Image copyright
Reuters
Users of the “BeAware Bahrain” app are required to register with a national ID number
Kuwait and Bahrain have rolled out some of the most invasive Covid-19 contact-tracing apps in the world, putting the privacy and security of their users at risk, Amnesty International says.
The rights group found the apps were carrying out live or near-live tracking of users’ locations by uploading GPS co-ordinates to a central server.
It urged the Gulf states to stop using them in their current forms.
Norway has halted the roll-out of its app because of similar concerns.
The country’s data protection authority said the app represented a disproportionate intrusion into users’ privacy given the low rate of infection there.
- Covid-19 contact-tracing app forced to delete data
- Contact-tracing app rumours debunked
Researchers at Amnesty’s Security Lab carried out a technical analysis of 11 apps in Algeria, Bahrain, France, Iceland, Israel, Kuwait, Lebanon, Norway, Qatar, Tunisia and the United Arab Emirates.
Bahrain’s “BeAware Bahrain” and Kuwait’s “Shlonik” stood out, along with Norway’s “Smittestopp”, as being among the most alarming mass surveillance tools, according a report published on Tuesday.
Media playback is unsupported on your device
Most contact-tracing apps rely solely on Bluetooth signals, but Bahrain and Kuwait’s capture location data through GPS and upload this to a central database, tracking the movements of users in real time.
The researchers say Bahraini and Kuwaiti authorities would easily be able to link this sensitive personal information to an individual, as users are required to register with a national ID number. Other countries’ contact tracing apps assure users’ anonymity.
Accessing such data could help authorities tackle Covid-19, but Claudio Guarnieri, head of Amnesty’s Security Lab, said the apps were “running roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified”.
Image copyright
EPA
Authorities in Kuwait have reported 36,400 cases of Covid-19 and 298 deaths
Mr Guarnieri added: “They are essentially broadcasting the locations of users to a government database in real time – this is unlikely to be necessary and proportionate in the context of a public health response. Technology can play a useful role in contact tracing to contain Covid-19, but privacy must not be another casualty as governments rush to roll out apps.”
Mohammed al-Maskati, a Bahraini activist who is the Middle East digital protection co-ordinator for the human rights group Front Line Defenders, said there was also a concern the information collected by the apps might be shared with third parties.
Bahrain’s app was linked to a television show called “Are You At Home?”, which offered prizes to users who stayed at home during Ramadan.
Media playback is unsupported on your device
The issues uncovered by Amnesty’s investigation are particularly alarming given that the human rights records of Gulf governments are poor.
“When you equip a repressive state with the means to surveil an entire population – whether it’s in the name of public safety or not – you can be certain that it’s only going to enhance their means of control and repression to then track down dissidents or anyone that they consider to be a public threat. And in a lot of places like the Gulf, that means activists,” says Sarah Aoun, chief technologist at privacy campaign organisation Open Tech Fund.
Image copyright
Reuters
In Bahrain, 46 people with Covid-19 have died and 19,000 others have been infected
There is also a concern that the technology will continue to be used after the threat of the coronavirus recedes, Ms Aoun adds.
“Historically, there’s been no incentive for governments to limit their overreach into people’s privacy. On the contrary, if you take a look at 9/11 and the aftermath of that, it essentially ushered a new era of surveillance in the name of protecting citizens. And this time is no different.”
Mr Maskati says critics will be unable to rely on regulatory oversight bodies in Gulf states for protection.
“If privacy is violated in a country like Norway, I can resort to regional tools such as the European Court of Human Rights and European Committee of Social Rights. But in our region there is not any such tool. On the contrary, resorting to local authorities may present an additional risk.”
A spokesman for Bahrain’s government said: “The ‘BeAware’ app was designed for the sole purpose of advancing contact-tracing efforts and saving lives. It is an entirely voluntary opt-in app… and all users are informed of its use of GPS software before downloading.”
“The app plays a vital role in supporting Bahrain’s ‘Trace, Test, Treat’ strategy and has helped to keep Bahrain’s Covid-19 death rate at 0.24%. 11,000 individuals have been alerted through the app and prioritised for testing, of which more than 1,500 have tested positive.”
Kuwait’s government has not responded to the BBC’s request for comment.