The countries that have acted quickly to stop the spread of the coronavirus have drawn on their finest technological capabilities to track the movement of their citizens. Israel was one of the first countries in the West to adopt this approach, but the lack of an up-to-date law on protecting the privacy of individuals in the digital era has raised serious doubts among privacy and legal experts – and among large segments of the public – after the Israeli government issued emergency orders granting the Shin Bet security service the authority to track its citizens.
To address the spread of the coronavirus, Prime Minister Benjamin Netanyahu issued emergency regulations last week allowing digital monitoring of coronavirus patients’ cellphones, using means that were not disclosed. He also sought to empower the police to help in enforcing isolation orders. Now the Shin Bet security service is using the technology at its disposal to track the routes that patients have taken outside their homes and to determine whom they have gotten close to.
On Thursday, it was also revealed that the service was also tracking details of all calls made by coronavirus patients. This was disclosed during a special session of the Knesset subcommittee in charge of overseeing intelligence and clandestine services, the first public discussion of the controversial regulations. No reason was given for the necessity of the practice, which will only be disclosed in private by the Shin Bet.
On Tuesday, the High Court of Justice held a hearing on the role of the Shin Bet in tracking coronavirus patients and the people with whom they have come in contact. It appears, however, that the Shin Bet will be able to continue the monitoring activity, subject to approval by the Knesset.
The Israel Privacy Protection Authority was not involved in deliberations on the wording of the emergency orders, but public health authorities argue need outweighs privacy concerns.
- Isolated After Waving at Corona Patient: Is Israeli Phone-tracking Tech Accurate?
- Stop the Shin Bet Surveillance
- Israeli Security Officials Concerned Over 'Terrorist-tracking' Methods on Coronaviru
“In a world of only a few or dozens additional patients a day, we could have used the traditional tool of epidemiological investigation and publish their path for the public. Given the numbers now, the task is impossible,” said Moshe Bar Siman Tov, director general of the Health Ministry, talking by video link, to the subcommittee on Thursday.
Just Israel and China
Rachel Aridor-Hershkovitz and Tehilla Shwartz Altshuler of the Israel Democracy Institute conducted a survey of legislation in Taiwan, South Korea, Singapore, Italy, Germany and China, some of the countries that have used technology to help stem the coronavirus. They found that most of these countries have special up-to-date legislation on the subject of pandemics that includes provisions on the collection of data.
But Israel has never passed similar legislation and the British Mandate-era health directive from 1940 which is being used does not address the issue from a contemporary perspective. The researchers also found that Israel is the only country in the world that is using a secret service agency to track its own population as part of its efforts to curb the virus. In other countries, health authorities administer the means that are employed – including determining the location of cellphones, tracking credit card use, as well as applications which are used voluntarily.
While Italy, Germany, South Korea and Taiwan have strict and up-to-date privacy and data protection laws that meet the standards of the European Union’s General Data Protection Regulation, China, which of course ranks poorly when it comes to democratic rights, has no such law.
Israel has data protection regulations that went into effect in 2018, but they only relate to protection of information and not to data collection and processing. Efforts to revise 1981 privacy legislation to address current technology have come to naught.
Learning from SARS
Over a two-month period, China concealed the severity of its coronavirus outbreak. It was ultimately forced to report in January that it is a virulent and highly contagious disease. After Chinese authorities were initially unable to curb the outbreak, they decided to resort to advanced tracking technology to enforce a closure on 20 districts, as well as isolation for those who contracted the virus. To enforce its isolation policy, China used cell phone tracking and employed face recognition technology that made use of 400 million cameras installed around the country.
The regime in Beijing also required its citizens to download an application and to enter data about the state of their health and other individual details. All of the hundreds of millions of citizens who were required to go into lockdown received a QR matrix barcode. The application assigned the population to one of three categories: those who were freely allowed to move about, those who would be confined to home quarantine for seven days, and those who, along with their families, would be in isolation for 14 days.
Government representatives conducted compulsory inspections of the status of the people’s phone applications as they entered workplaces and other public spaces. According to reports from China, the use of the application was successful in stopping the spread of the pandemic in less than two months, earning praise from the World Health Organization.
East Asian countries have experience with epidemics and pandemics after having faced several serious outbreaks over the past two decades – including SARS, swine flu and bird flu. That is part of the reason that widespread digital localization methods exist in that region but not in Europe. In Italy and Germany, the data generated by tracking activity is stored in a way that makes identifying details of the individuals inaccessible.
Winning Taiwanese and South Korean approaches
The two Israel Democracy Institute researchers described the approach taken in Singapore, which also scores poorly in rankings of democratic freedoms, but which has had success in combating the coronavirus while protecting people’s privacy. The efforts were based on legislation on pandemics that permits the authorities to collect data from citizens. Privacy legislation in Singapore was most recently revised in 2014 and entails that the processing of data about individuals requires their consent.
As in Israel, Singapore has carried out epidemiological studies and made them public. The Health Ministry in Singapore has cross-referenced the information with what was made available by transportation companies, public closed-circuit cameras and phone applications. They launched an application designed to provide a warning that a coronavirus patient was approaching or that a coronavirus test was needed.
Downloading the application was voluntary, it did not monitor people’s whereabouts, and the information collected was not provided to the government. As of Wednesday, Singapore reportedly had 558 coronavirus cases and two deaths.
Taiwan and South Korea took approaches that infringed more on their citizens’ privacy, but that limited the infringement on other fundamental rights, most notably freedom of movement. These countries are ranked higher than Israel by the U.S.-based group Freedom House, and both have current privacy legislation similar to the EU’s General Data Protection Regulation. This legislative preparedness enabled them to use more aggressive tracking methods in an emergency, while still ensuring oversight, information security and limitations on its use.
'We need to think about the day after the coronavirus'
“Studying the countries that used monitoring technologies allows us to create a sort of scale,” said Shwartz Altshuler. “On one side there is China, which conducts invasive monitoring of citizens during regular times. On the other side are Italy and Germany. In Italy, they may have imposed restrictions on citizens’ movement, but the culture of a lack of compliance with government instructions directly contributed to the disaster. Time will tell if the culture in Germany is stricter.”
“The way Taiwan and South Korea dealt with the balance between the need to provide a response to the crisis and the restriction of the rights by tracking citizens was the most impressive,” she added. These countries did not involve their secret services in monitoring because of their modern legislation, which includes oversight and transparency concerning their citizens. For example, citizens were provided with an explanation of what information was collected, for what purpose and when it would be erased, she said.
Safeguarding privacy is not a luxury, even in the time of a pandemic, Shwartz Altshuler said. “Protecting privacy in an emergency situation is not bleeding-heart liberal crying against the saving of lives, but thinking about the day after the coronavirus.”
Two questions that went unanswered during Thursday's Knesset subcommittee's session was whether some people would be exempt of tracking - such as journalists or political activists - and who was actually responsible for making sure the data would be purged after the end of the outbreak.
“The care taken over the transparency in Taiwan and South Korea was critical in creating the public trust required for taking such extreme steps. Here, the characteristics of the Shin Bet – which requires that every document that is connected to it, from regulations and instructions through to reports are classified – does not allow transparency. The oversight of the Shin Bet on the part of the Knesset and courts is relatively narrow, too,” said Shwartz Altshuler.