The TraceTogether app was launched in March 2020, as part of the Singapore government's efforts to stem the spread of the COVID-19 virus. If two users are in close proximity to each other, their devices trade encrypted user IDs that can later be decrypted by the Ministry of Health if one tests positive for COVID-19. The app stores information for 25 days, and is supposed to cease functionality once the pandemic is over. TraceTogether tokens that function in a similar manner were also introduced to extend coverage to those who do not have mobile phones.
Initial assurances about the app
When it was first introduced, there were many concerns raised over privacy. Mass surveillance is not a new concept in Singapore, thanks to the ubiquitous installations of Closed-Circuit Television Cameras (CCTVs) in many places. However, there was significant backlash against the app initially, as people were worried that their movements would now be monitored even more extensively. Nonetheless, citizens were assured that information about one's GPS location would not be collected, and that the data would only be used for contact tracing purposes.
The app indeed proved to be effective at aiding efforts in contact tracing, and Singapore has managed to achieve close to zero transmissions within the community for long periods of time. Citizens were therefore encouraged more strongly to use the app, and certain locations such as malls and cinemas have since made it mandatory to download it before entering the premises. The government also stated that the country could not move into the next phase of its reopening unless 70% of the population adopted usage of the app or token.
However, despite earlier assurances, the government later admitted that the data could in fact be accessed by the police for criminal investigations, and had already been used for a murder investigation.
A privacy statement on the TraceTogether website had earlier stated that the data would only be used for contact tracing purposes, but was later updated to read, "The Singapore Police Force is empowered under the Criminal Procedure Code (CPC) to obtain any data, including TraceTogether data, for criminal investigations."
Although it seems logical that public safety should come first, especially if serious crimes have been committed, the back-pedalling of messaging by the government raised a whole new set of concerns. "Clear communication of not just what the data will be used for, but who will have access to the data and how long the data will be kept, is critical," says Dr. Carol Soon, Senior Research Fellow at the Institute of Policy Studies in Singapore.
Reactions from the public
The revelation that contact tracing data could now be used by the police resulted in much criticism from the public, as it appeared to justify the public's initial worries about increased surveillance. TraceTogether users voiced their concerns, saying they felt as if a promise had been broken. Even if one had nothing to hide, the issue is ultimately that of trust. The government backtracking on initial assurances left people feeling betrayed. It even prompted some users to delete and stop using the app altogether.
To prevent this from occurring any further, Dr. Soon says that it is essential to outline the context of use for such apps. "The importance of the context of use also explains in part the public backlash the government faced when it said that the data collected from TraceTogether will be used for serious crimes. This is because it was communicated definitively during the roll-out of the app that data collected would only be used for contact tracing to aid efforts in curbing the spread of COVID-19."
The pandemic has also opened up discussions on how to best serve the public good, while still respecting individual rights. On a global scale, there has been much worry that authoritarian governments would exploit the current crisis as a means of normalising greater control over populations. Australian privacy watchdog Digital Rights Watch stated that this is the worst case scenario that privacy advocates have been warning us about.
Privacy concerns have caused the uptake of similar apps in other countries to be slow. In Australia for example, the COVIDSafe app functions in a similar manner. However, because not enough people downloaded it, very few cases have been discovered via the app. This led to the government denying access to data by law enforcement agencies in a bid to improve rates of adoption. "The more narrow and focused the purpose of use, the more likely people will trust and accept the technology/application," says Dr. Soon.
Striking a balance
Increased surveillance may be justified during times of crisis in order to maintain public health. On occasion, this means temporarily curbing civil liberties. However, this increased control over the population should not be normalised.
In the case of Singapore, some political experts argue that the government did not deliberately intend to lie to the public, as they would not have disclosed the details in Parliament if so. Instead, it had overlooked the issue of this data being made available to the CPC. The Smart Nation and Digital Government Office (SNDGO) released a statement saying, "We acknowledge our error in not stating that data from TraceTogether is not exempt from the Criminal Procedure Code." Unfortunately, as voiced by many disgruntled citizens, this admission has resulted in the government undermining its credibility.
The need to uphold citizen trust is essential, as the helpfulness of the app is undermined if users start deleting it. Whilst other countries are experiencing their second or third waves of infections and undergoing multiple lockdowns, Singapore's efficient contact-tracing system has played a huge part in minimising community transmissions and managing the pandemic. The TraceTogether app is still very much necessary in keeping transmission rates low.
But, it's important to keep in mind that these applications might still face skepticism from the public, a sentiment shared by Dr. Soon. "There will always be a segment in the society, regardless of which country, who will view data collection for public safety with suspicion and skepticism. And there is the majority of the population who are in the middle, whose minds need to be convinced."
Preventing efforts from going to waste
If public trust is eroded and citizens stop using the app, Singapore may no longer enjoy its reputation of having one of the lowest transmission rates in the world.
Some are calling for legislation to ensure that data is used solely for the purpose of contact tracing. In an effort to formally set out the use of contact tracing data in police investigations, the government has just introduced the COVID-19 (Temporary Measures) (Amendment) Bill in Parliament. It specifies serious offences such as terrorism, drug trafficking, murder, kidnapping and rape. To safeguard privacy, misuse of personal data by public officers will face harsher penalties than those in currently-existing public sector data protection laws.
Another possible solution is the formation of a committee comprising prominent public figures to whom the police would be accountable. Another suggestion was for the government to exclude TraceTogether data from the CPC's ambit altogether. It is essentially more important to convince as many people as possible to use the app.
There is also the option to use decentralised apps so that the government does not have access to the data. Some countries are currently using Google and Apple's exposure notification technology, which does not allow centralised local governments access. However, the Singapore government had previously rejected these systems, claiming they would be less effective. "The hesitation of governments to adopt decentralised apps from Google and Apple could stem from concerns on the lack of control over possible changes in terms of use," adds Dr. Soon.
Decentralised apps could also potentially be more vulnerable to malicious attacks on users and their data.
It appears that there will always be a trade-off between enhanced public safety, and individual civil liberties. Finding a new normal that allows effective management of the pandemic ultimately entails upholding public trust by being transparent and having clear information available about how data is being used.
Photo: David Austin