Thread: Why is Singapore doubling down on Covid-19 apps?

Compiled from this Twitter thread.

Unlike this time last year, when Singapore's epidemic curve shot up and we were seeing new cases in the 100s/1000s (mostly within migrant worker dorms), the number of cases have come right down now, and tend to be mostly imported cases.

Of course, this drop in cases + vaccination roll-out doesn't mean that we should get complacent and think that #Covid19 is over, because it isn't.

But what are we doing doubling down so hard on #Covid19 tech and surveillance?

Early last year, the government introduced TraceTogether, a contact-tracing app that works via Bluetooth to ping close contacts. This is a #wethecitizens issue I wrote with support from privacy conscious friends in March 2020:

Adoption of TraceTogether was left voluntary at first; take-up was poor. But that didn't mean that there was no digital contact-tracing, because what quickly became mandatory all over the place was SafeEntry, where you have to scan QR codes to register entry into places.

Over the past year, SafeEntry is *everywhere*. If I need to buy eggs, I need to scan a QR code for SafeEntry into the mall, then a QR code to get into the supermarket. If I need to go to any other shops, I have to scan into each and every shop.

Towards the end of 2020, the government started talking about merging the two systems to create TraceTogether-only SafeEntry (TT-only SE), and mandating it at certain venues.

The government kept assuring people that TraceTogether was privacy focused and that it doesn't track your location. Well, TT-only SE made that promise pointless, because even if TraceTogether doesn't track your location, SafeEntry does. That's the whole point of SE.

So a TT-only SE merge means that the government is collecting not just data of your movement from place to place, but can also access a list of close contacts off your phone or TraceTogether token if they want.

The government at first repeatedly assured Singaporeans that data collected via digital contact-tracing systems would *only* be used for contact-tracing. Here's two ministers assuring Singaporeans in June 2020:

This promise turned out to be false. In January this year, the government admitted that data collected via digital contact-tracing systems like TraceTogether could be obtained by law enforcement for investigations after all.

Not only did it turn out that the police could obtain the data, Singaporeans were told that they *had already done so*. They did it *before* Minister Vivian Balakrishnan assured us in June 2020 that such data would only be used for contact-tracing.

In Parliament, Vivian Balakrishnan admitted that he hadn't been thinking of the Criminal Procedure Code—which gives the police to obtain data for investigations—when he was making promises at the June press conference. 🙃

The ensuing public outcry led to the government acknowledging their "error" in not stating earlier that the data collected via TraceTogether and SafeEntry was not exempt from the Criminal Procedure Code.

Parliament passed a new law to keep police from obtaining contact-tracing data except in investigations into 7 types of serious offences. This limited access, but it also legitimised something the govt had originally told SGeans wouldn't happen.

Did this TraceTogether debacle slow us down and make us think more about surveillance and the wisdom of rushing head-long into "tech solutions"? Did we learn any lessons?

via GIPHY

Although it's been delayed, the government is continuing with its plan to make TraceTogether, a previously voluntary contact-tracing system, compulsory. It's already compulsory at some venues, and has already been mandatory for migrant workers living in dorms for months.

The govt has said that this is all necessary because this is an extraordinary period. Okay, we know #Covid19 is a ridic situation. But there's no end date to all this data collection, not even a tentative one (that can be reviewed and extended if necessary).

Instead, #Covid19 tech surveillance is starting look increasingly permanent. The government is now pushing out SafeEntry Gateways for TT-only SE.

Basically, you have to let the SafeEntry Gateway Box ping the TraceTogether app on your phone, or ping your TraceTogether token. It can also tell if your token is working or not; if it isn't, you have to get it replaced.

Not all venues are using this gateway. But some are adopting more permanent-looking check-ins. The gantries pictured require you to scan the SE QR code, then let the gantry scan your phone with the check-in page, while a facial recognition temperature scanner takes your temp.

It has never been clear to me at any of these entry checkpoints if facial recognition has been activated on the facial recognition temperature scanner, and if these scanners are taking our photos. But they certainly could do that.

Such gantries + the SafeEntry Gateway rollout can't be cheap. Significant amounts of resources are being spent on putting these things up all over the place. It suggests that this sort of #Covid19 surveillance is not going away any time soon.

I understand that contact-tracing is important during the pandemic, as do all the privacy conscious activists and friends I know. We are all aware of the necessity of being able to trace and test people. So this isn't about denying #Covid19 or its effects.

But there are very important questions about surveillance and privacy that have been not only neglected, but bulldozed in this relentless enthusiasm for more, more, more tech, and more, more, more data collection.

In many ways this is because, as I wrote for @LowyInstitute, privacy has never been at the top of our minds in Singapore, nor featured very much in public discourse.

What's worrying to me is how much surveillance is getting normalised, and we aren't talking about whether it's necessary, or what the trade-offs are. Why is it that surveillance seems to be going up (or getting entrenched) even thought the #Covid19 numbers have come down?

What are we entrenching in society? How much data collection/surveillance will there be in the "new normal"? Have we really given informed consent to all the data collection that the state undertakes, and will continue to undertake? How will it impact us + our communities?

I'm writing about Singapore here, but I'm sure it's happening elsewhere too. We all need to look out for governments who are using #Covid19 as a perfect opportunity to introduce more surveillance.

To be very clear, this isn’t a thread about how contact-tracing is bad. What I *am* saying, though, is that Singapore is failing to strike the right balance.