Delivered in Parliament on 2 February 2021
Mr Speaker, Sir, my speech is divided into three topics:
First, I will talk about the Government’s error in not realising that section 20 of the Criminal Procedure Code applies to TraceTogether data.
Second, I will speak on the carving out of the seven categories of offences in the Bill that permits the use of Trace Together data. I will thereafter set out the Workers’ Party’s (WP) position on the Bill.
Third, I will look to the longer term, and reflect on the balance between the privacy rights of citizens and the growing power of the state and private companies in collecting and using data and personal information. I believe there is scope to learn important lessons from the fallout that has ensued from the Government’s admission that TraceTogether data could be used for investigatory purposes, a departure from earlier assurances that TraceTogether would only be used for contact tracing.
I. The Government’s error
First, the Government’s error.
Sir, Singaporeans are willing to take the actions necessary to combat COVID-19 when called upon by the Government, if they believe these actions will help our country and all of us who live and work here.
A few Singaporeans have told me that if the Government had stated up front that TraceTogether data would be used for the seven categories of serious crimes only, they would have been prepared to prioritise the use of TraceTogether because of the imperative of fighting an epidemic. Even those who could have had residual privacy concerns could have been assuaged had the Government detailed the processes and accountability regime for using TraceTogether information in investigations.
Why was there disquiet, unhappiness and cynicism in some quarters at the Government’s belated acknowledgement that TraceTogether can be used for criminal investigations as originally explained by Minister of State Desmond Tan in Parliament last month?
It comes down to a question of trust, the perceived lack of empathy over the public’s privacy concerns and discomfort with sharing mobile phone data with the authorities without sufficient assurances.
In fact, from a very early stage, the Government clearly contemplated that there would be privacy concerns over the use of TraceTogether for contact tracing. In his broadcast of 21 April 2020, the Prime Minister said that Singapore intended to make full of use of IT including TraceTogether which would require everyone’s cooperation. He added, and I quote, “There will be some privacy concerns, but we will have to weigh these against the benefits of being able to exit from the circuit breaker and stay open safely.” Unquote.
In the months that followed, the public were told that the number of sign-ups to TraceTogether was not satisfactory. As late as November, the Multi-Ministerial Task Force linked transiting to phase three in our fight against COVID-19 with requiring at least 70% of the population signing up for TraceTogether. Since then, and along with the issuance of TraceTogether tokens, this minimum 70% threshold was reportedly reached on 21 December 2020, even as it had been hovering around the 50% mark around two weeks earlier.
When Minister Vivian Balakrishnan admitted in Parliament that he did not consider Section 20 of the Criminal Procedure Code at the next sitting of Parliament on 5 January this year, there are Singaporeans who opine that this was not fathomable or even believable, for an largely efficient Government machinery that has consistently approached COVID-19 as a Whole-Of-Government endeavour. They further contend that if not Ministers, at least the officials in the Ministry of Home Affairs, Ministry of Health and Govtech who conceived of TraceTogether would have known of the privacy considerations surrounding TraceTogether.
Some go a step further in suspecting the Government of wilful blindness on function creep, or worse, that information surrounding the use of TraceTogether for criminal investigations may have been suppressed until the threshold of 70% of the population had downloaded the app or collected the TraceTogether token.
A separate group of Singaporeans query whether there will be consequences for those who made this mistake in promising wrongly that TraceTogether would be used only for contact tracing. They believe the Government did not do its homework. While there was no dishonesty or malice, there was a lack of care or diligence in accurately communicating the potential use of data collected by TraceTogether. I am sure members have come across a range of opinions from residents in the course of their house visits or interactions with friends and family over the last few weeks.
Whatever the view, it is apparent that the Government’s handling of this matter has eroded trust from some members of the public. I would like to ask two questions of the Government:
First: what was the exact date on which the Minister in charge of Smart Nation knew that section 20 of the Criminal Procedure Code would apply to TraceTogether? Secondly, and in connection with this, was Mr Christopher De Souza’s parliamentary question submitted before or after the Minister became aware of Section 20 of the Criminal Procedure Code? These questions are important for the House to understand at what point the Government determined that its original representations on the use of TraceTogether were misleading, and whether it could have corrected the position and updated the public on its own initiative.
II. The Exceptions and the WP’s position
Let me now move to my second topic, the carving out of the seven categories of crimes and the Workers’ Party’s position.
The WP’s starting point on this matter is that Singapore is as close to a wartime scenario as most Singaporeans have seen in our lifetimes. This pandemic is exceeded in the living memory of older Singaporeans only by the far greater oppression of World War II. In terms of its effect on the national consciousness, COVID-19 is perhaps on a par with other upheavals such as the 1964 riots and Singapore’s ejection from Malaysia in 1965. Its scale and complexity have surpassed the SARS crisis of 2003.
In such a wartime scenario, the core question for this House is whether the change in the Government’s position on TraceTogether data to allow for use for serious crimes could compromise the fight against COVID-19 and jeopardise contact-tracing. I will make two points in this regard.
First, while we know that TraceTogether data is critical for contact tracing, we need to ask whether TraceTogether data is vital for solving these seven categories of crimes. As it stands, the police have an abundance of investigative tools. They have other technological tools like CCTVs. They can forensically examine mobile phones and laptops that contain massive amounts of data, other than TraceTogether. They also have old-fashioned police work such as finding and interviewing witnesses, using confidential informants, scrutinising the crime scene and collecting physical evidence for forensic analysis. There is a legitimate view that these tools should be more than sufficient in detecting crime and securing convictions.
To know whether these other tools are enough, I would ask the Minister two questions about the use of TraceTogether data for actual cases.
A. For the one known case where TraceTogether was used, was the case solved in that a suspect has been identified or charged, and how critical was TraceTogether data to solving the case?
B. How many other times has TraceTogether been used for the seven categories of serious crimes?
There is little or no doubt that TraceTogether would make things more convenient for the police. But it is my view that convenience for the police may not be a good enough reason to compromise the trust necessary to win the COVID-19 fight.
There is a legitimate view that with the existing tools at their disposal, the police are likely to have very little, if any, additional benefit from using TraceTogether data. I look forward to hearing the Minister’s answers to my questions so we can know for sure. The answers will allow members of the public to appreciate the balance that is being struck between privacy and policing.
Onto my second point – would allowing these exceptions compromise the use of TraceTogether in fighting the pandemic?
Against the possible benefits of using TraceTogether for fighting crime, we need to compare the likely costs to our fight against COVID-19.
There was a public outcry after Minister of State Desmond Tan’s reply on 4 January 2020, when Singaporeans found out that section 20 of the Criminal Procedure Code applied to TraceTogether tokens and data and that the Government had backtracked on their earlier assurances. Some Singaporeans seemed placated when the Government announced a day later that the use of TraceTogether data would be restricted to the seven categories of crimes. Others less so. However, this House’s knowledge of both support as well as resistance of Singaporeans is only anecdotal. In the middle of last week, it was confirmed that the TraceTogether sign ups had reached 80% from 78% some weeks earlier. However, these numbers too can give a false sense of security insofar as our contact tracing efforts are concerned.
In an Institute of Policy Studies (IPS) report released on 24 May 2020, out of a broadly representative sample size of the Singapore population, 87% of respondents were agreeable to imposing strict surveillance on those who need to be quarantined. But when the questioning moved to the employment of CCTVs and cell-phones to prevent the spread of COVID-19, only 49% were agreeable to have their cell-phone data tracked without their consent.
Separately, a few people have anecdotally shared online that they will use the TraceTogether app to gain entry to a place, only to turn off Bluetooth immediately after entering a premise. This clearly shows that a high level of downloads of the TraceTogether app does not necessarily translate to a high degree of continuous usage.
Those who choose to switch off their Bluetooth function could do so for various reasons, a common one being that people do not want to drain their phone battery, and not necessarily because of privacy concerns. We don’t know for sure either way, but if the IPS report is indicative, privacy is more than likely to matter. It is therefore open to question whether the efficacy of TraceTogether for contact tracing could be compromised because of the Government’s belated explanation on the use of TraceTogether data for investigative purposes.
To that end, I would like to enquire if the Government is able to track the number of users of the TraceTogether app who turn off the Bluetooth function after downloading the app, and separately, after gaining entry to a building or premise? The answer to this question will determine whether TraceTogether is working as intended or whether the Government needs to comprehensively review the public buy-in and effectiveness of the TraceTogether app and token.
I now move on to the WP’s position on the Bill.
The WP is of the view that Singapore’s number one priority should be to tackle the pandemic’s public health and economic effects. Anything that compromises this priority has to give way unless there are overwhelming good reasons. Other jurisdictions have taken a cleaner approach on contact tracing apps in line the Government’s original public statements that TraceTogether would be limited to contact tracing, period.
Personally, and subject to the Minister’s response on the centrality of TraceTogether data for policing, I would prefer aligning the use of TraceTogether with the Government’s original emphatic assurances that TraceTogether data would be used for contact tracing only. This is because of some Singaporeans’ residual concerns over privacy and the established discomfort about sharing cell-phone data. I am of the view that such an approach would also engender greater confidence given that a public conversation on privacy has hitherto not been ventilated in a significant way in Singapore. I will return to that subject very shortly.
Even so, the Workers’ Party is prepared to support the Bill to allow for the use of TraceTogether data for police investigations in the exceptional cases identified in this Bill. The main reason is because the exceptions constitute a significant reduction of the wide ambit of Section 20 of the Criminal Procedure Code. In other words, a Singaporeans’ right to privacy is better protected with this Bill than without it. Ms Sylvia Lim will speak further on the seven exceptions.
III. The longer term – Government collection and use of data against the right to privacy
Let me move on to my last topic, which is about the longer term. Sir, the discomfort and distrust in some quarters generated by the belated disclosure on the applicability of Section 20 of the Criminal Procedure Code to TraceTogether is to some extent unsurprising. A 2016 KPMG report shared that 32% of Singaporeans were extremely concerned about the handling and use of their personal data, and that Singaporean consumers felt the most defenceless among Asian respondents over the way organisations handle and use their personal information.
I would contend that across the population, there is a general lack of awareness about not just the Government’s powers of data collection, investigation and privacy but the rapid advance of predictive technologies for public use. As a society, many are relatively uninformed about legal or constitutional rights and responsibilities, to say nothing about the right to privacy. If we are already talking about a societal COVID-19 reset when this crisis passes, the Government should also review the lessons learnt from the rollout of TraceTogether and specifically, whether Singapore should actively appraise the balance between policing and citizen privacy.
The mobile application WhatsApp recently found out the hard way what happens when people suddenly become suspicious about technology and privacy. When the company published new terms of service with a short deadline for acceptance, there was huge backlash against WhatsApp and its corporate owner, Facebook. WhatsApp’s experience shows that Singapore’s experience with the TraceTogether issue is not unique. Confidence in technological tools and the institutions that control them can be lost overnight. This loss of trust engenders cynicism and pushback from the public. And in an age where information travels instantaneously and fake news spreads at light speed, cynicism has to be taken very seriously and addressed squarely from a governance standpoint.
In the first major debate of this parliamentary term, Prime Minister addressed the House on Disease X, a possible outbreak even deadlier than COVID-19. In this regard, a new national research programme for epidemic preparedness and response called “Prepare” was announced in December 2020. The programme is meant to accelerate the production of diagnostic tools, therapies and vaccines once a major disease strikes.
However, medical preparedness is only part of the fight. The other part is the battle for the trust and cooperation of the people. If Disease X strikes and another TraceTogether type situation occurs, our fight against Disease X may be rendered ineffective and tragically thwarted.
I call on the Government to initiate an immediate conversation on the balance between the state’s collection and use of data against the individual’s right of privacy because many of new technologies with public repercussions have already been rolled out. According to the latest Government Financial Statements or GFS, the Ministry of Home Affairs has invested in Polcam 3.0 and 4.0, whereas only Polcam 1.0 and 2.0 have entered the mainstream media lexicon. Intrusive technology has already extended to other areas of governance. The GFS confirms that the Ministry of Social and Family Development has implemented video analytics, facial recognition and behavioural analytics technology at a Voluntary Children’s Home. Let that sink in for a moment. Behavioural Analytics Technology at a children’s home. What impact could befall a child if such data is hacked in a cyber-security breach many years later? How is the problem of bias both within from a technology perspective and human interface angle dealt with? Who checks whether such information is secure or securely wiped? And who has a right to review this information, and for how long?
Countering Cynicism
To counter scepticism and its resultant behaviours and to replace it with trust and cooperation, Singaporeans also need to better understand the necessity and ambit of data collection. This is especially so for a new generation who are more likely to be concerned about privacy and individual rights. The public must also be assured that the data collected and used for investigative purposes have safeguards that are robust enough with independent and external checks and balances, if necessary. And it would be critical for the public to understand that in Singapore at least, regulation is marching in step with the evolution of newer and more intrusive policing and data collection technologies. This is currently not the case in many parts of the world and there is an opportunity for Singapore to be leader in this regard. To this end, I would advance there are important actions that the government can undertake to better dispel doubts.
First, the Government should be forthcoming, without prompting, in informing the public about what data it collects and how it ensures the robustness and integrity of its processes.
Second, the Government should ensure that our laws reassure Singapore citizens and residents that investigatory powers and data collection are used for legitimate purposes and are subject to rigorous checks that protect us from abuse of our personal data. Moving forward, a review of our existing laws may be required to achieve this.
Let me discuss each of these actions in turn.
Government should inform the public what it does with information collected.
The first thing the Government could do to counter cynicism and create trust is to be forthcoming about what data it collects and the safeguards to prevent the misuse of information in its possession.
The Government regularly asks information of the tech giants like Facebook. For example, the Straits Times reported in 2018 that Facebook’s semi-annual transparency report revealed that the Singapore Government had made 244 requests for information concerning 310 Facebook accounts in the latter half of 2017. It would reassure the public if the Government could, on its own accord, tell us what it has asked tech companies for, and for what purposes. This could be done on a regular basis, through the Police’s annual report, for example.
If the Government is forthcoming with such information, it will engender confidence that the Government has nothing to hide and that its requests are for legitimate purposes in the interests of Singaporeans. Singaporeans would also better appreciate the nature of the behind-the-scenes work that is done to keep Singapore safe and secure. I will make the point again – this awareness and confidence will aid us in our fight against future threats.
Balancing investigatory laws and privacy concerns
The second thing the Government could do is conduct a broad review of the state’s powers to collect data for the purpose of investigations in light of new technologies and consider how privacy concerns can be better balanced or accommodated. Section 39 of the Criminal Procedure Code for example, gives the police wide leeway, when investigating arrestable offences, to access computers and computer data, even for computers outside of Singapore. Section 40 of the Criminal Procedure Code allows the Public Prosecutor to authorise the accessing of decryption information. Statutes like the Broadcasting Act and Telecommunications Act and others give the police powers akin to those in the Criminal Procedure Code, although specifically scoped for those acts. Even so, like the Criminal Procedure Code, the investigative powers of the relevant authorities are drafted broadly and do not include separate laws on how the exercise of these investigatory powers come with safeguards. Such safeguards would reassure the public that the state is acting legitimately and with sufficient regard for the individual’s right to privacy.
To build confidence between the citizen and state in an era where the call for privacy will only get louder, other verification mechanisms can be considered. I would like to offer three suggestions in this regard.
One possibility for checking against abuse and engendering confidence can be the appointment of a neutral commissioner or an ombudsman to monitor the use of such powers by the Government, and in particular, the law enforcement agencies.
Another possibility is an omnibus legislation like the UK’s Investigatory Powers Act. This piece of legislation covers the acquisition and retention of data, including bulk personal datasets, and provides for how such material is dealt with, including oversight arrangements, amongst others.
Thirdly, the Government could include a Key Performance Indicator in the Budget Book for each relevant Ministry that measures the public’s confidence in the collection and use of data collected on the one hand and the public’s right to privacy on the other.
Conclusion
To conclude Mr Speaker, it is important for me to restate that privacy concerns are not the domain of a small segment of Singaporeans. The international conversation has moved significantly over the past few years with recent revelations of how the security agencies of democratic countries such as the US collect vast amounts of information about their citizens. Arising from such revelations, other democratic jurisdictions have updated their laws to focus on and better calibrate the balance between the state’s investigatory powers and the individual’s right to privacy. At the heart of this discussion is a desire for checks and balances that are fit for purpose for today’s day and age.
Understandably, the conversation with electorates in democratic countries has not been easy. Many people perceive the world to be in an Orwellian age, complete with fake news and the prospect of privacy intrusions by states and private corporations. However, the absence of such a conversation in Singapore, combined with an erroneous assumption that continuing down tried and tested routes will suffice, would engender a worse outcome even presaging a disunited population. We will all lose if that happens. COVID-19 is a crisis like no other, but insofar as finding a better balance between policing and privacy, the lessons that have been taught by this TraceTogether episode inform us they are lessons the Government would be wise not to dismiss.
To recap Sir, the Workers’ Party is prepared to support the Bill even as we look to the Minister’s answers on the specific queries with regard to the police’s use of TraceTogether data. Separately, and arising from this episode, I urge the Government to open national conversation on privacy forthwith, with a view to not just prevent the weakening of trust between citizens and the state today, but to strengthen it for the Singapore of tomorrow.
Thank you.