Coronavirus contact-tracing apps could pose major privacy risk, Amnesty warns
Bahrain’s ‘BeAware’ and Kuwait’s ‘Shlonik’ include the most invasive tracking measures
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Contact-tracing apps being used to prevent the spread of coronavirus could be collecting deeply personal information, Amnesty International has said.
The organisation claims the privacy and security of hundreds of thousands of people have been put at risk by the new platforms.
Contact-tracing apps are software that informs people when they have been in contact with someone who has contracted the coronavirus.
These vary in terms of features, but can generally be separated into two categories: decentralised apps, where the data is kept on the device, and centralised apps where the data is kept on a separate database.
Amnesty International reviewed software from 11 countries, including Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia and the United Arab Emirates.
Bahrain’s ‘BeAware Bahrain’ and Kuwait’s ‘Shlonik’ included the most invasive features, with both apps collecting live or “near-live” tracking data.
These two applications used a centralised approach, capturing location data through GPS and uploading it to a mass database.
This is the same approach originally proposed for the UK’s contact-tracing application, separate to the infrastructure developed by Apple and Google, although that could be liable to change.
Amnesty International also points out that this location information can be easily linked to individuals.
Bahrain and Kuwait require citizens to sign up with a national ID number.
The Bahrain government also enrolled people automatically into a national television show offering prizes to those who stayed at home, and published online sensitive information of people who may have Covid-19.
This included “an individual’s health status, nationality, age, gender and travel history,” Amnesty said.
Norway has since pulled its contact-tracing app ‘Smittestopp’ because of its threat to user privacy, as the software continually uploaded users’ live locations. It was downloaded 1.6 million times before it was removed from app stores.
Other applications, such as those in Austria, Germany, Ireland, and Switzerland, use a decentralised model of Bluetooth contact tracing.
Privacy advocates have contended that this is a better solution, as information is stored locally on the device, rather than sent to a separate database.
In China, the information gathered and retained on central databases has been used to restrict movement and allow the authorities to track people, a report from the New York Times alleged.
Other countries, such as Armenia, Russia, and Ecuador passed emergency laws giving the authorities the power to monitor people who test positive for the coronavirus through mobile location data, something which has been approved in the United Kingdom.
Even in more liberal countries, there are concerns that using technological solutions such as these improperly could be harmful to citizen’s privacy.
Contact tracing apps from France, Iceland and United Arab Emirates use a centralized system, but the information is only uploaded voluntarily by users or at the request of a health authority. But Amnesty said there could still be concerns about such apps.
"The centralized model of France’s contact-tracing app combined with the lack of transparency over how data is stored raises questions as to whether the users’ information could be de-anonymised", Amnesty International said.
Last month, Amnesty International raised numerous privacy questions about the UK’s contact tracing app, which is still undergoing trials in the Isle of Wight.
"Very important concerns around the current choice to adopt a centralised model, and issues like accessibility and transparency, still remain unanswered,” said Kate Allen, Amnesty International’s UK Director.
These include ensuring user’s informed consent is given when using the app, ensuring that data is only used for a limited purpose, and that there is independent expert oversight for the data collected.
Health secretary Matt Hancock could not confirm when the UK’s own app would be ready to launch. “The app is progressing and we will launch it when the time is right. I am not going to put a date on it,” he said.
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments