Liberty News

Eight major mobile carriers have agreed to share customer location data with the European Commission in a bid to track the spread of COVID-19.

The announcement arrives after Deutsche Telekom, Orange, Telefonica, Telecom Italia, Telenor, Telia, A1 Telekom Austria and Vodafone discussed tracking options with European Commissioner for Internal Market and Services Thierry Breton.

Government officials attempted to allay the fears of critics by noting all collected data will be anonymized and destroyed once the pandemic is squashed.

 Since the COVID 19 outbreak became a fast-spreading pandemic, governments from across the globe have implemented new policies to help slow the spread of the virus.

In addition to closing borders to non-citizens, many governments have also mobilized digital surveillance technologies to track and contain visitors and citizens alike.

On Wednesday, the Hong Kong government announced that all new arrivals to the city must undergo two weeks of self-quarantine, while wearing an electronic wristband that connects to a location tracking app on their phones.

If the app detects changes in the person's location, it will alert the Department of Health and the police. Prior to this new policy, only people who had recently visited Hubei province in China were required to wear a monitoring wristband during their quarantine period.

While surveillance technologies and measures may give the public a sense of security in controlling the spread of the virus, we must remain mindful and vigilant of their continued use after the pandemic subsides.

European and North American countries like Italy, Spain, and the US are currently being hit hard by the coronavirus. Meanwhile, Asian countries have been praised by international media for their swift responses and use of surveillance technologies to control the outbreak.

The Singaporean government, for example, implemented policies that can effectively and rigorously trace a complex chain of contacts . As of February, anyone entering a government or corporate building in Singapore will have to provide their contact information.

In addition, the government has been gathering a substantial amount of data detailing not only each known case of infection but also where the person lives, works and the network of contacts they are connected to.

While these measures have thus far seemed to yield positive results, they have highlighted the technological capacity and power of the government to monitor the movements and lives of every individual.

In China, where Covid-19 was first detected, the government has been deploying not only drastic lockdown policies but also a variety of surveillance technologies to ensure public compliance with self-quarantine and isolation.

In addition to using drones to monitor people's movements and ensure they are staying home, police in five Chinese cities have taken to patrolling the streets wearing smart helmets equipped with thermal screening technologies that sound an alarm if a person's temperature is higher than the threshold.

The government has also collaborated with the company Hanwang Technology Limited to finesse their existing facial recognition technology, so that it can work even when the person is wearing a face mask

When connected to a temperature sensor and the Chinese government's existing database as well as state-level intel, this technology allows authorities to immediately identify the name of each person whose body temperature is above 38 degrees Celcius.

According to Hanwang Technology, this refined facial recognition technology can identify up to 30 people within a second.

While the use of surveillance technologies like these has been effective in lowering the number of confirmed cases in China, it is not without risks.

Beyond the pandemic, both the Chinese government and the company have substantial interests in further developing and deploying this technology: the government can make use of it to track and suppress political dissidents, and the company has much to gain financially.

This technology can also be co-opted by China's counterterrorism forces to further monitor and regulate the movement of the Uighur people, who are categorised as terrorists by the Chinese government and are currently being forced into mass detention camps and subjected to forced labour.

Outside of Asia, Middle Eastern countries like Israel and Iran have also been deploying similar surveillance technologies , citing the need to control the spread of the coronavirus.

The Israeli government now makes use of technologies developed for counterterrorism to collect cellphone data, so that the government can trace people's contact network, and identify those who need to be quarantined.

The geolocation data gathered via people's phones will then be used to alert the public where not to go based on the pattern of infection.

Not only is it unprecedented for Israel to deploy counterterrorism data to combat a public health crisis, but the existence of this data trove has also, according to the New York Times , not been reported prior to this.

On March 6, researcher Nariman Gharib revealed that the Iranian government had been tracking its citizens' phone data through an app disguised as a coronavirus diagnostic tool.

Security expert Nikolaos Chrysaidos confirmed that the app collected sensitive personal information unrelated to the outbreak -- for example, the app recorded the bodily movements of the user the way a fitness tracker would.

Google has since removed the app from Google Play, but this case demonstrates the need for ongoing public vigilance over government use of surveillance technologies in the name of public health.

Safeguarding public health has historically been used as a justification for mainstream institutions and government authorities to stigmatise, monitor, and regulate the lives of marginalised people -- such as immigrants, racial minorities, LGBTQ+ people, and people living in poverty.

If we do not hold our government accountable for its use of surveillance technologies during the current pandemic and beyond, we will be putting those who are already marginalised at further risks of regulation, suppression, and persecution.

Governments Haven't Shown Location Surveillance Would Help Contain COVID-19 

Governments around the world are demanding new dragnet location surveillance powers to contain the COVID-19 outbreak. But before the public allows their governments to implement such systems, governments must explain to the public how these systems would be effective in stopping the spread of COVID-19. There's no questioning the need for far-reaching public health measures to meet this urgent challenge, but those measures must be scientifically rigorous, and based on the expertise of public health professionals.

Governments have not yet met that standard, nor even shown that extraordinary location surveillance powers would make a significant contribution to containing COVID-19. Unless they can, there's no justification for their intrusions on privacy and free speech, or the disparate impact these intrusions would have on vulnerable groups. Indeed, governments have not even been transparent about their plans and rationales.

The Costs of Location Surveillance

EFF has long opposed location surveillance programs that can turn our lives into open books for scrutiny by police, surveillance-based advertisers, identity thieves, and stalkers. Many sensitive inferences can be drawn from a visit to a health center, a criminal defense lawyer, an immigration clinic, or a protest planning meeting.

Moreover, fear of surveillance chills and deters free speech and association. And all too often , surveillance disparately burdens people of color. What's more, whatever personal data is collected by government can be misused by its employees, stolen by criminals and foreign governments, and unpredictably redirected by agency leaders to harmful new uses .

Emerging Dragnet Location Surveillance

China reportedly responded to the COVID-19 crisis by building new infrastructures to track the movements of massive numbers of identifiable people. Israel tapped into a vast trove of cellphone location data to identify people who came into close contact with known virus carriers. That nation has sent quarantine orders based on this surveillance. About a dozen countries are reportedly testing a spy tool built by NSO Group that uses huge volumes of cellphone location data to match the location of infected people to other people in their vicinity (NSO's plan is to not share a match with the government absent such a person's consent).

In the United States , the federal government is reportedly seeking, from mobile app companies like Facebook and Google, large volumes of location data that is de-identified (that is, after removal of information that identifies particular people) and aggregated (that is, after combining data about multiple people). According to industry executives, such data might be used to predict the next virus hotspot. Facebook has previously made data like this available to track population movements during natural disasters.

But re-identification of de-identified data is a constant infosec threat . De-identification of location data is especially hard, since location data points serve as identification of their own. Also, re-identification can be achieved by correlating de-identified data with other publicly available data like voter rolls, and with the oceans of information about identifiable people that are sold by data brokers . While de-identification might in some cases reduce privacy risks , this depends on many factors that have not yet been publicly addressed, such as careful selection of what data to aggregate, and the minimum thresholds for aggregation. In the words of Prof. Matt Blaze, a specialist in computer science and privacy:

One of the things we have learned over time is that something that seems anonymous, more often than not, is not anonymous , even if it's designed with the best intentions.

Disturbingly, most of the public information about government's emerging location surveillance programs comes from anonymous sources , and not official explanations. Transparency is a cornerstone of democratic governance, especially now , in the midst of a public health crisis. If the government is considering such new surveillance programs, it must publicly explain exactly what it is planning, why this would help, and what rules would apply. History shows that when government builds new surveillance programs in secret , these programs quickly lead to unjustified privacy abuses. That's one reason EFF has long demanded transparent democratic control over whether government agencies may deploy new surveillance technology.

Governments Must Show Their Work

Because new government dragnet location surveillance powers are such a menace to our digital rights, governments should not be granted these powers unless they can show the public how these powers would actually help, in a significant manner, to contain COVID-19. Even if governments could show such efficacy, we would still need to balance the benefit of the government's use of these powers against the substantial cost to our privacy, speech, and equality of opportunity. And even if this balancing justified government's use of these powers, we would still need safeguards, limits, auditing, and accountability measures. In short, new surveillance powers must always be necessary and proportionate .

But today, we can't balance those interests or enumerate necessary safeguards, because governments have not shown how the proposed new dragnet location surveillance powers could help contain COVID-19. The following are some of the points we have not seen the government publicly address.

1. Are the location records sought sufficiently granular to show whether two people were within transmittal distance of each other? In many cases, we question whether such data will actually be useful to healthcare professionals.

This may seem paradoxical. After all, location data is sufficiently precise for law enforcement to place suspects at the scene of a crime, and for juries to convict largely on the basis of that evidence. But when it comes to tracking the spread of a disease that requires close personal contact, data generated by current technology generally can't reliably tell us whether two people were closer than the CDC-recommended radius of six feet for social distancing.

For example, cell site location information (CSLI)--the records generated by mobile carriers based on which cell towers a phone connects to and when--is often only able to place a phone within a zone of half a mile to two miles in urban areas. The area is even wider in areas with less dense tower placement. GPS sensors built directly into phones can do much better, but even GPS is only accurate to a 16-foot radius . These and other technologies like Bluetooth can be combined for better accuracy, but there's no guarantee that a given phone can be located with six-foot precision at a given time.

2. Do the cellphone location records identify a sufficiently large and representative portion of the overall population? Even today, not everyone has a cellphone, and some people do not regularly carry their phones or connect them to a cellular network. The population that carries a networked phone at all times is not representative of the overall population; for example, people without phones skew towards lower-income people and older people.

3. Has the virus already spread so broadly that contact tracing is no longer a significant way to reduce transmission? If community transmission is commonplace, contact tracing may become impractical or divert resources from more effective containment methods.

There might be scenarios other than precise, person-to-person contact tracing where location data could be useful. We've heard it suggested, for example, that this data could be used to track future flare-ups of the virus by observing general patterns of people's movements in a given area. But even when transmission is less common, widespread testing may be more effective at containment, as may be happening in South Korea .

4. Will health-based surveillance deter people from seeking health care? Already, there are reports that people subject to COVID-based location tracking are altering their movements to avoid embarrassing revelations. If a positive test result will lead to enhanced location surveillance, some people may avoid testing.

Conclusion

As our society struggles with COVID-19, far narrower big data surveillance proposals may emerge. Perhaps public health professionals will show that such proposals are necessary and proportionate. If so, EFF would seek safeguards, including mandatory expiration when the health crisis ends, independent supervision, strict anti-discrimination rules, auditing for efficacy and misuse, and due process for affected people.

But for now, government has not shown that new dragnet location surveillance powers would significantly help to contain COVID-19. It is the government's job to show the public why this would work.

Update: In fight against coronavirus, European governments embrace surveillance

25th March 2020. See article from politico.eu

 

The Department of Homeland Security has a scary vision for expanding face recognition surveillance into our everyday lives, threatening a dystopian future in which the technology is used throughout our public spaces to scrutinize our identity, check us against watchlists, record our movements, and more. Work on building the infrastructure for this pervasive monitoring has already started, with U.S. Customs and Border Protection currently operating a face recognition system at the gates of departing international flights.

See article from aclu.org

Liberty, the human rights organisation, and Privacy International, today announced a joint legal action against MI5 following revelations the intelligence agency has systematically broken surveillance laws for years and kept it secret from the surveillance watchdog.

The details of MI5's lawlessness emerged last summer in two legal cases -- Liberty's challenge to the Snoopers' Charter (the Investigatory Powers Act 2016) and Privacy International's challenge to state powers to collect and store ordinary people's data.

In Liberty's challenge to the Investigatory Powers Act 2016 (IPA), the Government revealed that MI5 had been unlawfully retaining and mishandling the public's data for years.

As part of that case, the Government disclosed a number of documents to the court, including correspondence between the security service and the Investigatory Powers Commissioner's Office (IPCO, the body responsible for overseeing state surveillance practices), correspondence between the security service and the Home Secretary, and reports of inspections carried out by IPCO after they learnt of MI5's failings.

The documents reveal that MI5 not only broke the law, they failed to report this to IPCO, despite knowing about their non-compliance for years. They also gave IPCO false information in order to obtain warrants. These revelations led the then Investigatory Powers Commissioner, Lord Justice Fulford, to conclude that the UK security service had held and handled our data in an "undoubted unlawful manner".

In a remarkable admission to the Commissioner, a senior MI5 official acknowledged that personal data collected by MI5 might be stored in "ungoverned spaces", while an MI5 review in 2016 found "a high likelihood [of material] being discovered when it should have been deleted".

Liberty and Privacy International have today launched a legal bid to get MI5 to disclose the full extent of its unlawful conduct. The groups are asking the court to rule that MI5 violated our rights to privacy and free expression by unlawfully retaining and mishandling our data. The groups are also demanding that surveillance warrants granted during this unlawful activity are quashed and all record of the public's illegitimately obtained or retained data is destroyed.

Liberty lawyer Megan Goulding said :

"It's clear we need to know the extent of MI5's lawlessness as these court cases have revealed how our surveillance laws are not fit for purpose as well as MI5's disregard for our rights. MI5 has unprecedented and dangerous power to spy on any one of us and collect our sensitive private information.

"It's clear that the so-called safeguards in our surveillance laws are totally ineffective in protecting our rights. The Snoopers' Charter needs to be torn up and the Government must create a targeted surveillance regime that protects us while respecting our rights and freedoms."

Privacy International's Legal Director Caroline Wilson Palow said :

"For more than a decade, MI5 has been building massive datasets by systematically collecting our personal information. Such practices are a serious interference with our right to privacy and threaten democratic values. We were promised that robust safeguards were in place so that such data would never be abused. Yet it turns out that those safeguards were in some cases illusory - that MI5 held significant data in ungoverned spaces without any effective oversight. We are bringing this challenge together with Liberty to ensure that MI5 does not continue to operate outside of the law."

What we know of MI5's wrongdoing so far

• Illegal actions: The Investigatory Powers Commissioner concluded that the way MI5 was holding and handling people's data was "undoubtedly unlawful" . MI5 breached IPA safeguards relating to how long data is held for, how often it is copied, the number of persons to whom and extent to which material is disclosed, and how data is stored securely. The exact details of MI5's breaches are yet unknown, but Liberty and Privacy International hope this new legal case will reveal more.

• Senior people at MI5 knew for six years before informing IPCO : Issues with MI5's legal compliance were known to the MI5 Board in 2013, but were only brought to IPCO's attention in February 2019.

• MI5 misled judges : Senior judges (known as Judicial Commissioners) issued surveillance warrants on the understanding that MI5's data handling obligations under the IPA were being met - when they were not, in fact MI5 gave false information to obtain the warrants. The Investigatory Powers Commissioner has pointed out that warrants would not have been issued if IPCO had been aware about the breaches. The Commissioner states that "it is impossible to sensibly reconcile the explanation of the handling of arrangements the Judicial Commissioners were given in briefings...with what MI5 knew over a protracted period of time was happening."

The "bulk" powers Liberty challenged in the case against the Snoopers' Charter allow MI5 to scoop up the public's personal data en masse, regardless of whether they are suspected of any wrongdoing. It is therefore unclear how many people may have had their personal information unlawfully retained and mishandled, without their knowledge, by the security service.

The Metropolitan Police has announced it will use live facial recognition cameras operationally for the first time on London streets.

Following earlier pilots in London and deployments by South Wales police, the cameras are due to be put into action within a month. Cameras will be clearly signposted, covering a small, targeted area, and police officers will hand out leaflets about the facial recognition scanning, the Met said.

Trials of the cameras have already taken place on 10 occasions in locations such as Stratford's Westfield shopping centre and the West End of London. The Met said in these trials, 70% of wanted suspects in the system who walked past the cameras were identified, while only one in 1,000 people generated a false alert. But an independent review of six of these deployments found that only eight out of 42 matches were verifiably correct.

Over the past four years, as the Met has trialled facial recognition, opposition to its use has intensified, led in the UK by campaign groups Liberty and Big Brother Watch.

The force also believes a recent High Court judgment, which said South Wales Police did not breach the rights of a man whose face had been scanned by a camera, gives it some legal cover. The case is heading for the Court of Appeal. But the Met is pressing on, convinced that the public at large will support its efforts to use facial recognition to track down serious offenders.

Last year, the Met admitted it supplied images for a database carrying out facial recognition scans on a privately owned estate in King's Cross, after initially denying involvement.

Update: Censored whilst claiming to be uncensored

24th January 2020. See article from ico.org.uk

It seems to the normal response from the Information Commissioner's Office to turn a blind eye to the actual serious exploitation of people's personal data whilst focusing heavily on generating excessive quantities of red tape rules requiring small players to be ultra protective of personal to point of strangling their businesses and livelihoods. And, just like for unconsented website tracking and profiling by the only advertising industry, the ICO will monitor and observe and comment again later in the year:

In October 2019 we concluded our investigation into how police use live facial recognition technology (LFR) in public places. Our investigation found there was public support for police use of LFR but also that there needed to be improvements in how police authorised and deployed the technology if it was to retain public confidence and address privacy concerns. We set out our views in a formal Opinion for police forces.

The Metropolitan Police Service (MPS) has incorporated the advice from our Opinion into its planning and preparation for future LFR use. Our Opinion acknowledges that an appropriately governed, targeted and intelligence- led deployment of LFR may meet the threshold of strict necessity for law enforcement purposes. We have received assurances from the MPS that it is considering the impact of this technology and is taking steps to reduce intrusion and comply with the requirements of data protection legislation. We expect to receive further information from the MPS regarding this matter in forthcoming days. The MPS has committed to us that it will review each deployment, and the ICO will continue to observe and monitor the arrangements for, and effectiveness of, its use.

This is an important new technology with potentially significant privacy implications for UK citizens. We reiterate our call for Government to introduce a statutory and binding code of practice for LFR as a matter of priority. The code will ensure consistency in how police forces use this technology and to improve clarity and foreseeability in its use for the public and police officers alike. We believe it's important for government to work with regulators, law enforcement, technology providers and communities to support the code.

Facial recognition remains a high priority for the ICO and the public. We have several ongoing investigations. We will be publishing more about its use by the private sector later this year.

Update: Big Brother Watch  Petition

24th January 2020. Sign the petition from you.38degrees.org.uk

To: Priti Patel, Home Secretary and Cressida Dick, Commissioner of the Metropolitan Police

Urgently stop the Metropolitan Police using live facial recognition surveillance.

Why is this important?

The Metropolitan Police has announced it will use live facial recognition across London, despite an independent review finding its previous trials likely unlawful and over 80% inaccurate. The Met is the largest police force in the democratic world to roll out this dangerously authoritarian surveillance. This represents an enormous expansion of the surveillance state and a serious threat to civil liberties in the UK - and it sets a dangerous precedent worldwide. We urge the Home Secretary and Met Commissioner to stop it now.