“The emerging consensus is that government agencies must strike the right balance between public health interests and increased surveillance”, writes Lazarus Chok, a recent graduate from the LSE Department of Geography & Environment and Master’s candidate at the New York University Center for Urban Science + Progress

_______________________________________________

The COVID-19 pandemic has left cities struggling to reopen their economies while preventing hospital systems from being overwhelmed by recurring viral infections. Due to the novel coronavirus’ ability to transmit pre-symptomatically or even asymptomatically, public health experts have deemed it essential for cities to rapidly identify and isolate close contacts of infected persons (Kretschmar et al., 2020). Cities around the world are rolling out contact tracing technologies to identify quarantine targets, within hours. Mounting privacy concerns have been raised against such surveillance technologies, casting the implementation as a tradeoff between public health and personal privacy. This paper discusses how the false dichotomy of public health and privacy has become an instrument of convenience for the Singaporean government to introduce untested and unlimited surveillance. By tracing the development of TraceTogether and SafeEntry, two contact tracing technologies developed by Singapore’s Government Technology Agency (GovTech), this paper investigates how important questions of underlying efficacy, unlimited data experimentation and long-term ratcheting (or normalisation) effects of state surveillance have been elided over in the uncompromising ‘fight’ against COVID-19.

Getting a wrong balance right

GovTech has introduced both proximity tracking and digital check-ins to augment its contact tracing capacity. Its proximity tracking app, TraceTogether, has been installed by 2.3 million smartphone users or approximately 40% voluntary adoption, since March 2020. A physical proximity tracker, known as the TraceTogether Token, is also being rolled out to the entire population from September 14. SafeEntry, the national digital check-in system, has been deployed at over 16,000 premises for visitors to digitally log their entry and exit.

The emerging consensus is that government agencies must strike the right balance between public health interests and increased surveillance. The perceived risks to individual privacy and civil liberties have been highlighted by the government as the key reason for TraceTogether’s low adoption. Consequently, Singapore’s minister-in-charge of the Smart Nation Initiative, Vivian Balakrishnan, has repeatedly reassured Singaporeans that TraceTogether and SafeEntry only collect the data necessary for efficient contact tracing. All data is encrypted and is non-identifiable or de-identified. Data is also deleted after 25 days. With much international fanfare, Singapore has enjoyed the appearance of building a successful medical surveillance infrastructure while addressing teething privacy concerns and potential misuse of data (Cho, Ippolito and Yu, 2020; Bay, et al., 2020).

However, concerns about civil liberties are quite foreign to Singapore, a city-state where mass CCTV surveillance is already practised. A recent IPS survey found that 49.2% of Singaporeans would agree for the government to track people’s movements using cellular data without their consent. Only 17.5% disagreed that TraceTogether should be made mandatory. Preaching TraceTogether’s security architecture to a largely unbothered population is therefore unusual, especially given the state’s history of enforcing intrusive surveillance systems. The concerted effort by GovTech, fronted by Balakrishnan, to reconstruct a false (and moot) dichotomy between public health and privacy is perhaps performative. Imposing this naive framing that Singaporeans are concerned about increased state surveillance occludes, from people’s imaginations, that there may be other grounds to suspect the legitimacy of GovTech’s digital solutionism. GovTech has engineered a strawman: as long as data privacy concerns are addressed, Singaporeans should have no issues accepting increased surveillance measures. By investigating the technical implementation of TraceTogether and SafeEntry, this paper challenges this too-convenient dichotomy.

TraceTogether

Contact tracing is necessary to rapidly isolate close contacts of infected persons to break the chain of infection and reduce the reproduction number to below 1 (Ferretti et al., 2020). However, manually identifying their close contacts over the past 14 days is a laborious process and prone to recall biases. It misses out potential infection links via spontaneous interactions with strangers (e.g. crowded buses) and fomite meditated transmissions (i.e. contaminated surfaces). Technologies that help identify proximate contacts (both acquaintances and strangers) and the places where infected persons have visited are critical to boosting the efficacy of manual contact tracing. What used to take Singapore’s contact tracing teams 2-3 days is now completed within 24 hours.

TraceTogether is Singapore’s proximity tracking mobile application (Figure 1) using bluetooth received signal strength to detect periods of close contact between people, i.e. spending 15 minutes within 2 metres (Bay et al., 2020). Ideally, the ‘received signal strength indication’ (RSSI) should decrease with increasing distance between devices, providing a proxy for proximity. When the RSSI between two devices exceeds a predefined threshold, the TraceTogether apps exchange temporary identifiers through a ‘digital handshake’, keeping a log of temporary identifiers for devices that have come into close proximity. If and when users test positive, they can upload the temporary identifiers stored over the past 14 days onto a central server where the Ministry of Health matches the identifiers with registered devices, beginning the process of contact tracing.

Figure 1: TraceTogether App screenshots (Author taken).

Is proximity tracing the panacea to stemming COVID-19 outbreaks? Official narratives suggest that TraceTogether’s low adoption levels have been the major bottleneck to its effective implementation. Since this technology relies on both transmitters and receivers to possess TraceTogether, its potential to identify close contacts varies with the square of the fraction of users in the population, i.e. 40% coverage leads to ~16% likelihood of identifying close contacts (Kleinman and Merkel, 2020; Lorch et al., 2020). 75% adoption is widely regarded as the tipping point as more contacts (~56%) will be correctly detected than not. But more recent models have suggested that lower adoption levels (~40% coverage) could already bring the reproduction number under 1 (Hernández-Orallo et al., 2020). Where there is no scientific consensus, setting arbitrary adoption targets becomes political.

Moreover, fixing public narratives on arbitrary adoption targets ignores technical issues that handicap proximity tracing in real-world environments. While GovTech has conceded that it is “too early to tell” how effective TraceTogether actually is, there are compelling reasons to question its feasibility in real-world environments. Firstly, it is unclear whether RSSI correlates with epidemiologically meaningful distances (Cencetti et al., 2020; Leith and Farrell, 2020). Recent iterations of proximity tracing protocols calibrate for signal strength and sensitivity variation between device models. But much more research is needed to understand (1) how RSSI varies with signal path interference (e.g. body obstructions, surface reflections), and (2) how robustly RSSI models complex social environments. Due to reflections from walls and furniture, bluetooth signal propagation in indoor environments are more complex than open, outdoor spaces (Meckelburg, 2020); the more complicated the spatial environments are, the more difficult it is to correlate RSSI with physical distances, much less epidemiologically meaningful distances. Even the relative orientation of the smartphone or where the smartphone is placed (e.g. handbag, pockets) matters significantly, further complicating RSSI calculations. Moreover, RSSI is an oversimplification of real-world social interactions (Dignum et al., 2020). It makes no differentiation between adjacent bus commuters wearing face masks, or diners at the same table, or a workplace setting with spontaneous conversations. Epidemiologically meaningful interactions take place in social-spatial settings that are extremely unpredictable. Algorithmic decision-making for what constitutes a ‘close contact’ cannot afford to be performed in a social-spatial vacuum as TraceTogether does.

TraceTogether should not be evaluated by its number of downloads or even the efficiency gains for contact tracing teams. Its inherent algorithmic logic must be scrutinised and its ability to correctly identify epidemiologically meaningful interactions must be measured. Justifying surveillance is not merely about assuaging privacy concerns, but demonstrating its public health benefits.

SafeEntry

SafeEntry is the location tracking complement to TraceTogether (Figure 2). By scanning a Quick Response (QR) code at the premise, users log their time of entry/exit into SafeEntry. All data collected is encrypted and stored on government servers for 25 days. According to SafeEntry FAQs, data will only be accessed for the purposes of “preventing or controlling the transmission of COVID-19”, a rather wide mandate compared to TraceTogether’s purpose-limited design. Beyond the intuitive use case of identifying where infected persons visited, SafeEntry data may also be “de-identified and aggregated for analytics purposes”. Ironically, while GovTech incessantly assures citizens that TraceTogether will not store location data, SafeEntry does exactly that – providing a comprehensive log of residents’ movements. Beginning September 14, more venues would progressively trial “TT-only SafeEntry” systems where digital check-ins can only be done using the TraceTogether app or token, drafting into question whether the proximity and location databases are interoperable. If interoperability is possible, then the assurances that TraceTogether does not store location data could be moot.

Although location QR coding strategies have limited spatial specificity (Kleinman and Merkel, 2020), a person’s commuting patterns and social networks can be inferred by stitching together their digital check-ins over 25 days. Conceivably, similar patterns could be extracted from aggregate data, recreating a socio-spatial graph for specific demographics. This is already being experimented to assess and adjust safe distancing and segregation measures within migrant worker communities, demonstrating how seemingly nondescript surveillance systems can quickly become disciplinary instruments aimed at specific demographics.

Figure 2: SafeEntry digital check-in posters (Author taken).

We do not know the exact ways in which SafeEntry data is used or merged with other demographic, social or economic data the government possesses. Unlike TraceTogether which was purpose-limited in design, SafeEntry has decoupled data collection from the analysis. There must be greater accountability and debate on the socially optimal use of location data, potentially beyond the scope of medical surveillance and COVID-19. The scale of data collection is unprecedented and immensely powerful for agent-based modelling for city planning, public policy and real estate. Given the potential opportunities and risks associated with large-scale simulations using SafeEntry data, we must rigorously debate the socially acceptable parameters for conducting experiments on this novel dataset. Even if there are no intentions to conduct such experiments beyond medical surveillance, its disruptive potential for public good is cause to question, why not?

Implicit, impotent evaluative frameworks

There is ample theoretical justification for the use of TraceTogether and SafeEntry, supported by an epidemiological understanding of COVID-19 outbreaks and independent technical teardowns. But these technologies have not been rigorously evaluated in real-world environments.

In the absence of causal evidence linking the use of contact tracing technologies to COVID-19 containment, people associate the efficacy of these technologies to top-line infection statistics, such as the tapering infection numbers among migrant workers and persistently low number of community infections. This simplification ignores the counterfactual baseline – without implementing contact tracing technologies, what would infection statistics look like? Is the difference in outcomes, between the counterfactual and current infection levels, sufficient to justify the tradeoffs which contact tracing technologies impose? A retrospective study of Singapore’s earliest COVID-19 clusters found that only two of 425 contacts identified through manual contact tracing were positive cases (Pung et al., 2020). Resorting to emergency rhetoric that emphasises containment at all costs ignores the risks of deadweight and counterproductive policies/technologies.

The hierarchy of data

Framing the adoption problem as public health versus protecting personal privacy is contextually problematic in Singapore. We already collect large quantities of individual and aggregate data through eGovernment services, loose data protection regimes, CCTV networks and ‘smart’ public infrastructure. The shibboleth of ‘data as private property’ is incompatible with Singaporeans’ everyday experiences and should be replaced by a more nuanced understanding of data regulation.

A good place to start is Duncan et al.’s (2001) conceptual framework for data disclosure (Figure 3). By weighing disclosure risk and data utility, policymakers can theoretically identify what societies ‘maximum tolerable risk’ is for surveillance (Lane and Schur, 2020). In this framework, disclosure risk and data utility are not objective measures but qualitative judgements that are politically contested. Society’s ‘maximum tolerable risk’ is also a shifting goalpost. During a pandemic, this threshold would be lifted to allow for more intrusive surveillance. After all, the alternative to comprehensive contact tracing may be strict lockdowns that limits everyone’s freedom of movement (Sonn and Lee, 2020). Policymakers must also incorporate uncertainty and long-tail events into their decision models.

Aggregate data can often provide immense social utility, for example: optimising public transit by modelling commuting patterns or planning retail spaces by observing footfall. Similarly, de-identified SafeEntry data could have utility outside its immediate contact tracing uses; the emergent properties of city-scale social graphs could inform better urban planning decisions and public policies. Using the disclosure framework, policymakers can begin to identify opportunities as close to the ‘maximum acceptable risk’ as possible to optimise social utility.

Figure 3: A modified conceptual framework for disclosure risk and data utility (Duncan et al., 2001).

New normals in surveillance

One of the more interesting long-term consequences of habituating citizens to increased surveillance is the ratcheting effect of public policies. Expansions in state surveillance during the COVID-19 pandemic may be difficult to retract as habits stick and ideologies shift to the right. TraceTogether and SafeEntry are novel acts of self-administered surveillance (Rowe, 2020). The high degree of compliance suggests that Singaporean society is growing accustomed to surrendering private data to the government. Will this ratchet up a ‘new normal’ in everyday surveillance administered by the self?

Singapore’s partial success at containing COVID-19 has not been tempered by a critical analysis of its tradeoffs. Avoiding discussions of TraceTogether and SafeEntry’s efficacy might lead Singaporeans to believe that ‘innovative’ solutions are merely performing a ‘theatre of prevention’ (e.g. Datta, 2020), or worse, suspect that they are a facade for something far more disingenuous. Like many other East Asian countries with a strong tradition of state intervention, the dichotomy of public health versus personal privacy has been falsely constructed to justify exceptionally intrusive measures (e.g. South Korea’s disclosure of patient information). But beyond the intrusiveness of surveillance, this analysis suggests that the dichotomy elides over important questions of efficacy and the acceptability of using private data for large-scale experiments that could unlock, hitherto inaccessible, public good.

TraceTogether and SafeEntry are novel forms of medical surveillance with uncharted potential, not only to understand viral dynamics, but also social interactions at the city-scale. How we evaluate their efficacy could determine the path for data regulation, surveillance and experimentation in the years after.

References

Bay, J. et al. 2020. BlueTrace: A privacy-preserving protocol for community-driven contact tracing across borders. Singapore: Government Technology Agency.

Cencetti, G. et al. 2020. Digital proximity tracing in the COVID-19 pandemic on empirical contact networks. medRxiv preprint, medRxiv:2020.05.29.20115915.

Cho, H., Ippolito, D. & Yu, Y.W. 2020. Contact tracing mobile apps for COVID-19; Privacy considerations and related trade-offs. arXiv preprint, arXiv:2003.11511.

Datta, A. 2020. Self(ie)-governance: Technologies of intimate surveillance in India under COVID19. Dialogues in Human Geography, 204382062092979.

Dignum, F. et al. 2020. Analysing the combined health, social and economic impacts of the coronavirus pandemic using agent-based social simulation. arXiv preprint, arXiv:2004.12809.

Duncan, G.T. et al. 2001. Disclosure limitation methods and information loss for tabular data, in Confidentiality, Disclosure and Data Access: Theory and PRactical Applications for Statistical Agencies.

Ferretti, L. et al. 2020. Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing. Science, 368 (6491).

Hernández-Orallo, E., Manzoni, P., Calafate, C.T. & Cano, J-C. 2020. Evaluating How Smartphone Contact Tracing Technology Can Reduce the Spread of Infectious Diseases: The Case of COVID-19. IEEE Access, 8, 99083-97.

Kleinman, R.A. & Merkel, C. 2020. Digital contact tracing for COVID-19. CMAJ early release, cmaj:200922.

Kretschmar, M.E. et al. 2020. Impact of delays on effectiveness of contact tracing strategies for COVID-19: a modelling study. The Lancet: Public Health, 5 (8), 452-9.

Lane, J. & Schur, C. 2020. Balancing access to health data and privacy: A review of the issues and approaches for the future. Health Services Research, special issue in 2020.

Leith, D.J. & Farrell, S. 2020. Coronavirus contact tracing: Evaluating the potential of using bluetooth received signal strength for proximity detection. Ireland: Trinity College Dublin, School of Computer Science & Statistics.

Lorch, L. et al. 2020. A Spatiotemporal Epidemic Model to Quantify the Effects of Contact Tracing, Testing, and Containment. arXiv preprint, arXiv:2005.07641.

Meckelburg, H-J. 2020. Contact tracing coronavirus COVID-19: Calibration method and proximity accuracy. Germany: Rurh-Univerität.

Pung, R. et al. 2020. Investigation of three clusters of COVID-19 in Singapore: Implications for surveillance and response measures. The Lancet, 395 (10229), 1039-46.

Rowe, F. 2020. Contact tracing apps and values dilemmas: A privacy paradox in a neo-liberal world. International Journal of Information Management, 102178.

Sonn, J.W. & Lee, J.K. 2020. The smart city as time-space cartographer in COVID-19 control: the South Korean strategy and democratic control of surveillance technology. Eurasian Geography and Economics, 0 (0), 1–11.

*The views expressed in the blog are those of the authors alone. They do not reflect the position of the Saw Swee Hock Southeast Asia Centre, nor that of the London School of Economics and Political Science.