Can we live together with TraceTogether?

Why is trust in TraceTogether at an all-time low?

Singaporeans should be celebrating. After nearly a year of lockdown, Singapore has entered the elusive "Phase 3" despite the inter-ministerial covid task force tripping itself over and over again with poor communication skills and crisis management and a tendency to allow PR agendas to trump medical-scientific expertise and set policy. By refusing to hold daily televised coronavirus briefings during the initial darkest months, this team failed to reassure, educate, guide, and rally the public and to shore up the government credibility and authority during the pandemic. Yes, it's time to talk about TraceTogether fiasco, where this credibility and authority is finally found wanting by the public.

After months of task force ministers insisting in public and in Parliament they would not sign off on Phase 3 without at least 70% adoption of the national contact tracing app TraceTogether (an extreme exaggeration of the levels needed for contact tracing apps to ameliorate the pandemic and yet another triumph of PR agendas over medical and scientific expertise), promising that it would not actually be mandatory and walking back on that promise, then promising it would be used "purely for contact tracing purposes" (promises made by, at last count, Vivian Balakrishnan, Lawrence Wong, Teo Chee Hean) and "only a very limited, restricted team of contact tracers", it has transpired through a ministerial reply in a Parliamentary Question session that contact tracing data has in fact been accessed by the Singapore Police Force in criminal investigations because it is believed they are empowered under the Criminal Procedure Code to do so.

How much uptake does a contact tracing app need to be effective, highly effective, and then experience diminishing marginal returns? Source: MIT modelling.
Would you trust Singapore's ministers when they say 70% or MIT when they say 56%?
Would you trust The Lancet when it looks at real world data and finds the effectiveness of contact tracing apps sorely wanting?

Singapore's mentally stultifying members of parliament have fielded no queries to establish the chain of events, procedures taken, considerations made for and against, requests made and approved, by which individuals, departments, ministries, or ministers, and when the Desmond Tan and eventually the cabinet knew and how they knew, and what legal advice the cabinet sought and from whom, and when the cabinet jointly and severally decided to sign off on this imperial overreach. Instead, the cabinet attempts to make good on the error by establishing guidelines narrowing the type of police investigations that will be allowed to access contact tracing data.

This "remedy" marks an intellectual incuriosity, a placid comfort in Singapore being the only country to allow its police to raid the data of private citizens that has been garnered only because of a grave international emergency, or that attempts by law enforcement to break into the henhouse were rightly rejected and rebuked by leaders elsewhere. Given contact tracing apps are little more than proximity detection apps and no replacement for manual contact tracing, even a brain dead member of parliament or cabinet member should have asked how much such data would actually aid criminal investigations (as opposed to Singapore's vast CCTV network or actual GPS tracking and phone records). No one in the cabinet, backbenches, or the opposition benches did.

Can we delete TraceTogether?

Remedies by the public will be drastically limited especially when "TraceTogether-only Safe Entry" is fully implemented across the island. Either you carry the TraceTogether token around with you, use the TraceTogether app, or live with not going to your workplace building, the mall, restaurants, public places, and the cinema. On the bright side, you will be a real socially distancing hero even in Phase 3. Until this is actually implemented, you can and should just use normal SafeEntry whenever possible.

Modifying or rewriting the TraceTogether software on the phone, say to use the camera to take the venue QR code and produce an approved lookalike entry screen for eye-power safe distancing ambassadors door guards, is illegal and endangers the public at large at a time of a pandemic.

Even under a TraceTogether-only regime, we note that Singapore's TraceTogether app hasn't been vastly perverted from its BlueTrace origins, the major difference being that Singapore's contact tracing app has data in centrally stored servers while the NHS app was originally envisioned as such until privacy concerns led it to a decentralised model.

Compared with NHS, Singapore's TraceTogether is a less comprehensive Swiss army knife app. What matters most is venue check-in, followed by Bluetooth proximity detection which can be turned off temporarily in both the NHS and Singapore apps. Singapore doesn't seem to think you should be able to report symptoms on your own, order a Covid-19 test, or to communicate important advice and updates to you. Of course, the paternalistic mindset in Singapore obliges that the app throw up full-screen and near permanent notification bar nags if you have the temerity to turn off Bluetooth even just for a while.

Climate of fear in Singapore is real and pervasive, amirite

In terms of trust and/or privacy worries, the simplest remedy available to the public that causes the least harm in the face of the ongoing pandemic is this: minimise the amount of data TraceTogether generates while using the app and complying with check-in requirements at all venues. That means only turning on Bluetooth to use TraceTogether to check into venues, and then to turn off Bluetooth after you've shown the app check-in screen to the safety ambassador/door guard taking or reading your temperature.

How do I turn on and off Bluetooth on my phone?

Under iOS, use the automation tool in the shortcuts app to turn on bluetooth when TraceTogether is open and turn off Bluetooth when TraceTogether is closed.

Under Android, you have different hoops to jump through since there is no automation tool. You need to enter Settings, then Apps & Notifications, then look for the TraceTogether listing

Turn off notifications so the notifications submenu looks like this

And then turn on and off Bluetooth when you need it.

How about the data that's already in my phone from weeks and months of use?

From the app developers' description, the Bluetooth proximity data in your phone is only stored for 28 days and will be deleted automatically on a rolling basis. From the ministers' clarification in parliament, it can be surmised that data will be deleted automatically unless the Singapore Police Force open an investigation through one of your close contacts and somehow decide that ALL their close contacts are worth a cursory investigation, in which case your data will be stored permanently even if the case is closed, as per SPF standard operating procedure.

That said, no one knows what proximity TraceTogether data is in your phone until the Ministry of Health or the Singapore Police Force request for your cooperation. You can presumably write in to delete your data in the TraceTogether server, although it has never been explained how the data or what kind of data makes it to central servers pre-cooperation.

We at Illusio have a simpler solution for those who wish to start on a new slate of mistrust: deleting certain extraneous phone data especially when your phone is running out of storage.

In Android, from settings > app & notifications > TraceTogether, select Clear Storage.

This wipes the Bluetooth data without waiting for the 28 day rollover. However you will need to reauthenticate and re-register the app with your NRIC and SMS OTP before you can use it again.

In iOS, you can only uninstall and reinstall the app. There is no way to "clear storage" in iOS. You will also need to reauthenticate and re-register the app with your NRIC and SMS OTP before you can use it again.

How often should we clear our TraceTogether data?

We at Illusio suggest that users who have been using TraceTogether diligently and now want to use it only for checking into venues do so as soon as possible.

We also suggest that users wipe their TraceTogether app storage each time a new patch/update of TraceTogether is released and installed on your phone. And then to check that your preferred settings remain the same after the app is updated, as they can be reset by the app on update/patch.