Singapore says contact tracing data may be used for criminal investigations

https://www.channelnewsasia.com/news/singapore/singapore-police-force-can-obtain-tracetogether-data-covid-19-13889914

by acekingspade • 6 years ago

146 137 6 years ago

channelnewsasia.com

ainiriand• 6 years ago

It should say 'contact' instead of contract.

acekingspade2• 6 years ago

Thanks. Fixed.

wyxuan• 6 years ago

According to this article (https://www.bbc.com/news/technology-53146360) the Singapore contact tracing app works the same way the iOS and Android do, so no location tracking.

From my read of the situation, there is some worry that activists might be cracked down upon.

acekingspade2• 6 years ago

The difference is that Apple/Google contact tracing gives the user control over their data. Singapore's app works differently. Once someone's app picks up your signal, it's logged on their device and there's no way to delete it. The data is handed over to the authorities who have a list of everyone that they interacted with. Source: https://www.straitstimes.com/singapore/apple-google-contact-...

ValentineC7• 6 years ago

Once someone's app picks up your signal, it's logged on their device and there's no way to delete it.

Unless they've changed the schema, it should be just a SQLite database [1].

Most people with some competence at app development should be able to access the data file on their (Android) phones, and delete any rows which might prove troublesome.

They could also just uninstall the app and wipe all data if they want.

[1] https://medium.com/@frankvolkel/tracetogether-under-the-hood...

howlgarnish2• 6 years ago

Activists are already cracked down plenty. Here's one currently under criminal investigation for holding up a sign with a smiley face (and nothing else) on it:

https://www.bbc.com/news/world-asia-55068007

ignoramous2• 6 years ago

Singapore is a surveillance state. Don't be fooled by its corporate friendliness and general societal progress.

The government is every bit authoritarian which at this point increasingly looks like a euphemism for totalitarian.

https://www.aristeon.net/2019/04/singapore-as-pioneer-of-cap...

mparramon• 6 years ago

Singapore’s parliamentary political system has been dominated by the ruling People’s Action Party (PAP) and the family of current prime minister Lee Hsien Loong since 1959. The electoral and legal framework that the PAP has constructed allows for some political pluralism, but it constrains the growth of credible opposition parties and limits freedoms of expression, assembly, and association.

https://freedomhouse.org/country/singapore/freedom-world/202...

jesterson6• 6 years ago

Corporate friendliness is not a disguise. It's needed to sustain the surveillance state cashflow.

As for general societal progress, I am really not sure what are you talking about. There is no progress whatsoever.

ekianjo2• 6 years ago

There is no progress whatsoever.

Economic progress is a thing. https://www.worldbank.org/en/country/singapore/overview

Singapore is a high-income economy with a gross national income of US$54,530 per capita, as of 2017. The country provides one of the world’s most business-friendly regulatory environment for local entrepreneurs and is ranked among the world’s most competitive economies.
In the decades after independence, Singapore rapidly developed from a low-income country to a high-income country. GDP growth in the city-state has been amongst the world’s highest, at an average of 7.7% since independence and topping 9.2% in the first 25 years.

gbtw• 6 years ago

And this article written by William Gibson is still relevant all these years later: https://en.wikipedia.org/wiki/Disneyland_with_the_Death_Pena...

iridium_core• 6 years ago

Singapore also has one of the lowest fertility rates in the world, at only 1.16 children per woman. Living in a controlled and apartment-dominated country seems to crush the desire and ability to have many children.

jariel2• 6 years ago

So general societal progress and their control of covid is evil?

The 'tracking for criminal cases' is clearly a 'bad thing' but ... it's also legit democracy with excellent universal healthcare and rule of law.

... careful with the easy characterizations.

half0wl• 6 years ago

Any perceived "societal progress" comes at a (heavy) cost of personal liberties; the Singapore government have always "preferred" the former.

it's also legit democracy

If your interpretation of a democracy boils down to mere voting rights and choice, then sure, it's legit. But I think we should also consider the trickle-down effects of having the same party in power ever since the government was formed. Your ethics, beliefs, judgment, and mentality determines how you vote - it's not that hard to sway the majority to your side if you are always in total control of how lives are shaped across generations.

bigiain2• 6 years ago

Singapore is a surveillance state.

And the Australian Covid tracing app is a copy/paste from the public open sourced github repo the Singapore government shared.

I guess being part of FiveEyes makes any fantasy of me _not_ living in a surveillance state pretty lame...

asiando• 6 years ago

Having an app per country was unnecessary to begin with. All that Google and Apple had to do is supply the UI and accept government requests to enable the system in their country.

ValentineC7• 6 years ago

And the Australian Covid tracing app is a copy/paste from the public open sourced github repo the Singapore government shared.

The GitHub repo has a "reference" implementation of the published BlueTrace protocol [1].

Encryption keys aside, it's not possible to reproduce the Singapore TraceTogether builds currently released on both the iOS and Google App stores.

[1] https://bluetrace.io/

jesterson6• 6 years ago

That was expected from the very beginning. Government will collect as much data as possible citing medical reasons and then use the data as it pleases saying since we collect, we are free to use as we want (citing again some blah-blah about public benefits).

What's surprising is that they disclose it. Perhaps he just wasnt prepared for the question

powerapple• 6 years ago

You have some data in the hands of any government, and once you have a judge's approval, the data will be obtained by the authority regardless where you are. It makes sense that the data should be stored on your devices only. If a criminal is caught with his phone, the data can still be obtained by the police (the same as phone records for example), and it can still be useful for criminal investigation, and normal citizen don't have to worry about their data. It is actually achievable with Google and Apple's approach.

And I think it was a genuine answer. This is a reply to MP, not a random reporter on streets.

jesterson6• 6 years ago

I believe you're missing the point.

At first, they explain the information is collected solely for medical reasons. Now they say they can use it as they please. Don't you see fallacy here?

I am sure it was a genuine answer - that's why I was surprised. Usually those things are sugar covered.

kasperni4• 6 years ago

Government will collect as much data as possible citing medical reasons and then use the data as it pleases saying since we collect

Some governments... We don't all live in a surveillance state.

jesterson6• 6 years ago

While I do agree with the correction - thank you, unfortunately this is applicable to certain extend to any government in developed world. Especially since the whole COVID madness started.

coldtea6• 6 years ago

You'd be surprised.

Where do you leave that's not a surveillance state?

throwaw9995• 6 years ago

I'd be happy to learn which governments in your opinion wouldn't abuse such power.

PikachuEXE• 6 years ago

Everything is permitted...

Without a system that gives strong enough negative feedbacks to this kind of "usage", they will never go away.

Lack of negative feedback can be seen as a kind of positive feedback too.

malka4• 6 years ago

Surprising. It seems usually a bad idea to trust a government.

kasperni4• 6 years ago

That really depends on where you are in the world.

tehlike2• 6 years ago

Not really. It might be good now, but no guarantees that it will stay that way. Principle of least privilege and data should be the norm but sadly it never is.

postingpals• 6 years ago

The alternative is trusting corporations, who also give your data to the government. Who do you trust with power then?

malka4• 6 years ago

Me. My wife.

poxwole• 6 years ago

Singapore is anyway a totalitarian state, Lee Kuan Yew was basically a "benevolent" dictator, if there is such a thing.

kmlx• 6 years ago

true, but he did "create" an extraordinary city state.

coldtea6• 6 years ago

If it wasn't convenient for many players (from western to asian neighbors) to have a neutral tax-haven state in the area, it would have ended up like any small Asian/African/Latin American state.

mrkwse• 6 years ago

I always recall William Gibson's description of the city-state as 'Disneyland with the Death Penalty'.

The accompanying 1993 article for those who haven't seen it previously: https://www.wired.com/1993/04/gibson-2/

k3nt0456• 6 years ago

It wouldn't be a post about Singapore without someone bringing up the 27 year old article

nomay• 6 years ago

The country is designed for elites, and it's not shy about it.

pydry• 6 years ago

Singapore has democratic pressure points than it looks, and that's largely the reason why LKY acted "benevolently" where he did. He was essentially forced to. He was still a thug.

Firstly the fact that the leaders and all the population are squashed up against one another exerts a massive influence on the government. They're much more vulnerable to protest than other governments because they can't hide as easily. This makes them much more nervous and more willing to placate the populace than the government in, say, Myanmar, is.

Secondly they were competing with as well as trying to crush the communist Party. LKY co-opted a lot of their policies as well as trying to crush them. Note the essentially Soviet style housing and various effective social security systems. These were popular. This is a pattern that they have followed since (crush the opposition, steal their policies) and it helped fix their schooling system by bringing down class sizes in the 90s. Is that democracy? Kind of.

Singapore isn't proof that if you get the right dictator he can be benevolent. It's proof that the will of the people can be exerted through means other than the ballot box and that even a thug can do the right thing if he lives in fear.

ValentineC7• 6 years ago

Firstly the fact that the leaders and all the population are squashed up against one another exerts a massive influence on the government. They're much more vulnerable to protest than other governments because they can't hide as easily. This makes them much more nervous and more willing to placate the populace than the government in, say, Myanmar, is.

Singaporean here. They've done well in the 55 years we've been around to make sure that people don't protest — people here value wealth and personal comfort over the thought of going to jail for their freedoms.

Even a solo person holding up a smiley face might get charged and indicted for an "assembly" in Singapore: https://www.bbc.com/news/world-asia-55068007

jbergler• 6 years ago

The New Zealand app is local storage only (at least that’s how it’s marketed, I’m not sure if this has been validated by a third party)

https://www.health.govt.nz/our-work/diseases-and-conditions/...

throwaw9995• 6 years ago

And how would you know if there was a backdoor that allows the government to pull anyone's data? Even if the app is validated by reliable third party in current version, there's no mechanism stopping a malicious update in few months.

Once it's mandatory to have such app it's game over. Doesn't matter what algorithm is being used, doesn't matter who developed it. It's insanely easy to abuse this. The government will simply deny there's any sort of backdoor and gaslight people who say otherwise.

blackrock• 6 years ago

Well, according to Google’s former CEO, Eric Schmidt: If you have nothing to hide, then you don’t need to worry about your privacy.

Edit: I’m getting downvoted. But I wrote this as a warning: that if you don’t value your privacy, then others, will make sure that you have no privacy.

gonehome12• 6 years ago

One thing that drives me crazy about this is that Apple and Google partnered to come up with a brilliant Bluetooth solution to contact tracing right at the beginning of the pandemic.

It was privacy first, well designed, and it works.

It was hamstrung by being opt-in instead of opt-out, relying on state level cooperation and misunderstood by people who didn’t even attempt to try to understand it (including here on HN).

As a result you now see dumber, less effective, less privacy conscious contact tracing in effect or governments relying on data brokers (all the other apps that collect and resell your data to third parties and are not opt-out).

It’s a shame.

https://www.apple.com/newsroom/2020/04/apple-and-google-part...

https://covid19.apple.com/contacttracing

verroq5• 6 years ago

Google and Apple will happily deliver all your information to the government when it becomes their legal obligation.

Are we so naive to believe that if only we adopted their “privacy conscious” solution, there won’t be less privacy focused solutions preferred by the government? Or that their solution won’t be forced to change to meet their legal requirements?

gonehome12• 6 years ago

“ misunderstood by people who didn’t even attempt to try to understand it (including here on HN).”

Your comment is case-in-point the kind of knee-jerk response that I was talking about.

Edit: You added the second part after I’d already responded. They developed a good model to do large scale contact tracing in a privacy conscious way. People rejected this with vague suggestions like your comment about how it could be changed to be the opposite of what they’ve developed. Most people didn’t understand how it worked at all or why the design was good.

As a result, worse less-privacy preserving methods are used.

kypro• 6 years ago

I personally refuse to use any contact tracing because an envitible consequence of its adoption is the idea that mass surveillance is legitimate so long as it can be argued it's keeping people safe.

Tech like this is always abused by governments. Just look at how governments are attacking encrypted messaging services today. It would be naive to think same thing wouldn't happen for any popular privacy-first contact tracing app.

gonehome12• 6 years ago

Your comment is another example of dismissing what they did without understanding it.

As a result of this we now have less effective, higher privacy risk implementations in place.

yegle• 6 years ago

To me, anyone who work in tech and dismisses the Exposure Notification framework as "surveillance" is no different from an anti-vaxxer.

The app does 3 things on your phone: 1) continuously exchange Temporary Exposure Keys with other phones with EN enabled, and 2) periodically download a list of TEKs, compare to locally cached list of TEKs to determine if you were in close contact with a COVID positive patient, and 3) in the unlikely event when you are tested positive, work with your Health Authority, use a one-time code to upload your TEKs to the key server.

If you are really paranoid, you can do 1 and 2 with just a battery powered Raspberry Pi Zero (someone has done that and was previously posted to HN but can't find it right now) which should be net beneficial to you. But if you just don't understand this framework please stop spreading FUD.

zachberger• 6 years ago

I agree. I'm visiting Thailand and the locally developed app requires high precision location permissions, the app is constantly running, and the data is all tied to my passport number. It destroys my battery, and it's a complete privacy invasion.

sneak• 6 years ago

We had a lot of other existing technology, like simple face masks, that could have been deployed against the spread of the pandemic as well.

It is almost a case study on how you can't solve problems that are fundamentally social ones by throwing technology (old or new) at the problem.

You're absolutely right that it's a shame.

gonehome12• 6 years ago

Yes - I agree, we need both.

Sane policy and competent people to prioritize policy in order to lead effectively and move what needs to happen forward (massive categorical failure in the US on this bit, both in government and initial media response to the virus).

We also need the technical solution to consider privacy risk in the initial design so that we don’t implement something that can be abused later for other purposes.

This second part we have and it’s a great solution, but without the policy/leadership piece we can’t leverage it.

dirtyid• 6 years ago

Exposure notification is not contact tracing. Questionable if effective contact tracing on mass scale without privacy violation is possible. At least Singapore contact trace and enforcement chain worked. Worse, A&G hubris in their solution and lack of cooperation with governments that wanted a proper contact trace solution bordered on insolence has caused preventable deaths. The fact that two platform owners could prevent the rest of the world from mounting proper epidemic responses is terrifying. Even more so if it's just a handful of employees dictating their culture to the rest of the world.

avh023• 6 years ago

With enough responsible people and critical mass, exposure notification and contact tracing are ideally equivalent at their objective. Unfortunately though, people aren't responsible

throwaw9995• 6 years ago

It's really optimistic to think mass rollout of Apple/Google protocol wouldn't be abused. Once government makes it compulsory to use such app in some scenarios (and society actually agrees to do that instead of protesting it en masse) it's over. There's nothing fundamentally stopping government from later changing the technical mechanism ("Please install our national app; it's more trustworthy than foreign megacorps"). Good percentage of society is not technical literate enough to differentiate between "brilliant Bluetooth solution" and "dumber contact tracing relying on data brokers"; for many people that's just implementation detail on the same level as new UI.

gonehome12• 6 years ago

Apple/Google pushing their specific privacy preserving implementation of exposure notifications out via an OS update is not the same as a government mandating surveillance app installs.

The existence of the first does not lead to the second.

tomatocracy2• 6 years ago

The API/protocol is a good way of implementing the idea in a privacy-friendly way although I think everyone should have been clear that it is not as private as simply disabling Bluetooth or not carrying a phone. It is pretty benign. But being honest about that is important if for no other reason than to build trust.

However, the apps built on top of the API have (at least in some instances) clearly fallen victim of scope creep - eg the UK app came with venue check-in functionality (which then suddenly became legally mandated and there was no separate check-in app so you were out of luck if your phone didn't support the API or you didn't want to enable Bluetooth) and a function which tells you how "risky" your postcode is which you can't switch off. There was even brief talk about it being extended to include "vaccine passport" type functionality.

This was, sadly, predictable, and is why many people simply won't trust it.

The other issue with the app-based approach is that it sadly appears to be pretty useless. At least the UK app appears to notify for far too many contacts, large numbers of which are false alarms of one sort or another (neighbours, people sat in different offices, etc). While using Bluetooth proximity was a good idea, I think it's fair to say at this point that in the real world it just hasn't worked.

gonehome12• 6 years ago

I agree with you that relying on state/country cooperation to build the apps was part of the problem.

I don’t agree that it’s useless, 15min of close proximity to a confirmed positive COVID patient within the timeframe is the best possible determination of exposure and people should quarantine if they get it.

I could be persuaded that too many are notified if there’s decent evidence of it, but with the massive case load/spread in the UK right now - I’m more likely to suspect that amount of people exposed is massive.

roenxi• 6 years ago

Meh. If the Singaporian government thinks the police force should have contact tracing information then the police force shall have it. How v1 of an app was designed doesn't matter. Either Google folds and changes the design to suit or they move to a new app provider.

If it is acceptable to use the data for contract tracing for, what exactly is the argument that the government should be using data for contract tracing but not other law enforcement? I can imagine a few arguments, but they all seem weak. The contract-tracing-by-app can of worms shouldnh't have been opened.

gonehome12• 6 years ago

I don’t disagree, Singapore specifically leans a little authoritarian and doesn’t really care about the privacy preservation. I was thinking more for countries that have stronger privacy protections or culture around individual rights.

In those countries a lot of people dismissed the Google/Apple approach without understanding it which lead to a privacy worse approach that’s also less effective.

bijant• 6 years ago

I don’t disagree with the criticism of it being opt-in but I would go further: Apple and Google took months to roll out their framework, they certainly didn‘t prioritize it enough. They are the only parties in a position to implement digital contact tracing natively and they failed us. With great power comes great responsibility. No start-up or government has the ability to implement a low-level cross-platform contact tracing api. As of Today Apple still has not enabled their framework on iOS <= 12 devices even though there are countless people using devices that can not be updated to the current iOS. They have previously provided critical security updates for out-of-support versions of their OS. Why did they not do the same for the contact tracing framework?

djbebs• 6 years ago

Same in germany

throwaw9995• 6 years ago

Can't wait until few years down we learn this data has been abused to harass political opponents in some way. Or when someone runs experiment to pull everyone's data and use ML to predict crimes (Minority Report style). It's done, we are never escaping the "sanitary" regime (just as we never got back to world pre-2001 despite extensive war on terror).

867-5309• 6 years ago

sort of related, but there is an open database over at WiGLE.net which has WiFi and Bluetooth MAC addresses stored with timestamps and GPS coordinates

so, if you were within range of a device scanning wireless bands at a certain time in a certain place, light forensic analysis of your phone, wearables, car, etc. could place you in the vicinity of a crime with up to dozens of times the resolution of mobile network tracking

you bought the burner phone, the burner SIM card, disposed of them by ..burning, but drat! that blasted Fitbit got you fingered

and that's just one example of open involuntary surveillance. scanners can be small, cheap and housed anywhere with minimal electrical power. in urban areas it would be trivial to track permanently and store indefinitely someone's minute-by-minute position, especially in conjunction with known CCTV blindspots

Singapore says contact tracing data may be used for criminal investigations

Related Stories