Singapore and South Korea have drawn international attention for their successful use of mobile technologies in their COVID-19 responses. As Canadian provinces and the federal government consider the introduction of similar tools, APF Canada’s Digital Asia team has taken a deeper look at the usefulness and limitations of apps being used in these two countries, along with perceived and actual personal privacy risks. While these apps have been helpful in mitigating outbreaks, they are only as strong as the government and institutions that facilitate their use as part of broader COVID-19 containment strategies.
Singapore: Bluetooth-enabled app, ‘TraceTogether’
Under Singapore’s Infectious Disease Act (IDA), the Ministry of Health (MOH) can issue Quarantine Orders (QO) to Singaporean citizens or residents confirmed or suspected of carrying the COVID-19 virus, or to those likely exposed to positive cases. MOH determines a person’s quarantine period of at least 14 days on a case-by-case basis. MOH ensures compliance through random visits or phone checks.Similarly, Stay-Home Notices (SHNs) are issued to all international returnees, mandating isolation for 14 days. Individuals issued a QO must self-isolate in a hospital, a designated government facility (such as university dormitories and hotels), or at home. All SHN individuals must isolate at designated facilities. MOH ensures compliance through random visits or phone checks by Certis personnel, a private security contractor engaged for this purpose. Army staff and police are also conducting such checks. Those quarantined receive text messages with links to share their mobile’s GPS data, or a call requesting video or pictures of their current location as evidence they are in fact in self-isolation.
On March 21, Singapore’s Government Technology Agency (GovTech) and MOH released TraceTogether, an app designed to aid contact tracing efforts. Users sign up with their phone number and are assigned a unique identification number to safeguard their identity. The app employs Bluetooth signals to “determine the user’s proximity” to other phones with TraceTogether installed, then logs and encrypts these close contacts for 21 days. Afterwards, the logs are erased. Personal information stored in the phones – like address book, or location data through GPS, Wi-Fi, or cellular networks – is not collected. Should users contract the virus or be part of a contact tracing investigation, MOH can decrypt TraceTogether logs to identify suspected cases users may not remember or be aware of coming into contact with. Consequently, MOH can reach out to close contacts, enquire on their health, and test or isolate them if necessary.
The government has emphasized that signing up for TraceTogether is voluntary, repeatedly asserting that users can revoke their consent at any time, even refuse MOH access to TraceTogether logs. However, state media has reported a potential hitch. Refusal to share the app’s data with MOH may be subject to prosecution under the IDA. As of April 17th, approximately one million people had installed TraceTogether, or one in six Singaporeans. Given that these apps rely on the ‘network effect’ to yield comprehensive data, TraceTogether is still short of the three-quarters of the population needed to be connected before it becomes effective for contact tracing. MOH and GovTech together have now launched public campaigns encouraging people to install the app.
South Korea: The ‘Self-isolation Safety Application’
Since February 4, the Korea Centers for Disease Control (KCDC) have mandated self-isolation for “those who have been in contact with a confirmed COVID-19 patient within 2 metres, or those who were in the same closed space when a confirmed COVID-19 patient coughed without a mask.” The Ministry of Interior Safety released the Self-isolation Safety Application(자가격리자 안전보호 앱) on March 7 to help manage individuals that are supposed to be self-isolating. Starting March 22, those coming from abroad have been asked to install this application as well.
Those who do not install the application are subject to stricter monitoring.The primary purpose of the app is to help local government officials monitor individuals under self-isolation. In responding to the COVID-19 outbreak, South Korea has deployed a system in which each self-isolating individual is monitored by a local government official. Like TraceTogether, the installation of the application is not mandatory, but strongly encouraged. Those who do not install the application are subject to stricter monitoring via more frequent check-ups from designated officials via telephone.
Self-isolating individuals using the app are required to report the status of their health (fever, cough, sore throat, and respiratory difficulties) twice a day through the application, which will also continue to report the location of the individuals to the responsible local government officials. Should the self-isolating individual leave their designated location (e.g. home, hotel), the alarm embedded in the application goes off, incentivizing them to return to their location of self-isolation. According to the Ministry of Interior Safety, about 45 per cent of those subject to self-isolation (approximately 5,000 residents) have installed the application. The rest, who either do not own smartphones or have refused to install the app, are closely monitored via phone calls.
The app comes in six different languages. When the app is installed, it asks for permission to collect personal, health, and location data, listing the Quarantine Act and Infectious Disease Control and Prevention Act as legal grounds for doing so. In the final installation step, the app asks for the identification number of the local official from the contact tracing app responsible for the individual in self-isolation. The app further states that the purpose of the data collection is the containment of the COVID-19 outbreak and that the data collected will be stored for up to two months after the end of the COVID-19 outbreak, complying with the requirements of the EU’s General Data Protection Regulation (GDPR).
Apps are not silver bullets
As the outbreak continues to expand in Canada, federal and provincial government officials have started considering the use of similar apps for contact tracing, drawing attention to their uses in Asia. The Government of Alberta, for instance, will use a mobile app to enforce quarantines. In moving forward with app development and use in Canada, there are a few points worth considering about their usage in Singapore and South Korea.
First, the use of apps for contact tracing in Singapore and South Korea represents only a small part of their COVID success stories. Singapore introduced its app on March 21, and South Korea on March 7, when the curve had already started to flatten in both countries. Further, the installation of apps is voluntary and is managed in compliance with established privacy protection norms, with a relatively small number of subscribers. With stricter limitations on the public’s movements, such as restricting non-essential businesses as seen in parts of Canada, the relevancy of these applications lessens since people are already less likely to contract and spread the virus.
While privacy is a concern in Canada with the use of apps, similar concerns exist in South Korea and Singapore.Second, while privacy is a concern in Canada with the use of apps, similar concerns exist in South Korea and Singapore. Both states have made efforts to uphold global privacy rules and have established a clear legal basis for collecting personal data during disease outbreaks that align with GDPR guidelines. While there are some potential concerns about abuses (e.g. prosecution under IDA), it is critical that discussions in Canada focus on practical ways of balancing the provision of quality public service and the protection of personal data. Singapore and South Korea provide useful examples of what with further adjustments can achieve both: safeguard privacy and enhance public health efforts.
More importantly, while mobile apps have been helpful, they should not be seen as silver bullets. Singapore’s contact tracing teams and police have access to the city’s extensive surveillance infrastructure, with approximately 15 CCTV cameras per 1,000 people. Singapore also has one of the most efficient civil services in the world. In South Korea, the installation of the app is voluntary, and many people choose not to install it. As such, local officials must continue to monitor most of the self-isolating individuals through daily phone calls, which is what they were doing prior to the launch of the apps.
And finally, these two countries are relatively smaller and denser than Canada, their strong centralized governments oversee public health (rather than the provinces), and both have access to dense security infrastructure (e.g. CCTV cameras, national ID systems) that is not available in Canada. It is important to consider Singapore's and South Korea's co-ordinated and coherent mobilization of their public services to control virus transmission, not only apps, which provide only one component of a larger response.
