TraceTogether

From Infogalactic: the planetary knowledge core
Jump to: navigation, search
TraceTogether
80px
<templatestyles src="Template:Hidden begin/styles.css"/>
Screenshot
300px
Developer(s) Government Technology Agency
Stable release 2.7 / 29 March 2021
Written in
  • Kotlin (Android)
  • Swift (iOS)
Operating system Android, iOS
Available in Bengali, Burmese, Chinese, English, Hindi, Malay, Tamil, Thai
Type Digital contact tracing
COVID-19 apps
Licence GPL-3.0
Website www.tracetogether.gov.sg

TraceTogether is a digital system the Government of Singapore implemented to facilitate contact tracing efforts in response to the COVID-19 pandemic in Singapore. The main goal is quick identification of persons who may have come into close contact with anyone who has tested positive for COVID-19. The system initially consisted of an app, by the same name, and was later supplemented by a physical token mainly intended for elderly and children who may not own a smartphone, or those who prefer not to use the app. The system helps in identifying contacts such as strangers encountered in public one would not otherwise be able to identify or remember. Together with SafeEntry, it allows the identification of specific locations where a spread between close contacts may occur.

TraceTogether app

Technology

<templatestyles src="Module:Hatnote/styles.css"></templatestyles>

Main article: BlueTrace

The app utilises a custom protocol, BlueTrace, which allows for a distributed approach whereby participating devices exchange proximity information whenever an app detects another device with the TraceTogether app installed.[1][2][3] The protocol, and reference app implementations of it, were also open sourced as BlueTrace and OpenTrace respectively.[4][5]

Initial versions of the app required users to register using only their mobile number.[6], with subsequent versions from June 2020 onwards requiring users' NRIC or passport numbers. [7][8] The website states that the NRIC number is required in order to allow MOH to reach the right person when they need to give important health advice on COVID-19, and is stored in a secure server, never accessed unless needed for contact tracing, and never shared with other app users. [9] Further iterations of the app added support for SafeEntry, a national digital check-in system that logs the national identification and mobile numbers of individuals visiting hotspots, workplaces of permitted enterprises, as well as selected public venues.[10][11] The main goal of SafeEntry helps COVID-19 cases remember the places that they've visited. This helps MOH to identify potential infection clusters and perform cluster COVID-19 testing.[12]

Following installation, the user is requested to grant relevant permissions such as Bluetooth.[13] Android users are additionally required to grant Location permission as Bluetooth can be used to derive location information when combined with beacons in fixed locations. [14]

To trace users the Ministry of Health (MOH) issues time sensitive anonymous temporary IDs that are used to identify the patient to all third parties. When two users of the app pass by, it uses the Bluetooth Relative Signal Strength Indicator (RSSI) readings between devices across time to approximate the proximity and duration of an encounter between two users. This proximity and duration information is stored on one's phone for 25 days on a rolling basis.[1] Once a user tests positive for infection, the MOH works with them to map out their activity for past 14 days and requests the contact log. Facilitating the conduct of contact tracing measure to prevent further outbreak of any infectious disease, under the Infectious Diseases Act (Chapter 137), user cannot withhold contact information log.[15]

The usage of the app had been limited by the technical limitations of needing to have the application to run in the foreground on iOS devices, and battery drain,[16] but these problems had been reportedly addressed in the 2.1 version of the app released on 3 July 2020, and version 2.1.3 of 5 Aug added informational, work pass and SafeEntry QR features.[17]

Timeline

The app was released on 20 March 2020, following 8 weeks of development by Singapore's Government Technology Agency in collaboration with Ministry of Health (MOH). [18]

On 10 April 2020, following the lifting of the embargo on the Google-Apple Exposure Notification (GAEN) system, the developers announced that they had been working with Apple and Google on specifications which would allow for cross-border inter-operability, and had begun to incorporate these new APIs into TraceTogether.[19][20][21] The developers envisaged this as a way to overcome the app's inability to access full background Bluetooth scanning functionality on iOS devices (which led to the app being active only when it ran in the foreground), and increase the pool of interoperable devices, both of which could have increased the contact tracing utility.[19]

On 5 June 2020, the Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan acknowledged in Parliament the inability of the TraceTogether app to work well particularly on iOS or Apple devices, and that these had not been overcome despite discussions at the technical and policy level with Apple. [22] He subsequently explained that the Government had decided against using the Google-Apple Exposure Notification (GAEN) system, citing its inability to "identify how, when and whom the person was infected by or passed the infection to" and "the 'graph' not being available to the contact tracers".[7][21][23]. Instead, a new portable, wearable device, called the TraceTogether Token would be issued to all 5.7 million residents in order to increase the pool of participants. [21][24]

On 7 December 2020, market research firm Gartner crowned TraceTogether as the Asia-Pacific winner for its 2020 Government Eye on Innovation award, after the firm had conducted a poll among various government organisations around the world.[25][26][27][28]

Uptake and Effectiveness

During the release of the app, Minister for National Development Lawrence Wong, a co-chair of the multi-ministry Covid task force, explained that for TraceTogether to be effective, at least three-quarters - if not everyone - of the population had to install it, and had to turn on their Bluetooth function to ensure the app was running.[6]

On 10 April 2020, approximately 3 weeks after its release, about one million people had downloaded the app, which translated to about one in six of the resident population at the time.[29] This percentage increased to 17% of the population in May 2020.[30]

On 5 June 2020, the Minister-in-charge of the Smart Nation Initiative announced in Parliament that the TraceTogether has been downloaded on a voluntary basis by 1.5 million users, which worked out to only 25 per cent of the population. [22]

By 4 September 2020, about 2.4 million users had downloaded the app, with 1.4 million active users in August.[31]

As of 14 December 2020, following the release of the token, adoption rate of the app and token combined exceeded 60% of Singapore's resident population.[32] Despite falling short of the 70% adoption target that the Government had set loosen restrictions,[32] the Government later announced on the same day the loosening of restrictions to start from 28 December 2020.[33]

On 23 December 2020, Balakrishnan revealed that the adoption rate had exceeded 70%.[34]

On 11 May 2021, Balakrishnan revealed that the adoption rate had exceeded 92%, with 4,923,054 individuals aged above six.[35]

With TraceTogether complementing manual contact tracing effort,[36] the contact tracing teams has improved their efficiency by reducing the time taken to identify and quarantine a close contact from four days to less than two days.[32] More than 10% of close contacts identified by TraceTogether turned positive during quarantine period,[37] the percentage may be low due to Singapore mandating mask-wearing since 14 April 2020.[38]

On 22 April 2021, the effectiveness of TraceTogether managed to identify 75 persons who had to be placed under quarantine, but would likely not have been picked up through a manual contact tracing process.[39]

TraceTogether Token

On 7 June 2020, Minister-in-Charge of the Smart Nation Initiative Vivian Balakrishnan announced that the government would be distributing a physical device, named TraceTogether Token, to augment the app.[24] The TraceTogether Token is designed primarily to support Singapore residents who do not own a smartphone, mainly some elderly, children aged seven and above[40] or residents with workplace restriction. The physical token helps to increase the optimal number of users required for the contact tracing system to work well, which was 75% of the population.[24] With the issuance of the device, the government aimed to achieve at least 70% of the population using either the TraceTogether Token or app.[41]

Upon the announcement of the physical device, there was a public backlash against the physical device initiative, with a petition launched to protest against the development of the device over concerns about potential privacy issues.[42] The Singapore People's Party also released a statement regarding the privacy concerns and about the potential abuse of the data.[43]

Similar to the app, the TraceTogether Token utilises BlueTooth to exchange signals with other TraceTogether Tokens or the mobile app. After encrypting the data of what devices or apps are near by, the device stores up to 25 days of information before deletion.[41] The device is designed for those who have no smartphone, which consisted of about 5% of the population. It is designed to be waterproof and its battery life is about six months. There are no physical buttons on the device, and it has a green/red light indicator for battery life and/or to indicate a fault.[41] The device does not have GPS functionality, and access to the data remains restricted among the civil service.[43]

The physical device was made available for collection from 14 September 2020.[44][45][46]

A 26 October 2020 report indicated that there was a higher than expected demand after the news of mandatory usage of TraceTogether was released.[47] Authorities also did not expect that residents would travel to different distribution points island-wide to collect the tokens[48] and had suspended collection for a day on 28 October 2020 to rework the distribution strategy.[49] The collection of the token at the community centres could only be made by residents in the respective constituencies, and distribution was done on a rolling basis at the constituency level,[49][50][51] with the last remaining community centres reopened for collection only on 23 December 2020.[52] A Straits Times editor, Irene Tham advocated on 30 October 2020 for the tokens to be distributed first and mandate the usage later.[53] Tham also suggested a similar queue system to that of telcos registering customers and assigning time slots could be adopted to avoid overcrowding at the collection points as it was noted that a crowd formed and lasted for a couple of hours at Marsiling Community Centre for a couple of hours even after that distribution strategy was reworked.[53]

Mandatory usage of TraceTogether

Downloading, installing and activating (registering) the app has been made mandatory for specific populations, such as migrant workers.[54][55]

The usage of either the app or the token was to be made mandatory initially by December 2020 for people attending potential high risk activities or large events, together with the usage of SafeEntry system.[56] Places where TraceTogether will be compulsory include cinemas, restaurants, workplaces, schools and shopping malls.[57]

According to the Singapore Government, this is in part to encourage the adoption of the app or the device, and at the same time answer the question of to whom a person could have passed the virus to through close contact at the event or activity.[56]

File:TraceTogether History negative.jpg
Example of a 'normal' TraceTogether History tab required for entry

On 2 November 2020, Ministry of Education postponed its requirements for students to use either the app or token for entry to school from 1 December 2020 until all tokens are distributed.[58] As with what Tham had raised in her news report on 30 October 2020 about the coordination of the timelines between the token collection and mandatory usage,[53] the Member of Parliament for Mountbatten, Lim Biow Chuan had also questioned the timeline of the mandatory usage at public venues such as cinemas in the Parliament on 4 November 2020 as his constituency was scheduled to distribute the tokens only from 14 December 2020 onwards.[48] On 14 December 2020, the mandatory usage of TraceTogether app or token had been pushed back to early 2021 to allow for more residents to collect the token.[59]

On 22 April 2021, the Minister of Health and Smart Nation and Digital Governance Group (SNDGO) announced that TraceTogether will be mandatory for checking in to various venues and events from 1 June onwards.[39] This was subsequently brought forward to 17 May 2021 in a later announcement on 4 May, in response to a recent spike in community cases.[60] Other methods of checking in – scanning the SafeEntry QR codes with a different QR mobile app, or using the Singpass app – will be discontinued,[39] while the use of identification cards will be allowed only until 31 May 2021.[60]

Use by commercial organisations to deny access

In early May 2021, some businesses including ComfortDelGro Driving Centre, Royal Caribbean Cruises and Dream Cruises were reported to have denied entry to students and passengers whose TraceTogether app displayed "possible exposure", despite the Ministry of Health (MOH) affirming that such persons were at low risk and not restricted from continuing with their regular activities. [61] This was effected by requiring customers to show the ‘Covid Health Status’ section of the app or the ‘history’ tab, despite the app data being originally intended only for personal reference. [62] The Singapore Tourism Board subsequently issued a statement that "cruise lines should adhere to the guidance from the MOH and the SNDGO regarding the use of data from the TraceTogether app", while the cruise companies reversed or changed the ban to an advisory "encouraging" affected passengers to postpone their sailing dates.[62]

Privacy

File:TraceTogether Privacy Statement.jpg
Original Privacy Statement on the TraceTogether App

The BlueTrace protocol is designed to preserve the privacy of users,[63] but in contrast to other implementations, the TraceTogether app is not anonymous as participants have to register using their phone number and national registration number or other evidence of residency.

To safeguard participant's mutual privacy and ensuring their control over the data, TraceTogether states that it:[64]

  • Stores limited data. Data over 25 days old is deleted automatically. When signing up, a random User ID is generated and associated with the mobile number. Both the mobile number and User ID are stored in a secure government server. All data from or about other phones will not be accessed, unless the user has been in close contact with a COVID-19 case and is contacted by the contact tracing team.
  • Does not collect data about location via GPS or Wi-Fi, however fine-grained location tracking is possible using Bluetooth.[65] TraceTogether uses Bluetooth to approximate distance to other nearby phones running the same app.
  • Creates temporary IDs that change regularly.
  • Allows consent revoking via an email to a government agency. If a user opts out, their contact information is deleted from the MOH servers, meaning any log entries they appear can no longer be matched to them.[63][66]
  • Prompts disabling TraceTogether's functionality once contact tracing ceases.

The main privacy concern relating to the BlueTrace protocol is due to the use of centralised report processing, in which a user must upload their entire contact log to a health authority administered server. This is in contradistinction to decentralised report processing protocols such as the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) protocol.

In Parliament on 2 February 2021, it was revealed that the police could request the data after 25 days under certain unspecified exceptions.[67][68]

Controversy over police access

Access under the Criminal Procedure Code

On 4 January 2021, Minister of State for Home Affairs Desmond Tan revealed in Parliament that TraceTogether data could be accessed by the police for criminal investigations under the Criminal Procedure Code, which contradicted previous assurances by Minister Balakrishnan and others that the data would be used only for contact tracing.[69][70][71] This disclosure followed investigations triggered by an inquiry from a member of the public in October 2020, and the filing of a parliamentary question by MP Christopher de Souza in early December 2020, with the 3-month delay attributed to deliberations over the possibility of excluding TraceTogether data from the Criminal Procedure Code.[72][73]

Access during the May 2020 murder investigation

On 5 January 2021, Minister Balakrishnan updated Parliament that the police had to the best of his knowledge by that point in time accessed contact tracing data once in the case of a murder investigation.[74][75] Following questions from Leader of the Opposition Pritam Singh and Non-Constituency MP Leong Mun Wai, Minister Desmond Tan explained in Parliament on 2 February 2021 that this had happened in May 2020 during the course of the Punggol Field murder investigation.[76]

Reactions

There was significant backlash to the announcement, despite Balakrishnan's explanation and acceptance of full responsibility.[69][70][72][77] Some observers attributed this to the fact that the clarification was made 9 months after the data had already been used, and only in response to direct and repeated parliamentary questioning.[73] Privacy concerns were raised by various experts with former Nominated Member of Parliament and Associate Professor of Law Eugene Tan saying that "the news came across as the Government backtracking on its earlier assurance that TraceTogether would only be used for contact tracing" and "clearly undermines their trust and credibility, and could undermine its future efforts .... to keep Covid-19 under control".[78]

Following the announcement, some users deleted the app or left the token at home, while others disabled their phone's Bluetooth or selected the “Pause Tracking” function after checking in.[79] In the month of the disclosure (January 2021), 350 people requested that their contact tracing data be erased from the government's servers,[80] with the number increasing to more than 1100 by April.[35]

The original TraceTogether privacy statement[81][lower-alpha 1] was updated on 4 January 2021 to include possible access by police officers for investigations.[69]

Various officials provided reassurances. Balakrishnan explained that this situation was not unique to TraceTogether and that under the same law, other forms of sensitive data like phone or banking records could also have their privacy regulations overruled.[82] Desmond Tan emphasised that access to TraceTogether data remained restricted without authorisation.[69] This point was reiterated by K Shanmugam, who said that the police will restrict the use of TraceTogether to "very serious offences" like murder and terrorism, only after careful consideration and discretion.[83] In addition, Balakrishnan said that TraceTogether programme will be stood down once the COVID-19 pandemic ends, with epidemiological data given to MOH that does not identify users.[84]

The backlash prompted the Government to introduce the COVID-19 (Temporary Measures) (Amendment) Bill on 2 February 2021 formalising the assurances to restrict police access to investigate for seven categories of offences.[72][85] Additionally, only senior police officers with the rank of inspector and above can request for data in the TraceTogether system, similarly to existing data requests requirements for bank data from financial institutions.[85] The Bill was debated among the Members of Parliament from People's Action Party, Workers' Party (WP), and Progress Singapore Party (PSP), with members from opposition WP preferring not to use the data but support a bill to restrict, and PSP opposing the use of data.[85] The Bill was passed by the end of the session.[85]

Singapore's reversal of initial promises regarding police access to TraceTogether data was cited as one of the reasons for resistance to the Hong Kong's COVID-19 contact-tracing application, LeaveHomeSafe.[86][87]

See also

Notes

  1. ↑ Refer to archived version of original privacy statement

References

  1. ↑ 1.0 1.1 Lua error in package.lua at line 80: module 'strict' not found.
  2. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  3. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  4. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  5. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  6. ↑ 6.0 6.1 Lua error in package.lua at line 80: module 'strict' not found.
  7. ↑ 7.0 7.1 Lua error in package.lua at line 80: module 'strict' not found.
  8. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  9. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  10. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  11. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  12. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  13. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  14. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  15. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  16. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  17. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  18. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  19. ↑ 19.0 19.1 Lua error in package.lua at line 80: module 'strict' not found.
  20. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  21. ↑ 21.0 21.1 21.2 Lua error in package.lua at line 80: module 'strict' not found.
  22. ↑ 22.0 22.1 Lua error in package.lua at line 80: module 'strict' not found.
  23. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  24. ↑ 24.0 24.1 24.2 Lua error in package.lua at line 80: module 'strict' not found.
  25. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  26. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  27. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  28. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  29. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  30. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  31. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  32. ↑ 32.0 32.1 32.2 Lua error in package.lua at line 80: module 'strict' not found.
  33. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  34. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  35. ↑ 35.0 35.1 Lua error in package.lua at line 80: module 'strict' not found.
  36. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  37. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  38. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  39. ↑ 39.0 39.1 39.2 Lua error in package.lua at line 80: module 'strict' not found.
  40. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  41. ↑ 41.0 41.1 41.2 Lua error in package.lua at line 80: module 'strict' not found.
  42. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  43. ↑ 43.0 43.1 Lua error in package.lua at line 80: module 'strict' not found.
  44. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  45. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  46. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  47. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  48. ↑ 48.0 48.1 Lua error in package.lua at line 80: module 'strict' not found.
  49. ↑ 49.0 49.1 Lua error in package.lua at line 80: module 'strict' not found.
  50. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  51. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  52. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  53. ↑ 53.0 53.1 53.2 Lua error in package.lua at line 80: module 'strict' not found.
  54. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  55. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  56. ↑ 56.0 56.1 Lua error in package.lua at line 80: module 'strict' not found.
  57. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  58. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  59. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  60. ↑ 60.0 60.1 Lua error in package.lua at line 80: module 'strict' not found.
  61. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  62. ↑ 62.0 62.1 Lua error in package.lua at line 80: module 'strict' not found.
  63. ↑ 63.0 63.1 Lua error in package.lua at line 80: module 'strict' not found.
  64. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  65. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  66. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  67. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  68. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  69. ↑ 69.0 69.1 69.2 69.3 Lua error in package.lua at line 80: module 'strict' not found.
  70. ↑ 70.0 70.1 Lua error in package.lua at line 80: module 'strict' not found.
  71. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  72. ↑ 72.0 72.1 72.2 Lua error in package.lua at line 80: module 'strict' not found.
  73. ↑ 73.0 73.1 Lua error in package.lua at line 80: module 'strict' not found.
  74. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  75. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  76. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  77. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  78. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  79. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  80. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  81. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  82. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  83. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  84. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  85. ↑ 85.0 85.1 85.2 85.3 Lua error in package.lua at line 80: module 'strict' not found.
  86. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  87. ↑ Lua error in package.lua at line 80: module 'strict' not found.
Retrieved from "https://infogalactic.com/w/index.php?title=TraceTogether&oldid=726237348"