Bahrain and Kuwait are using their COVID-19 contact tracing apps as mass surveillance tools, it has emerged. According to a new report released by Amnesty International, the two Gulf states, along with Norway, have released “some of the most invasive COVID-19 contact tracing apps around the world, putting the privacy and security of hundreds of thousands of people at risk.”

In its investigation, Amnesty’s Security Lab reviewed apps released in Europe, the Middle East and North Africa, focusing on 11 products from Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia and United Arab Emirates. According to the NGO, Bahrain’s ‘BeAware’, Kuwait’s ‘Shlonik’ and Norway’s ‘Smittestopp’ emerged as the “most alarming mass surveillance tools” with the three reportedly carrying out live or near-live tracking of users’ locations by frequently uploading GPS coordinates to a central server. Most contact-tracing apps rely solely on Bluetooth signals.

“Bahrain, Kuwait and Norway have run roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified in efforts to tackle COVID-19,” stated Claudio Guarnieri, head of Amnesty International’s Security Lab. “Privacy must not be another casualty as governments rush to roll out apps.” 

THE LARGER CONTEXT

Prior to the release of Amnesty’s report, Norway’s government had announced it would halt release of its app. The organisation had already shared its findings with Norwegian authorities earlier this month.

“The Norwegian app was highly invasive and the decision to go back to the drawing board is the right one. We urge the Bahraini and Kuwaiti governments to also immediately halt the use of such intrusive apps in their current form,” added Guarnieri. “They are essentially broadcasting the locations of users to a government database in real time – this is unlikely to be necessary and proportionate in the context of a public health response. Technology can play a useful role in contact tracing to contain COVID-19, but privacy must not be another casualty as governments rush to roll out apps.”

In Bahrain, the app emerged as even being linked to a Ramadan television game show called, “Are You at Home?”, which offered prizes to those who abided by lockdown rules. Inclusion in the programme was mandatory up until Bahrain’s Information and eGovernment Authority added an option for users to ‘opt out’ of participating.

However, according to Amnesty’s investigation, Bahraini authorities have also published sensitive personal information of suspected COVID-19 cases online, including health status, nationality, age, gender and travel history.

Looking at other apps, Qatar’s EHTERAZ app highlighted a major security vulnerability, which exposed sensitive personal details of more than one million people. However, this has now reportedly been fixed.

Contact tracing apps used in the United Arab Emirates, France and Iceland were identified as reduced risk, as contact between devices is only uploaded when users voluntarily report themselves as symptomatic or at the request of the health authorities.

“Such voluntary and consensual uploads at least reduce the risk of mass surveillance, as data is not automatically uploaded. The centralised model of France’s contact tracing app combined with the lack of transparency over how data is stored raises questions as to whether the users’ information could be de-anonymised,” said Amnesty in its statement.

ON THE RECORD

“Governments across the world need to press pause on rolling out flawed or excessively intrusive contact tracing apps that fail to protect human rights,” concluded Guarnieri. “If contact tracing apps are to play an effective part in combating COVID-19 people need to have confidence their privacy will be protected.”

Meanwhile, a Bahraini government spokesperson told the BBC: “The ‘BeAware’ app was designed for the sole purpose of advancing contact tracing efforts and saving lives. It is an entirely voluntary opt-in app... and all users are informed of its use of GPS software before downloading.

“The app plays a vital role in supporting Bahrain’s ‘Trace, Test, Treat’ strategy and has helped to keep Bahrain’s COVID-19 death rate at 0.24%. 11,000 individuals have been alerted through the app and prioritised for testing, of which more than 1,500 have tested positive.”