Covid-19 Ushered in a New Era of Government Surveillance
By: Dave Gershgorn
Tags: Privacy, Surveillance, Covid 19, Technology, Government

In early December, after finding 16 people had illegally crossed the border from Myanmar to Thailand and evaded the mandatory quarantine period, the Thai government said it would start patrolling the border with new surveillance equipment like drones and ultraviolet cameras.

In 2020, this kind of surveillance, justified by the coronavirus pandemic, has gone mainstream. Since March, more than 30 countries have instituted data gathering or surveillance measures questioned by privacy advocates, as OneZero tracked earlier in the year. That includes drones, like those used by the Thai government, but also apps that track a coronavirus patient’s every move, or even government cameras installed in Australians’ homes to make them comply with quarantine orders.

Nine months on, a new OneZero review suggests that many of those programs are still in effect, and have even been extended in some cases: Governments are still mandating the installation of invasive apps, as well as tracking movement by partnering with location-tracking companies and using CCTV cameras and drones.

It’s still unclear how long the coronavirus will persist, given that countries around the world just started their vaccination campaign days ago. It’s also unclear how long these surveillance measures will be in place — and whether they’ll still be around long after the coronavirus is a distant memory.

Nationally mandated location tracking apps have been implemented in countries Qatar, India, Russia, and Poland, and are all still actively used.

Qatar’s state news agency has repeatedly stressed that business owners must constantly check that their customers and employees have a “green check” on a mandated app called Ehteraz. Government employees like bus drivers also have to verify whether a passenger has a green check before letting a passenger ride.

The mandatory app is now being used as a kind of immunity passport for the country. Local festivals and even sporting events with 20,000 attendees require a green check on the Ehteraz app for attendance.

In India, the use of the national coronavirus contact tracing app is not technically mandatory, except for those who use public transportation, work in offices, or live in high-risk areas, according to CBSNews.

But two new lawsuits in December are challenging the use of the Indian government’s app, called Aarogya Setu. One lawsuit is against a local passport office, which denied service to an Indian citizen who didn’t have the app installed. The other was brought by Colin Gonsalves, senior advocate of the Indian Supreme Court, who also challenged the state’s assertion that the app isn’t mandatory.

“While on paper, downloading of the Aarogya Setu app is not mandatory, however, all government organizations, private companies, and landlords are compelling [citizens] to use the app,” he said, according to BarAndBench.com, an Indian legal news outlet.

Both Indian lawsuits argue that the app is functionally mandatory, and given the app’s data collection via Bluetooth and GPS tracking, laws must be put in place to justify the surveillance.

Hundreds of thousands of Russians are also still under surveillance through CCTV and facial recognition scans, and Russian authorities continue to demand those who have tested positive for the disease to install an invasive tracking app. Earlier this year, one woman described having to upload an image of herself every 2 hours in order to satisfy the app’s demands, according to Radio Free Europe.

A similar situation is underway in Poland, where people are also required to install an app that asks them to upload selfies as proof of quarantine. The app is still being used, according to more than 11,000 reviews of the app on the Google Play Store, which date up to December 13, 2020.

The app’s reviews are vastly negative, and many users have commented that the app either isn’t functional or an invasion of privacy.

“What this apps requires to work is suspicious at best,” one user wrote. “The app wants me to send a photo every half an hour — it is annoying and frustrating.”

Another reviewer wrote that they weren’t getting any notifications at all.

“The only way not to get fined for not keeping self-quarantine is to constantly monitor it for new tasks. Gross,” they wrote.

Countries like Israel and Ghana have focused instead on tracking citizens’ whereabouts through aggregating their phone’s location data, without the artifice of making them download an app. This data is collected directly from telecommunications companies, which have an unparalleled view of their customers’ location.

Israel has repeatedly re-approved contact tracing surveillance by the Shin Bet secret service, which uses a nationwide location database gathered from telecoms to track the location of citizens who have tested positive for the virus, according to a report from the Brookings Institute.

The rate of success for these tools have been lackluster. An October report from Israeli newspaper Haaretz suggested that the invasive contact tracing effort was only able to find 13.5% of those who ended up contracting the virus.

“If an individual leaves their house, we can detect that in a matter of seconds.”

The Ghanian government is also taking location data directly from telecommunications companies, specifically Vodafone and MTN, to help with its contact tracing efforts, Bloomberg reported. The executive order from Ghana’s president, Nana Akufo-Addo, which called for telecoms to provide the data, was challenged in court in June but ultimately upheld.

“The purpose of the collection of the data is for the protection of the whole state of Ghana,” said Ghanian judge Stephen Oppong, according to Bloomberg.

Other countries have also tapped startups and third-party companies to collect the data for them. In Austria and Brazil, data science companies collect data either from users directly or from telecoms, then process the data and give insights to local governments.

Austrian telecom A1 has been working with a company called Invenium Data Insights, which analyzes the data and then provides trends to the government, Austrian digital rights organization Epicenter.Works told OneZero in an email. Each A1 customer is given a unique identifier that changes every 24 hours, so it’s more difficult to track individuals across the data set. The data collection has been happening since before the pandemic, and is also used for analyzing tourism trends.

Brazilian startup InLoco also made headlines earlier in the pandemic due to its extremely detailed tracking capabilities, which it shared with local and state Brazilian governments.

“We have visibility of certain behaviors that couldn’t be captured by other technologies: for example, if an individual leaves their house, we can detect that in a matter of seconds,” CEO Andre Ferraz told Brazilian media in March.

The company’s website has now changed its tune to a more privacy-friendly appeal.

“Inloco has a technology that understands the localization behavior of 60M of Brazilians. It was designed not to identify people, ensuring their privacy and anonymity,” the website says. Inloco also offers assurance that data collected for health tracking will be deleted after the pandemic.

Some surveillance tactics have been struck down for being too invasive. France has been particularly active in curbing the overt use of surveillance to track and shame its citizens for not complying with stay-at-home orders and wearing masks.

A French court grounded the use of drones to surveil citizens and enforce coronavirus restrictions in May, calling the tactic “a serious and manifestly unlawful infringement of privacy rights.”

This ruling impacts the use of 650 drones that the French police had also just procured, according to Bloomberg. Any use of the drones will now require legislation and oversight from an independent privacy organization.

A Parisian project to use facial recognition to detect whether Paris metro riders are wearing a mask, run by local tech startup DakataLabs, is also on hold, the company told OneZero. Chief product officer Xavier Fischer said that the project was paused while the company has discussions with France’s GDPR compliance organization. However, it’s worth noting that the DakataLabs project didn’t stream back video or identities to the startup, and the cameras only counted the number of people wearing masks.

It’s unclear how many of these surveillance programs will outlast the pandemic itself. Events like 9/11 have previously heralded long-standing security measures such as the Patriot Act, which legalized broad categories of government surveillance, as well as the creation of the Department of Homeland Security, which has not only reshaped airports and international travel, but turned U.S. borders into highly surveilled and militarized zones. That means that many of these programs aren’t just stop-gap efforts, but a glimpse of a future in which governments track their citizens’ every move.