Live Now
Innovation for Resilience
March 23, 2023 • 9:00 am – 12:05 pm EDT
Singapore’s Updated TraceTogether Privacy Policy Could Erode Public Trust
Photo: Tr3/Adobe Stock
By Kyra Jasper and Camille Bismonte
TraceTogether, Singapore’s widely-used Covid-19 contact tracing application, made international headlines on January 4 after Minister of State for Home Affairs Desmond Tan said during a parliamentary session that data collected through the app fell under the purview of the country’s Criminal Procedure Code. Contrary to previous statements made by lawmakers, Tan’s statement means that police can use data from the TraceTogether, SafeEntry (Singapore’s national digital check-in system) and BluePass (a specifically-designed contact tracing device for migrant workers) systems in criminal investigations unrelated to Covid-19 contact tracing efforts. One day after the announcement, senior government ministers admitted that the data had already been used as evidence in a murder case. This policy change risks undermining the Singaporean public’s trust in their government and raises concerns regarding equity for migrant workers, whom these policy changes will disproportionately impact.
These developments stand in contrast with previous statements by Foreign Minister Vivian Balakrishnan, who is also in charge of the Smart Nation Initiative. He said during a June 7 interagency task force news conference that “there is no intention to use a TraceTogether app or TraceTogether token as a means of picking up breaches of existing rules.” However, at the parliamentary session on January 5, he backtracked, saying, “the [CPC] was not on my mind” during that press conference in June. He also claimed to have “sleepless nights” after realizing that the police could invoke the CPC for “serious criminal offenses.”
The government has tried to amend public relations by introducing a bill on February 1 specifying the cases in which data from these systems can be used. However, the bill is still filled with ambiguity. Notably, the bill states that data can be collected and used in the specified criminal cases “once the pandemic is over” and “as soon as practicable,” a timeline that is ultimately unclear given the course of the pandemic in the region.
To date, nearly 80 percent of residents in Singapore are using the app and token, which launched in March and June, respectively. The government required a high rate of adoption of TraceTogether for Singapore to enter Phase 3 of its reopening process. Although using TraceTogether was initially voluntary, its usage in partnership with SafeEntry will be required to enter public venues such as workplaces and schools this year. Compared to contact tracing apps in other Southeast Asian nations, TraceTogether has enjoyed higher rates of adoption. Additionally, the TraceTogether system has proven effective at reducing the time it takes for Singaporean officials to contact trace by half.
Several independent privacy organizations and reviews deemed Singapore’s TraceTogether application one of the “least intrusive” contact tracing applications in Southeast Asia. According to a study conducted by the MIT Technology Review in May, TraceTogether satisfied a set of technology principles guided by the American Civil Liberties Union, including the amount of time data on apps should be stored and the amount of data collected.
Although lawmakers from the ruling People’s Action Party (PAP) later specified the exact offenses that the police could use TraceTogether data to investigate, controversy surrounding the use of data from the app has exposed underlying fractures in Singapore’s political cohesiveness.
The amount of data that TraceTogether collects is not unusual in Singapore, considering that the government already uses other surveillance methods, ranging from CCTV to drones. Thanks to the assurances of officials like Minister Balakrishnan, many Singaporeans did not perceive TraceTogether as posing a privacy risk. A November 2020 survey found that a majority (68 percent) of Singaporeans’ expressed either “Quite High” or “Very High” confidence in the government to use TraceTogether app data only for contact tracing purposes.
But the government’s about-face on the use of data gathered from TraceTogether has caused some Singaporeans to raise concerns. In the aftermath of Minister Tan’s announcement, Teo Yi-Ling, a senior fellow at the S. Rajaratnam School of International Studies’ Centre of Excellence for National Security, said that citizens felt they had been “baited and switched.” Teo cited the “inconsistency of information from the government” as a precedent that would likely impact the efficacy of future government programs.
Eugene Tan, a law professor at Singapore Management University, also noted that this sudden shift in policy harms the government’s credibility. Tan said, “this damage could undermine its future efforts, given its reiteration that Singapore has only managed to keep Covid-19 under control due to the people’s trust in the government’s measures.”
A Singaporean citizen, who did not wish to be named, said to the BBC that “this is not that [Singaporeans] feel like they’re constantly being watched … It’s more that they feel they’ve been cheated. The government had assured us many times that TraceTogether would only be used for contact tracing, but now they’ve suddenly added this new caveat.”
Moreover, this change in Singapore’s privacy policy disproportionately impacts migrant workers, who make up a substantial 58 percent of Singapore’s labor force. Migrant workers are not subject to the same data privacy protections as Singaporean citizens and have had to give up their privacy rights to participate in TraceTogether. Since May, it has been compulsory for migrant workers to participate in the TraceTogether program.
The type of data collected on TraceTogether is similar to the information police have access to through cell phones. Although Singaporean citizens have been given the option to use TraceTogether, migrant workers must use both the TraceTogether app and the BluePass token. The BluePass token was specifically designed for migrant workers in dormitories or those working in the construction, marine shipyard and process sectors. Additionally, businesses contracting migrant workers are required to provide them with smartphones to use the TraceTogether app. The Singaporean government has distributed more than 450,000 BluePass tokens to migrant workers in October.
While TraceTogether users can request the government to delete all of the data collected in its servers, this privilege only applies to individuals who have not tested positive for Covid-19. Significantly, 47 percent of migrant workers have tested positive for Covid-19 as of December 15, making up almost 93 percent of the Covid-19 cases in Singapore. They are therefore not eligible for this exemption.
This issue could also test the Workers’ Party’s efficacy in moderating the PAP’s legislative decisions. As the main opposition in Parliament, the Workers’ Party has raised several concerns regarding TraceTogether’s privacy changes. Workers’ Party lawmaker Gerald Giam raised his concerns with Minister of State for Home Affairs Tan, calling the government’s lack of transparency regarding TraceTogether’s data privacy policy “ill-advised.” While Parliament has introduced legislation clarifying the definition of “serious criminal offenses,” Giam warned that the changes may already lead to “lower adoption and usage” of the app, hampering the effectiveness of Singapore’s Covid-19 response.
Debate over the use of data from TraceTogether could have far-reaching effects in the country’s roll-out of its “Smart Nation” initiative as well as regional efforts to deploy cutting-edge responses to the pandemic. As Balakrishnan works to transform Singapore’s economy through the greater adoption of digital innovation, Singaporeans are skeptical that the government will fully think through how current legislation will regulate future technical developments. TraceTogether has been seen as a model for other countries, especially in Southeast Asia, to effectively conduct contact tracing and attract high levels of participation in their apps. As Covid-19 variants from the UK and South Africa are driving another wave of community transmission in countries across Southeast Asia, governments are turning to contact tracing apps to mitigate the spread. Digital rights activists like Lee Yi Ting warn that even if the updated TraceTogether policy does not deter Singaporean residents from using the app, it could be bad news for the already weaker privacy infrastructure of other applications in the region.
Kyra Jasper is a research intern with the Southeast Asia Program at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Camille Bismonte is a research intern with the CSIS Southeast Asia Program.
TraceTogether, Singapore’s widely-used Covid-19 contact tracing application, made international headlines on January 4 after Minister of State for Home Affairs Desmond Tan said during a parliamentary session that data collected through the app fell under the purview of the country’s Criminal Procedure Code. Contrary to previous statements made by lawmakers, Tan’s statement means that police can use data from the TraceTogether, SafeEntry (Singapore’s national digital check-in system) and BluePass (a specifically-designed contact tracing device for migrant workers) systems in criminal investigations unrelated to Covid-19 contact tracing efforts. One day after the announcement, senior government ministers admitted that the data had already been used as evidence in a murder case. This policy change risks undermining the Singaporean public’s trust in their government and raises concerns regarding equity for migrant workers, whom these policy changes will disproportionately impact.
These developments stand in contrast with previous statements by Foreign Minister Vivian Balakrishnan, who is also in charge of the Smart Nation Initiative. He said during a June 7 interagency task force news conference that “there is no intention to use a TraceTogether app or TraceTogether token as a means of picking up breaches of existing rules.” However, at the parliamentary session on January 5, he backtracked, saying, “the [CPC] was not on my mind” during that press conference in June. He also claimed to have “sleepless nights” after realizing that the police could invoke the CPC for “serious criminal offenses.”
The government has tried to amend public relations by introducing a bill on February 1 specifying the cases in which data from these systems can be used. However, the bill is still filled with ambiguity. Notably, the bill states that data can be collected and used in the specified criminal cases “once the pandemic is over” and “as soon as practicable,” a timeline that is ultimately unclear given the course of the pandemic in the region.
To date, nearly 80 percent of residents in Singapore are using the app and token, which launched in March and June, respectively. The government required a high rate of adoption of TraceTogether for Singapore to enter Phase 3 of its reopening process. Although using TraceTogether was initially voluntary, its usage in partnership with SafeEntry will be required to enter public venues such as workplaces and schools this year. Compared to contact tracing apps in other Southeast Asian nations, TraceTogether has enjoyed higher rates of adoption. Additionally, the TraceTogether system has proven effective at reducing the time it takes for Singaporean officials to contact trace by half.
Several independent privacy organizations and reviews deemed Singapore’s TraceTogether application one of the “least intrusive” contact tracing applications in Southeast Asia. According to a study conducted by the MIT Technology Review in May, TraceTogether satisfied a set of technology principles guided by the American Civil Liberties Union, including the amount of time data on apps should be stored and the amount of data collected.
Although lawmakers from the ruling People’s Action Party (PAP) later specified the exact offenses that the police could use TraceTogether data to investigate, controversy surrounding the use of data from the app has exposed underlying fractures in Singapore’s political cohesiveness.
The amount of data that TraceTogether collects is not unusual in Singapore, considering that the government already uses other surveillance methods, ranging from CCTV to drones. Thanks to the assurances of officials like Minister Balakrishnan, many Singaporeans did not perceive TraceTogether as posing a privacy risk. A November 2020 survey found that a majority (68 percent) of Singaporeans’ expressed either “Quite High” or “Very High” confidence in the government to use TraceTogether app data only for contact tracing purposes.
But the government’s about-face on the use of data gathered from TraceTogether has caused some Singaporeans to raise concerns. In the aftermath of Minister Tan’s announcement, Teo Yi-Ling, a senior fellow at the S. Rajaratnam School of International Studies’ Centre of Excellence for National Security, said that citizens felt they had been “baited and switched.” Teo cited the “inconsistency of information from the government” as a precedent that would likely impact the efficacy of future government programs.
Eugene Tan, a law professor at Singapore Management University, also noted that this sudden shift in policy harms the government’s credibility. Tan said, “this damage could undermine its future efforts, given its reiteration that Singapore has only managed to keep Covid-19 under control due to the people’s trust in the government’s measures.”
A Singaporean citizen, who did not wish to be named, said to the BBC that “this is not that [Singaporeans] feel like they’re constantly being watched … It’s more that they feel they’ve been cheated. The government had assured us many times that TraceTogether would only be used for contact tracing, but now they’ve suddenly added this new caveat.”
Moreover, this change in Singapore’s privacy policy disproportionately impacts migrant workers, who make up a substantial 58 percent of Singapore’s labor force. Migrant workers are not subject to the same data privacy protections as Singaporean citizens and have had to give up their privacy rights to participate in TraceTogether. Since May, it has been compulsory for migrant workers to participate in the TraceTogether program.
The type of data collected on TraceTogether is similar to the information police have access to through cell phones. Although Singaporean citizens have been given the option to use TraceTogether, migrant workers must use both the TraceTogether app and the BluePass token. The BluePass token was specifically designed for migrant workers in dormitories or those working in the construction, marine shipyard and process sectors. Additionally, businesses contracting migrant workers are required to provide them with smartphones to use the TraceTogether app. The Singaporean government has distributed more than 450,000 BluePass tokens to migrant workers in October.
While TraceTogether users can request the government to delete all of the data collected in its servers, this privilege only applies to individuals who have not tested positive for Covid-19. Significantly, 47 percent of migrant workers have tested positive for Covid-19 as of December 15, making up almost 93 percent of the Covid-19 cases in Singapore. They are therefore not eligible for this exemption.
This issue could also test the Workers’ Party’s efficacy in moderating the PAP’s legislative decisions. As the main opposition in Parliament, the Workers’ Party has raised several concerns regarding TraceTogether’s privacy changes. Workers’ Party lawmaker Gerald Giam raised his concerns with Minister of State for Home Affairs Tan, calling the government’s lack of transparency regarding TraceTogether’s data privacy policy “ill-advised.” While Parliament has introduced legislation clarifying the definition of “serious criminal offenses,” Giam warned that the changes may already lead to “lower adoption and usage” of the app, hampering the effectiveness of Singapore’s Covid-19 response.
Debate over the use of data from TraceTogether could have far-reaching effects in the country’s roll-out of its “Smart Nation” initiative as well as regional efforts to deploy cutting-edge responses to the pandemic. As Balakrishnan works to transform Singapore’s economy through the greater adoption of digital innovation, Singaporeans are skeptical that the government will fully think through how current legislation will regulate future technical developments. TraceTogether has been seen as a model for other countries, especially in Southeast Asia, to effectively conduct contact tracing and attract high levels of participation in their apps. As Covid-19 variants from the UK and South Africa are driving another wave of community transmission in countries across Southeast Asia, governments are turning to contact tracing apps to mitigate the spread. Digital rights activists like Lee Yi Ting warn that even if the updated TraceTogether policy does not deter Singaporean residents from using the app, it could be bad news for the already weaker privacy infrastructure of other applications in the region.
Kyra Jasper is a research intern with the Southeast Asia Program at the Center for Strategic and International Studies (CSIS) in Washington, D.C. Camille Bismonte is a research intern with the CSIS Southeast Asia Program.