The Collapsed Bridge Loan: Israel’s Shin Bet Location Tracking of Omicron Carriers

Israel reinstated contact-tracing activities by the Israel Security Agency to track carriers of the omicron variant of the coronavirus. Five days later, it halted the ISA’s contact-tracing activities, due to a lack of parliamentary support.

Flash 90

In late November, Israel reinstated contact-tracing activities by the Israel Security Agency (ISA, also known as Shabak or Shin Bet) to track carriers of the omicron variant of the coronavirus. Five days later, it halted the ISA’s contact-tracing activities, due to a lack of parliamentary support. This is not the first Israeli exercise in purpose creep, where invasive intelligence measures are used for civilian matters. Over 11 months during the coronavirus pandemic, Israel employed the ISA’s “Tool” for contact-tracing purposes.

The Tool is a vast database operated by the ISA into which all Israeli communication metadata have been siphoned for nearly two decades. Under Israeli ISA law, licensed telecommunications providers are required to provide the ISA with any noncontent communications data that the prime minister determines necessary. Although the statutory provisions that provide the legal basis for the operation of the Tool are publicly available, the Israeli public learned of the Tool’s existence only following its controversial use for contact-tracing purposes in 2020, from an expose in a leading Israeli newspaper.

The Tool relies on cell phone location data continuously streamed by the telecommunications providers to the ISA. Unlike contact-tracing apps, which require users to own a smartphone and to actively install them, ISA contact-tracing measures are undertaken without consent and their reach extends to all cellular devices, including basic models that lack the advanced functionality of smartphones.

When the Tool is employed for location tracking of coronavirus carriers and of persons with whom they have been in close contact, the ISA receives identification details of the virus carrier from the Ministry of Health. The ISA then returns the carrier’s location data for the 14 days preceding the diagnosis and identifying data for persons with whom the carrier has been in close contact during that period, as well as the time and location of the contact.

During the first and second waves of the coronavirus pandemic in Israel, the authorization of the ISA’s purpose creep was gradual. The first instances of ISA use of the Tool around March 8, 2020, for contact tracing were without any legal basis, as Israel’s state comptroller later determined. Only a week later did the government issue emergency regulations authorizing ISA contact-tracing activities. These were later replaced by a government resolution under the ISA law, which is subject to the approval of the parliamentary subcommittee for secret services. Pursuant to an Israeli High Court of Justice ruling in late April 2020, the government embarked on drafting a statutory law, which was enacted in July 2020. After a technical extension to its sunset provisions, the law expired in July 2021.

These dynamics of authorization of purpose creep were almost replicated for carriers of the omicron variant. Within days of the first reports of the variant, the Israeli government responded by tightening travel restrictions and issuing emergency regulations authorizing the ISA to engage in location tracking of carriers of the omicron variant.

The omicron emergency regulations, later described by government officials as an interim “bridge loan” authorizing the ISA’s activities while drafting and enacting a statutory law, reflect a shift in the operational understanding of the Tool. Previously, the Tool was perceived as a measure replacing human epidemiological investigators. Under the provisions of the now-expired law from July 2020, the ISA was allowed to engage in location tracking only when the daily number of new coronavirus carriers exceeded 200. However, under the omicron emergency regulations, there was no such threshold of new carriers. The government now views the Tool as a supplementary measure that allows epidemiological investigators to cope with carriers’ memory and knowledge gaps in an effort to nip the spread of a new variant in the bud.

The omicron emergency regulations were limited to carriers of the new variant and to persons that, according to lab tests, may be carriers of the omicron variant, rather than to carriers of the coronavirus as a whole. The ISA was authorized to provide the Ministry of Health with data relating to the seven days preceding diagnosis, rather than the two-week period set in the authorization law from July 2020. The emergency regulations were set to expire within five days.

Apart from these provisions, the omicron emergency regulations appear to be identical to the July 2020 authorization law, and they provide for a data transfer scheme between the ISA and the Ministry of Health identical to the one in the previous law. The regulations also contain similar provisions pertaining to retention of contact-tracing data by the ISA and the Ministry of Health and its confidentiality and access limitation. Under the omicron emergency regulations, as was ISA policy throughout the first coronavirus waves, the ISA is not authorized to monitor or enforce any coronavirus-related quarantines nor is it authorized to directly engage with carriers of the omicron variant or persons with whom they have been in close contact.

Within a day of their promulgation, the emergency regulations were challenged by several nongovernmental organizations at the High Court of Justice. The petitioners argued that, according to existing ISA coronavirus location case law, the ISA cannot authorize the location-tracking measures through emergency regulations but, rather, must do so through a parliamentary review procedure—either by limited review by the secret services subcommittee of a government resolution or by a full deliberative parliamentary statutory legislation process. The court rejected these arguments, ruling that in the current circumstances of a short expiration term and narrow scope of the regulations, and given the uncertainty surrounding the threat of the new variant, emergency regulations can be in effect for a five-day period while statutory legislation is promoted. In response to arguments made by the petitioners regarding the limited efficacy of the Tool for location tracking, the court relied on classified data presented to it ex parte, as well as to the limited temporal and personal scope of emergency regulations, and determined that the omicron emergency regulations are proportional.

The court delivered its ruling on the last effective day of the omicron emergency regulations. Later that day, the government announced that it would not extend the regulations any further. While the government presented this decision as guided by professional considerations, it seems that a forming bipartisan group of Knesset members opposing ISA coronavirus surveillance have managed to deter the government from moving on with the draft bill to authorize the ISA to engage in location tracking of carriers of the omicron variant, thereby collapsing the bridge loan the government took when it promulgated the emergency regulations.

In the omega variant war game exercise conducted merely weeks before the appearance of the omicron variant, the Israeli government tested its ability to handle an outbreak of a new coronavirus variant. The ISA Tool was employed in this drill. Thus, its use to counter the threat of an omicron outbreak was not improvised at the last minute, as may have been the case in the first coronavirus wave.

The Israeli government’s readiness to reinstate the use of an invasive counterterrorism measure for civilian purposes, time after time, raises concerns about ongoing, long-term purpose creep of surveillance technologies originally intended for national security purposes. For example, earlier this year, the government introduced a draft bill to authorize police use of license plate recognition systems, which lays the ground for future use of facial recognition measures (whose application for national security purposes in the occupied territories is disputed) by law enforcement authorities.

Furthermore, despite the shift in the operational purpose of the Tool, the continued reliance on it as a ready-made solution hinders the development of alternative civilian, privacy-minded measures and overlooks the lessons from the previous round of ISA contact tracing. One such lesson is that the Tool suffers from accuracy gaps in certain circumstances, which may render it technically unsuitable for contact-tracing tasks.

The end result of this round of ISA coronavirus location tracking serves as a reminder that privacy-related issues are indeed bipartisan. The High Court of Justice ruling in this petition can be read as allowing the government to issue more temporally limited emergency regulations authorizing the ISA to assist in containing the spread of future variants. However, these cases will require a limited timeframe and a narrow and targeted scope of surveillance to justify the utilization of the Tool for purposes beyond the ISA’s statutory purposes. Perhaps further burden of proof will be required in light of the collapsed omicron bridge loan case, where no parliamentary support was found for statutory legislation authorizing ISA contact tracing.

The article was published in Lawfare.