Wed, Jul 29, 2020

New AtlanticistbySimon Handler and Lily Liu

Related Experts: Aleksandra Gadzala,Laura Galante,Simon Handler,Kenneth Propp,

This article is part of the monthly CSI5x5 series by the Cyber Statecraft Initiative, in which five featured experts answer five questions on a common theme, trend, or current event in the world of cyber. Interested in the CSI5x5 and want to see a particular topic, event, or question covered? Contact Simon Handler with the Cyber Statecraft Initiative at[emailprotected].

Policymakers have rushed to adopt surveillance measures to help slow the spread of the COVID-19 pandemic, but not without controversy. On March 16, Israeli Prime Minister Benjamin Netanyahu authorized the Israeli Security Agency (Shin Bet) to track the mobile phone location data of its citizens and notify those who may have come in close proximity to COVID-19 carriers to self-isolate. While Shin Bets system has successfully warned almost 4,000 individuals who have later tested positive, many privacy advocates fear that such enhanced surveillance may provide opportunities for abuse. The Supreme Court of Israel even ruled against this decision on April 26, condemning the prime minister for violating the non-delegation doctrine by authorizing the policy without explicit statutory authority.

Israel is not alone in turning to digital surveillance; Singapore has implemented wearable contact-tracing tokens and with the help of machine learning tools, France is monitoring whether individuals are wearing masks through video surveillance cameras. Even some of the most privacy-protective European countries, Italy and Germany, have launched contact-tracing applications to track the spread of coronavirus. Some countries are utilizing apps built by private sector technology giants like Apple and Google, using open-source code in order to prioritize transparency.

As more countries rely on digital tools to contain the spread of COVID-19, how will enhanced surveillance challenge privacy norms in the future? According to the World Health Organization, public health surveillance is critical to containing the pandemic. However, can enhanced surveillance during a public health crisis set precedents for digital surveillance in the future?

Cyber Statecraft Initiative experts go CSI5x5 to assess the implication of COVID on the future of mass surveillance:

Benjamin Ang, senior fellow, head of cyber homeland defence, Centre of Excellence for National Security, RSIS:

Government surveillance has different meanings in different parts of the world. Most Singaporeans have demanded more surveillance in neighborhoods and public spaces, for crime prevention, resulting in more than 70,000 police cameras deployed in our tiny island-state. But they have also criticized a proposal to issue contact tracing wearables to every resident. It looks like surveillance is good when everyone else is being watched, but not when Im the one being watched.

Governments who build better trust (e.g. by making contact tracing apps open source), whose populations are more communitarian than individualistic (e.g. many Asian countries), may find them more tolerant of surveillance during a crisis like this pandemic. When the crisis is over, the population may be less tolerantbut with the infrastructure in place, it may be too late to turn back.

Aleksandra Gadzala, senior fellow, Africa Center; head of research, The Singularity Group:

False. COVID-19 is arguably making individuals even more aware of the risk of government surveillance and more guarded of their privacy than before.The steady slide into mass collection of citizens private details was accelerating across much of Africa since especially the 2011 Arab Spring, with governments in Tanzania and Ethiopia, among others, imposing social media taxes, cybersecurity, and terrorism laws aimed at monitoring online communications. These measures were already being met with resistance. But contact tracing and other forms of COVID-19-related surveillance involve a different, deeper, level of intimacyindividual social and health historiesthat extend beyond the kind of information most are willing to forego. More and more Africans are taking the position that their social activities and health records are not essential to stemming the pandemic, but rather risk giving their respective governments more control than they in many cases already have. This heightened degree of caution will likely persist, if not accelerate, in the months and years following the pandemic.

Laura Galante, senior fellow, Eurasia Center; founder, Galante Strategies LLC:

Depends on the country: I think populations that were growing comfortable with outright surveillanceparticularly Chinawill look back at COVID as a proof point for mass surveillances positive effect in fighting the pandemic.

Harel Menashri, head of cyber, Holon Institute of Technology:

The world is divided into countries that are totalitarian and dictatorial in nature and culture, such as China, as opposed to countries with a democratic history and culture. In democratic countries, the public will still prefer to block government surveillance capabilities as much as possible.

Kenneth Propp, senior fellow, Future Europe Initiative; director for global trade policy, BSA:

The answer depends very much on your nationality. Asian populations seem broadly tolerant of pandemic-related surveillance; Americans seem quite distrustful; Europeans are somewhere in the middle. Those general attitudes will carry on.

Ang: Lateral surveillanceindividuals policing one another for not complying with safe distancing or wearing masksis one privacy risk that is grossly overlooked. This risk comes from vigilantes with mobile phone cameras hunting and shaming covidiots (a derogatory term for people who appear to be ignoring COVID-19), to the extent of uploading videos and doxing them. The vigilantes have no training or interest in privacy, no due process, and no accountability.

Gadzala: The by-now-apparent elephant in the room when it comes to surveillance risks and privacy in Africa is China, and I worry that we continue to underestimate the extent of Beijings data collection and influence operations in the regionand the enormous opportunity that COVID-19 has created in this regard. Technology linked to Chinese companiesparticularly Huawei, Hikvision, Dahua, and ZTEsupply artificial intelligence solutions ranging from facial recognition systems to smart policing in nearly twenty African countries. Huawei dominates the African telecommunications market (it is building 70 percent of Africas 4G infrastructure and is proceeding with plans to deploy 5G networks on the continent). With African governments now turning to (Chinese-based) mobile tracing solutions to stem the spread of the virus, Beijing is likely to gain significant data and intelligence. This carries a variety of strategic implications for the United States and significant risks for Africa: if the Chinese government and Chinese companies have valuable information on African populations, it could be used in bilateral commercial negotiations, potentially crowding out local industries, or as leverage in political disputes. African leaders are likely aware of at least some of these vulnerabilities, though are largely unwilling or unable to address the challenge.

Galante: By using rolling proximity identifiers, as many of the contact tracing efforts do, an app would be creating an incredibly valuable and exploitable set of data on both peoples locations and habits and who has been infected. There are myriad scenarios that Id rather not outline, on how an adversary could expose that data and wreak havoc on populations for years to come.

Menashri: The risk to privacy stems from the fact that in the absence of voluntary options, and due to a lack of good enough civilian applications to monitor contacts between blue suspects and others, we are inevitably forced to operate systems designed to monitor suspicious activity in front of civilians.

Propp: I think the privacy risks from the pandemic have been well-flagged in the debate so far. I dont see any that have been grossly overlooked.

Ang: Singapores government developed the TraceTogether contact tracing app and made the code open source, which enables the public to verify its privacy statements and assess its level of surveillance. In many Southeast Asian countries, governments are more accountable for their actions than large private sector corporations like Google, Facebook, or Apple. Governments can be voted out of office, whereas relatively small markets have little if any influence over large private sector technology corporations, which engage in surveillance for profit. One caveat: unlawful surveillance may not exist if a countrys laws and constitution allow mass surveillance.

Gadzala: In the West we are also struggling to decipher whether technology companies like Google or Apple, or government agencies, are best suited to this task. So far both answers are unsatisfactory, and the same is true in Africa. The trouble is that any kind of centralized database risks mission creep and can dramatically hamper trust in, and acceptance of, the responsible organizations. A viable solution could be a decentralized blockchain-based system, similar to existing smart contract frameworks. Such a solution could potentially allow for real-time monitoring of a populations immunity while offering greater protections of personal data. And this opens the door for the private sector beyond big tech in a rather significant way.In Africa, blockchain-based companies like Kenyas Nurse-in-Hand, Paxful, and AZA Group have started assuming various roles in the regional response to COVID-19. With greater support, they and their peers could be essential in the prevention of both the virus and unlawful surveillance.

Galante: Google, Apple, device manufacturers, and the telecomshave arguably the best datato work with for contact tracing. They shouldnt be left to devise privacy controls on their own. The federal government needstoprovide theframework for user consent, metadata collection parameters, and sunsetting and deletionpolicies.

Menashri: There is no doubt that the government has more existing tools to carry out monitoring and surveillance. The problem with the private sector stems from the fact that not all hardware and programming production is always done in the same country. You are sometimes forced to rely on a programmer who comes from another culture, and therefore, his ethical culture is also differentand this may be reflected in the software product he provides to you, without you being aware of it. If you make hardware in China, you are following other laws that allow the Chinese government to plant a backdoor on you. Thus, when it comes to privacy, the government has higher capabilities and if I want the private sector, I owe close regulatory oversight of the privacy authorities, to the manufacturers.

Propp: Most Americans seem comfortable with browser providers taking the lead in building contact tracing apps that protect privacy best against unlawful surveillance. European and Asian governments enjoy broader trust from their populations, so they are better trusted with developing privacy protections for such apps. Its also noteworthy that a number of European governments publicly have expressed great frustration about their desire to centralize tracing data being supervened by browser decisions.

More from the Cyber Statecraft Initiative:

Ang: In Singapore, support for surveillance for crime prevention has come from both conservative and liberal blocsthe former want law and order, the latter want protection of vulnerable persons. During this pandemic, Ive seen both blocs engage in lateral surveillance (i.e.vigilante shaming of people who do not comply with COVID-19 health regulations).

Galante: In the United States, you would be hard pressedto finda pro-surveillance faction. Thatsaid, most Americans are comfortable, or at least complacent, about theprofilethat theirspendingand online behavior creates forexploitationby advertisers. In the context of contact tracing, the benefit for the user is not the free use of an online social media or email account but rather the ability to protect themselvesand othersfrom infection.

Menashri: As I see it, the epidemic has caused extremism in public attitudes. It did not change their mind. There are certainly many who think that government officials should not carry out surveillance, for fear of invading privacy. By the way, I argue that it is not the role of internal intelligence organizations such as the Israeli ISA to deal with this issue.

Propp: I suspect that the pandemic has simply deepened existing ideological positions on surveillance rather than shifting them significantly.The views of those who fear intrusive government surveillance generally have been reinforced by the introduction of tracing apps, while those with greater tolerance of surveillance for the public good tend to accept tracing apps.

Ang: Democratic governments are sensitive to public opinion, so public awareness, scrutiny, and critique of public surveillance programs will help to curb mission creep.

Gadzala: There is a good deal that can be done in this regard, though none of it is easy, as it concerns matters of institutional accountability. One aspect on which I remain laser-focused is journalistic freedom, which has unfortunately declined across much of Africa in recent years and also now since the start of the pandemic. In Madagascar, Zambia, Zimbabwe, South Africa, and among other countries, journalists are being threatened and media outlets shut down. This has implications both for how the health crisis is handled in these countries as well as the future state of their democracy. An encouraging trend that warrants greater support, however, is the emergence of new and decentralized media in the form of mobile apps, newsletters, and other platforms where the emphasis is on local reporting and local narratives. WanaData, for example, is a Nigerian-based, pan-African network of female journalists and data scientists focused on producing data-driven news in collaboration with community media and freelancers. The ability of such initiatives to report on instances of unlawful surveillance and hold violators to account is immensely important. Paradoxically, technology is here at once the culprit and the solution.

Galante: We need sunset and deletion policies whenever a surveillance measure is put in place locally, statewide or federally. The Electronic Frontier Foundation and the ACLU are doing good work to elevate privacy concerns amidst the many efforts to fight the pandemic.

Menashri: What is needed is a democratic culture, law enforcement, parliamentary authorities with supervisory powers and, most importantly, transparency of moves.

Propp: The limited acceptance of tracing apps in Western democracies suggests that their publics will remain wary of overt government surveillance in the future in other contexts.That wariness presumably will have an effect on government surveillance ambitions, at least on overt ones.

Simon Handler is a program assistant with the Atlantic Councils Cyber Statecraft Initiative under the Scowcroft Center for Strategy and Security, focused on the nexus of geopolitics and international security with cyberspace. He is a former special assistant in the United States Senate. Follow him on Twitter @SimonPHandler.

Lily Liu is an intern with the Atlantic Councils Cyber Statecraft Initiative.

See the article here:

Fighting COVID-19 with surveillance: Perspectives from across the globe - Atlantic Council