Some prominent exposure apps are slowly rolling back freedomsBobbie Johnsonon November 23, 2020 at 8:37 pm

Many countries launched contact tracing and exposure notification apps early in the pandemic to help slow the spread of covid-19. Now some of the most prominent are beginning to change their approach to privacy and transparency, according to MIT Technology Review’s covid tracing tracker.

The tracker, which launched in May, looks at the policies and safeguards around contact tracing apps worldwide. It collects information on the use and policies around these new technologies, including how they approach privacy.

We recently changed the entries for several apps after finding that they had made significant changes to how they use and store personal data.

Singapore was the first country to launch a significant digital contact tracing system, and its TraceTogether technology has been picked up by several other countries. But while the program was initially voluntary, that has slowly shifted as the world has fallen deeper into the pandemic and cases have risen.

Around 45% of the nation’s 5.6 million residents currently use TraceTogether, and the country has tied it to its digital check-in system, called SafeEntry, which allows it to monitor people’s movements. But the government plans to make the use of these systems mandatory by the end of December. Residents will have to use the smartphone app or a wearable device and use SafeEntry, or they will not be allowed access to shops, schools, or other public places without checking in.

According to reports, education minister Lawrence Wong said that the country believes 70% adoption could help push it to its next level of reopening, phase three—but that this could be achieved only through legal compulsion.

“When we have both a higher take-up rate of TraceTogether and wider deployment of TraceTogether-only SafeEntry … and community transmission throughout this period remains low, then there is a good chance of us entering phase three … by the end of the year,” he said.

Singaporeans are already required by law to upload their health information through TraceTogether when contacted by the government. As a result, the tracker now reflects that Singapore’s system is mandatory.

In India, meanwhile, the country is making mixed progress with its huge digital contact tracing system. The Aaroyga Setu app has been downloaded more than 160 million times since launching in April, and came in for early criticism for its lack of transparency and murky “voluntary” status. But the government in Delhi has made progress on several fronts since then, first making the app’s code open source so that it can be more easily interrogated by outsiders, and this week announcing that it would share the system’s back-end code for the same reason. 

Its rating for data limitations—how other agencies can use health data captured through the app—has been upgraded because it made its policies more clear recently.

But despite these changes, trust between the government and users remains low. The country’s National Informatics Center has been unresponsive or unhelpful with inquiries, which has led to ongoing confusion over who developed Aarogya Setu. After a review, India’s transparency rating has been downgraded.

In the Philippines, there has been controversy over the way the app uses data. One report earlier this year called the national app “borderline spyware,” and there are particular concerns that the regime of President Rodrigo Duterte—who is notorious for supporting extra-judicial killings—may use data it collects. Because that information will be retained for an undetermined period of time, we have downgraded the country’s rating accordingly.

Not every country is rolling back freedoms, though. Several European countries were upgraded in the latest round of changes. Germany and France have both had their ratings on data limitation upgraded thanks to privacy policies that prevent health data from being shared with other government or law enforcement agencies. In the UK, meanwhile, the tracker has upgraded ratings in several areas, including limitation, data destruction, and transparency.

—This story is part of the Pandemic Technology Project, supported by the Rockefeller Foundation.

Read More