, or not much different from all the ways in which we already compromise our privacy in interactions with major tech companies like Google or Facebook.

But everyone has different circumstances and risk assessments: for some, getting their networks traced is uncomfortable at best and dangerous at worst. With some of Singapore’s earliest COVID-19 positive cases, it was (falsely) rumoured that the infected individuals were either sex workers, or had visited sex workers. Even when false, these speculations are damaging; when true, this “outing” of sex workers compromises their safety, and exposes them to violence.

The government says the app only collects your mobile number and an anonymised ID, and doesn’t collect location data!

It’s not entirely clear at the moment how this app works, and what the data logs look like. GovTech says that it’s still working on making the BlueTrace protocol—upon which TraceTogether is built—open source, so (as far as I’ve been able to find out) the code hasn’t been inspected by independent parties yet. A proper audit of the code and how it’s executed is likely to be quite time-consuming.

Update: After publishing this issue, I received this Medium blog post in which the author takes a peek under the hood of the Android app.

It’s worth remembering that information can also be extrapolated from anonymised data—often more than we might think. Given that TraceTogether is built to complement existing contact tracing practices, I’m assuming that these data logs will also be used in conjunction with the interviews, CCTV footage, and even police work that’s going on.

Furthermore, friends have reminded me that it isn’t always the best idea to keep your Bluetooth on 24/7.

So… should I download it?

Ultimately, that’s a decision you have to make for yourself. As mentioned, everyone has different risk assessments and circumstances to be considered, and it more often than not will come down to a matter of trust. Do you trust that the app does what the government says it does, and only that, and that the privacy protections they say are present are being implemented properly, etc.?

Some people I know in civil society and the journalism industry (myself included) are uncomfortable and reluctant to download TraceTogether. It’s a scepticism that’s grown out of either personal encounters or knowledge of other people’s encounters with state actors (Singaporean or otherwise), as well as an awareness of the sensitivity of the work that we do, and an unwillingness to take risks (or more risks) when it comes to surveillance and privacy. But I also know people who don’t have such concerns, and see downloading TraceTogether as one’s civic responsibility amid this outbreak.

While we might not see eye-to-eye, we can’t exactly force one another to choose one way or the other. What’s key is that you try to make the most informed choice for you, and I’d ask everyone not to be judgy or attack others for making different decisions.

How far is too far when it comes to fighting the coronavirus?

I think we can all agree that these are not normal times. There are certain measures, such as travel restrictions, that we’re willing to put up with now, that we wouldn’t be okay with at any other time. Governments might also move to pass urgent or emergency measures that allow them more powers than they would normally be able to wield.

During this time of crisis and anxiety, the issue of privacy (personal, data, etc.) is often treated as secondary. This is an extraordinary period, so it makes sense to many of us that we should give up some personal liberties to enable governments to handle the crisis better or more easily.

But this doesn’t mean that it’s wise to give governments—any government—carte blanche to do whatever they like during this period. This doesn’t mean that we can’t question governments, or that we have to “leave politics out of it” and just comply with everything—because everything is political and politicians everywhere are definitely still keeping political interests in mind even when dealing with COVID-19. We need to keep having nuanced discussions and conversations about how to react and respond to this crisis.

What’s important is that there are adequate safeguards and checks and balances in the emergency measures and laws that governments are now using or introducing. They should be targeted and proportionate to the situation, rather than allowing governments to hold on to extensive powers even after the crisis has passed. We should also be asking what checks and balances are present even during this emergency period.

The Electronic Frontier Foundation has a good article on principles we should keep in mind to protect civil liberties during a health crisis.

In any case…

...whether you download TraceTogether or not, or are concerned about privacy and surveillance during this period or not, there are some common-sense measures that we should all be taking:

• Don’t go out if you’re unwell. (If you live somewhere that’s in lockdown, please don’t anyhow.)
• Wash your hands.
• Seek medical attention if you’re sick.
• If you have a stay-home or quarantine order, follow it.
• Cancel/defer all non-essential travel.
• Stay away from crowds as much as you can.
• Support organisations/businesses/initiatives that are currently struggling in any way you can. (I’ll be highlighting some other initiatives in the next weekly round-up this Saturday.)
• Be kind to one another.

How can we support each other during this time, even if we can’t be physically in the same space? Leave a comment with your thoughts!