BANGKOK: There have been concerns over knowledge privacy in Thailand’s COVID-19 contact tracing app, because the nation battles a new wave of infections.
Despite these challenges, the authorities are attempting to encourage extra individuals to make use of the app, together with by way of efforts to guard private information.
Since mid-December, Thailand has reported greater than 14,000 new cases from a number of clusters, following months of zero native transmissions. In whole, there at the moment are greater than 23,000 confirmed cases within the nation.
As the federal government makes an attempt to regulate the pandemic, numerous lockdown measures have returned and proactive testing has been carried out in communities. To preserve observe of the unfold of the virus, the federal government has inspired individuals to make use of a state-run contact tracing cellular software referred to as Mor Chana or Doctors Win within the native language.
“I’ve never downloaded this app and never will because I don’t trust it. I feel what I risk losing isn’t worth the services I’d get from having this app,” mentioned college instructor Phanphaka Rungruang from Bangkok.
“I’m afraid of data breaches caused by malware like spyware,” she added. “I’m not so worried about my phone number or identity but rather the government’s indirect surveillance.”
Mor Chana’s effectiveness depends on the scale of its lively person base. Since its launch in April final yr, the app has about 7 million to eight million downloads, in line with information expertise director Julapong Ponngoh from the Digital Government Development Agency (DGDA).
“Frankly speaking, this is not a lot. If not enough people download this app, it won’t be of much use, really,” he mentioned.
Mor Chana’s downloads presently make up lower than 20 per cent of Thailand’s Internet customers who log on with their smartphones, which is about 41 million primarily based on a 2019 survey by the Ministry of Digital Economy and Society.
“The app is driven by the number of active users. That’s why the government has been trying to promote it so that it gets used as much as possible,” Julapong added.
- READ: Bill restricting use of TraceTogether data for serious crimes passed by Singapore Parliament
- READ: Behind the scenes of a COVID-19 contact tracer’s work, tough cases and how TraceTogether has helped
- BOOKMARK THIS: Our comprehensive coverage of the coronavirus outbreak and its developments
HOW MOR CHANA WORKS
The app was initially developed by volunteers from numerous organisations who needed to leverage smartphone applied sciences to help healthcare staff in Thailand in controlling the COVID-19 pandemic.
The expertise was absolutely transferred to the federal government on Jan 15 and has since been managed by the Disease Control Department of Thailand’s Public Health Ministry and DGDA.
According to Julapong, Mor Chana’s knowledge controller is the Disease Control Department, which has the ability and duties to make selections relating to the gathering, use or disclosure of customers’ private knowledge.
His company, however, features as an information processor, which implies it solely operates the gathering, use or disclosure of private knowledge when ordered by the Disease Control Department.
“The top priority right now is to control the pandemic. So, the main user is the Disease Control Department. We’re working to help it access information and respond promptly,” he advised CNA.
Mobile cellphone customers who set up the newest model of Mor Chana will first be prompted to take a selfie and permit the app to entry sure assets needed for contact tracing similar to GPS location and Bluetooth.
The app will then create a QR code for them and full the set up. This code, in line with Julapong, offers them with an nameless identification (AID) and might solely be deciphered by officers from the Disease Control Department utilizing a particular device.
When Mor Chana is lively, it data the place and when every AID is situated and sends the information to the central server. If there is no such thing as a GPS sign, the app will seek for Bluetooth indicators from close by telephones and document their GPS places as an alternative. Users will not be required to check-in at particular person institutions.
Such knowledge is analysed when COVID-19 sufferers are recognized, together with their previous journey historical past. Health officers can point out people in danger of an infection, utilizing their GPS places and AIDs saved within the central server. They can then proceed to alert the customers of the well being danger by way of app notifications.
“The system doesn’t list names but (only) AIDs. So, the doctors won’t know to whom these AIDs belong,” Julapong mentioned.
“If users open the app to check the message, they’ll see a warning from the Disease Control Department that they were in close contact with a risk group at a certain place and time and that they’re at risk and should urgently contact the department.”
Unlike in its earlier variations, Mor Chana now not requires customers to disclose their private information similar to names, addresses or cellphone numbers. This would imply that the onus is on these recognized as being in danger of an infection to get in contact with the authorities.
As for its request for a selfie upon set up, Julapong mentioned the picture is simply saved on the person’s cellphone and might be used to show that they’re the proprietor of the gadget when reporting themselves to healthcare officers in any potential illness investigation course of.
However, these particulars will not be spelt out within the app’s privacy coverage, which presently states it requires the person’s cellphone quantity, age and deal with. Moreover, the privacy coverage doesn’t present clear particulars on who can share the information, merely saying the DGDA might share it with “other relevant authorities” underneath authorized foundation in several cases.
For knowledge legislation specialists, failure to precisely and comprehensively declare the app’s necessities and functions may have an effect on the transparency of Mor Chana in addition to the quantity of lively customers.
The specialist in private knowledge safety legal guidelines mentioned a transparent and correct privacy coverage is the duty of the information controller, who ought to declare what private knowledge is collected to be used, why it’s collected and to whom or which entities it might be disclosed.
Despite earlier affirmation by the federal government about Mor Chana’s knowledge privacy, Prapanpong mentioned its present privacy coverage is so broad it “opens a window of possibility” for the non-public knowledge to be shared with different events.
“If the policy could detail clearly which groups or units can access the data, people would have more confidence and understanding in this regard,” he added.
“It’s better than just guessing if that is possible.”
READ: Behind the scenes of a COVID-19 contact tracer’s work, tough cases and how TraceTogether has helped
CONCERNS OVER PERMISSIONS GIVEN TO APP
While there have been preliminary concerns over the permissions given to the app, latest software program updates point out an try to permit customers to be extra selective in managing these permissions.
Last yr, an information privacy research carried out by the Data Protection Excellence (DPEX) Centre in Singapore revealed that Mor Chana is essentially the most privacy-intrusive contact tracing app amongst these rolled by six Southeast Asian governments.
In its Privacy Sweep report, the centre reviewed six contract tracing apps developed by the governments of Indonesia, Malaysia, Philippines, Singapore, Thailand and Vietnam.
Data safety specialists studied the kinds of permissions sought by these apps on the Android working system and whether or not they exceeded what can be anticipated primarily based on their performance. They additionally assessed how every of the apps defined to customers why it needed their private knowledge and what it deliberate to do with the information.
“It appeared then that Mor Chana used the most permissions – camera, device and app history, location, microphone, photos/media/files, and phone storage – to perform its functions. We reviewed these permissions against the functions and purposes of the app,” head of the DPEX Centre and knowledge privacy specialist Kevin Shepherdson advised CNA.
Permissions given to an app enable it to entry the person’s private knowledge on the cellular gadget but when abused, they might pose potential dangers for private knowledge privacy.
For occasion, permission to entry the digicam allows the app to take footage and movies on the cellphone nevertheless it may additionally enable the app to observe the person by way of the digicam and take heed to the person by way of the microphone. The microphone permission, however, permits the app to document audio.
However, Shepherdson famous that which have been “positive privacy developments”, primarily based on the newest app replace within the Google Play Store on Jan 18.
“The app now uses fewer permissions and they are only the permissions required for the app’s core functions to work. For example, it no longer requires permission to record audio – microphone – which would be excessive,” he mentioned.
As day by day new case counts in Thailand proceed within the tons of, well being officers have suggested mobile phone customers to obtain Mor Chana to get promptly notified of potential well being dangers in addition to to assist velocity up the illness investigation course of and combat the pandemic.
However, there are trade-offs between well being and security, in addition to private privacy.
According to Shepherdson, a key ingredient that might assist the Thai authorities to strike a steadiness between public well being and knowledge privacy is transparency in Mor Chana’s privacy coverage.
“It is important during a pandemic such as this because the people need to trust the government,” he advised CNA.
At current, Mor Chana’s privacy coverage is being edited to mirror its present options and a new model is anticipated to be printed sooner or later, in line with Julapong. Still, some stay sceptical and like to maintain their private knowledge confidential.
“I don’t want to download it because I don’t think it’d be so useful. I don’t want to reveal my personal data either as I fear the government would misuse it,” mentioned dentist and Bangkok resident Chanya Srisa.
“I take care of myself by wearing a facial mask whenever I go out and avoiding crowded places. I mainly travel between my workplace and home these days.”