(Bloomberg) — Contact-tracing apps rolled out by Bahrain, Kuwait and Norway to track the spread of the coronavirus have endangered the privacy and security of hundreds of thousands of people by marking users’ locations in real time, human rights group Amnesty International said.
Bahrain’s “BeAware Bahrain”, Kuwait’s “Shlonik” and Norway’s “Smittestopp” apps stood out as some of “the most alarming mass surveillance tools” in an analysis of 11 apps across Europe, the Middle East and Africa, the group said. The survey was carried out by Amnesty’s Security Lab, which conducts technical investigations into cyber-attacks against civil society.
The three apps frequently capture users’ GPS location data and upload it to a central government database, effectively tracking users’ movements as they happen, Amnesty said. The location information can be easily linked to an individual given that users are required to sign up to the app with a national ID number in Bahrain and Kuwait and with a valid phone number in Norway.
“Bahrain, Kuwait and Norway are running roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified in efforts to tackle Covid-19,” said Claudio Guarnieri, head of Amnesty International’s Security Lab. “These governments must immediately halt the use of such intrusive apps in their current form.”
Representatives for Bahrain and Kuwait didn’t immediately comment late Monday. Amnesty said it notified authorities in the three countries of its findings ahead of publication of the report.
“Downloading the app is completely voluntary. Many people download apps that store sensitive information centrally and that’s used for commercial purposes,” Norway’s Health Minister Bent Hoie said in an email. “‘Smittestopp’ is an app that’s used and owned by society to fight a pandemic.”
Hoie had responded to Amnesty in a letter dated June 12 defending the app, which he said followed the European General Data Protection Regulation as well as local privacy-protection rules and was crucial in fighting the spread of Covid-19 and preventing a longer lockdown.
Still, the Norwegian Institute of Public Health on Monday had already halted the use of its mobile phone tool and deleted all the data it had collected after the country’s data protection authority warned it would temporarily ban the processing of personal information associated with the app.
The Norwegian watchdog also questioned how useful the app is given its low usage and also warned that pairing Bluetooth technology for contact detection with location data for analysis went too far.
Hoie said in the letter that the public health authorities were investigating some of the issues that Amnesty had brought up and had reduced the amount of time data would be stored to 10 days from 30.
Amnesty said both the Bahraini and Kuwaiti apps can pair with a Bluetooth bracelet used to enforce quarantine measures by ensuring the user remains near their phone. The Kuwait app regularly checks the distance between the bracelet and the device, uploading location data every 10 minutes to a central server, the group said. In Bahrain, users registered for home quarantine who don’t wear the bracelet face fines or imprisonment, it added.
Governments around the world have developed mobile apps to trace possible infections of the coronavirus, alerting users when they may have been near someone infectious. Authorities say the tools can help track and contain any resurgent outbreaks of the virus.
But since their inception, contact-tracing apps have raised concerns about their potential to infringe on people’s rights to privacy by collecting sensitive data about location, health and information about who people interact with.
Read more: Coronavirus Newsletter: Protecting Privacy in a Pandemic
Amnesty said it chose not to analyze apps that are based on a decentralized system, which is supported by a joint tool developed by Apple Inc. and Alphabet Inc.’s Google. It said such apps, which store data on people’s phones instead of on government servers, tend to be less concerning from a privacy perspective.
(Adds Norway’s response to Amnesty International starting in the sixth paragraph)
<p class="canvas-atom canvas-text Mb(1.0em) Mb(0)–sm Mt(0.8em)–sm" type="text" content="For more articles like this, please visit us at bloomberg.com” data-reactid=”39″>For more articles like this, please visit us at bloomberg.com
<p class="canvas-atom canvas-text Mb(1.0em) Mb(0)–sm Mt(0.8em)–sm" type="text" content="Subscribe now to stay ahead with the most trusted business news source.” data-reactid=”40″>Subscribe now to stay ahead with the most trusted business news source.
©2020 Bloomberg L.P.
Add Comment