Health QR Codes 2: Rise of the "Digital Leviathan"

The spread of QR code-based quarantine systems has made digital surveillance a reality for the first time for most people on the mainland. While many credit the system with allowing China to emerge from its lockdown, some mainland commentators also worry about the privacy and governance implications of the growing “digital Leviathan.” Many assume that the system will outlive the epidemic it was built to control.

The following translations first appeared on Technode.

Wang Rong, a researcher at Tencent’s internal think tank, worries that China’s legal privacy framework isn’t up to the task of ensuring privacy for Health Code users. He argues that China’s policies should more closely follow Europe’s GDPR framework, which clearly delineates between data processors (the role Tencent and Ali have played) and controllers (the government). Wang argues that the government should be held accountable on several dimensions. 

[In Europe], the data processor can only process data in accordance with the written requirements of the data controller, and must ensure that its employees can comply with the requirements of confidentiality.

As the controller, the government department should limit the scope of data collection to the necessary range related to the epidemic when establishing the scope of data collection and use.

The government department has not been fully integrated into the personal information protection legal system. Although the national standard "Information Security Technology-Personal Information Security Specification" does not distinguish between applicable subjects, it is still a recommended technical standard and is not mandatory for various subjects including the government. Compared with internationally accepted practices, there is no doubt that the government is an important applicable subject in the legal system of personal information protection. 

Yan Hailu, a political economy researcher, traced back the growth of China’s surveillance state to 9/11 in The Initium, a Hong Kong-based outlet.  The academic was skeptical, however, that these changes will prevent the next outbreak.

The general consensus among researchers in surveillance societies is that the 9/11 incident was a turning point for countries around the world to imitate the United States' investment in digital surveillance, and China is probably the best student among them. During this period, the United States’ Cisco has deeply intervened in the informatization construction of Chinese public security.

9/11 made the Chinese government realize the important impact of terrorism on national security, and a few years later, the London bombing of the 7/7 subway in 2005 strengthened the urgency of the Chinese government to promote the construction of electronic monitoring platforms in cities.

The huge construction of surveillance infrastructure has made China the world's largest consumer market for surveillance equipment and related integrated services after 2016, and about 60% of this is due to public sector procurement.

Unlike Google and Apple’s designs based on voluntary and selective user participation, Alibaba and Tencent, which have taken the lead in developing “health codes” to assist the Chinese government in incorporating the majority of users into a mandatory, algorithm-based social management system.

During the epidemic, China’s commercial data giants not only provided tracing data including data consumption and mobile calls to the government, but also invested in the development of big data platforms and systems to help the government monitor the epidemic, such as Baidu’s migration data platform, Alibaba monitoring cloud, and so on. As epidemic prevention has become the number one priority for local governments, state-owned enterprises are also providing epidemic prevention technical support to the government. China’s three major communications operations have developed their own big data application solutions.

Driven by both political needs and commercial interests, the Chinese government seems to be able to rely on government-enterprise cooperation and use technology to achieve any goal to implement security governance. The experience of the provinces outside Hubei shows that the use of grid management and monitoring technology has indeed controlled the spread of the epidemic.

In fact, the health code has been described by some officials as a digital governance tool that can be retained and expanded in the future, and some Chinese public management scholars advocate that the "health code" be used as a lever to build digital infrastructure and further break down information silos. 

Yan was skeptical, however, that there’s an engineering fix to the problems that caused the outbreak.

A digital Leviathan can certainly prevent the threat of citizens and society to the security of the regime, and prevent the spread of the epidemic after the outbreak, but it cannot prevent the systemic failures that caused the outbreak.

Finally, podcast host podcast Li Houchen imagines Chinese society with a permanent Health Code system in a post on the platform “Seeing Ideals.” Li’s podcast focuses on deep dives into Western political thought has a bit of a Sam Harris vibe. Here he worries about balancing public health with individual rights. 

The core logic of this risk spread is: in the face of diseases like Covid-19, preventive measures are always better than not doing enough.

But what about preventing medical staff from returning to the community? Medical staff are definitely a group with high health risks. Personal freedom can be compromised, so what will stop us from not behaving decently to those compromised by the disease?

At the moment when the continuation and expansion of the health code is almost inevitable, I suggest that you pay attention and discuss the following matters:

a. Legislative characteristics of health codes

The connotation of the sacred social contract we signed is: If I have not violated the consensus (law) reached by everyone through public persuasion, my freedom should not be restricted.

So if the health code restricts access in such a powerful way, then every citizen needs to understand the operating principles and rules of the health code.

Everyone should transparently understand why they are assigned a red code when they receive one.

b. The human element of health codes

No matter how automated the health code itself is, in order to avoid the advent of a digital Leviathan, the health code itself also needs to have a centralized management department, a place to lodge complaints, and finally a mechanism for complete review and adjustment.

c. Compensation for high-risk groups

In order to prevent the health code from becoming a tool for the majority to exclude and discriminate against the minority, it’s extremely important for those who are evaluated as "unhealthy” to receive some form of compensation. 

Responding to the system in a proactive way, rather than rushing to get in line, show off our support, and engage in groupthink, is a top priority for public culture change.