China appears to be using the COVID-19 outbreak to collect data on its citizens, says reporter

China is using a phone app in order to track which of its citizens are at risk of COVID-19 — but according to a New York Times investigation, the app may also be sending user data directly to the police.

The Times reported this week that China's government has set up checkpoints in many parts of the country requiring people to show a code on their phone in order to pass through.

But it's not entirely clear how it works — or whether it works correctly. Some Chinese citizens are reporting being quarantined without actually being sick.

Paul Mozur is one of the reporters who worked on the story. He covers both Asia and technology for The New York Times.

He spoke with Day 6 host Brent Bambury about the phone app, and its implications for surveillance in China. Here is part of their conversation.

How does this app actually work?

So basically you enter a bunch of personal data into the app, and it also uses big data and a bunch of calculations that are sort of opaque and unclear. It then decides whether people should be quarantined.

It works on a kind of stoplight system of red, yellow, and green. Green, you're good to go and you can move around the city. Yellow, you need a seven-day quarantine. And red, you actually have to sit inside for 14 days.

And it works because you have checkpoints all over the place where people are actually looking to see what colour your app code is.

How does the app decide what colour it's going to assign to a citizen?

There's just not a lot of clarity on that at all. We tore apart the code of the app, and there are a couple of interesting things. It seems to check people's reported health information — where they might have been travelling, and where they live — that kind of thing.

But another thing it was doing is grabbing their phone location and sending it back to the police. The app sort of disclosed that it was a government program, but it didn't say specifically that law enforcement was getting this data.

How are citizens reacting to the app?

It's really interesting. I think most people are pretty comfortable with it. We spoke with a bunch of people who said this is fine.

But there is a whole population of people who are living in this sort of limbo where they have a red code and they don't know why. There's a phone you can call where you can complain but the problem is that number is always busy.

And so those people are stuck. They can't go back to work [or] leave their house because their code is red. And for them it's become this arbitrary form of detention, and it's quite frustrating.

Has anyone tried to bypass the app or checkpoints?

You could take a screenshot of a green code and try to use that. I've used that to get through a few times.

One guy we talked to was trying to get back home and was driving on a highway. He went to three different exit ramps and each time they checked his code.

Because it was red, they wouldn't let him get into town. But on the fourth ramp, lo and behold, they didn't check, and he got off. So you can kind of find the holes in the system, but at the same time it certainly makes life much more difficult.

You discovered that the phone was reporting to police. What did the app developers say when you asked them about it?

The project was done by Alibaba (the large Chinese internet company) in cooperation with the Chinese police and the local government there. They said ... they ask a user's permission to share their data. And they only share after that.

And that is very much true. ... The thing is, in a public health crisis with an app that you know you have to use to get around, you don't really have a lot of choice.

How much concern is there that the Chinese government might use this kind of data gathering tool in the future after the panic from the coronavirus has subsided?

This is the big question right now. And it may seem from outside of China as if Chinese internet companies are sharing all their data with the government at all times. But in fact, that's not really how it works. There's actually a process.

Police, for instance, have to provide a name to an internet company before they can start looking at that person's information. What this app represents is this sort of step beyond that ... where the data is being shared directly to the police without that intermediary step being there. And that's a really big shift, and it's an important one.

I think this app will go away when when the virus goes away. But the question becomes: OK, if the government is comfortable with this, do they keep using that kind of feature in other products and pressing companies to cooperate?

These are monster internet companies, but they're pygmies compared to the Chinese Communist Party — and they don't have a lot of choice.

Written and produced by Steve Howard. Q&A edited for length and clarity.

To hear more from Paul Mozur, download our podcast or click Listen above.