EDIT: I am incorrect: TraceTogether is now using its own, non-anonymized technology[1]. Thanks detaro for correcting me. I'll still leave the comment because I'

EDIT: I am incorrect: TraceTogether is now using its own, non-anonymized technology[1]. Thanks detaro for correcting me. I'll still leave the comment because I'm interested in the ending question – This same damning article could have been written if TraceTogether had done everything right, so how do we effectively motivate governments to get everything right? -------- It feels wrong to loop in the anonymized TraceTogether technology with other genuinely egregious privacy violations of the Singaporean government. The Android/Apple exposure notifications API[0] rolled out in the early days of the pandemic is a pretty solid example IMO of handling privacy correctly. The protocol generates you a new anonymous ID every 20 minutes and locally remembers the last ~30 days of ids. Through BTLE, it collects the anonymous ids of other phones that it's within range of (and for how long), and remembers them locally for ~30 days. When someone voluntarily self-reports as COVID-positive, the API broadcasts the list anonymous ids used during their likely contagious period, allowing other phones to locally recognize if they've been exposed, and for how long. It's hard to imagine a more private version of this with any amount of usefulness. Unless I'm missing something (which I may well be!), the privacy loss the article refers can only happen if: 1. The police can legally and physically confiscate and unlock your phone 2. The police can legally and physically confiscate and unlock the phone of the person they suspect you of being/not being within 20 feet of 3. It was less than a month ago 4. There were no other eyewitnesses or evidence of the contact The first one, of course, also gives them access to plenty of other data we think of as private. Because this scenario exists, you can definitely make an argument that phones are a little less private with TraceTogether than without. But with the rarity and narrowness of the breach, I have a hard time putting it even remotely close to the other pieces of the article, describing 24/7 security cameras and exposing confidential lawyer correspondences. The article concludes: > What’s less considered is the sheer volume of data, and the variety of types of data that the state is collecting, allowing it to piece together people’s lives with much more detail than we might realise. ...and, well, I completely agree. That's exactly the context the article seems to lack. It's also a broader problem: How do we effectively define and communicate a right to privacy when the volume is what's so important? [0] https://www.google.com/covid19/exposurenotifications/ https://www.google.com/covid19/exposurenotifications/ [1] https://www.straitstimes.com/singapore/apple-google-contact-tracing-system-not-effective-for-singapore-vivian-balakrishnan https://www.straitstimes.com/singapore/apple-google-contact-...