Civil liberties under threat from ‘covtech’ surveillance apps

Poland has become the first European country to activate a smart phone app that allows police to check if a person is respecting the Covid-19 quarantine.

The app, Home Quarantine, was launched on 24 March. Developed by private company TakeTask for the Ministry of Digitisation, it is a free app downloadable from GooglePlay at the App Store.

For the moment, the app is targeted at people forced to remain in isolation, either because they have come to Poland from another country or because they have been in contact with an infected person. It is not known whether it will also be used to track Covid-19 patients in quarantine.

When a person arrives in Poland from abroad – at an airport, train station or motorway border – they receive a card, with their quarantine address for fourteen days and a residence permit. This document explains how the Home Quarantine app works: every day at random unscheduled times the person receives a request from the app to send it at least one selfie – a photo of themselves at home. The app may, however, ask for more than one selfie per day.

If within twenty minutes of sending the message, the required photograph has not been sent, complete with the sender’s geolocation, an alarm is triggered and the police can visit the registered house to check the resident is abiding by the regulations. People who fail to respect the rules of confinement face a fine of €6,500.

If within twenty minutes of sending the message, the required photograph has not been sent, complete with the sender’s geolocation, an alarm is triggered and the police can visit the registered house

Within two days Home Quarantine had registered 3,000 people. The question now being asked in Poland is what will TakeTask, a private corporation, do with all the data it is collecting on people? Once the coronavirus crisis is over will the data be deleted? Or will they follow other tech companies and use it to target people with advertising?

Tomasz Zielinski, a professional programmer who specialises in working for public institutions, warns that the source code analysis for Home Quarantine is controversial, because – ‘One should only wonder – if the rush wasn’t too great – the presence of Facebook libraries in the application issued by the government is, however, a strong clash.’ The Polish Government has already replied to Zielinski’s blog, stating that ‘The redundant code was removed with one of the last application updates.’

This downloadable app is raising big questions for civil liberties in Poland: How will fundamental rights be guaranteed by the Polish police? A question made even more urgent by the Kaczynski regime’s lack of respect for the rule of law.

But this is not just happening in Poland, all over Europe there is a race to find an app to identify Covid-19 sufferers and prevent contagion. In Germany, one of the strictest countries when it comes to the defence of privacy, there is a heated debate on whether to change the rules on data protection and ‘follow Covid-19 patients.

German Health Minister Jens Spahn prepared a bill to amend the Infection Protection Act, but then withdrew it (for now), in the face of the hostility from the majority of the government.

In the meantime, the Robert Koch Institute, a top authority on crisis management, is working on an app with the Heinrich Hertz Institute. This app aims to make it possible to ‘record the proximity and duration of contacts between people in the last two weeks and store them anonymously on mobile phones,’ stated a spokeswoman for the Hertz Institute.

This app aims to make it possible to ‘record the proximity and duration of contacts between people in the last two weeks and store them anonymously on mobile phones

The giant Deutsche Telecom has been working with the Koch Institute for several weeks. In Germany, information on people’s movements is provided anonymously. So far, 46 million Germans have been tracked.  This is similar to Lombardy, Italy, where telephone companies can track the movements of the general population, but not trace specific individuals.

As the crisis deepens in Spain, authorities there are also taking this path. Prime Minister Sanchez has asked for work to be done on an algorithm which could identify groups of people in the same place and trigger an alarm. Such a device already exists in Switzerland: if 20 smartphones are geolocated in the same public space of at least 100 square metres an alarm will be triggered.

These developments show how the circle of our privacy is shrinking, but these apps are still not focused on gathering information about people’s health status.

Several start-ups in France are working on ways of specifically gathering health data – after President Macron called for them to work closely with the Pasteur Institute. In France, the aim is to follow – on a voluntary basis – Covid-19 patients to check whether they comply with confinement rules. With apps able to identify other patients nearby.

“If a person declares being infected in the application, the algorithm will track down all the people with whom he has been in contact, they will receive a message that they are potentially carriers of the disease asking them to immediately go in quarantine and the chain is broken,” explains Christophe Mollet, director of the ITSS agency that developed the CornAPP programme. ITSS have submitted a proposal to the French Ministry of Defence, which launched a €10 million tender to be spent on innovation against Covid-19.

In the United Kingdom, the National Health Service (NHS) is working closely with Oxford’s John Radcliffe Hospital on an app to trace infected people. Oxford researchers are looking at ways of producing an app while at the same time protecting fundamental civil liberties.

Investigate Europe contacted the office of Dr David Bonsall, senior researcher at Oxford’s Nuffield Department of Medicine and clinician at Oxford’s John Radcliffe Hospital: “If a user agrees to share data and in return receives personalised health information that keeps them, their family and vulnerable people safe, in doing so it helps us all to save lives.”

“There are a number of ways of encrypting mobile data that are tried and tested,” Dr Bonsall said. “Our suggestion is that the person receiving an alert, telling them they’ve been exposed to someone with coronavirus, will not be informed of that person’s identity.”

The Oxford team has shared its results with the governments of Norway, Iceland and France. But Dr Bonsall warns: “To work, this approach needs to be integrated into a national programme, not developed by independent app developers.”

Indeed, these algorithms can only work if people know if they are infected, so tests should be increased massively into the population in the coming weeks. The UK is also reporting a rise in Covid-19 related cyber-crime with people being warned against downloading symptom-tracker apps.

When Italy offered a €2.5million Covid-19 tech tender, 170 companies sent in proposals. Guarantees of privacy are off the table, however, with the Italian Government stating that in a national emergency privacy rules can be ‘frozen’ for a limited period.

Frozen privacy rules are reminiscent of the situation in South Korea, where technological surveillance is being widely used to combat Covid-19. It is also reminiscent of day-to-day life in China, where telephone companies (all public) sell phones with the personal geolocation already active.

Guarantees of privacy are off the table, however, with the Italian Government stating that in a national emergency privacy rules can be ‘frozen’ for a limited period.

In China, the all-encompassing , ‘big brother’ of the Chinese Communist Party  knows who has been sick, when they leave their house, and who they meet with. In Europe it will be necessary to break down legislative walls and decades of jurisprudence in defence of personal freedoms and the right to privacy and not to declare one’s own diseases. But in order speed the pass of the corona virus storm, governments are ready, for a limited period, to renounce respect for privacy.

Yet the General Data Protection Regulation (GDPR), Europe’s privacy code is clear: spreading information on citizen’s health is prohibited (art.9). But there are exceptions: for reasons of public health and national emergency and under special laws for a limited time. The door is therefore open for methods used in China.

What we need to know is whether this renouncement of our civil liberties will be repealed. Answers from our shared history are not encouraging, in France for example, November 1, 2017 was the day the French Parliament transformed the extraordinary measures instituted after the Bataclan attacks into ordinary law, creating a ‘permanent state of emergency.’

Click here for more Covid-19 reporting from Investigate Europe

Click here for a list of app Covid-19 already used in the world

Investigate Europe’s Covid-19 graph

Click here for Investigate Europe’s graph based on hourly updated data from Johns Hopkins University. This unique graph has been developed by Investigate Europe in order to aid research and a greater understanding of the situation we face in Europe.