Security and privacy experts sound the alarm on contact tracing apps

Everything was justified by being described as necessary in the War on Terror. At that time, many citizens welcomed it because they feared terrorist acts. Now the same is being done in the war on the virus and many are welcoming it once more, because of fear that authorities and not least the establishment media whip up daily with frequent reporting.

Multinational technology giants Apple and Google have been working together to create a massive monitoring system that will facilitate contact tracing of citizens. It provides the technical prerequisite for all people in the world to be monitored and tracked in real time. This is done in the name of public health this time, just as it was previously done in the name of the War on Terror. Many nevertheless welcome it in the face of an invisible enemy.

Apple and Google, the two US multinational companies that, through their IOS and Android operating systems respectively, have a duopoly over the entire global mobile phone market, are normally competitors. But now they are teaming up to “help” health authorities around the world fight the Coronavirus – or at least they are producing the means for that themselves.

Apple wrote on its website in April: “Software developers help create technical tools to fight the virus and save lives. In this spirit of collaboration, Google and Apple announce a joint effort to enable the use of Bluetooth technology to help governments and health organizations reduce the spread of the virus, with user privacy and security central to the design.

These contact tracing apps have caught the imagination of politicians looking for ways to control their voters.

More than 30 systems are being developed by governments and health authorities but the technology could prove useless, threaten basic privacy laws and usher in unprecedented mass surveillance. Much of the hype around contact tracing apps, it seems, comes from anecdotal reporting rather than hard science.

Tracing movements in real time by means of an app. Photo: Pixabay

Contact tracing is the name of the process for identifying people who may have come in contact with an infected person and subsequent collection of additional information about these contacts. This is done by tracing the contacts of infected individuals, testing them for infection, treating the infected and in the next step also tracing their contacts. This often means that the tracers must be quarantined or isolated, even from their own family members if, for example, the home is too small or just has a toilet. Those who oppose being tested, treated or quarantined, may face imposed coercive measures or imposed criminal penalties.

Carly Kind, the director of the Ada Lovelace Institute, told Wired after a review of how technology can be used to ease Coronavirus lockdowns: “This is the first major epidemic or pandemic where these kinds of contract tracing apps have been under consideration. There’s not very much evidence at all to support the sustained benefit.”

Singapore was one of the first countries to introduce a manual contact tracing app. While authorities there were initially able to contain the spread of the virus, the contact tracing app had little to no effect in stopping it from spreading. The West focuses on using Bluetooth to track the Coronavirus, while in Asia CCTV footage and phone location were tracked by teams of experts. Automated tracing, via phones, will not necessarily be more successful in containing the disease however.

What happens to the stored information once the war on the virus is over? Photo: Pixabay

University of Oxford academics claim Asian manual contact tracing is “too slow” for pandemics. “We conclude that viral spread is too fast to be contained by manual contact tracing, but could be controlled if this process was faster, more efficient and happened at scale,” the academics said.

A European open-source project, DP3T, uses a similar system as Apple and Google. Even officials from the Council of Europe have asked: “Considering the absence of evidence of their efficacy, are the promises worth the predictable societal and legal risks?” after researchers at the KU Leuven Institute for the Future in Belgium, said any evidence for their effectiveness in managing disease outbreaks is ”limited”.

Apple and Google in May released an application programming interface (API) to create interoperability between the two operating systems and open up the same to the developers of tracking apps, which is the target of the venture. API is the abbreviation for Application Programming Interface, which is a specification of how different application programs (apps) can use and communicate with specific software.

Since Apple and Google own their respective operating systems, they have full control over all APIs, allowing them to update their operating systems with them without the approval of the mobile phone manufacturers or owners. Google’s new contact tracking APIs are backwards compatible with Android 6, as is Apple’s.

About twenty states today use apps to track the country’s residents in real time and more are joining the move, but so far mobile phone owners must approve and download the government’s apps themselves. However, these are often camouflaged as important health information or news updates regarding Covid-19, which many fearful users therefore choose to install.

This means that when they start searching for information or, for example, make a self-diagnosis by answering different questions, algorithms calculate a communication risk factor with others in the vicinity who have the app. This can be done without the person seeking information or answering questions about their intent.

In several countries, there is also a requirement that those who test positive install these apps, which then detect all other mobile phones within Bluetooth range, which is 30-60 meters. The app then alerts everyone within this range, but also everyone you’ve been around for over the past two weeks. It also measures the distance to others and also makes a risk assessment based on it.

China used a similar system to send its contact trackers to “interview” anyone who was near an infected and retrieve them from their homes if needed – sometimes with physical coercion.

The UK’s public health authority National Health Service (NHS) is now testing a contact tracking app on the Island of Wright Island with over 140 000 inhabitants. The islanders have been able to download it since May 7, which is optional. Smaller surveys on the island show that there are those who welcome the app for fear of the virus, as they want to know where the sick are so they can stay away from them.

Citizens are being told that the NHS app is the key to their health, but it may rather be the key to a loss of privacy. Photo: Pixabay

However, many were initially sceptical of the app, until the NHS staff, sent to the island as part of the pilot project, made it clear that the app is a must in order to lift the shutdown of society and that the islanders can only be “liberated” if they embrace the app. This is also very clear in the way authorities offer “information” about the app.

A future vaccine may be on the cards, since the World Health Organization (WHO) and countless governments have repeatedly stated that normal life can only return after all people are vaccinated globally. Many people therefore wonder if installing the tracing apps – or taking vaccines –  may be optional after all if the alternative is to remain in de facto house arrest without income or social contact, something that billions of people around the world – not least those living alone – have now had to live through to varying degrees since March.

It may be worth remembering here that isolation is a punishment for prisoners who misbehave and they can testify to how psychically degrading it is after being kept in such conditions for just a few days.

The NHS app differs from the real-time decentralized systems that Apple and Google claim to have, as the UK has chosen to monitor and control everything from a central server controlled by the NHS authority. But not everyone welcomes such an app. No less than 170 UK security and privacy experts have made a joint statement warning of the risks with the app.

The NHS responded with the same mantra that the WHO and countless governments do, that is, for the good of the people and their security. The only thing that sets this apart from developments following the 911 terrorist attacks and the subsequent War on Terror is that it is now the decrees of the WHO and health authorities instead of various countries’ security services that have become mandatory and surveillance is even more intrusive this time.

In the coming months, the technology giants say that the system will be developed so that “everyone can participate” and at the same time connect it with other mobile functions, apps and government systems. It suggests that no restrictions are planned for participation and all non-real-time information will be stored by Apple and Google on giant servers, data that can then be sold to third parties.

While technology giants claim that they will not collect personal information and that anonymity will be given, it is hardly difficult with such total access to information from the phone to find out who the owner is. This is something that third parties or hackers can take advantage of, as several security experts have pointed out. Besides, Apple and Google already know exactly who the person is through many other apps.

The multinational companies, as well as many countries’ authorities, declare that this is only temporary as long as the pandemic is in progress, but such statements preceded many new laws and measures after the terrorist acts of 911. Sadly, these laws have remained and have in many cases have been further developed and extended in almost all areas.

Those who oppose being tested, treated or quarantined, may face imposed coercive measures or imposed criminal penalties. Still image: WSJ

An example is the Patriot Act, a collection of legislative changes creating long-standing privacy interventions, adopted by the United States Congress as a result of the terrorist attacks of September 11, 2001. As of now, there is no exit strategy or end date for either the War on Terror or the virus. Although the lucrative apps may be disabled afterwards, few believe it will ever be done. And the question remains of what will happen with the information gathered about everyone’s movement patterns, actions and meetings with others.

Technology giants have repeatedly abused their positions and violated many laws in different countries over the years. For example, Google transferred 1,6 million patient data from UK hospitals in 2015 to the DeepMind Health database to create the Health app Streams.

Google then promised not to link this patient information with Google Accounts, which many of the affected patients had installed on their phones and computers. Three years later, however, Google did just that by merging DeepMind Health’s database with its own.

Ross J. Anderson, a Professor of Security Engineering at the Department of Computer Science and Engineering at the University of Cambridge, is one of many who have sounded the alarm about the new mass tracking systems that are now being developed for mobile phones. He explains that these apps will not be anonymous and that contact trackers will be given access to all sorts of information, such as card purchases or public transport tickets purchased with apps.

Anderson also warned that health authorities need geographical data for more than just contact tracing. For example, if they need to find a person to quarantine or test, they can use such an app.

On social media, many have expressed vivid concern, but also pointed out that Apple and Google do not seem keen to build a similar system to facilitate the hard-to-find food and medicine distribution chains, but again focus only on privacy-violating surveillance.

List of countries that have already introduced contact tracing apps:

Australia:  COVIDSafe
Bahrain:  beaware
Colombia:  CoronApp
Ghana:  GH Covid-19 Tracker App
Iceland:  Ranking C-19
India:  Aarogya Setu
Israel:  HaMagen
Malaysia:  MyTrace
North Macedonia:  Stop Corona
Norway:  infectious Stop
New Zealand
China
Russia
Saudi Arabia: Corona Map
Singapore: TraceTogether
UK:  NHS – Covid-19
South Korea
Taiwan
Czech Republic: eFacemask
Thailand
Hungary: virus Radar

List of countries that currently have a contact tracking app under development:

Denmark, Estonia, Finland, France, Latvia, Ireland, Italy, Canada, the Netherlands, Switzerland, Germany and Austria. Russia intends to introduce a geofencing app for patients diagnosed with Covid-19 living in Moscow, to ensure that they do not leave home.

Footnote: These are the countries that Nya Tider have confirmed. It is likely that there are significantly more.