Privacy concern over Covid tracing system

Minister for Health Stephen Donnelly with the app.

Privacy concerns have been raised over the HSE’s new Covid tracker smartphone app after it emerged that GPS location services are a prerequisite in order for the application to function on a large percentage of phones.

The app, which had been at the design stage for more than three months and subject to a series of delays, was launched to some fanfare by the HSE and the Department of Health with a massive 500,000 downloads noted within 18 hours of its launch, an Irish record.

Health Minister Stephen Donnelly has implored the public to download the smartphone application, saying to do so will be to “protect your family and friends, and people you don’t know”.

The new app consists of four separate strands - automated contact tracing, symptom tracking, daily information updates, and the submission of anonymised data on user behaviours to the HSE.

However it is the need for GPS location services to be enabled on phones using Google’s Android operating system in order for the app to work, a fact which only emerged after the application went live on Monday evening, that drew the most ire from privacy campaigners.

Android users currently represent roughly 39% of the Irish smartphone market, making it by some distance the dominant operating system here.

The HSE has stressed for two months that the app does not track location, with all elements of contact tracing operating under bluetooth ‘handshake’ functionality.

However, in order for the app’s exposure notification protocol to function on Android phones location services must be enabled so that a device’s bluetooth radio ‘beacons’ can be activated, with the app rendered useless without them.

This means, for users averse to enabling location settings, that in order for virus tracking to occur all apps on their devices which mine location data will be empowered to do so as long as the app is running.

“For anyone who likes turning off location services, you can’t do that and turn on the HSE app, and that’s a problem,” said Stephen Farrell, research fellow at the school of computer science in Trinity College Dublin.

All of the other social media apps on your phone do so much more when you have location services on.

Mr Donnelly, who had dubbed the launch as representing a rare “good news day” in the midst of Covid-19, said that the app had been “designed with data privacy at its core”.

Asked whether or not handing so much information over to corporate interests like Google and Apple was a good thing, Mr Donnelly said it is a “facet of modern life” that the two companies are relied on to such a large extent, comparing the two’s function to that of the ESB’s responsibility for Ireland’s power network.

"The app works with Bluetooth technology - it works phone-to-phone. If two people meet on top of Carrauntoohil in Co Kerry for 15 minutes - the phones will log that.

"The app is not active in the six counties (of Northern Ireland) right now. We would very much like it to be across the entire island, but certainly for now, anyone who is crossing the border should absolutely download the app."

He said if someone tests positive for Covid-19, they will receive a phone call where they will receive advice.

"If you have the tracker app, you will be asked your permission for your phone to share the close contact information. You can say no at this point. The app is opt in - no-one is being forced to download or use it."

More than 60% of the population must download the app for it to be effective.

Elizabeth Farries, director of information rights with the Irish Council for Civil Liberties (ICCL), dismissed this point of view as “setting a poor precedent”.

“You don’t just hand the reins over to profit-oriented companies in health-related matters, or you shouldn’t. Google and Apple aren’t sharing their code for the app, we can’t see what it does and may not be able to see silent updates running in the background,” she said.

Meanwhile, the latest figures show one additional person had died from Covid-19, with 24 new cases notified.