TraceTogether and police investigations

My speech in Parliament on 2 Feb 2021 on the COVID-19 (Temporary Measures) (Amendment) Bill.

When I first read the January 4th Parliamentary Question by the Member for Holland-Bukit Panjang, Mr Christopher de Souza, I anticipated that the Government would answer it in one of two ways: 

One, that TraceTogether (or TT) data is not, and will never, be used for anything other than contact tracing, as per their earlier assurances; or two, that TT data may be used for criminal investigations in some circumstances. 

I thought the second scenario would be less likely. I shared with a colleague ahead of that day’s sitting that I did not think the Government would use TT data for non-contact tracing purposes. It would cause a public outcry, as it would violate the TT’s privacy policy and what the Government had been saying about TT’s privacy protections so far. More damagingly, it could lead to a lower adoption rate for TT, which would in turn hinder our battle against the Covid-19 pandemic.

As it turned out, option two was closer to reality. Minister of State Desmond Tan said that, “the Singapore Police Force is empowered under the Criminal Procedure Code or CPC to obtain any data, including TraceTogether or TT data, for criminal investigations”, and went on to assure the House that the data was secure and only authorised officers are allowed to access it. 

In response to my Supplementary Question, the Minister of State clarified that other than for the purpose of criminal investigations and protecting public safety and security, TT data is to be used only for contact tracing. 

The next day, on January 5th, the Minister for Foreign Affairs made a clarification, following a lot of unease expressed by Singaporeans about the previous day’s revelations, where he stated that the use of TT data would be restricted to “serious crimes”.

Three days later, on January 8th, the Smart Nation and Digital Government Office announced upcoming legislative provisions for the usage of data from TT and SafeEntry, which are the Bill we are debating today.

Why did the Government choose to make this revelation only on January 4th, more than nine months after TT was launched? All that time, the TT privacy statement contained a more absolute assurance: “Any data shared with MOH will only be used solely (sic) for contact tracing of persons possibly exposed to Covid-19” (see Annex A below). This changed only sometime after 12.25pm on January 4th—the afternoon that the PQ was answered—with a new clarification that it can also be used for criminal investigations (Annex B).

On 8th of June 2020, the Minister for Foreign Affairs had stated in a press conference that TT data is “only used for contact tracing.”  While the Minister has since admitted that he had not thought of the CPC at that time and I appreciate his explanation, why didn’t anyone in Government come out sooner to correct his misstatement? 

Many Singaporeans downloaded the TT app and collected the TT tokens in large numbers, in part because they trusted the Government’s assurances of privacy and limitation of use. 

This unfortunate sequence of events may make many Singaporeans more wary of taking Government statements at face value. Some may now adopt Ronald Reagan’s adage: Trust, but verify.

We may now have a 80% adoption rate for TT, but we should not rest on our laurels and become complacent. First, the more people use TT, the more effective contact tracing will be. We should always aim for maximum adoption and usage, and minimise any obstacles to adoption, for example privacy fears or poor app performance.

Second, just because 80% of residents have downloaded the app or collected the token, it doesn’t mean they are actually using it. There are many ways that TT can be disabled. There is even a pause function within the TT app itself. Suffice to say, one does not need to be a rocket scientist to figure out how to legally disable the TT app or token.

With the 4th January revelation, people who anticipate engaging in even minor misdemeanours may choose to disable TT just to avoid detection. Some might even do so to avoid being called as a witness in a court case. Others might do so, as a matter of principle or because of their lack of trust in the Government. All these might add up to a not-so-insignificant proportion of our population.

We may think that these people are holding out on TT for unjustifiable reasons, but we cannot control every action that individuals make with their electronic devices. Ultimately, TT relies on user consent. Perception will drive behaviour. The net result may be a lower than desired usage of TT, which will hamper our contact tracing efforts.

The Government does not want to constrain itself by committing to never use TT data for crime fighting. However is the potential cost of slower containment of the community spread of Covid-19 worth it?

Put another way: If the Covid-19 situation were to take a turn for the worse, overwhelming our healthcare system, would the police still use TraceTogether data if it inadvertently suppresses the adoption rate and hinders contact tracing efforts? Mr Murali Pillai said in his speech earlier that it is worth using the contact tracing data if even one serious crime is solved. On the flip side, is it worth it if even one Covid-19 cluster goes undetected because a few people deactivated their TT app out of privacy concerns?

I will, with some reluctance, be prepared to support this Bill. However, I hope the Government and the police will consider this question carefully in deciding how often and to what extent it uses the broad powers conferred on it by Section 20 of the CPC and this Bill.

Mr Speaker, I have some further clarifications for the Minister on the Bill.

First, we now know that SafeEntry data is also accessible to the police. Since its launch, how many times have the police used SafeEntry data for investigations and how many of these investigations were outside of the seven serious crimes in the Seventh Schedule?

Second, the sunset clause under the proposed section 82(8) gives a lot of power to the Minister to determine if we still need digital contact tracing and when the contact tracing data will be deleted. The pandemic may last another four to five years, as Minister Lawrence Wong has recently alluded to. In an even more pessimistic scenario, Covid-19 may never be fully eradicated but will become endemic in our population. If this happens, will these digital contact tracing systems ever be stood down? What is the criteria that will be used to determine this?

Third, do the safeguards in section 82 of the Bill cover data that has been uploaded to MOH databases for the purposes of contact tracing? If so, will the police still be allowed to access this data, even after the pandemic is over?

I asked a similar question on January 5th and the Minister answered then: “I believe that once the pandemic has passed, that data – certainly, the specific, personalised data – those fields should be eliminated.”

Can I confirm that this remains the intent of this Bill?

Annex A

TraceTogether privacy statement, 4 Jan 2021, 12.25pm 

Annex B

TraceTogether privacy statement after 4 Jan 2021

Author: Gerald Giam

Gerald Giam is the Member of Parliament for Aljunied GRC. He is a member of the Workers' Party of Singapore. The opinions expressed on this page are his alone.