COVID app triggers overdue debate on privacy in Singapore

Singapore – For a country that prides itself on being on the cutting edge of high-tech governance, there has been little national discussion in Singapore on the balance between data collection and individual privacy.

Now, COVID-19 has forced the conversation, after it was revealed that data from the government’s contact-tracing app, contrary to initial promises, could also be used for criminal investigations.

The public backlash prompted the government to not only acknowledge that it had made a mistake but also to introduce new legislation to restrict the use of the data.

Under the new amendments to the COVID-19 (Temporary Measures) Act, passed in the Singapore Parliament this month, personal data collected by digital pandemic contact-tracing programmes can only be used to contact trace, unless it is required by law enforcement for investigations into “serious offences”.

Pritam Singh, the leader of the opposition, has called for an “immediate conversation” on the balance between individual privacy and the use of technology and data collection in Singapore.

“To counter scepticism and its resultant behaviours and to replace it with trust and cooperation, Singaporeans also need to better understand the necessity and ambit of data collection. This is especially so for a new generation who are more likely to be concerned about privacy and individual rights,” he said in Parliament.

Prepared by the country’s experience with SARS in 2003, the Singapore government quickly rolled out a test-and-trace strategy in the early days of the coronavirus’ emergence and poured resources into developing digital solutions to speed up the process.

Throughout the pandemic, Singaporeans have been introduced to contact-tracing programmes such as SafeEntry, which uses QR codes to register people’s entry into and exit from public venues, and TraceTogether, a Bluetooth-enabled app that swaps anonymous pings with other devices to generate a list of close contacts.

SafeEntry is currently mandatory across the island, applying to a wide range of venues, such as shopping malls, restaurants and workplaces.

Trust tested

The response to TraceTogether was lukewarm when it first launched in March 2020, but adoption shot up later in the year, after the government indicated its intention to make it mandatory. Apart from the smartphone app, wearable devices – operating on the same principles – were also made available. More than 80 percent of the city-state’s 5.7 million residents has adopted either the TraceTogether app or the device so far.

To assuage concerns over privacy, the government had assured Singaporeans that digital contact-tracing data would only be used to track people down who might have been exposed to the virus. “TraceTogether app, TraceTogether running on a device and the data generated, is purely for contact-tracing. Period,” Vivian Balakrishnan, the minister in charge of Singapore’s Smart Nation initiative said at a press conference on 8 June last year. Teo Chee Hean, the coordinating minister for national security, made a similar assertion in Parliament just days before.

Half a year later, Balakrishnan was forced to admit in Parliament that he had not been thinking of the Criminal Procedure Code – which gives law enforcement expansive powers to obtain information for their investigations – when he spoke at that press conference.

“Perhaps I was so enamoured by what I thought was the ingenuity and brilliance of this that I got blindsided,” he said in Parliament last week. “I regret the consternation and anxiety caused.”

However, the Ministry of Home Affairs confirmed last week that the police had requested, and obtained, TraceTogether data for a murder investigation in May 2020 – about a month before Balakrishnan spoke at the press conference. The minister has said that he did not know of the case until October, when he was first made aware of the oversight following questions from a member of the public.

In deploying their own contact-tracing technology, other countries have also had to contend with questions about privacy and data security. Australia, for instance, developed the COVIDSafe app based on the same application protocol behind TraceTogether but passed legislation to ensure that the gathered data could only be used in contact-tracing efforts.

The government hopes that the new legislation will remedy any erosion of public trust in Singapore’s contact-tracing programmes. The new law limits police access to such data to investigations into seven classes of offences, such as rape, kidnapping, murder, or drug offences punishable by death.

Arguing that Singapore is in “exceptional circumstances”, Balakrishnan emphasised the urgent need to focus on dealing with the pandemic.

“This is crucial because the virus is  a clear, present and growing threat. And it will remain so for some time. We cannot afford to be distracted from our fight against COVID-19,” he said.

He asserted that Singaporeans, on the whole, still trust TraceTogether. Following the revelations in early January, only 350 people had requested that their identification data be deleted from the government server, while 390,000 joined the programme.

“I think by and large the public still trust the government, but ‘trust’ is a rather broad word to use here,” Howard Lee, a PhD candidate researching media governance at Murdoch University, told Al Jazeera English.

“Rather, I think the public is convinced by the need for TraceTogether and are willing to give the government the benefit of the doubt, if it means using TraceTogether keeps the economy going. My belief is that the government is attempting to expand on the boundaries of that willingness by sanctioning such data breaches through legalising it, rather than address the privacy issues directly.”

Surveillance concerns

But questions have arisen regarding the trade-off made by allowing law enforcement access to such information.

“While we know that TraceTogether data is critical for contact-tracing, we need to ask whether TraceTogether data is vital for solving these seven categories of crimes,” Leader of the Opposition Singh said in Parliament, referring to the classes of offences for which the authorities will still be allowed to access contact-tracing data.

Pointing to the “abundance” of other tools that law enforcement can use during their investigations – from CCTV footage, forensic examinations of devices like mobile phones and laptops, to interviews with witnesses and the collection of other physical evidence – Singh said that there was “a legitimate view that these tools should be more than sufficient in detecting crime and securing convictions.”

“There is little or no doubt that TraceTogether would make things more convenient for the police but it is my view that convenience for the police may not be a good enough reason to compromise the trust necessary to win the COVID-19 fight,” he added.

Terry Xu, the editor of local news website The Online Citizen, told Al Jazeera English that he shares Singh’s scepticism: “Hearing what has been said in Parliament, I am somewhat assured that the government will restrict the use of data to serious offences stipulated in the urgent bill. But … I doubt there is any crucial data that the [law] enforcement agencies can retrieve from [TraceTogether] for the said serious offences than what they [can already access] through the existing surveillance devices that they have access to.”

Political scientist Ian Chong told Al Jazeera English that, with this new legislation in place, “some people may be willing to give state authorities the benefit of the doubt”, but added that “others may worry that there remains few channels for recourse and remedies should there be discovery of some overreach by authority in future.”

Xu is wary of the surveillance potential of these contact-tracing systems. “There is nothing stopping the government from abusing the information to keep tabs on individuals,” he said, pointing to the hostility that the authorities might have towards the more critical members of Singapore’s civil society.

Activists who have criticised the government or engaged in protests have reported that law enforcement officers often seize their electronic devices during interrogation, with no avenue for them to find out what information has been retrieved from these devices.

Jolovan Wham, a social worker currently facing multiple charges for participating in assemblies declared illegal by the authorities, has had mobile phones seized by the police in the course of various investigations. He told Al Jazeera English that the amount of data collection and surveillance in Singapore can sometimes feel overwhelming and exhausting to guard against.

“Surveillance is so normalised that sometimes I just want to go: ‘F**k it, I don’t care any more’,” he said. Yet he also acknowledges that he takes steps to protect his privacy as much as he can, such as using Faraday pouches that can block radio signals and prevent unwanted attacks on electronic devices.

Lee pointed out that, for a national conversation on privacy to be truly meaningful, it would be necessary for the government to first be transparent with Singaporeans about the sort of citizen data that has already been collected and how it is used.

He also said that political will to make real changes will also be necessary: “A national conversation on privacy is useless unless it also comes with an unconditional review of all laws that can infringe on our privacy, with the need to safeguard privacy made a priority rather than play second fiddle to ‘national security’ or ‘crime deterrence’.”