askST: How new token and app will address privacy concerns

The new TraceTogether Token and updated TraceTogether app are part of stepped-up efforts to curb the spread of Covid-19. PHOTO: ST FILE

SINGAPORE - Questions have been raised about the implications for privacy with the announcement of a contact tracing device and an updated version of an existing app, both developed by the Government.

One is the new TraceTogether Token and the other, an updated TraceTogether app - both of which are part of stepped-up efforts to curb the spread of Covid-19 in Singapore.

The updated app requires Singaporeans to enter their NRIC numbers and for other residents, their work pass or Dependant's Pass numbers. All residents also have to give their mobile phone numbers.

The passport details - name, passport number, birth date and nationality - of short-term visitors will also be captured by the app as users will be asked to enter them into the app.

The TraceTogether Token will be issued from the second half of this month, while the updated TraceTogether app was rolled out last week.

Tech Editor Irene Tham looks at the six commonly asked questions about the TraceTogether Token and app.

Q: Why TraceTogether Token?

A: The token will allow people, such as children and the elderly, who may not have smartphones or the latest models of smartphones, to participate in digital contact tracing.

Currently, people have to download the TraceTogether app on their smartphones, which cannot be more than five years old or use an older operating system.

Singapore needs to drive up participation rate to more than 75 per cent, from the current 25 per cent, for digital contact tracing to be effective, Minister-in-charge of the Smart Nation Initiative Vivian Balakrishnan said at a multi-ministry task force virtual news conference on Monday.

The boost is crucial in the current post-circuit breaker period as more workers return to their physical place of work, more domestic business activities start again and Singapore mulls over allowing cross-border travel for work to resume.

Digital tools will reduce the time it takes to trace the close contacts of a Covid-19 infected person to less than a day, compared with two to three days using manual methods.

Q: How will the TraceTogether Token work?

A: The token will function in a similar way to the TraceTogether app.

Short-range wireless Bluetooth signals emitting from the token will be exchanged with nearby devices, which could be another token or a Bluetooth-enabled smartphone with the TraceTogether app.

The exchange will be logged in encrypted form in both the device and app, with data older than 25 days erased automatically.

The data will not be uploaded to a central server by default.

Q: Is the Government using TraceTogether to track citizens' whereabouts?

A: The TraceTogether Token and app do not collect location data. The token does not even have any mobile connectivity to enable such tracking.

Plus, the data logs stay in the phone or the token until the user is confirmed to be a Covid-19 patient. The Ministry of Health (MOH) will then ask for the token to be handed over to extract exchange logs for contact tracing. Smartphone users will be guided to remotely upload data logs in the TraceTogether app to MOH.

While use of the app and token is currently voluntary, refusing to cooperate with the health authorities, like sharing data logs, is an offence under the Infectious Diseases Act.

Q: Can the TraceTogether Token or app detect when social distancing is not observed, and result in users being prosecuted?

A: While Bluetooth devices can detect proximity by signal strength readings, the authorities have assured people that the logs will be used only for contact tracing, nothing more.

"There is no intention to use a TraceTogether app or TraceTogether Token as a means of picking up breaches of existing rules," Dr Balakrishnan said on Monday.

Q: Why is there a need for the existing 1.8 million TraceTogether app users to re-register by entering their NRIC numbers?

A: The NRIC number helps speed up and ensure accurate contact tracing by allowing greater inter-operability with the Government's visitor check-in system SafeEntry.

For instance, contact tracers can identify the close contacts of confirmed Covid-19 patients by their NRIC numbers and locate their home address, even if their phone numbers change or their phones are switched off.

By adding a feature to capture passport details, short-term visitors in Singapore can also participate in digital contact tracing. Others, including work pass and Dependant's Pass holders, can also have their relevant information captured by the digital system more accurately.

Q: How will users' data be protected?

A: All public-sector data protection rules will apply to the data held by MOH. These rules include purging data from the central database or retaining data in an anonymised form when it is no longer required for contact tracing.

People who suspect data breaches by government agencies can "blow the whistle" by completing a form on the Smart Nation website.

Join ST's WhatsApp Channel and get the latest news and must-reads.