Extensive surveillance measures introduced around the world during the coronavirus outbreak have widened and become entrenched, digital rights experts have said, three months after the World Health Organization declared a pandemic.
The measures have often been billed as temporary necessities rushed into place to help track infections, but governments have been accused of denting civil rights with the widespread use of techniques such as phone monitoring, contact tracing apps, and physical surveillance such as CCTV with facial recognition.
Top10VPN, a pro-digital privacy website that reviews secure internet connection software, has maintained a database since March of digital and physical surveillance measures implemented to fight the virus.
As of Wednesday, it showed digital tracking was in use in 35 countries, with contact tracing apps in at least 28 countries, half of which use GPS location data. Meanwhile, more than half of the apps do not disclose how long users’ data is stored.
“The number of countries using digital tracking and physical surveillance technologies has steadily risen,” said Samuel Woodhams, the website’s digital rights lead. “There are few countries on Earth that haven’t implemented increased surveillance during the pandemic.”
Israel’s government was one of the first to introduce controversial phone tracking when it directed the country’s secretive internal security agency in March to monitor the mobile phones of people suspected or confirmed to have been infected.
Security services stopped the tracking this month, but by then, a dangerous precedent had already been set, said Tehilla Shwartz Altshuler, an expert on privacy issues at the Israel Democracy Institute thinktank.
“It does not mean, God forbid, if we do face a second wave, they’re not going to reuse it,” she said.
Shwartz Altshuler has been comparing responses to the pandemic around the world. At one end of the scale, she places several European countries such as Germany and Italy, which she said had been restricted by how deeply they could track citizens, in large part because of the EU General Data Protection Regulation (GDPR).
Israel’s approach of centralised spying was more akin to that of China, she said, where a surveillance dragnet has escalated domestic spying in the name of containing the outbreak.
“I can understand the decision-making process that was done in Israel, but I cannot justify it,” she said. “Hundreds of thousands of people moves were tracked by the secret service, which is really unheard of.”
Other countries have focused on asking – or in some cases demanding – citizens to download contact tracing apps.
A state-built app in India, called Aarogya Setu and downloaded by more than 100 million people, has led to fierce criticism. It uses both Bluetooth and GPS, and is mandatory for all government employees to download.
Amnesty International said on Tuesday that its Security Lab investigation team had reviewed contact tracing apps from Europe, the Middle East and North Africa and found those in Bahrain, Kuwait and Norway to be some of most invasive in the world. All three used live or near-live tracking of users’ locations by frequently uploading GPS coordinates to a central server, the rights group said.
Norway announced on Monday that it had suspended its app. Amnesty said it had shared its findings with the government earlier this month.
While the rights group said contract tracing apps could form part of an effective pandemic response, Rasha Abdul-Rahim, deputy director of Amnesty Tech, said some governments were rushing them out without properly considering their impact on human rights.
She said: “As we learned from the attacks of 11 September 2001, states are extremely reluctant to reign in new, invasive surveillance powers once they’ve been established.”
Qatar has continued to make a Covid-19 tracing app mandatory even as the kingdom has relaxed its lockdown, and despite security loopholes that exposed the personal information of more than a million users. Being caught outside without a phone carrying the app is punishable by a fine of up to £43,000 or up to three years in jail.
In Hangzhou, a Chinese city of 10 million people, authorities announced last month that they would seek to expand their coronavirus app to gather more comprehensive health and personal data.
Under the proposal, an individual’s status would be colour-coded and scored out of 100 based on medical records as well as other lifestyle choices such as smoking, drinking alcohol, or hours slept.
International advocacy group Human Rights Watch has warned about reports that authorities in Russia were considering introducing an app that migrant workers would have to download when they entered the country.
“If this app does actually come into being, it could wreak serious harm,” said Russia researcher Damelya Aitkhozhina. “[It’s] hard to imagine that the app would meet the standard needed to justify the blanket intrusion into privacy.”
In other countries, there have been attempts to use surveillance while limiting its encroachment on privacy, although it is not clear to what extent that was possible.
France has been testing AI tools with security cameras in the Paris Métro system and buses in Cannes to check whether passengers were wearing face masks. While the software has raised domestic concerns from privacy watchdogs, the French tech company Datakalab said its product complied with GDPR.
The technology does not store or disseminate images, the company said, and its goal is not to identify individuals breaking the rules. Instead, it seeks to help authorities anticipate future outbreaks based on the percentages of people wearing masks.
In South Korea, one of the first countries to use contact tracing, including credit card transaction histories, the government has begun using electronic wristbands.
Authorities initially wanted to place the bracelets on tens of thousands of people who were self-isolating, prompting the Korean Bar Association to point out that they could infringe on people’s constitutional rights. In response, the government agreed to use the gadgets only on people who had broken quarantine, and only with their consent.
Abdul-Rahim said government measures must be kept under scrutiny and pressure.
Otherwise, she said, “we risk sleepwalking into a permanent new era of total surveillance, particularly as governments are seeing contact tracing apps as a way to ease lockdown restrictions”.