TraceTogether
TraceTogether was a digital system implemented by the Government of Singapore to facilitate contact tracing efforts in response to the COVID-19 pandemic in Singapore. The main goal was a quick identification of persons who may have come into close contact with anyone who has tested positive for COVID-19. The system helps in identifying contacts such as strangers encountered in public one would not otherwise be able to identify or remember. Together with SafeEntry, it allows the identification of specific locations where a spread between close contacts may occur.
Developer(s)
- Kotlin (Android)
- Swift (iOS)
Bengali, Burmese, Chinese, English, Hindi, Malay, Tamil, Thai
www
Released on 20 March 2020, the system initially consisted only of an app by the same name.[1] However, this was later supplemented by a physical token mainly intended for elderly and children who may not own a smartphone, or those who prefer not to use the app. The app was the first main COVID-19 tracking app released in the world and its development encouraged the development of similar apps in other countries.[2]
The app has raised significant concerns about the privacy of those who use the app, especially due to a lack of decentralised report processing and access to the data by police. However, the app states it has several features to ensure users' privacy, such as regularly rotating users' IDs and storing limited data. Despite the concerns over privacy, the app was slowly adopted by the population of the Singapore, eventually reaching a 92% adoption rate in May 2021.[3] The app was now mandated for specific groups of people and those attempting to enter certain venues and events.
On 9 February 2023, the system was deactivated after the authorities determined that the system was no longer required and closed down on 10 January 2024.
Scale back and deactivation[edit]
With the easing of the Covid Omicron wave, the Disease Outbreak Response System Condition was lowered from orange state to yellow state on 26 April 2022.[65] Additionally, the usage of TraceTogether system would be limited to large events with 500 participants, food and beverages outlets, and nightlife entertainment establishments with dancing facilities.[66]
The distribution of the tokens was scaled back from 1 July 2022 as the demand for the token fell.[67] On 9 February 2023, authorities announced that the system was no longer required.[68] The public was encouraged to return the tokens at the community centres in a month-long exercise from 13 February 2023. The TraceTogether app (as well as SafeEntry app) could be uninstalled from handphones as well. Authorities had also announced that the data collected through the system was deleted from their servers.[69]
The BlueTrace protocol is designed to preserve the privacy of users,[70] but in contrast to other implementations, the TraceTogether app is not anonymous as participants have to register using their phone number and national registration number or other evidence of residency.
To safeguard participant's mutual privacy and ensuring their control over the data, TraceTogether states that it:[71]
The main privacy concern relating to the BlueTrace protocol is due to the use of centralised report processing, in which a user must upload their entire contact log to a health authority administered server. This is in contradistinction to decentralised report processing protocols such as the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) protocol.
In Parliament on 2 February 2021, it was revealed that the police could request the data after 25 days under certain unspecified exceptions.[74][75]
Controversy over police access[edit]
Access under the Criminal Procedure Code[edit]
On 4 January 2021, Minister of State for Home Affairs Desmond Tan revealed in Parliament that TraceTogether data could be accessed by the police for criminal investigations under the Criminal Procedure Code, which contradicted previous assurances by Minister Balakrishnan and others that the data would be used only for contact tracing.[76][77][78] This disclosure followed investigations triggered by an inquiry from a member of the public in October 2020, and the filing of a parliamentary question by MP Christopher de Souza in early December 2020, with the 3-month delay attributed to deliberations over the possibility of excluding TraceTogether data from the Criminal Procedure Code.[79][80]
Access during the May 2020 murder investigation[edit]
On 5 January 2021, Minister Balakrishnan updated Parliament that the police had to the best of his knowledge by that point in time accessed contact tracing data once in the case of a murder investigation.[81][82] Following questions from Leader of the Opposition Pritam Singh and Non-Constituency MP Leong Mun Wai, Minister Desmond Tan explained in Parliament on 2 February 2021 that this had happened in May 2020 during the course of the Punggol Field murder investigation, where the police tried to but failed to obtain the TraceTogether data from the suspect Surajsrikan Diwakar Mani Tripathi, who did not install the app in his phone.[83] In the aftermath, Surajsrikan was found guilty of murder and sentenced to life imprisonment with 15 strokes of the cane on 15 September 2022.[84]
Reactions[edit]
There was significant backlash to the announcement, despite Balakrishnan's explanation and acceptance of full responsibility.[76][77][79][74] Some observers attributed this to the fact that the clarification was made 9 months after the data had already been used, and only in response to direct and repeated parliamentary questioning.[80] Privacy concerns were raised by various experts with former Nominated Member of Parliament and Associate Professor of Law Eugene Tan saying that "the news came across as the Government backtracking on its earlier assurance that TraceTogether would only be used for contact tracing" and "clearly undermines their trust and credibility, and could undermine its future efforts .... to keep COVID-19 under control".[85]
Following the announcement, some users deleted the app or left the token at home, while others disabled their phone's Bluetooth or selected the “Pause Tracking” function after checking in.[86] In the month of the disclosure (January 2021), 350 people requested that their contact tracing data be erased from the government's servers,[87] with the number increasing to more than 1,100 by April.[3]
The original TraceTogether privacy statement[88][a] was updated on 4 January 2021 to include possible access by police officers for investigations.[76]
Various officials provided reassurances. Balakrishnan explained that this situation was not unique to TraceTogether and that under the same law, other forms of sensitive data like phone or banking records could also have their privacy regulations overruled.[89] Desmond Tan emphasised that access to TraceTogether data remained restricted without authorisation.[76] This point was reiterated by K Shanmugam, who said that the police will restrict the use of TraceTogether to "very serious offences" like murder and terrorism, only after careful consideration and discretion.[90] In addition, Balakrishnan said that TraceTogether programme will be stood down once the COVID-19 pandemic ends, with epidemiological data given to MOH that does not identify users.[91]
The backlash prompted the Government to introduce the COVID-19 (Temporary Measures) (Amendment) Bill on 2 February 2021 formalising the assurances to restrict police access to investigate for seven categories of offences.[79][92] Additionally, only senior police officers with the rank of inspector and above can request for data in the TraceTogether system, similarly to existing data requests requirements for bank data from financial institutions.[92] The Bill was debated among the Members of Parliament from People's Action Party, Workers' Party (WP), and Progress Singapore Party (PSP), with members from opposition WP preferring not to use the data but support a bill to restrict, and PSP opposing the use of data.[92] The Bill was passed by the end of the session.[92]
Singapore's reversal of initial promises regarding police access to TraceTogether data was cited as one of the reasons for resistance to the Hong Kong's COVID-19 contact-tracing application, LeaveHomeSafe.[93][94]