When it comes to the new normal, the Thai Chana application -- which requires people to scan a Thai Chana Quick Response (QR) code to check in and check out of places they visit, stop by or dine at -- is certain to be familiar for those living in Thailand as a post-Covid-19 measure.
Endorsed by the government, the Thai Chana platform was developed by the IT team of Krung Thai Bank. It was then introduced by the Centre for Covid-19 Situation Administration (CCSA) as a national platform to fight against Covid-19 before the government started the second phase of easing of lockdown measures on March 17.
"We designed Thai Chana as a tool to help businesses safely resume operations," said Somkid Jiranuntarat, adviser to the president of Krung Thai Bank and a board member of the Digital Government Development Agency. Somkid is in charge of the team that developed Thai Chana and several other of the government's large-scale technology programmes like Chim, Shop, Chai (Taste, Shop, Spend) which has more than 10 million users and Rao Mai Thing Kan (no one will be left behind) which handles more than 30 million users.
"If you use Thai Chana, you are taking part in a process to help the country stop the spread of Covid-19," he said, adding that the more people check in and check out, the more data the government will have to mitigate the spread of the disease.
Thai Chana is available as a platform (www.thaichana.com) and also as a mobile app for Android and iOS smartphones (an English version for iOS will be available soon). The platform was built to provide a voluntary approach to help other users and businesses as it has a feature which allows users to evaluate the hygiene of shops or places. Moreover, users can also check if a place they are planning to visit will be crowded and they can also search for nearby restaurants or shops via the website and the app.
As of June 18, the Thai Chana platform has more than 24 million users, 355,000 of which are app users. Across the country, there have been more than 110 million check-ins, while the number of check-outs is about 60% of check-ins when the webpage platform is used and about 90% when the app is used.
During its early stages, the platform required people to provide a mobile phone number when they checked in. This requirement prompted some to voice their concerns over data privacy, especially since some users received spam messages asking them to join gambling websites after using the Thai Chana platform.
Although it was later made clear that advertising messages sent to smartphone users were not related to the Thai Chana platform as confirmed by the National Broadcasting and Telecommunications Commission and the five mobile phone operators, the reputation of Thai Chana had already become tainted. It led to uncertainty among people about using the Thai Chana platform.
"I prefer to check in via Thai Chana platform rather than using the app because I don't know the consequence of using it. I don't want to take a risk," said Hattaya Maneekaew, an office worker.
Thai Chana QR code on a public bus. Photo: Pattarapong Chatpattarasill
RECORDED DATA
Today, the Thai Chana platform does not ask for your mobile phone number when you check in. If you use the Thai Chana app, it will only ask for your mobile phone as part of the registration process.
"The app does not even ask for your name," said Somkid.
If you use Thai Chana app to scan a QR code, it will automatically check in for you and soon a group check-in function will be available as well. You may also check out later if you forget to do so after leaving the place or else the system will force check out at midnight, meaning data will be cleared out daily.
After a user checks in with the app, it will send an anonymous code to the server for collection, similar to when we swap a credit card. The system will not send our credit card numbers but it will send a code for safety reasons.
"The checked-in data will enable us to know places where people visit but we will not know who they are," he said. The data is used for displaying customer density at any given location.
The Thai Chana platform also has security layers to safeguard the data it collects. The technology includes data encryption, hash function and anonymous code. The anonymous data of check-ins and check-outs are stored for 60 days in a backend system. Although the Covid-19 incubation period is between two-14 days, academics say the ideal infection-free period is 28 days. To ensure the safety period, the data will be kept for two months.
Moreover, the Thai Chana app does not have a function to record your whereabouts. It will only use GPS coordinates when you use the search function to find places near you.
For those who want to keep a record of where and at what time they checked in during the past 14 days, they may consider using the Mor Chana -- meaning Doctors Win -- app. It is also a contact tracing app that was launched around early April. It features a Covid-19 self-assessment feature, location tracking via GPS and Bluetooth Low Energy technology, and an alert function if an infected patient is nearby.
The Thai Chana and Mor Chana platform complement one another.
Apart from the two apps, other Covid-19 tools available include Thai.Care from the Thai Chamber of Commerce, QR Checkin by the Association of Thai Software Industry (ATSI) and Skan & Go by Siriraj Hospital.
A visitors uses the Thai Chana platform to check in at the Damnoen Saduak floating market in Ratchaburi. Photo: Arnun Chonmahatrakool
DATA PRIVACY ISSUE
With the aim to fight Covid-19, governments in many countries have launched contact tracing apps including Australia, France, Germany, Israel, Kuwait, United Arab Emirates and Vietnam.
Based on research by Amnesty's Security Lab, these tracing apps can be categorised into three groups. The first group consists of apps that allow users to voluntarily record and check their symptoms without any tracing ability.
The second group is made up of apps that use Bluetooth technology for contact tracing and the data is stored on the user's phone. Last but not least, the third group, which Amnesty believes poses the most risk towards human rights, consists of contact tracing apps that use the phone's Bluetooth sensor or via GPS (or both) to track the user's locations and upload data to a centralised government database.
However, Amnesty's Security Lab has not done any research about Thailand's Thai Chana app.
"Sometimes people are too worried about data privacy when it comes to the digital format," said the Association of Thai Software Industry (ATSI) President Tinnakorn Laoraovirot.
Data privacy does not mean that personal data can't be used. It can be used as agreed in the consent, he said.
Based on the Thai Chana's consent, the Public Health Ministry and its agencies are those who can collect, use and disclose mobile phone numbers, places and times to prevent and control the spread of Covid-19 and other contracted diseases.
"Thai Chana states clearly how the information will be used. Some are afraid that the data will be misused but no one wants to do anything that is not stated in the agreement because it is illegal," he said.
Even though the Thai Chana app collects only mobile phone numbers and omits the contact tracing function, people are still concerned with its tracing ability.
"The Thai Chana app will collect data only when you check in and check out. It is a spot-checking app. It is not a contact tracing app," said Prinya Hom-anek, a cybersecurity specialist. He is also a member of a data governance committee for the Thai Chana platform. The committee was set up by the government around the end of May to audit the system's security and to ensure data privacy protection for the public.
"I always use Thai Chana app to check in because it will benefit me. If there is a new infection and if I happen to be at the place, the system will alert me. It is useful," he said.
"If people understand this benefit, they will check in with Thai Chana every time as I do."
Regarding concerns of data privacy violation, Prinya said the level of violations by Thai Chana is next to nothing. People were not confident in using the platform during its initial launch but nowadays, the number of people who are using the platform has gradually increased.
Even without Thai Chana, the government already has all the personal information of people. Banks collect more personal information than Thai Chana, he said, adding that even some well known foreign platforms collect and process more personal data of users than the Thai Chana, but people still happily use them.
Somkid Jiranuntarat. Photo: Wichan Charoenkiatpakul
For him, the real worrying issue has yet to come.
"For sure hackers will try to attack the system because data is an asset. It is money," he said.
So far, the Krung Thai team has managed to keep the information safe and secure. The committee, which had a meeting with the IT team of the bank a couple of weeks ago, has already offered some security advice. The committee will also audit the cybersecurity of the system in the future to prevent any possible cyber attacks.
"We will also make sure that the data will be erased after the health crisis is over," he noted.
