Coronavirus contact-tracing apps could pose major privacy risk, Amnesty warns

Bahrain’s ‘BeAware’ and Kuwait’s ‘Shlonik’ include the most invasive tracking measures

(PA)

Contact-tracing apps being used to prevent the spread of coronavirus could be collecting deeply personal information, Amnesty International has said.

The organisation claims the privacy and security of hundreds of thousands of people have been put at risk by the new platforms.

Contact-tracing apps are software that informs people when they have been in contact with someone who has contracted the coronavirus.

These vary in terms of features, but can generally be separated into two categories: decentralised apps, where the data is kept on the device, and centralised apps where the data is kept on a separate database.

Amnesty International reviewed software from 11 countries, including Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia and the United Arab Emirates.

Bahrain’s ‘BeAware Bahrain’ and Kuwait’s ‘Shlonik’ included the most invasive features, with both apps collecting live or “near-live” tracking data.

These two applications used a centralised approach, capturing location data through GPS and uploading it to a mass database.

This is the same approach originally proposed for the UK’s contact-tracing application, separate to the infrastructure developed by Apple and Google, although that could be liable to change.

Amnesty International also points out that this location information can be easily linked to individuals.

Bahrain and Kuwait require citizens to sign up with a national ID number.

The Bahrain government also enrolled people automatically into a national television show offering prizes to those who stayed at home, and published online sensitive information of people who may have Covid-19.

This included “an individual’s health status, nationality, age, gender and travel history,” Amnesty said.

Norway has since pulled its contact-tracing app ‘Smittestopp’ because of its threat to user privacy, as the software continually uploaded users’ live locations. It was downloaded 1.6 million times before it was removed from app stores.

Other applications, such as those in Austria, Germany, Ireland, and Switzerland, use a decentralised model of Bluetooth contact tracing.

Privacy advocates have contended that this is a better solution, as information is stored locally on the device, rather than sent to a separate database.

In China, the information gathered and retained on central databases has been used to restrict movement and allow the authorities to track people, a report from the New York Times alleged.

Other countries, such as Armenia, Russia, and Ecuador passed emergency laws giving the authorities the power to monitor people who test positive for the coronavirus through mobile location data, something which has been approved in the United Kingdom.

Even in more liberal countries, there are concerns that using technological solutions such as these improperly could be harmful to citizen’s privacy.

Contact tracing apps from France, Iceland and United Arab Emirates use a centralized system, but the information is only uploaded voluntarily by users or at the request of a health authority. But Amnesty said there could still be concerns about such apps.

"The centralized model of France’s contact-tracing app combined with the lack of transparency over how data is stored raises questions as to whether the users’ information could be de-anonymised", Amnesty International said.

Last month, Amnesty International raised numerous privacy questions about the UK’s contact tracing app, which is still undergoing trials in the Isle of Wight.

"Very important concerns around the current choice to adopt a centralised model, and issues like accessibility and transparency, still remain unanswered,” said Kate Allen, Amnesty International’s UK Director.

These include ensuring user’s informed consent is given when using the app, ensuring that data is only used for a limited purpose, and that there is independent expert oversight for the data collected.

Health secretary Matt Hancock could not confirm when the UK’s own app would be ready to launch. “The app is progressing and we will launch it when the time is right. I am not going to put a date on it,” he said.