Brief on Digital Means Employed by the Government of Israel RE: Covid-19

The Government of Israel has activated two parallel and separate digital programs against the spread of the Covid-19 virus. Both programs interact with a central data base of diagnosed patients and their full movements in the 14 days prior to their diagnosis.

1/ Meta-Data collected by law by the Israeli Security Agency for counter terrorism efforts, from cellular service providers

 The Health Ministry sends requests to the Security Agency including the following data of diagnosed patients: name, government i.d number or passport number, cell phone number, date of diagnosis and date of 14 days prior to diagnosis.

 The citizens receive a text message informing them that their data has been shared.

 The Security Agency then extracts meta data about the people these patients were in proximity to, including name, I.D number, phone number, data of birth, last date of exposure to the diagnosed patient, location of exposure. The data is sent automatically to the Health Ministry.

 The Ministry then generates text messages to the people who crossed paths with patients, ordering them to self quarantine. The identity of the diagnosed patients is not disclosed in the message.

 The reported criteria for triggering an alert is proximity of less than 2 meters for c. 15 minutes.

 Privacy Concerns:
o No opt-out mechanism
o Large scale mandatory data collection triggering quarantine orders
o Non-compliance with the orders is a criminal offence punishable by fine
o Suspected slippery slope of civic rights violations when a security agency is involved with a civic crisis
o Insufficient transparency and oversight
o Lack of appeal process on quarantine orders and citizen redress
o Based on new emergency regulations enacted in a speedy process

 Privacy and Security measures:
o The data extracted by the Security Agency will be kept separate from any other data the service has
o It will not be uploaded to a cloud service
o The data extracted will be deleted 7 days after the transfer to the Health Ministry, and unnecessary data will be deleted immediately
o No human will be exposed to the data, which is sent automatically, unless there is a claim or error that needs investigating
o The use of this data for a purpose other than the authorized one will be a criminal offence
o The arrangement is temporary and in force only until 30.4.2020 when the necessity to continue will be re-examined by a team of ministers who will consult with the head of the Security Agency and the Head of the National Security Council
o The examination will be based on measures of effectiveness of the solution in light of it being privacy intrusive
o The conclusion will be brought to the Prime Minister whose decision on continuing the program requires approval by a parliamentary committee and further legislation

 This program was petitioned against at the Supreme Court by civil society groups. The discussions have generated changes in the program and strengthening of oversight mechanisms but didn’t bring its cancellation. Proceedings are still undergoing.

 The government reported that between 18.3.2020 when this activity begun, and 6.4.2020, 1,800 of the people who received proximity alerts and were quarantined were found to be infected.

2/ Israel Proximity application “Hamagen” (the “Shield”)

 “Hamagen” is an opt-in, voluntary program where the application requires the user to download and install it from the app store and give it permissions to collect location data.

 It processes GPS data, Wi-Fi data, Google Timeline history upon separate consent.

 Bluetooth data feature in development.

 The app collects data from the moment of download and retains it on the user’s device.

 Every hour it checks the database provided by the Health Ministry with the current data and detailed itineraries of officially diagnosed patients.

 If there is a positive result the user gets an alert of being in proximity to a patient, and the time and location, without the patient’s identity.

 This alert is shown only to the user and is not reported to the government.

 The user is recommended to self quarantine but may use discretion if he/she thinks there is no need.

 If a user is diagnosed with the virus, the location history paths are already retained on the device and can be shared with the government database in order to accurately support the epidemiological research that is very laborious and challenging.

 As of 11 April, the App was downloaded by c. 1,480,000 people.

 The app was deleted by c. 452,000 people.

 The desired number for effectiveness of the program is 4 million installed devices.

 Currently c. 25% of the desired population is using the app.

 HaMagen was developed on open source code with the intention to share the code with all. The Health Ministry planned to publish the code on GitHub.

 Information in English from the Health Ministry can be found here: https://govextra.gov.il/ministry-of-health/hamagen-app/download-en/