Covid-19 and the privacy trade-off

The Covid-19 pandemic has come at a time when we have unprecedented access to technology capable of collecting an unlimited amount of personal data. While this has been of huge benefit, it also poses serious threats to an individual's privacy and cybersecurity of the data that could enable mass surveillance and data breaches due to insufficient protection.

New Zealand joined other countries around the world this week with the launch of a national Covid-19 contract tracing app by the Ministry of Health on May 20.

The app, NZ COVID Tracer, creates a digital diary of places the user visits when they scan QR codes at entrances to business premises and public buildings. Each scan records the location name, address of the business, time and date. The data is stored on the device and deleted automatically after 31 days. Users’ personal information is expected to be used for public health purposes.

Unlike other apps, the app is relatively energy efficient, less resource intensive, and collects minimum data, which is securely transmitted and stored on the server, if users want. It can be downloaded from Google Play or App Store.

Any system like this that requires entry of personal data comes with a level of unease and privacy is always a major concern for users, organisations and regulatory authorities in New Zealand and worldwide. Users need guarantees that, if a piece of their data is collected for a particular scenario, say a Covid-19-like emergency, organisations and regulatory authorities must comply with their privacy provisions. In particular, they must prohibit any information leakage or potential misuse including illegitimate access in the future.

So how are other countries tracing movements of citizens in this pandemic?

Australia has interviewed close contacts of positive cases and developed a Bluetooth-based COVID SAFE app for further tracing, where the data is managed by users. Once a positive case is discovered, this data is transmitted to a national repository and stored in an encrypted manner.

Singapore launched a Bluetooth-based TraceTogether app and MIT (Massachusetts Institute of Technology) in the US has developed a privacy-preserving tracing app which is also based on Bluetooth. Each device on a Bluetooth system periodically (every five minutes) generates and sends anonymous codes to nearby devices that record those codes. Users who are tested positive can upload their generated codes to a central server. Any users can download and check if they were in the close proximity of a positive case.

The fundamental issue with all Bluetooth-based apps is the risk of inaccurate results. For instance, if the smartphone is in a pocket or bag, or if weather conditions are poor, signals can be missed and this could generate negative results. Also, Bluetooth apps can drain the phone battery quickly because its operations are quite resource-intensive, with lots of data being sent to and received by devices. Other issues could be low uptake of the app or people moving around without their smartphones. On a side note, technological solutions such as apps do not pick up if someone physically leaves traces of Covid-19 on a surface.

Countries such as Israel, Italy and Turkey have tracked the locations of people with data provided by telecom providers. Israel, China, South Korea and India have used CCTV and facial recognition technology to trace their citizens. South Korea also used credit card history to accurately reconstruct past actions of active cases.

In the wake of this pandemic, and for future incidents that may require access to personal data and movement information, the following suggestions could help in mitigating potential risks and protect people and organisations:

Tips for users

• Use the app for maintaining your private digital diary
• Enable the screen lock feature of your smartphone
• Secure your password
• Backup your data regularly
• Consult reliable sources to avoid misinformation that could come through online social networks
• Beware of emails from unknown IDs

Suggestions for organisations

• Comply with privacy policies for building user trust
• Secure data in transmission and at rest
• For developing new solutions, consider security and privacy by design
• Enable multi-factor authentication

Considerations for government and regulatory authorities

• Like the privacy impact assessment made for Release 1, do the same for all the future releases
• Share source code of the app for fostering public trust as well as for sharing these efforts globally