Contact-tracing apps rolled out by Bahrain, Kuwait and Norway to track the spread of the coronavirus have endangered the privacy and security of hundreds of thousands of people by marking users’ locations in real time, human rights group Amnesty International said.

Bahrain’s BeAware Bahrain, Kuwait’s Shlonik and Norway’s Smittestopp apps stood out as some of “the most alarming mass surveillance tools” in an analysis of 11 apps across Europe, the Middle East and Africa, the group said. The survey was carried out by Amnesty’s Security Lab, which conducts technical investigations into cyberattacks against civil society.

The three apps frequently capture users’ GPS location data and upload it to a central government database, effectively tracking users’ movements as they happen, Amnesty said. The location information can be easily linked to an individual given that users are required to sign up to the app with a national ID number in Bahrain and Kuwait and with a valid phone number in Norway.

“Bahrain, Kuwait and Norway are running roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified in efforts to tackle Covid-19,” said Claudio Guarnieri, head of Amnesty International’s Security Lab. “These governments must immediately halt the use of such intrusive apps in their current form.”

Representatives for Bahrain, Kuwait, and Norway didn’t immediately comment late Monday. Amnesty said it notified authorities in the three countries of its findings ahead of publication of the report.

The Norwegian Institute of Public Health on Monday had already halted the use of its mobile phone tool and deleted all the data it had collected after the country’s data protection authority warned it would temporarily ban the processing of personal information associated with the app.

The Norwegian watchdog questioned how useful the app is given its low usage and also warned that pairing Bluetooth technology for contact detection with location data for analysis went too far.

Amnesty said both the Bahraini and Kuwaiti apps can pair with a Bluetooth bracelet used to enforce quarantine measures by ensuring the user remains near their phone. The Kuwait app regularly checks the distance between the bracelet and the device, uploading location data every ten minutes to a central server, the group said. In Bahrain, users registered for home quarantine who don’t wear the bracelet face fines or imprisonment, it added.

Governments around the world have developed mobile apps to trace possible infections of the coronavirus, alerting users when they may have been near someone infectious. Authorities say the tools can help track and contain any resurgent outbreaks of the virus.

But since their inception, contact-tracing apps have raised concerns about their potential to infringe on people’s rights to privacy by collecting sensitive data about location, health and information about who people interact with.

Amnesty said it chose not to analyse apps that are based on a decentralised system, which is supported by a joint tool developed by Apple Inc and Alphabet Inc’s Google. It said such apps, which store data on people’s phones instead of on government servers, tend to be less concerning from a privacy perspective.

 - Bloomberg