Meant to work hand-in-hand with more on-the-ground physical distancing measures ― like lockdowns and travel bans ― Health Code, as the new software has been called, instead operates in the cyber realm. It leverages China’s massive digital population and taps into the government’s vast stores of data for contact tracing.
According to a translation of the official account of a Hangzhou Engineer Crew, posted on Weixin on 2 April, Health Code was first pitched as a “unified digital declaration platform” that would feature “personal electronic health codes and timely data sharing.”
In practice, Health Code functions as a plug-in for mega-apps Alipay and WeChat. To opt into it, users have to fill out a questionnaire, providing their personal and health information.
The app then returns a color-coded QR code that reflects their personal risk of having been exposed to the virus. Green means they’re safe; yellow suggests mild risk and recommends self-isolation for a week; and red signals that infection is likely and requires home quarantine for 14 days. As a result, Health Code has become an important determinant of personal mobility. To enter key public spaces ― such as parks, movie houses, restaurants, and apartment complexes ― people first need to scan their QR codes before they are given the go-ahead by security.
Shroud in secrecy
According to Xiao Qiang, founder and editor-in-chief of China Digital Times, Health Code is a “perfect example” of how China has embraced and mastered surveillance technologies. ‘’It’s a very powerful tracking tool,” he says. “These are indeed very effective tools during this public health crisis, and that’s actually one reason that China has been relatively successful.”
“The issue here is that there’s no public discussion about the privacy concerns,” he adds. And of those, there are a lot.
The exact way the app works is still largely unknown to the public and to independent experts who may want to audit the software. How it determines a color assignment, for example, or what data it collects, where it stores data, or who manages it have all been opaque.
“It’s not known. It’s not transparent,” Qiang says. “But we do know they use the geolocation data, social interactions data, a timeline of the people’s actions, places they’ve been to, and in some cases, it includes financial transactions data.”
Another major concern and blind spot is what happens once the outbreak subsides, he continues. Will people be required to keep the app on their phones? What will it be used for? Perhaps most importantly: What will happen to all the information that had already been collected? Will users be allowed to withdraw or delete their data from the platform?
These questions are becoming more and more pressing, as at least one Chinese city has expressed its intent to parlay Health Code into a permanent health tracking app. According to officials of Hangzhou City, where the app was first launched, they are looking into incorporating more health indicators into the app, The Guardian reports.
The proposed app looks at the user’s records and lifestyle, and scores them accordingly. Healthier habits, like exercise and getting enough sleep at night could boost the score, while eating junk food, for example, or keeping a vice, might cost a user some points.
Qiang gives a clear example: “If the … Public Health Department of Hangzhou City, for their own benevolent purpose, are trying to promote … less smoking, they’ll use the system to track down the smokers, and where they have been, what kind of cigarette they bought or, and who they interacted with.”
This gives the government more control, allowing them to better target their interventions, reminders, or restrictions in order to achieve their policy goal.
Big brother on a whole new level
This brand of micromanagement is nothing new for China. The internet arrived in the country near the turn of the century, sparking hope that it would help foster a more democratic flow of information into the country. In 1997, however, the Ministry of Public Security came out with the first set of policies meant to control internet use, marking the start of the country’s long and fraught history of cyberspace surveillance and censorship.
Since then, the grip has only gotten tighter. In late 2005, the government formalized rules for internet registration. Websites and organizations engaged in information services must first register with and be approved by the government.
In early 2014, the Cyberspace Administration of China was established, and its primary role was to ensure internet security. Part of the job was a top-down management of all online content: taking down what it deemed to be false information, shuttering associated websites, and holding the responsible people liable.
To this end, the Administration issues policies that, for instance, requires real-name registration for accounts, or that allows them to regulate even content on instant messaging platforms.
Today, it’s clear to Qiang that the internet was double-edged. “What we did not see at the time clearly, but now is becoming an unfortunate reality in China [is that] the digital technology also empowered the state big time. They helped bring the massive surveillance and the micro-targeted control to a totally new level.”
The complete ugliness of this was born out for the world to see in 2017, when it was revealed that in the northwestern province of Xinjiang, the Chinese government was keeping millions of Uighur Muslims in prison-like concentration camps, where inmates undergo forced indoctrination. Initially, the Chinese government denied the existence of these camps. The New York Times in 2018 reported that Hu Lianhe, a senior government official, said, “There is no such thing as re-education centers.”
Following a big 2019 exposé by the International Consortium of Investigative Journalists, the government instead pivoted and invoked the fake-news defense, calling the leaked documents “pure fabrication.”
These camps allowed the government to flaunt its surveillance prowess. According to a 2018 Human Rights Watch report, “Xinjiang authorities conduct compulsory mass collection of biometric data, such as voice samples and DNA, and use artificial intelligence and big data to identify, profile, and track everyone in Xinjiang.” This was in complement to a very extensive and intrusive network of surveillance cameras, acting as the government’s eyes on the ground.
Independent nonprofit Open Technology Fund (OTF) also found that local authorities were forcing residents to install an app into their smartphones, backing up accounts of former detainees who had fled Xinjiang. “Any user with this app installed will have every file stored on their device sent to [an] unknown entity for monitoring,” the OTF report says.
China has spent years building and perfecting a sophisticated but disturbing surveillance infrastructure. Covid-19 provided the perfect opportunity for a massive test drive.
“The Chinese government … [has the] ability to access personal data through the private companies, but usually there is still some kind of a barrier,” Qiang says. Unless it’s in the face of a national security emergency, the government typically has restricted access to the data that tech companies accrue from their users.
But amid the panic over the pandemic, “Everybody was following the order to install that app,” he says, referring to Health Code. “Everybody put their personal information into it.”
For the government, Qiang adds, “it was so easy. [They didn’t] even have to do any other campaign or any other forceful implementation to get a whole population under their hand.”
In a statement, Ant Financial, an affiliate of Alibaba and the company behind Alipay, tells Business Insider: “We believe digital technology can and should play an active role in helping contain the global spread of the Covid-19 outbreak.
“Ant Financial requires that all third-party developers, including those who offer health code services using our technology platform, strictly adhere to our data security and privacy requirements, which include obtaining user consent before providing services.
According to a Chinese human rights expert, who is now based in Hong Kong and has requested anonymity out of security concerns, the problem is that among the general Chinese public, there is a basic and fundamental lack of understanding about privacy. “People are ignorant,” they say. “But this is not their fault. No one [has taught] them how important privacy is, or how it is their right to keep their privacy.”
This is compounded by a largely muzzled media, a hamstrung civil society, and laws that only serve to empower those already in power. “The purpose of many legislations actually strengthen this surveillance,” they added. “Privacy is not the purpose of the legislation.”
The result is what Qiang calls a “distorted information space” that makes it “extremely hard” for citizens to stay aware and organize themselves. Instead of being taught the value of individual liberty, they instead just learn to live with it.
“I think most people just already get used to it,” the expert says. “When it becomes like a daily routine in your daily life, you have to get used to it.” ●
Note: To view more data and other countries represented in the graph above, move the cursor above the circles.
The graph ranks Asian countries according to their coronavirus contact tracing apps’ number of downloads and penetration rate (expressed as a percentage of the population). China’s Health Code system pulls far ahead in both respects. As of 25 June, it has been downloaded ten times more than all the other COVID-19 apps in Asia (including West Asia) combined. India’s app, Aarogya Setyu, comes a distant second in terms of number of downloads, but has a low penetration rate (8.28%). Singapore’s Trace Together has the next-highest penetration rate (34.19%) in the region, but is curtailed by a low number of downloads.
*Countries in West and Central Asia, as well as transcontinental territories, are included in the analysis
**Penetration rate refers to the number of downloads divided by the country’s total population.
***In Centralized systems, data are stored at a central repository as opposed to the Decentralized model, which stores collected data in the users’ phones.
Data sources:
1. Google Play Store: WeTrace (Philippines), Stop COVID-19 KG (Kyrgyzstan), Stay Home Safe (Hong Kong), Shlonik (Kuwait), Bluezone (Vietnam), Tawakkalna (Saudi Arabia), Tabaud (Saudi Arabia), COCOA (Japan)
2. Government websites: HaMagen (Israel), BeAware (Bahrain), MyTrace (Malaysia), Mask.ir (Iran), TraceCovid (UAE), AMAN (Jordan), PeduliLindungi (Indonesia), TraceTogether (Singapore), AarogyaSetyu (India)
3. News Articles: ThaiChana (Thailand), Corona 100m (South Korea), Hayat Eve Sığar (Turkey), Health Code (China)
4. MIT Review