Singapore city with bubble chat showing impact of trust on TraceTogether COVID-19 contact tracing app

Police Have Access To Singapore’s TraceTogether App Data, in Spite of Earlier Assurances; Will Trust in Contact Tracing Apps Be Undermined?

Singapore has been one of the world leaders in controlling the coronavirus pandemic from the beginning; after some initial spikes from April to mid-July, the country has limited new cases to the single digits most days in the past four months and has experienced only 29 of the world’s 1.9 million total deaths. A large part of that success was the early and aggressive rollout of contact tracing efforts. The country was among the world’s first to roll out an app for this purpose, called TraceTogether, and voluntary public uptake of it was key.

Part of the public’s willingness to use the app, which was eventually required for entry to certain public and private spaces, was owed to reassurances by both the Education Minister and the Minister for Foreign Affairs that it would not be used for anything but contact tracing. That position was suddenly reversed with the recent announcement that TraceTogether data had been used in the investigation of a murder. The government has now backtracked on its initial statements, with the head of the national contact tracing initiative claiming that he “had not considered” an overriding portion of the country’s Criminal Procedure Code (CPC).

Trust in TraceTogether shaken?

Lockdown and contact tracing measures require trust in government, something that the citizens of Singapore have in relatively high levels as compared to other nations. Still, voluntary uptake of TraceTogether was very slow. By May, only about 20% of the population was using it. That number has since jumped to about 78%, driven in no small part by an increasing amount of shops and workplaces requiring it for entry.

These contact tracing measures are relatively strict as compared to other countries. Some, notably the United States, still do not have any kind of national digital system in place. Low trust in government is a major obstacle in these places; it could be something that emerges in Singapore as well given that voluntary TraceTogether uptake was very low before compulsory elements were introduced.

That trust in the contact tracing system may be eroded by the government’s sudden reversal of policy at the start of the new year, with Foreign Minister (and TraceTogether program manager) Vivian Balakrishnan attributing the change to a failure to account for Section 20 of the Criminal Procedure Code. The code states that law enforcement agencies may “order production of any document or other thing” deemed necessary as part of a criminal investigation. That, at least according to authorities, includes the contact tracing data that was supposed to be off the table. Desmond Tan, Minister of State for Home Affairs, told Parliament on January 4: “The Singapore Police Force is empowered … to obtain any data, including TraceTogether data, for criminal investigations.”

TraceTogether privacy statement - Sep 3, 2020
TraceTogether privacy statement – Sep 3, 2020
TraceTogether privacy statement - Updated Jan 4, 2021
TraceTogether privacy statement – Updated Jan 4, 2021

Most residents of Singapore either install the contact tracing app on their smartphones or obtain a special Bluetooth-based token that must be carried outside the home. The system uses direct communications between these devices instead of GPS or cell phone networks, giving users a relatively higher level of privacy. The devices are also supposed to be anonymized and to automatically dump stored data every 25 days. While it does not appear that law enforcement has the means to casually browse the interactions of all users of TraceTogether from a centralized source, investigators can request access to an individual’s data under Criminal Procedure Code terms.

Balakrishnan defended the move by suggesting that this would only be done in very serious cases. “Where lives are at stake, it is not reasonable for us to say that certain classes of data should be out of reach of the police. This power – on the part of the police – to access data must be exercised judiciously, and with utmost restraint.”

Maintaining a successful contact tracing program

With a total of about 58,000 recorded cases to date, only about 1% of Singapore’s total population of 5.7 million has had Covid-19. That means that the TraceTogether program (and related contact tracing efforts) will continue to be vital until most of the population has been vaccinated, something not likely to happen until mid-2021 at the earliest.

Trust is critical with the government planning to require TraceTogether participation for access to an even greater range of venues and services in 2021. A mass distribution of the wearable contact tracing technology to all remaining residents is planned for sometime early in the year, followed by an expansion of the existing SafeEntry program to various “higher risk” venues. This is being paired with trial programs allowing venues that host certain types of large gatherings, such as weddings and business conferences, to begin re-opening. The ultimate goal is to make the program mandatory for all residents at all times, though a date for this has yet to be set.

Public cooperation with law enforcement is also critical to the program’s success, given that the government has relied heavily on the Singapore Police Force for basic contact tracing activities such as reviewing the movements of diagnosed patients on public cameras and locating the potential contacts of anyone who tests positive.

Singapore government has backtracked on its initial assurance that TraceTogether app will only be used for COVID-19 contact tracing. #privacy #respectdata Click to Tweet

Some citizens interviewed by the BBC expressed dismay at the news and indicated that they would disable the Bluetooth component of the smartphone app unless it was required to enter an area, essentially defeating the purpose of using it for contact tracing. Others took things a step further by publicly throwing their tokens in the trash. Use of TraceTogether is not currently compulsory or punishable by law, but it can be somewhat difficult to navigate everyday life without it given that it is required to enter grocery stores and use public transportation or taxis.

 

Senior Correspondent at CPO Magazine