The Department of Health (DOH) will soon be taking control of the government-endorsed contact tracing app, StaySafe.PH, amid concerns on its privacy protocols.
In its Resolution No. 45, series of 2020, the Inter-Agency Task Force for the Management of Emerging Infectious Diseases (IATF) ordered DOH to sign a Memorandum of Agreement (MOA) with Multisys Technology Corporation, the developer of StaySafe.PH, for the said turnover.
Under the accord, Multisys Technology Corporation will donate the source code, data, data ownership and intellectual property of StaySafe.PH. to DOH.
The donated version of StaySafe.PH must be able to perform the functions of two separate applications, as follows: bluetooth digital contact tracing which shall be connected to tracing technologies (ex. Google, Apple, etc.); and serve as the frontend application system for local government units.
“As part of the donation, all data currently in the database of StaySafe.PH shall be migrated to Covid-Kaya [system],” the IATF said.
In preparation for the MOA, the IATF instructed the Department of Information and Communication Technology (DICT) and the National Privacy Commission (NPC) to ensure the donation is “technically feasible and secure, that systems are compatible, and that the arrangement is compliant with data privacy laws.”
In an online press briefing, DICT deputy spokesperson Adrian Echaus said StaySafe.PH already went through the assessment of their Cyber Security Bureau.
“We are just deferring to what the IATF will say [on the matter],” Echaus said.
Multisys was given 30 days from the issuance of the new IATF issuance on June 10, 2020, to complete the donation of StaySafe.PH to DOH.
“Otherwise, the endorsement by the IATF to the effect that StaySafe.PH is the official contact-tracing application of the government shall be withdrawn and Multisys shall migrate the data collected and stored in StaySafe.PH to the DICT,” IATF said.
The IATF made the decision after former DICT undersecretary Eliseo Rio Jr. alleged StaySafe.Ph is plagued by privacy protocol weaknesses.
Rio, who proposed a different contact tracing system during his stint at the DICT, maintained the government should have used multiple providers instead of just Multisys.
Presidential spokesperson Harry Roque said the IATF considered Rio’s proposal, but it ultimately decided pick option offered by Multisys since it was already available at a time when it was needed by authorities.
“IATF had to make a decision quickly and they decided that the only available technology then was StaySafe.PH. It is true he [Rio] had a proposal also, but the problem was it was yet to be implemented,” Roque said.
He said Rio was aware of this since he was present meeting as a undersecretary of DICT, when the IATF made the decision.