Home Coronavirus

5.1 million sacrifice privacy to Thai Chana virus-tracing app in first 2 days

Analysis: Thailand faced with Hobson's choice between offering personal data allowing the government or missing out on alerts warning them of a deadly virus

ThaiChana Thailand Checkin App Central World Shoping Mall Covid-19 Contact Tracing App
Customers "check in" at Bangkok's Central World on May 17 using the government's controversial Thai Chana app.

More than 5 million people used the government’s new Thai Chana mobile app to check in to shopping malls and other retailers in its first two days despite questionable privacy policies and questions over personal data protection.

Taweesin Visanuyothin, spokesman for the Center for Covid-19 Situation Administration, said Tuesday that 5.08 million used the app created by Krungthai Bank for the Ministry of Digital Economy in order to access businesses that reopened from Sunday.

The system recorded 8.6 million check-ins but only 6.4 million check-outs, showing retailers are not being nearly as mindful about people leaving than arriving.

Countrywide, 67,904 businesses have registered on the Thai Chana platform, which provides them a QR code that customers scan on the way in and out. One third of those are in Bangkok, with Chonburi, Nonthaburi and Samut Prakan next.

While aimed at shopping malls, a large variety of businesses have glommed on to the system, including supermarkets, banks, consumer beauty clinics and salons, even though most have been happily receiving customers for weeks or the entirety of the pandemic with mere temperature checks and hand sanitizer.

Thai Chana is the government’s amateurish effort at contact tracing to prevent new mass outbreaks of the coronavirus. While contact tracing is essential and the goal admirable, the technological approach taken is primitive and the privacy worries significant.

Taweesin stressed again at his Monday news conference that system does not take any information from a user’s mobile phone other than what is volunteered: a phone number. He insisted the data is only used by the Public Health Ministry and will be deleted after 60 days.

The government, however, has been the opposite of transparent in laying out exactly what phone-software processes the system accesses, so users are forced to take the government’s word at face value, which has meant little since the 2014 military coup.

Thai Chana is actually based on a readily-available app called MorChana (Doctors Win) built by Electronic Government Development Agency, a Thai government enterprise. It was developed into a web app run on Naver Corp.’s Line messaging app platform to allow the ministry to alert users that someone visiting a venue at the same time had been diagnosed with Covid-19. Users who obtain the alert are eligible for a free coronavirus test.

Thai Chana coronavirus contact tracing app survey page

When checking out, users also are presented with a short survey asking – in Thai only – if the venue cleans surfaces regularly, has staff wearing face masks and personal-protection equipment, provides hand-sanitizing gel and spaces tables and seating at least a meter apart. There is no text area for providing written commentary and no stars to collect, thankfully.

But, as always, the devil is in the details. In this case, those are the Terms and Conditions that retailers – not the public – are given access to.

Those terms allow the health ministry to access to its mountain of personal data to any organization it wants in the name of the “public interest”. With a loophole large enough to fly an Airbus A380 through, it’s no wonder that government opposition groups are worried. The military-based government can get its hands on personal tracking data with the wave of another emergency decree.

Assuming users do provide valid phone numbers, they can easily be identified as the copies of their identification cards and passports were required to obtain a SIM card for the phone. That database of matched ID and phone numbers is, of course, maintained by the government at the Ministry of Information and Communication Technology.

But leaving the key mechanism of a app with such a critical function – contact tracing – up to the honestly of a skeptical public is the real flaw of the Thai Chana system. There is nothing to stop the user from simply punching in a fake number. The same is true for users who choose, instead, to write their contact details into a written log.

So how many of those 5.1 million people entered fake numbers? No one knows and the government will never admit it. Users are faced with a Hobson’s choice: Concede your privacy to a government that cannot be trusted with it or risk missing out on a notification that you might have been exposed to a deadly virus.