Data privacy concerns above Thailand's COVID-19 get in touch with tracing software amid new wave of cases

There have been concerns more than data privacy in Thailand’s COVID-19 contact tracing app, mainly because the country battles a fresh wave of infections.

Despite these challenges, the authorities want to encourage more persons to use the app, including via efforts to protect personal information.

Since mid-December, Thailand has reported a lot more than 14,000 new cases from more than a few clusters, following a few months of zero hometown transmissions. Altogether, there are now a lot more than 23,000 confirmed situations in the country.

As the federal government attempts to control the pandemic, various lockdown procedures have came back and proactive testing has been completed in communities. To keep an eye on the spread of the virus, the government has encouraged people to employ a state-run get in touch with tracing mobile application known as Mor Chana or Doctors Win in the local language.

“I’ve never downloaded this iphone app rather than will because I don’t trust it. I feel what I risk losing isn’t worth the services I’d get from having this app,” said university teacher Phanphaka Rungruang from Bangkok.

“I’m afraid of data breaches caused by malware like spyware,” she added. “I’m not worried about my contact number or identity but instead the government’s indirect surveillance.”

Mor Chana’s effectiveness depends on the size of its active user base. Since its start in April this past year, the app has about 7 million to 8 million downloads, according to information technology director Julapong Ponngoh from the Digital Authorities Development Agency (DGDA).

“Frankly speaking, this is not a lot. If not enough persons download this app, it won’t be of many use, really,” he said.

Mor Chana’s downloads currently constitute less than 20 per cent of Thailand’s Internet users who go surfing with their smartphones, which is approximately 41 million predicated on a 2019 study by the Ministry of Digital Market and Society.

“The software is driven by the amount of active users. That’s why the federal government has been trying to promote it in order that it gets applied as much as possible,” Julapong added.

HOW MOR CHANA WORKS

The app was actually produced by volunteers from various organisations who wished to leverage smartphone technologies to assist healthcare staff in Thailand in controlling the COVID-19 pandemic.

The technology was fully transferred to the government on Jan 15 and has since been managed by the condition Control Section of Thailand’s Public Wellness Ministry and DGDA.

Regarding to Julapong, Mor Chana’s data controller may be the Disease Control Section, which has the energy and duties to create decisions about the collection, use or perhaps disclosure of users’ personal data.

His agency, alternatively, functions as a info processor, this means it only operates the collection, use or perhaps disclosure of personal info when ordered by the condition Control Department.

“The top priority at the moment is to regulate the pandemic. Therefore, the main user may be the Disease Control Section. We’re working to make it access information and react promptly,” he informed CNA.

People walk in Icon Siam shopping centre amid the COVID-19 outbreak in Bangkok, Thailand. (File photo: Reuters/Soe Zeya Tun)

Cellular phone users who install the most recent version of Mor Chana will earliest be prompted to have a selfie and invite the app to gain access to certain resources essential for call tracing such as GPS location and Bluetooth.

The app will create a QR code for them and complete the installation. This code, according to Julapong, delivers them with an anonymous identification (AID) and can only end up being deciphered by officials from the condition Control Department by using a special tool.

When Mor Chana is active, it information where so when each AID is situated and sends the data to the central server. If there is no Gps navigation signal, the application will search for Bluetooth signals from nearby cell phones and record their GPS locations instead. Users aren't necessary to check-in at specific establishments.

Such data is certainly analysed when COVID-19 patients are identified, with their earlier travel history. Overall health officials can indicate individuals vulnerable to infection, utilizing their GPS places and AIDs kept in the central server. They are able to then proceed to alert the users of medical risk via iphone app notifications.

“The system doesn’t list names but (only) AIDs. So, the doctors won’t find out to whom these AIDs belong,” Julapong said.

“If users wide open the app to check on the message, they’ll visit a warning from the condition Control Department that these were in close connection with a risk group at a certain place and period and that they’re at risk and should urgently contact the section.”

ONLINE PRIVACY POLICY NOT CLEARLY SPELT OUT

Unlike in its previous versions, Mor Chana no longer requires users to uncover their personal information such as for example names, addresses or telephone numbers. This would imply that the onus is certainly on those determined as being at risk of infection to speak to the authorities.

As for its obtain a selfie upon assembly, Julapong said the image is only kept on the user’s mobile and will be used to prove that they are the owner of the device when reporting themselves to healthcare officials in virtually any potential disease investigation method.

However, these details aren't spelt away in the app’s privacy policy, which presently states it needs the user’s contact number, age and address. Moreover, the privacy policy will not provide clear information on who can share the data, simply saying the DGDA may share it with “other relevant authorities” under legal basis in several cases.

For data law pros, failure to accurately and comprehensively declare the app’s requirements and needs could affect the transparency of Mor Chana plus the number of energetic users.

“A privacy plan is essential to create transparency and trustworthiness for an app,” said Prapanpong Khumon from the institution of Law at the University of the Thai Chamber of Commerce.

The consultant in personal info protection laws said a clear and accurate privacy policy is the responsibility of the info controller, who should declare what personal info is collected for use, why it really is collected also to whom or which entities it may be disclosed.

Despite earlier confirmation by the government about Mor Chana’s data privacy, Prapanpong said its current privacy policy is so wide it “opens a window of possibility” for the non-public data to be distributed to other parties.

“If the plan could detail clearly which groups or units can access the data, people would have more confidence and understanding in this respect,” he added.

“It’s better than only guessing if that is possible.”

CONCERNS OVER PERMISSIONS DIRECTED AT APP

While there were initial considerations over the permissions directed at the app, recent program updates indicate an effort to permit users to be more selective in managing these permissions.

This past year, a data privacy analysis carried out by the info Protection Excellence (DPEX) Center on Singapore revealed that Mor Chana may be the most privacy-intrusive contact tracing app among those rolled by 6 Southeast Asian governments.

In its Privacy Sweep record, the centre examined six contact tracing apps produced by the governments of Indonesia, Malaysia, Philippines, Singapore, Thailand and Vietnam.

Data protection professionals studied the types of permissions sought by these apps on the Android operating-system and if they exceeded what would be expected based on their functionality. In addition they assessed how each one of the apps explained to customers why it desired their personal info and what it organized related to the data.

“It appeared in that case that Mor Chana used the virtually all permissions - camera, device and app history, location, microphone, images/media/files, and mobile storage - to execute its functions. We reviewed these permissions against the features and reasons of the app,” brain of the DPEX Center and data privacy consultant Kevin Shepherdson advised CNA.

“When you compare the permissions used in combination with other Southeast Asian countries’ apps, Mor Chana didn't do very well. Simply because our reviewers were not able to verify why these permissions were required - these were certainly not discussed in the app’s privacy policy,” he added.

Soldiers from Royal Thai Army Chemical substance Section prepare to spray disinfectant seeing as a good precaution against the coronavirus in Bang Bua school found in Bangkok, Thailand, Tuesday, Jan. 26, 2021. (AP Photo/Sakchai Lalit)

Permissions directed at an app let it gain access to the user’s personal info on the mobile machine but if abused, they could pose potential risks for personal data privacy.

For instance, permission to gain access to the camera permits the iphone app to take pictures and clips on the phone but it could also allow the app to view the user via the camera and pay attention to an individual via the microphone. The microphone authorization, alternatively, allows the application to record audio.

However, Shepherdson noted that which have been “positive privacy developments”, based on the latest app update in the Google Play Store on Jan 18.

“The software now uses fewer permissions plus they are only the permissions required for the app’s core functions to work. For example, it no more requires permission to record sound - microphone - which will be excessive,” he said.

People wearing encounter masks look for street food in Chinatown amid the pass on of COVID-19 found in Bangkok on Jan 6, 2021. (File photo: Reuters/Athit Perawongmetha)

As daily new circumstance counts in Thailand continue in the hundreds, wellbeing officials have advised cellular phone users to download Mor Chana to get promptly notified of probable health risks as well concerning help acceleration up the disease investigation process and fight the pandemic.

However, presently there are trade-offs somewhere between health and safety, and personal privacy.

According to Shepherdson, an integral ingredient that could help the Thai government to strike a balance between community health and data personal privacy is definitely transparency in Mor Chana's privacy policy.

"It is important during a pandemic like this because the people need to trust the government," he told CNA.

"The privacy policy may be the means by which a developer displays transparency to its users and explains the precise purposes of processing personal data and the way the permissions will be utilized."

At the moment, Mor Chana's privacy policy has been edited to reflect its current features and a new version is likely to be published later on, according to Julapong. Nonetheless, some continue to be sceptical and prefer to preserve their personal info confidential.

"I don't wish to download it because I don't think it'd be as a result useful. I don't want to reveal my personal data either as I fear the government would misuse it," said dentist and Bangkok resident Chanya Srisa.

"I manage myself by wearing a good facial mask whenever I venture out and avoiding crowded locations. I mainly travel between my workplace and home these days."