Customers stand on circles marked on the ground to maintain social distancing as they wait to enter the Reliance Mart mall during a government-imposed nationwide lockdown as a preventive measure against the Covid-19 coronavirus in Ahmedabad on March 26, 2020. Sam Panthaky | AFP | Getty Images

When law enforcement agencies want to gather evidence locked inside an iPhone, they often turn to hacking software from the Israeli firm Cellebrite. By manually plugging the software into a suspect's phone, police can break in and determine where the person has gone and whom he or she has met. Now, as governments fight the spread of COVID-19, Cellebrite is pitching the same capability to help authorities learn who a coronavirus sufferer may have infected. When someone tests positive, authorities can siphon up the patient's location data and contacts, making it easy to "quarantine the right people," according to a Cellebrite email pitch to the Delhi police force this month. This would usually be done with consent, the email said. But in legally justified cases, such as when a patient violates a law against public gatherings, police could use the tools to break into a confiscated device, Cellebrite advised. "We do not need the phone passcode to collect the data," the salesman wrote to a senior officer in an April 22 email reviewed by Reuters. A Cellebrite spokeswoman said the salesman was offering the same tools the company has long sold to help police enforce the law. The company is also offering a version of its product line for use by healthcare workers to trace the spread of the virus that causes COVID-19, but the tools can only be used with patient consent and can't hack phones, she said. Cellebrite's marketing overtures are part of a wave of efforts by at least eight surveillance and cyber-intelligence companies attempting to sell repurposed spy and law enforcement tools to track the virus and enforce quarantines, according to interviews with executives and non-public company promotional materials reviewed by Reuters. The executives declined to specify which countries have purchased their surveillance products, citing confidentiality agreements with governments. But executives at four of the companies said they are piloting or in the process of installing products to counter coronavirus in more than a dozen countries in Latin America, Europe and Asia. A Delhi police spokesman said the force wasn't using Cellebrite for coronavirus containment. Reuters is not aware of any purchases by the U.S. government. So far, Israel is the only country known to be testing a mass surveillance system pitched by the companies, asking NSO Group, one of the industry's biggest players, to help build its platform. But the rollout of NSO's surveillance project with the Israeli Ministry of Defense is on hold pending legal challenges related to privacy issues, an NSO executive said. A spokesman for Israeli Defense Minister Naftali Bennett said NSO was involved in the project but did not provide further details. Surveillance-tech companies have flourished in recent years as law enforcement and spy agencies around the world have sought new methods for countering adversaries who now often communicate through encrypted mobile apps. The firms argue that their experience helping governments track shadowy networks of militants makes them uniquely qualified to uncover the silent spread of a novel disease. "I really believe this industry is doing more good than bad," said Tal Dilian, a former Israeli intelligence officer and now a co-chief executive officer of Cyprus-based Intellexa, a cyber-surveillance firm that works with intelligence agencies in Southeast Asia and Europe. "Now is a good time to show that to the world." Yet some technologists remain skeptical that spying tools reliant on phone location data can be used to effectively combat a virus. "It's not precise enough, that's the point. It's not nearly going to get you down to whether you're next to a certain person or not," said Michael Veale, a lecturer in digital rights and regulation at University College London. While the methods for location tracking and accuracy vary, surveillance companies say they can narrow down a person's coordinates to within three feet, depending on conditions.

Privacy rights vs. health concerns

Privacy issues loom. Civil liberties advocates fear that virus tracking efforts could open the door to the kind of ubiquitous government surveillance efforts they have fought for decades. Some are alarmed by the potential role of spyware firms, arguing their involvement could undermine the public trust governments need to restrain the spread of the virus. "This public health crisis needs a public health solution - not the interjection of for-profit surveillance companies looking to exploit this crisis," said Edin Omanovic, advocacy director for the UK-based civil liberties group Privacy International. Claudio Guarnieri, a technologist with the human rights organization Amnesty International, said any new surveillance powers embraced by states to combat the virus should be met with "high scrutiny." "New systems of control, from location tracking to contact tracing, all raise different concerns on necessity and proportionality," said Guarnieri. Cellebrite, for one, said it requires "agencies that use our solutions to uphold the standards of international human rights law." Government officials have sought to address such concerns by pointing to the unprecedented nature of the crisis. COVID-19, the respiratory disease caused by the new coronavirus, has so far infected more than 3 million people worldwide, killing over 210,000. In South Africa, for example, after the government last month announced it would use telecom data to track the movements of citizens infected with COVID-19, a communications minister acknowledged concerns about loss of privacy. "We do respect that everyone has a right to privacy, but in a situation like this our individual rights do not supersede the country's rights," Stella Ndabeni-Abrahams, the communications minister, said at a press conference for South Africa's COVID-19 command council this month. The South African Health Ministry declined to comment on details of the program and whether it had contracted with any of the intelligence firms. A number of countries are developing and deploying COVID-19 contact-tracing apps that do not rely on location data. Instead, these apps, already in use in Singapore, India and Colombia, tap the smartphone connectivity technology Bluetooth to sense and record when other devices are nearby. When someone tests positive for coronavirus, typically, everyone that person made contact with is notified. Christophe Fraser, an epidemiologist at Oxford University's Big Data Institute, said this approach, if implemented properly, could save lives and shorten lockdowns. "The idea is to try and maximize social distancing practices of those at risk of infection and minimize the impact on all the other people," he said. This app-based approach to contact tracing is considered, by its advocates, as more privacy friendly because people voluntarily download the app and sensitive personal data are visible only to health authorities. This method of containing the disease is the focus of a rare collaboration between Apple Inc and Alphabet Inc's Google to quickly deploy the Bluetooth-based technology for use in the United States and elsewhere. But the approach relies on widespread adoption of the apps, and its accuracy remains unproven. South Korean job seekers during an exam conducted outdoors amid social distancing measures in Seoul, April 25, 2020. REUTERS/Kim Hong-Ji

Apple says its plan is designed to "help amplify the efforts of the public health authorities" and that "many factors will help flatten [infection] curves — no one believes this is the only one." A Google spokesman referred to a prior statement, which said "each user will have to make an explicit choice to turn on the technology." By contrast, deploying a mass surveillance platform like Intellexa's means everyone would be under collection right away; no one needs to opt in, nor could anyone opt out. Such a setup can be done remotely in a matter of weeks, said an executive at NSO Group, which is also offering its wares to fight the coronavirus.

Public health spy tech