Singapore said its contact tracing app would only be used to fight the coronavirus, but now police are accessing its data for criminal investigations

• Singapore is under renewed scrutiny after updating the privacy policy of its national contact tracing app TraceTogether, and now says that police can access user data if someone is under criminal investigation.
• About 80% of Singapore's population, around 4.2 million people, are using the app via their devices or government issued wearables.
• "We do not preclude the use of TraceTogether data in circumstances where citizens' safety and security is or has been affected, and this applies to all other data as well," Minister Desmond Tan said.

Singapore's contact tracing app, TraceTogether, is under scrutiny after the country revealed the app's data could be accessed in criminal investigations by local police.

An update to TraceTogther's privacy policy on Monday now allows Singapore Police to access app data, whether on a government-issued wearable or on a user's device, Engadget reported.

Thus far, around 80% of Singapore's 5.6 million people have downloaded the tracing app. The Singapore government had previously told citizens that adoption of the app would be required in order to move from Phase 2 to Phase 3 and loosen up restrictions.

But as the app's widespread use is proving helpful for contact tracing, privacy advocates are pointing to central privacy issues related to recent updates.

Several US states and other countries have developed contact tracing apps with Apple and Google's Exposure Notification System, which anonymizes user information. In contrast, Singapore's TraceTogether app opted for the BlueTrace protocol, which Singapore developed itself.

In Singapore's system, the user's contact log is uploaded to a server managed by the government's health department. The government had previously said that data collected by the app would only be stored for 25 days, and that all data would be encrypted in order to prevent access by third-party services.

But the app's January 4 update allows that the data "may be used in circumstances where citizen safety and security is or has been affected." The new privacy policy added that "Authorized Police officers may invoke Criminal Procedure Code (CPC) powers to request users to upload their TraceTogether data for criminal investigations."

Engadget reported that no previous versions of the privacy policy referenced police having access to data collected by TraceTogether, and prior to Monday, the app's website stated that "data will only be used for COVID-19 contact tracing."

The paragraph was added to TraceTogether's policy after Singapore MP Christopher de Souza asked Minister of State and Home Affairs Desmond Tan on Monday if police could access data, and what the privacy safeguards might be.

"We do not preclude the use of TraceTogether data in circumstances where citizens' safety and security is or has been affected, and this applies to all other data as well," Tan said.

Singaporeans had previously expressed mixed opinions about the TraceTogether app and the overall use of tracking to manage coronavirus. A May 2020 study from the country's independent think tank, Institutes of Policy Study on the use of surveillance to fight COVID-19 found that around 50% of the population was "agreeable to have their cell phone data tracked without their consent." However, 87% of respondents were "agreeable to imposing strict surveillance on people who need to be quarantined."

Singapore has reported fewer than 50 coronavirus cases a day since September 14 and has had two COVID-related deaths in the same time period.