The coronavirus pandemic has led to an unprecedented global surge in digital surveillance, researchers and privacy advocates around the world have said, with billions of people facing enhanced monitoring that may prove difficult to roll back.
Governments in at least 25 countries are employing vast programmes for mobile data tracking, apps to record personal contact with others, CCTV networks equipped with facial recognition, permission schemes to go outside and drones to enforce social isolation regimes.
The methods have been adopted by authoritarian states and democracies alike and have opened lucrative new markets for companies that extract, sell, and analyse private data. One of the world’s foremost experts on mobile phone surveillance said the pandemic had created a “9/11 on steroids” that could lead to grave abuses of power.
“Most of these measures don’t have sunset clauses. They could establish what many people are describing as a new normal,” Ron Deibert, who heads the Citizen Lab at the University of Toronto, said in an interview with the Guardian.
“I think we have to be really vigilant about that to make sure there are appropriate safeguards in place because the potential for the abuse of power is pretty extreme … so it’s a little bit like 9/11 on steroids.”
In China, hundreds of millions have installed mandatory “health code” apps that determine whether users– given colour-coded designations of green, yellow, or red (for confirmed Covid-19 patients) – can travel or leave home.
In Europe, some of the world’s most privacy-conscious governments are collecting telecom data, employing drones and copying contact-tracing apps pioneered in Asia. In the US, Apple and Google have announced they will open up their mobile operating systems to allow for similar apps, which will run on iPhones and Android phones alike.
Moscow, a city of 12 million people, will require citizens to have QR codes for travel on its streets and is seeking to employ its 100,000 surveillance cameras and facial recognition technology to enforce self-isolation schemes.
In India, local authorities have experimented with solutions such as mobile tracking apps, geolocated selfies, and releasing the addresses of coronavirus patients.
With the proliferation of digital surveillance methods, a number of global initiatives have appeared to chart their progress around the globe.
“This isn’t just an issue with authoritarian governments. This is happening across the world,” said Samuel Woodhams, the digital rights lead at the London-based Top10VPN, who has compiled an index of new surveillance measures related to the coronavirus outbreak. “A lot of the technologies we’re seeing are alarmingly similar.”
Whether that surveillance is eventually rolled back will depend on public oversight.
“[The crisis] has shown that negative technology can appear around the world, including in the west,” said Artem Kozlyuk, the head of the Russian Roskomsvoboda internet rights group, which has released a global tracker called Pandemic Big Brother. “But we suspect that these measures are going to be under greater public control in western democracies than in not-entirely democratic regimes.”
Israel, with its global reputation for both state and private sector intelligence gathering technology, was quick to implement surveillance on a national scale, initially with phone tracking measures endorsed by the prime minister, Benjamin Netanyahu. Lawmakers, however, opposed a proposal from the hardline defence minister, Naftali Bennett, to involve a private sector company in data analysis, which was later identified as the controversial Israeli spyware company the NSO Group.
Bennett had outlined a system in tweets that would give people a rating of one to 10 on their likelihood of carrying the virus, based on their movements and other factors.
Israel is not using an NSO-developed system but a person familiar with the company said a “handful of governments” were already piloting the software it made to track the virus.
An NSO spokesperson said it did not operate the platform it developed and data was not shared with the company. It denied any invasion of privacy. “The data required to operate the system by authorities and governments is statistical and aggregated, not personal data,” the spokesperson said.
Campaigners have also warned the focus on surveillance measures may be diverting resources from health-focused approaches,such as improving testing capability or supplying hospitals with more medical equipment.
“It’s this kind of technological ‘solutionism’ that might look good on paper but is actually undermining efforts to fight the disease in the long run,” said Edin Omanovic, advocacy director at the London-based charity Privacy International.
Contact-tracing apps and other methods to identify those who have been in contact with people infected with the disease were pioneered in Asia. Hong Kong issues tracking wristbands to international arrivals that connect to a StayHomeSafe mobile app and a registered “quarantine address”, while Singapore’s TraceTogether app, which uses Bluetooth to find people within two metres of someone diagnosed with Covid-19 for half an hour or more, has been made open source to allow other countries to copy it.
Contact-tracing has been especially effective in South Korea, which has employed GPS data, CCTV footage and and credit card records to identify and warn suspected victims of the disease. But the country’s surveillance push would not have been effective without widespread testing, experts said, allowing officials to quickly confirm new coronavirus cases.
The adoption of tracing apps and other electronic surveillance measures has become a live issue of concern in Brussels, where member states have been warned of the risk to the EU’s “fundamental rights and freedoms”.
Authorities in Poland, the Netherlands, Spain, Ireland and the UK have all either expressed an interest or started to roll out mobile phone apps to help them track and trace those infected with the virus.
The UK health secretary, Matt Hancock, announced plans on Sunday for a Bluetooth-based app that will warn users if they have recently been in close proximity to someone suspected to be infected with the coronavirus. The Dutch health minister, Hugo de Jonge, said last week at least 60% of the population would need to download the Netherlands’ similar app for it be effective. “We are looking at whether you can require everyone to do it,” he said during a press conference.
Meanwhile, telecom operators in Italy, Spain and other EU countries have released “heat maps” of users’ movements, arguing that the data was sufficiently anonymised and aggregated to prevent the tracking of individuals, which would be a potential violation of GDPR.
The UK’s last EU commissioner, Julian King, who held the security portfolio in Brussels, said he was concerned about the lack of debate so far “about what kind of society we want, and what values we hold dear”.
In Russia, the crisis has helped expose the country’s potential for digital surveillance, but also some of its limitations. Officials last month said they would use mobile apps, employ CCTV cameras with facial recognition, QR codes, mobile phone data and credit card records in a digital surveillance menu that opposition members had termed a “cybergulag”.
Most quarantine violations are, however, still exposed by physical surveillance, meaning police patrols and roadblocks on the streets. Pavel Chikov of the Agora International Human Rights Group noted that a more sophisticated system could be “too expensive” for many of the country’s regions to employ. In Tatarstan, an SMS permission system looked suspiciously similar to a local parking app, suggesting the government may just have adapted the technology.
When Moscow did finally roll out its QR-code system this week, the website quickly crashed, and remained down on Monday morning. Privacy advocates have said personal data put into the system may not remain secure. “If they can even make it work, I have zero trust that this data is going to remain private,” said one open-source investigator based in Russia.