2021-01-04: CNA: Singapore Police Force can obtain TraceTogether data for criminal investigations: Desmond Tan

Surprised Pikachu

On June 8 2020, the Government announced that TraceTogether tokens would be distributed to segments of the Singapore population to bolster contact tracing efforts. The public’s response was swift and a certain Wilson Low even started a petition to suspend the development of the token, garnering over 54,000 signatures at present. Vivian Balakrishnan, the minister in charge of the Smart Nation project, had to come forward to publicly clarify on the token’s supposed intentions and capabilities.

He clarified that the app & token program was to be on a voluntary basis.

Yet, here we are, less than 5 months after the initial announcement and resulting backlash, the Government has made it mandatory to check-in with the TraceTogether app or token at all public venues in Singapore, including restaurants, workplaces, schools and shopping malls, by the end of December.

This news is setting a very dangerous precedent for the privacy and data security of all Singaporeans. There is hardly any legislation to ensure that this data will not be abused, mishandled, or breached.

I believe Dr Balakrishnan, quoting from the article:

Addressing privacy concerns that have surfaced, Dr Balakrishnan said: “So here’s where I need to emphasise, and repeatedly emphasise, it is not a tracking device. It is not an electronic tag as some Internet commentaries have fretted about. In particular, and here to be technical, there is no GPS chip on the device. There isn’t even any Internet or mobile telephone connectivity.”

Without a GPS chip, the device cannot track an individual’s location and movements. Without Internet connectivity, there is “no possibility” of data being uploaded “without the participation and consent of the user”, said the minister.

Like the TraceTogether app, the device only captures Bluetooth proximity data, he added.

“And that data never leaves the device or the phone. It is encrypted. It is stored for up to 25 days and automatically deleted.”

If not Dr Balakrishnan, GovTech Singapore likewise invited four members of the community on 19 June 2020, to come and inspect the TraceTogether token in question. one of them even did a teardown of the token.

However, the ability for real time tracking does not even have to be implemented on the token itself. The Government, in this hypothetical scenario, can simply have their own devices that work in a similar fashion, placed at any physical location, without the knowledge of the members of the public.

With it being made mandatory, anyone walking by with the device will and can automatically be recorded. The Government’s own devices which CAN be connected back to their network. With enough of such devices, the Government will then have the ability to precisely identify and track in real time on any device holder’s movement.

The Government doesn’t even have to be doing this covertly, with a simple change in legislation, the Government can use the data collected for any purpose with any justification. This is notably already happening in the UK.

Already today, if you dare tell your family and friends that you aren’t installing the TraceTogether app or collecting the token out of privacy concerns, no doubt some will tell you that you are being selfish and it is a trivial sacrifice to stop the pandemic.

Once acceptance of the tracking tokens is normalised, there really is nothing stopping the enhancement of the token’s current tracking ability, or the development of more capable tracking devices in the future.

Never let a good crisis go to waste.