Hi :)

In issue #21 of this newsletter, I mentioned that the invasion of privacy by various governments worldwide to combat the virus was troubling me. The situation has become much worse in the last two months.

I won’t have a problem if these privacy-invading apps are only used to curb the coronavirus and are stopped once the situation is under control. But the indicators are that these surveillance tools will persist long after [Quartz].

📇 How contact tracing tech works

Contact tracing apps use location tracking via GPS or triangulation, and Bluetooth. There are four solutions that use these technologies. These solutions can be used on their own or together.

1. Location: By tracking location through GPS and triangulation, they can determine if two people were close by at a given time. This is the worst for privacy.

2. Bluetooth: Bluetooth has a relatively short range of a few metres and can detect other devices with Bluetooth when the devices come within range. When certain strength and duration of the signals are met, they can swap encrypted tokens with each other. Each device keeps a record of which devices it has come near. This is much better for privacy as locations are not required to be tracked.

3. Google/Apple: Google and Apple have jointly developed an exposure notification system [Apple] that works over Bluetooth and allows communication between iOS and Android devices. This system is free for developers to use in their contact tracing apps. Preserving user privacy has been one of the fundamental requirements when building this solution.

4. DP-3T: Decentralized Privacy-Preserving Proximity Tracing is an open-source protocol based on Bluetooth. The contact logs are only stored on the device and are not shared with any authority.

If a person tests positive for COVID-19, these apps will alert everyone else who was within range in the last two or three weeks. Those people can then report any symptoms and take precautions such as self-quarantining themselves.

🔎 Tracking the tracing apps

MIT Technology Review has put together a Coronavirus Tracing Tracker that lists all the automated contact tracing apps launched or backed by national governments. They graded the apps on five criteria:

• Is it voluntary?

• Are there limitations on how the data gets used?

• Will data be destroyed after a period of time?

• Is data collection minimized?

• Is the effort transparent?

Most notably, in India and China, the two countries with the largest populations in the world, the use of the app is not voluntary. It’s also quite unnerving to see how many countries are not transparent about their policies, how many don’t minimize the collection of data, and how many don’t delete the data after a reasonable period.

I already addressed the privacy issues of 🇨🇳 China’s and 🇰🇷 South Korea’s apps in issue #21.

🇮🇳 India is the only democracy to impose the use of the app. Although it’s not mandatory for the entire population, it's been made mandatory for citizens living in containment zones and for all government and private sector employees [BBC]. The Indian Railway is making it compulsory to have the app to travel on certain trains [The Hindu]. The government is also contemplating making it mandatory for flyers once air travel resumes [Times of India].

More importantly, India doesn’t have a privacy law, although a draft law is in process. After numerous complaints at the initial release of the app, they updated the privacy policy to resolve some of the issues. In a detailed analysis of the changes in the privacy policy [Medianama], Aditi Agrawal at Medianama points out that there are still several ambiguities on how long they retain data, whether they delete the data ever, who they share the data with and if the data is truly anonymized.

Once you have location data, especially at every 15-minute interval which is the frequency with which Aarogya Setu collects that data, it’s trivial to identify who the data belongs to.

🇬🇧 UK’s contact tracing app has privacy advocates up in arms as well. As the app is being trialled, a parliamentary committee has said that it is unlawful under the Data Protection Act [The Guardian].

Harriet Harman, the chair of the joint committee on human rights, said government assurances on privacy were “not enough”.

“The contact-tracing app involves unprecedented data gathering. There must be robust legal protection for individuals about what that data will be used for, who will have access to it and how it will be safeguarded from hacking.

🇳🇴 In Norway, more than 25% of its population has installed the contact tracing app. Within days of the app’s release, a programmer was able to create an app that could monitor users of the contact tracing app in the nearby area.

In an interview with Universitetsavisa, cryptology professor Kristian Gjøsteen warned that it’s all too easy to let the right to privacy slip: “I do not think anyone, at least here in this country, would have considered installing such an app in normal times. Now we just do it. This starts a slippery slope that points towards the extensive monitoring that we see in China.”

🇸🇬 Singapore, on the other hand, has ensured that its TraceTogether app data can be used only by its health ministry to access data [BBC]. It further emphasizes that the data is strictly for disease control and will not be shared with any other agencies or for enforcing lockdowns and quarantine. Singapore is one of only six countries to score all five stars on MIT’s tracing tracker.

🕵️‍♀️ Human contact tracing is more effective

Jason Bay, the product lead for Singapore’s TraceTogether app, wrote in a blog post [Medium]:

If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain 😂 (throw whatever buzzword you want), not for the foreseeable future.

Technology has lots of limitations. It excludes those segments of the population without smartphones or those who don’t install the app. Bluetooth and GPS are not very smart—if there is a wall between two devices, it still records proximity. But these are false positives when it comes to measuring proximity for possible transmission of the virus.

Aaron Holmes, reporting for the Business Insider, writes:

Success stories in China and South Korea, where COVID-19 outbreaks have been largely brought under control, were aided by huge numbers of human contact tracers who call people infected with COVID-19, ask who they came into contact with, and subsequently alert those people to slow the spread.

Tech can aid human contact tracers, but it can’t replace them. That’s why it is so infuriating to me that our privacy is at stake for technology that is not very effective on its own.

Some feel-good stories

Here are some feel-good stories so that I can end this newsletter on a more positive note :)

+ 👨‍🏫 Using tech to teach — smartly [The New York Times] - Shira Ovide’s newsletter, On Tech, is brilliant and I highly recommend subscribing to it. In yesterday’s newsletter, she wrote about Ben Kogswell, a kindergarten teacher in California who is using some unusual techniques such as a robot puppet, to keep students engaged via remote learning.

+ 🧠 New Brain Implant Lets Blind People 'See' Letters Without Using Their Eyes [Science Alert] - Scientists at Baylor College of Medicine in Houston have developed a brain implant allows blind people "see" the shape of letters. The device skips the eye and uses electrodes implanted in the brain to trace letters directly on patients’ brains dynamically. This may allow blind people to regain full vision in the future.

+ 💜 Covid-19: Reasons to Hope [Avaaz] - Avaaz has compiled ten stories that highlight some of the best attributes of humanity—the spirit of compassion, wisdom, and unity that people are sharing in the middle of this pandemic.

💬 Quote of the week

“The fantastic advances in the field of electronic communication constitute a greater danger to the privacy of the individual.”
―Earl Warren

I wish you good health and a brilliant day ahead :)

Neeraj