A new study analyzing COVID-19 contact tracing apps conducted by Amnesty International has found that Bahrain and Kuwait are using their public health apps as mass surveillance tools.
The study analyzed a collection of contact tracing apps, which are designed to inform and monitor physical contact between people in the event someone contracts COVID-19, from 11 countries: Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia, and United Arab Emirates. It found three particularly egregious apps that collected satellite location data from users, instead of relying simply on Bluetooth signals, and matched accounts with real identities.
In one extreme case, some citizens who downloaded the BeAware Bahrain contact tracing app became contestants on a televised game show called Are You At Home? The show involved a host randomly video calling phone numbers of Bahraini individuals using government-collected data to check if they were adhering to social distancing guidelines and offering monetary rewards to those that were. By signing up for BeAware Bahrain, users were automatically enrolled into Are You At Home?, which is produced by state-controlled television channel Bahrain TV. (BBC now reports you can opt out of the show if you don’t want to run the risk of being called.)
Amnesty International found that the Gulf states’ apps it analyzed were among the most invasive, collecting and storing GPS data and making it easy for the government to identify someone based on their account ID. Norway’s app was also flagged for putting its citizens’ privacy at risk for collecting and storing location data on a central server. But the country on Monday said it would pause the rollout of its the app, called Smittestopp, after Amnesty International shared its findings with the Norwegian government.
Mobile contact tracing is already in place in dozens of countries around the globe, although it’s been slow to get off the ground in the US. But the approaches have differed — most prominently, around issues of user privacy and whether the data should be anonymized and stored locally or linked to real identities and sent to a central server.
Apple and Google are still in the process of developing a more privacy-focused system for the US and other countries that would work across both Android and iOS, while some governments have simply made their own apps along separate lines. The scattershot approach has raised concerns about the long-term effects this kind of software could have for human rights and privacy protections. It’s still not clear how long the apps will remain in active use, which government bodies might regulate them, and whether states will keep them around as surveillance tools well into the future.
“Bahrain, Kuwait and Norway have run roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified in efforts to tackle COVID-19,” said Claudio Guarnieri, the head of Amnesty International’s Security Lab, which conducted the analysis. “The Norwegian app was highly invasive and the decision to go back to the drawing board is the right one. We urge the Bahraini and Kuwaiti governments to also immediately halt the use of such intrusive apps in their current form. They are essentially broadcasting the locations of users to a government database in real time – this is unlikely to be necessary and proportionate in the context of a public health response.”
In a statement given to the BBC, the Bahraini government touted its app’s effectiveness in tracking the spread of COVID-19 and says it is opt in. “The ‘BeAware’ app was designed for the sole purpose of advancing contact-tracing efforts and saving lives. It is an entirely voluntary opt-in app… and all users are informed of its use of GPS software before downloading,” the spokesperson said. “The app plays a vital role in supporting Bahrain’s ‘Trace, Test, Treat’ strategy and has helped to keep Bahrain’s Covid-19 death rate at 0.24%. 11,000 individuals have been alerted through the app and prioritized for testing, of which more than 1,500 have tested positive.”
Bahrain has a population of just under 1.6 million and has had more than 19,000 confirmed cases and 46 recorded deaths caused by the novel coronavirus. Kuwait, with a population of more than 4.1 million, has had nearly 36,000 confirmed cases and just over 300 deaths.
