In an attempt to stem the tide of the coronavirus pandemic, at least 30 governments around the world have instituted temporary or indefinite efforts to single out infected individuals or maintain quarantines. Many of these efforts, in turn, undermine personal privacy.
It’s a complex trade-off: Governments need information to create containment strategies and know where to focus resources. At the same time, governments have a way of holding onto tools that undermine citizens’ privacy long after the moment of crisis has passed. Take, for example, the United States’ 2001 Patriot Act, which was passed in response to the 9/11 attacks. The Patriot Act gave the government broad surveillance powers with little oversight, including demanding customer data from telecoms without court approval. Twenty years later, it’s still around.
To document global surveillance measures in response to the coronavirus pandemic, OneZero compiled press reports from more than 30 countries where potential privacy issues are occurring.
The most common form of surveillance implemented to battle the pandemic is the use of smartphone location data, which can track population-level movement down to enforcing individual quarantines. Some governments are making apps that offer coronavirus health information, while also sharing location information with authorities for a period of time. For instance, in early March, the Iranian government released an app that it pitched as a self-diagnostic tool. While the tool’s efficacy was likely low, given reports of asymptomatic carriers of the virus, the app saved location data of millions of Iranians, according to a Vice report.
One of the most alarming measures being implemented is in Argentina, where those who are caught breaking quarantine are being forced to download an app that tracks their location. In Hong Kong, those arriving in the airport are given electronic tracking bracelets that must be synced to their home location through their smartphone’s GPS signal.
So far, OneZero has found reports of potentially privacy infringing technology being deployed by 34 countries, listed below. We’ll be updating this list on a weekly basis.
These surveillance programs were last updated on 5/22/2020. Qatar was added to the list.
As of March 25, the Ministry of Health had built a mandatory app for those entering the country to keep installed for 14 days, which requires users to give access to location data.
It’s not clear if the government is actively tracking people with that location data, but the province of Santa Fe is allegedly forcing those who have violated quarantine to download an app that specifically tracks their whereabouts.
Those ordered into quarantine could have government surveillance devices installed in their homes or be forced to wear electronic surveillance devices, according to a new law in the state of Western Australia as of April 1.
However, the Australian government has opted not to use cellphone-based location tracking.
An Austrian telecom gave two days’ worth of anonymized location data to the government in order to analyze movement in the country, as of March 17. The data is reportedly unable to be analyzed in groups of fewer than 20 people.
As of April 8, the small country of Bahrain has started using electronic bracelets connected to a mobile app to track confirmed cases of the coronavirus, similar to an initiative in Hong Kong. The punishment for being caught breaking the quarantine is a potential prison sentence of at least three months, according to MobiHealthNews.
As of March 31, three telecoms in Belgium are giving data to a company called Dalberg Data Insights, which is analyzing the information to detect widespread trends of movement in the country.
The country is using drones to make announcements, but may also be using the devices to capture surveillance footage, according to Top10VPN’s Digital Rights Tracker.
Local governments across Brazil are tracking location data from citizens’ smartphones, as of March 27. The city of Recife alone is tracking 700,000 people’s locations through their personal devices, and it’s one of Brazil’s smaller metropolitan areas.
Most of this tracking is being done by Brazilian startups working in conjunction with governments.
“We have visibility of certain behaviors that couldn’t be captured by other technologies. For example, if an individual leaves their house, we can detect that in a matter of seconds,” the CEO of one Brazilian firm told Brazilian news site Mobile Time.
Ontario police have access to a government database of people who have tested positive for the coronavirus, including personal information like names, addresses, and birthdays, according to an April 24 Vice report.
“Protecting the health of communities and first responders is rightly a priority,” the Canadian Civil Liberties Association said in a letter to the Canadian government. “Providing personal health information directly to law enforcement, however, is an extraordinary invasion of privacy.”
China has been using practically every surveillance system in its toolbox since at least February: Authorities are tapping publicly located cameras to run facial recognition searches, citizens are being location-tracked through their phones, and drones are being put to use in order to give directions from the government, according to CNBC.
The Chinese government is also tracking individuals in more than 200 cities through a smartphone app that grades their health and assigns them a classification of green, yellow, or red, according to the New York Times. The app sends that data to the police and works as a hall pass for entry into certain public places. Travel to designated hot spots, contact with an infected person, or reported symptoms in the app can result in red and yellow designations, which restrict a person’s movement. How to remove that designation, as well as exactly how those decisions are made, is unclear.
China is also putting pressure on private companies in the country to hand over data to further contain the pandemic.
Surveillance cameras are being installed inside the homes of people living in China under mandatory quarantine, as well as outside people’s front doors, according to CNN.
Cameras typically used to catch speeding motorists in Dubai will analyze drivers’ license plates and determine whether they are deemed essential workers as of April 6, according to Gulf News.
The system allegedly tracks drivers throughout their entire trip and will know whether or not the route they take is to their job.
Ecuador is tracking the location of cellphones nationwide to curb the spread of the virus and enforce the country’s 9 p.m. curfew, according to a March 17 report from EcuadorTV.
As of April 11, Swedish telco Telia has given anonymized phone location data to the Finnish government for analysis of user movement in the country.
More than 140 French cybersecurity and privacy experts signed a letter on April 26 warning the public and authorities about the risks of an expected contact tracing app.
“All these applications involve very significant risks with regard to respect for privacy and individual freedoms. One of them is mass surveillance by private or public actors,” the experts wrote.
The French government’s app is called Stop Covid, and will not be compulsory.
Security cameras in the Paris metro system are now capable of detecting whether people are wearing masks or not. Startup DatakaLab, which built the technology, says it’s not meant for tracking individuals but instead for gathering data on mask adoption.
German telecom Telekom is providing location data from its customers to the Robert Koch Institute, the organization coordinating the country’s national action against the coronavirus, as of late April. Germany is also expected to launch a Bluetooth-based app like those used in Singapore and Indonesia to track personal movement and contact.
The country’s public health authority also launched a smartwatch app that collects health data in an attempt to determine whether people are exhibiting signs of the coronavirus.
Those quarantined in Hong Kong must wear electronic wristbands that track their locations, as of March 20. Wristbands are handed out at the airport and must be paired with the individual’s smartphone.
Once a person arrives home, they are given one minute to walk around their apartment to calibrate the wristband and the accompanying app to the space where they are confined.
As of March 20, Indian authorities have expanded tracking citizens through digital and analog means. Location data and CCTV footage are being used to track citizens in the southern Indian state of Kerala, according to Reuters. Western states are also stamping the hands of those arriving in airports with irremovable ink, with the stamp detailing the date until which the person must quarantine.
In addition to personal tracking, Indian authorities are also taking passenger information from airlines and railroad companies.
Now that touch-based authentication like fingerprint scanners are considered risky since they require people to touch a common surface, facial recognition is getting a boost in adoption across India. Secureye, an Indian telecom, is also replacing 650 fingerprint-based security checkpoints in offices and hotels with facial recognition.
The state of Chhattisgarh has released an app to authorize travel in the region, which requires a picture, ID, and “business proof,” as well as details of the trip such as location and duration.
India’s countrywide Aarogya Setu app, meant to be the government’s attempt at contact tracing, tracks a wide range of smartphone data with little insight into what it’s collecting or how it will be used, as of May 7. The Indian government is also building e-payment and telemedicine into the app, suggesting it will be a lasting fixture in India’s digital landscape.
On May 11, the state of Madhya Pradesh revealed personal information about 5,400 quarantined people on a public online dashboard, including their current GPS coordinates. It has since been taken down, and public officials said that the personal information was mistakenly published.
The Indonesian government has developed an app as of March 30 that tracks interactions with nearby Bluetooth devices, like other smartphones, in an attempt to track social distancing and personal interactions. It’s opt-in and offers benefits like notifying people who might have been exposed to get tested for the virus.
A smartphone app developed by the Iranian government scooped up millions of users’ location data alongside a short questionnaire that claimed to detect the likelihood of infection, according to a March 14 report from Vice.
A notice about the app was sent to tens of millions of Iranians, with the directive to take the questionnaire before going in for a coronavirus test. According to an Iranian official, at least 3.5 million people shared their location.
The Israeli government is using data from telecom providers to track the locations of millions of citizens in an attempt to find people diagnosed with the coronavirus and alert those with whom the infected person might have interacted, as of March 16. Those breaking quarantine are threatened with up to six months of imprisonment.
Palestinians checking the status of their permits to stay in Israel must now download an app that tracks their location, since the offices typically visited for this kind of paperwork is closed.
English telecom Vodafone is providing the Italian government with heatmaps of its mobile phone users’ locations, with the first being from Lombardy, Italy. Officials have determined that 40% of people are moving around too much, according to a March 23 report from the New York Times.
The Kenyan government is instituting 24/7 aerial surveillance of the country’s border to detect illegal crossings of goods or people, as of April 9.
As of March 27, the Norwegian Institute of Public Health and Norwegian tech company Simula will build a voluntary app that tracks GPS and Bluetooth data, to be stored for 30 days.
Through location surveillance and mass texts, the government of Pakistan is tracking confirmed cases of the coronavirus as of April 24, and sending alerts to people found to have potentially come in contact with those suffering the disease in the past 14 days.
An app called Home Quarantine requires Polish citizens who are quarantined to intermittently check in by sending a picture of themselves at home within 20 minutes or face a fine, as of March 19.
The app uses facial recognition to determine it’s actually the person being quarantined, and the phone’s location data is used to make sure they’re really at home.
As of May 18, the nation of Qatar has made it mandatory for every citizen to download the Ehteraz app if they intend to leave their home, and to keep installed indefinitely, according to the Qatar state news agency. The app demands extreme data-sharing permission, including location, access to all files, and access to call information.
Local governments have been called upon to create their own surveillance systems as well. In the Nizhny Novgorod region, citizens download an app that generates a unique, timed QR code that allows them to go out for three hours to get groceries, one hour to walk a dog, or 30 minutes to take out the trash, according to the Washington Post on April 5.
The Singapore government released an app called TraceTogether, which pings nearby smartphones through Bluetooth to determine which people have come within 6.5 feet of each other for more than 30 minutes, according to the Los Angeles Times on March 25.
The data is stored for 21 days, according to the developers, and does not record the users’ location.
South African telecom companies are handing over cellphone location data in order to track the pandemic, according to Business Insider South Africa. Reportedly 1,500 people’s data are being shared, as of April 3.
Confirmed cases of the coronavirus are being tracked in South Korea by a fusion of credit card purchases, smartphone location tracking, and CCTV footage, presumably analyzed by facial recognition algorithms, according to a March 26 Reuters report.
This allows the Korean government to reconstruct the past actions of those diagnosed with the virus with incredible granularity, like using the person’s location data to check nearby CCTV footage and see if they were wearing a mask, Reuters reports.
In an attempt to enforce social distancing, telecom company Swisscom will alert the federal government when more than 20 phones are located in a 100-square-meter area, as of March 25.
Although the government rejects the accusation that it’s adopting surveillance technology, Taiwan is tracking its citizens’ movement by triangulating the location of their cellphone between nearby cell towers as of March 12.
Those arriving in Thailand from high-risk areas will be given a SIM card that lets the government track their movement for 14 days, as of March 17.
The Turkish government is tracking the locations of coronavirus patients using their cellular data, and will automatically send warning messages if they are detected violating quarantine. All cellular companies operating in Turkey are cooperating with the government to provide this data, according to the state-run Anadolu Agency on April 9.
A draft law was proposed that would mandate that social media platforms like Facebook, YouTube, and WhatsApp have a legal representative in Turkey that the government could pressure to take down content or ban accounts, according to Human Rights Watch. However, those parts of the draft were later withdrawn.
The U.K. is allegedly talking with telecom companies to track its citizens’ location data. In the meantime, the National Health Service has partnered with Palantir as of April 1 to track the spread of the virus and its impact on the health system.
To help track the movement of citizens, the mobile advertising industry is currently supplying data to local, state, and federal government organizations about the location of individuals, according to a March 28 report by the Wall Street Journal. The data is granular enough to tell whether people are complying with stay-at-home directions or if parks are still in use. Foursquare, which has one of the most comprehensive repositories of personal location data, is in talks with numerous government organizations, according to the WSJ. Most data being used comes from apps that have permission to log a user’s location, which is then compiled and resold.
The goal of these efforts is to create a portal that could track citizen movement in up to 500 U.S. cities. Google is also contributing a trove of movement data, which it collects for services like Google Maps’ traffic function.
There are also troubling state and local policies. In West Virginia, those who test positive for the virus but refuse to quarantine are being outfitted with GPS ankle monitors, according to the Associated Press on April 6.
On April 10, Apple and Google announced a new set of digital tools for detecting if individuals have come in close contact with those diagnosed with the coronavirus. The software will eventually be integrated into Android and Apple phones, making the tracking all but ubiquitous. Many of the software’s privacy-guarding machinations are still unknown, but you can read more about what we know so far in Medium’s Coronavirus Blog.
PredPol, a controversial predictive policing company used in cities across the United States to theoretically identify future crime hotspots, has advised on new ways customers can use its software for coronavirus control in a company blog post on April 8.
“Most people gracefully accept these orders to protect their fellow citizens, but not everyone cooperates, so rolling a cruiser through their neighborhood periodically can remind them of their obligations,” the blog said.
Police in New Jersey and Connecticut are using aerial drones with temperature sensors and other apparatus to detect people outside who might have the coronavirus. The drones are made by a company called Draganfly, which claims the drones can detect fevers, sneezing, respiratory rate, and whether people are standing an appropriate distance from one another.
Onfido, a British startup that tries to tie government documentation to your digital identity, is in early talks with U.S. and European countries about developing a “passport” that would prove immunity to the coronavirus, according to Axios and City A.M on April 15.
Peter Thiel-backed Palantir will be a driving force behind the United States’ coronavirus tracking system. The system is called HHS Protect Now, and includes 187 datasets including supply chain data, medical reports, and undisclosed data from private companies.
The Kansas Department of Health and Environment is also tracking its citizens’ movement with a platform called Unacast.
As of May 20, Alabama, North Dakota, and South Carolina are the first three states to publicly start using Apple and Google’s contact tracing technology within their own apps. The two companies said 22 countries and “some U.S. states” have requested access to the technology, according to CNBC.
All states and territories are being directed to provide Palantir with daily data on ventilator availability, according to emails obtained by The Daily Beast.