Israel Reauthorizes Shin Bet’s Coronavirus Location Tracking

In its attempts to contain the spread of the novel coronavirus, Israel has employed a measure that has not been used by any other democratic country. Since mid-March, the Israeli government has sought the assistance of the General Security Service (also known as the Israeli Security Agency, the ISA, the Shabak or Shin Bet) in conducting epidemiological investigations by providing the Ministry of Health with the routes of coronavirus carriers and lists of individuals with whom they have been in close contact. The ISA queries its communication metadata database to identify the route of confirmed carriers and the individuals with whom they have been in close contact.

The legal framework authorizing ISA location tracking evolved from emergency regulations promulgated by the government, through a government resolution approved by the Knesset’s Intelligence Subcommittee, to a government-drafted bill. The draft Law to Authorize the ISA to Assist in the National Effort to Contain the Spread of the Novel Coronavirus 2020-5780 (Coronavirus Location Tracking Bill) was prepared pursuant to the Supreme Court’s ruling in Ben Meir v. Prime Minister. Under the Ben Meir ruling, the government resolution to harness the capabilities of the ISA for coronavirus location tracking (a purpose outside the ISA’s statutory remit, which requires special approval by the subcommittee) could be extended by no more than a few weeks and only to allow for the drafting of a new law.

The Coronavirus Location Tracking Bill was approved by the Ministerial Committee on Legislation in early June 2020, although eventually the government decided not to bring it before the Knesset—reportedly at the request of the ISA director. ISA authorization to engage in location tracking of coronavirus carriers, which was employed for only one case in a period of two weeks (tracking a carrier who could not communicate with the epidemiological investigators), was finally extended for 48 more hours and then terminated by June 11.

However, in light of the growing likelihood of a second wave, by June 21 the government had started considering retasking the ISA with coronavirus tracking. On June 24, the bill was approved by the Cabinet and subsequently passed in a preliminary reading in the Knesset Plenum. Following Intelligence Subcommittee Knesset Member Zvi Hauser’s suggestion, the bill was split in two: temporary provisions (effective for 21 days) and the main bill. The temporary provisions shall provide the Ministry of Health with immediate authorized ISA assistance and allow for more thorough parliamentary deliberations on the main bill.

On July 1, the Knesset Plenum enacted the Law to Authorize the ISA to Assist in the National Effort to Contain the Spread of the Novel Coronavirus (Temporary Provisions) 2020-5780 (Coronavirus Location Tracking Temporary Provisions).

The Coronavirus Location Tracking Temporary Provisions

Under the Coronavirus Location Tracking Temporary Provisions, which are to remain in force for a period of three weeks, the ISA is authorized to engage in location tracking activities subject to an authorizing declaration. An authorizing declaration can be made provided that the government is convinced that, due to concerns about an outbreak of COVID-19, the respiratory disease caused by the novel coronavirus, it is required to use the ISA for individual cases, wherein other epidemiological investigation measures are not sufficient, or when the daily number of newly confirmed cases exceeds 200 patients. Under an authorizing declaration in the latter case, the Ministry of Health shall perform regular epidemiological investigations on 200 of the new patients and may decide whether to request ISA assistance regarding the rest.

An authorizing declaration shall remain in force for 21 days, and it shall be deemed that an authorizing declaration was made on the day the law was enacted. Authorizing declarations may be terminated either by the government or by the Knesset. The government shall appoint a ministerial committee (which will include the prime minister, the minister of health, the justice minister, the intelligence minister and others) to examine the continued necessity of ISA assistance under the Coronavirus Location Tracking Temporary Provisions.

During the effective period of an authorizing declaration, the ISA is authorized to receive requests for assistance from the Ministry of Health regarding a COVID-19 patient—those requests are limited in scope subject to the authorizing declaration—to process technological data pertaining to the patient for the 14-day period preceding the patient’s diagnosis as a coronavirus carrier, and to provide the Ministry of Health with the required data.

“Technological data” is defined under the Temporary Provisions as “subscriber data” (further defined as “name, identification number, phone number and date of birth”) and cell phone location data and traffic history (further defined as the phone numbers of both parties to a phone call and the time it was made), excluding the contents of a “conversation” as defined by the Wiretap Law of 1979. “Required data” is defined as a patient's location data in the 14-day period preceding diagnosis as a coronavirus carrier, and as the subscriber data of individuals who have been in close contact with a patient, as well as the location and time of such contact. A “patient” is an individual with positive lab test results for the coronavirus (compare with the wider definition of a patient in the emergency regulations, later limited by a Supreme Court interim order).

An authorized representative of the Ministry of Health will submit requests for required data to an authorized ISA representative. The ministry will then notify the patient that such a request was made. Once identified by the ISA, individuals who have been in close contact with a patient will be promptly notified by the Ministry of Health and reminded of their legal duties to report and self-quarantine. Such individuals may request that the Ministry of Health review the data determining that they were in close contact with a patient. In such cases, the Ministry of Health will submit a follow-up query to the ISA with all relevant details within three days.

The Coronavirus Location Tracking Temporary Provisions further order that the director of the ISA shall set confidential internal procedures (subject to the approval of the attorney general) pertaining to ISA activities under the Temporary Provisions. The Intelligence Subcommittee shall be informed of these internal procedures. The chief executive of the Ministry of Health shall also set internal procedures (subject to the approval of the attorney general) pertaining to its activities under the Temporary Provisions, which will include review procedures, data protection procedures, clinical guidelines regarding the definition of “close contact” and the criteria for defining individual cases wherein other epidemiological investigation measures is not sufficient. The internal procedures for the Ministry of Health shall be made publicly available online.

The Coronavirus Location Tracking Temporary Provisions stress that the ISA shall not be in direct contact or communication with patients or individuals who have been in close contact with patients. Furthermore, the ISA shall not be tasked with enforcement of quarantine orders and shall not provide any assistance to enforcement activities.

The data protection provisions in the Coronavirus Location Tracking Temporary Provisions provide that the ISA shall hold Ministry of Health requests and the required data on its computer systems, but that information must be kept separately from any other data lawfully held by the ISA. A purpose limitation clause limits the ISA use of both the Ministry of Health requests and the required data to only its assistance activities under the Temporary Provisions. The ISA shall retain such data for a period of 14 days following the transfer of the required data to the Ministry of Health, and delete it thereafter. Any other incidental data created while processing technological data under the Temporary Provisions shall be deleted immediately. The Temporary Provisions require that only specifically authorized ISA personnel will be allowed access to Ministry of Health requests and the required data, and their activities will be documented in an automated log maintained by the ISA.

Similar provisions apply to the Ministry of Health, which is required to safeguard the required data in a manner that ensures its confidentiality and security. The Ministry of Health will purge the required data received under the Coronavirus Location Tracking Temporary Provisions upon the termination of the effective period of the law. However, the Ministry of Health may retain the data for an additional period not exceeding 60 days for internal review purposes. The chief executive of the Ministry of Health shall authorize employees of the ministry to access required data for specific purposes listed in the Temporary Provisions (such as handling Ministry of Health requests for required data, patient notification, review of close contact appeals and internal oversight).

The ISA shall not share any data received or created under the Temporary Provisions other than the required data and with the Ministry of Health only. Similarly, the Ministry of Health shall not provide any other party with any information received under the Temporary Provisions apart from information regarding the inclusion of an individual on the lists of persons under quarantine.

Both the director of the ISA and a representative of the Ministry of Health will provide written reports to the Intelligence Subcommittee and the attorney general on a weekly basis. The Temporary Provisions detail the data and statistics to be included in these reports.

Data Privacy Concerns

Much like the preceding legal frameworks authorizing ISA COVID-19 surveillance, the Coronavirus Location Tracking Temporary Provisions cover mainly the interface between the ISA and the Ministry of Health. The thorough drafting process of the Temporary Provisions and the law’s predecessor, Government Resolution 4950, focused on the data-transfer scheme between both parties, and have not yielded any development or discourse regarding the ISA metadata collection measures, which are governed by a loose statutory framework and a cloud of secret rules and internal ISA procedure.

Concerns may also be raised regarding oversight. Although the Temporary Provisions require both ISA and the Ministry of Health to report to the Knesset Intelligence Subcommittee, the data in these reports might not provide sufficient insights to subcommittee members. Some members of the Knesset have pointed in previous hearings of the subcommittee to inconsistencies between the ISA reports and the Ministry of Health reports that make it difficult to assess the effectiveness of the ISA assistance activities. Having no dedicated external oversight agency (such as the U.K.’s Investigatory Powers Commissioner Office or the Dutch CTIVD), reliance on a parliamentary committee and the quasi-external executive oversight of the overworked attorney general’s office might not be enough.

Also, the so-called limited scope of the Ministry of Health’s reliance on ISA assistance may not be so limited. On average, there were more than 500 newly confirmed coronavirus cases per day in the last week of June, and that number is expected to grow. Given these numbers, ISA is authorized to use its powers under the Temporary Provisions for more than 50 percent of the new patients, climbing up to 80 percent of the patients added on July 2—hardly a limited scope.

Government authorities around the globe have been developing a taste for data. Once access to the ISA’s communication metadata treasure trove for purposes other than national security and counterintelligence receives statutory approval, other instances may follow. The greatest concern raised by the Coronavirus Location Tracking Temporary Provisions and its complementary pending legislation is legitimizing mission creep, and creating a legal device that could be adapted in the future for data transfers between the ISA and other authorities for other purposes. This treasure trove of communication metadata may turn out to be Pandora’s Box.