Full Report (PDF, 226KB)
Israel’s Ministry of Health (MOH) has been conducting contact tracing in an effort to reduce the spread of the coronavirus pandemic. Tracing has involved questioning diagnosed patients, using tracing technology via a voluntary app, and surveillance by the Israel Security Service (ISA) without the consent of those observed. Surveillance of civilians for the purpose of epidemiological examination is normally outside the scope in which the ISA is authorized to operate and constitutes a serious challenge to the right to privacy and to patients’ rights. The assistance provided by the ISA to the MOH is therefore regulated under temporary special legislation that defines the scope, procedure, and duration of the activity, while addressing the constitutional challenges associated with it. Under the legislation, ISA tracing assistance requires a government declaration. The latest declaration extends to December 9, 2020. An audit conducted by Israel’s State Comptroller’s Office suggests that the questioning of patients may be more effective than the use of digital contact tracing.
In an effort to stop the spread of the Covid-19 pandemic, Israel’s Ministry of Health (MOH) has implemented contact tracing by epidemiological questioning of patients as well as the use of digital technologies.
In March 2020, the MOH issued a voluntary app, the Magen. The app appears to be unpopular so far and has been uploaded on a relatively small number of cellular phones in Israel. The MOH has also used tracing information transmitted to it by the Israel Security Service (ISA) regarding persons who were in close proximity to identified Covid-19 patients.
The ISA is a “leading operational and technologically-oriented security Agency” that engages in activities “to secure state secrets and counter threats posed by terrorism, cyber-attacks, foreign espionage, and domestic subversion.” The ISA Law, 5762-2002, specifies that
[t]he service is responsible for safeguarding the security of the state, the rules of the democratic regime and its institutions, against threats of terrorism, sabotage, subversion, espionage and revealing state secrets, and the service will work to safeguard and promote other state interests that are vital for national security. . . .
The tracing assistance provided by the ISA to the MOH, therefore, appears to be outside of the scope of its legal authority. Additionally, the use of tracing devices by the ISA raises challenges to the right to privacy and to patients’ rights, which are protected under Israel’s basic laws, statutes, and regulations.
The utilization of ISA’s robust surveillance technologies for the purpose of contact tracing, therefore, required special authorization by legislation that restricted its scope and duration. Previously issued emergency regulations, in accordance with a determination by the Supreme Court that the ISA tracing assistance provided to the MOH must be regulated by law, were replaced by legislation. The ISA authorization under the legislation, however, is temporary and will expire on January 20, 2021, unless extended by a legislative act.
This report analyzes the provisions of the ISA Authorization Law, the effectiveness of the ISA’s assistance in tracing Covid-19 contacts, and the current status of the authorization.
II. Objective of the ISA Authorization Law
The ISA Authorization Law states that its objective is to enable the ISA
to assist the Ministry of Health in conducting an epidemiological investigation to reduce the spread of the novel corona virus, in order to protect the safety and health of the public, as part of the State of Israel’s efforts to confront the fast spread of the virus and in view of the urgency deriving from the increase in the rates of disease that constitutes a serious and immediate danger to the citizens of Israel and its residents and requires the use of extraordinary means, all for a limited period and while promoting and assimilating the use by the public of civilian technology to locate those who have been in close contact with patients.
III. Government Declaration Authorizing Tracing Assistance
A. Issuance of a Declaration
The ISA Authorization Law empowers the government, based on a concern for the widespread of the coronavirus, to issue a declaration authorizing the ISA to provide tracing assistance to the MOH by conducting epidemiological investigations for tracing patients’ contacts in a period of up to 14 days prior to diagnosis, in accordance with professional guidelines issued by the MOH.
The government may not issue the declaration unless it is satisfied that there is no suitable alternative to ISA assistance, having regard to the risk posed to the public by the disease and having been presented with the recommendations of a ministerial committee. The ministerial committee is composed of the prime minister (PM), the alternate PM, the minister of health, the minister of justice, the minister of intelligence and other ministers as needed. The Law requires that the committee issue its recommendations after it has received the opinion of the Office of Privacy Protection in the Ministry of Justice on the matter.
B. Parliamentary Review
The government’s declaration must be submitted to the Foreign Affairs and Defense Committee (KFADC) of the Knesset (Israel’s parliament) for approval. The KFADC may approve, disapprove, or shorten the duration of the declaration. If it has decided not to approve the declaration, it will expire at the end of 24 hours from its issue. The declaration is deemed approved if the KFADC takes no action on it.
The declaration will expire on the date it specifies or within 21 days from its publication in the official gazette, depending on the prognosis for the spread of the coronavirus. During the period of validity of the declaration, the MOH may submit a request for assistance to the ISA, provided that the number of new patients on that day or the day before it exceeds 200.
D. Current Status of ISA Authorization
On November 23, 2020, the KFADC approved the government’s declaration, which authorized the continued ISA assistance operations until December 9, 2020. The ISA authorization was granted in accordance with the ISA Authorization Law that had been adopted by the Knesset on July 1, 2020, and amended on July 21, 2020.
IV. Scope and Procedures for ISA Tracing Assistance
ISA tracing assistance activities are limited to processing “technological information” about patients and the persons with whom they came into close contact within 14 days before diagnosis, in accordance with MOH professional guidelines. The Law defines “technological information” as data regarding identification, location, and communication, excluding call content as defined in the Secret Wiretapping Law 5739-1979.
During the duration of the declaration, the ISA is authorized to transfer to the MOH information
(a) Regarding the patient-location data in the period up to 14 days before the date of diagnosis and according to the professional guidelines of a representative of the Ministry of Health;
(b) For persons who came into close contact with the patient-identification data, date and time when they were in last close contact with the patient and the location where that contact took place.
The Law requires that to the extent possible, any ISA tracing assistance will be delivered digitally, while maintaining the privacy and dignity of the patient and of the persons with whom the patient came into close contact.
The Law regulates the procedures for the submission of MOH requests for ISA assistance. It further requires the MOH to inform the patient that a request for tracing assistance had been filed with the ISA due to the patient’s positive diagnosis. The patient must be informed of the objective of the request and how to find out more details in the matter. The Law similarly regulates the procedures by which the MOH will inform persons who were in close contact with the patient of their status and of their ability to appeal the MOH decision in the matter.
The Law requires the head of the ISA to establish a protocol of operating procedures for tracing assistance. The protocol must be approved by the attorney general, and it will be brought to the attention of the Knesset Committee on Service Affairs. The protocol is confidential, and its disclosure or publication is prohibited.
As compared with the confidential procedures that apply to ISA operations, the MOH procedures and any updated information must be published on the MOH website after being approved by the attorney general. They include all of the following:
(1) Provisions regarding the submission of an application for assistance;
(2) The manner in which the necessary information is used, its possession, storage and deletion;
(3) The [MOH] clinical guidelines . . . regarding close contact with a patient, as valid from time to time;
(4) Criteria for determining individual and unique cases . . . ;
(5) Provisions regarding the handling of objections [to determination of being in close contact with a patient] . . . ;
(6) Provisions regarding the exception to the transfer of details of an application for [tracing] assistance from a patient who is a journalist.
V. Adoption of a National Plan and Availability of a Voluntary App
The Law requires the MOH to adopt a national plan to encourage the public to use civilian technology and ensure the allocation of a budget for its implementation.  Accordingly, the MOH posted on its website the Hamagen 2.0, a voluntary app for notification regarding exposure to coronavirus identified patients. As discussed further in this report, the MOH Magen app does not appear to have been uploaded by the majority of the Israeli public.
In addition, the MOH posted on its website “Magen Israel“ [Israel’s shield], a multifaceted national plan to fight the pandemic. The plan’s stated objective is to achieve “a systematic reduction of the basic reproduction number (R) and its preservation below the value of -1 over time for the purpose of stopping the virus.”
Among the principles enumerated in the plan are the creation of a unified data bank that would be updated on a daily basis, the establishment of a panel of subject matter experts to make recommendations and lead the national effort for elimination of the pandemic, the establishment of an executive board with the authority to adopt restrictions on public activity based on hospitalization capacity, and the strengthening of public trust to encourage responsible behavior to curtail the spread of the pandemic.
VI. Data Preservation, Usage, Transmission, and Erasure
A. By the ISA
ISA officials may access relevant information and carry out tracing assistance activities only upon being specifically authorized to do so by the ISA head or the head’s designee, and under the condition that they have signed a confidentiality agreement specifying the criminal implications of its violation. Details of a request for tracing assistance and any relevant information must be digitized and kept separate from any other information preserved by the ISA. Tracing information should be kept for a period of 14 days from the date of transfer to a competent body in the MOH, with “any other information created by data processing . . . immediately removed.”
B. By the MOH
Information requested should be kept by the MOH in a manner that will ensure the security of the information, its confidentiality, and the confidentiality of the identification data of the patients and those with whom they came into close contact. Information retrieved via tracing assistance must generally be erased at the end of the period of validity of the Law. Similar to ISA officials, MOH officials who handle tracing assistance information must be authorized and sign a confidentiality agreement and must preserve secrecy under penalty of law.
VII. Parliamentary Oversight of ISA Tracing Assistance
The KFADC must receive weekly written reports on the administration of tracing assistance from both the ISA and the MOH.
The Law requires the head of the ISA to report in writing to the KFADC, once a week, on the number of patients and those who were in close contact with them for whom processing of technological information was requested, and of the status of erasure of information as provided under the Law. The ISA report to the KFADC must also include a briefing on any special incidents or challenges in the exercise of the ISA tracing assistance activities and on the way they were addressed. In the event this information is classified, the report will be forwarded to the Knesset Committee for Service Affairs instead of the KFADC.
An MOH representative must similarly report to the KFADC on the number of patients diagnosed in the past week based on ISA assistance, epidemiological investigation, or by other means, and on the number of those informed of being in close contact with a patient. In addition to information on special incidents and challenges, the MOH report should indicate the number of objections submitted by persons identified as being in close contact with a patient that were handled and provide information on the manner in which they were handled.
VIII. Effectiveness of Technology-Based Contact Tracing
On October 26, 2020, the State Comptroller’s Office (SCO) issued an interim report on the way in which the State of Israel “dealt with the coronavirus crisis.” 
A. Voluntary App
The SCO notes that, according to an MOH report on August 5, 2020, out of the 6.5 million mobile phone internet users in Israel, about 900,000 uploaded the Magen voluntary app. In the week between July 29, 2020, and August 5, 2020, 71,600 users uploaded the app, while about 74,000 users have removed it from their phones.
B. ISA Tracing Assistance
The SCO audit indicated that only 3.5% of persons identified by ISA as having come into contact with patients were found to have contracted the virus. This percentage is much lower than the 24% figure associated with persons identified by epidemiologic investigations. The SCO thus concluded that “the effectiveness of the epidemiologic investigation performed by questioning the patient was considerably higher than that of the ISA tracing operations.” The SCO report found four incidents where the ISA “operated in violation of rules and procedures and in a way that was disproportionately infringing on the right to privacy.”
Additionally, according to the SCO, tracing activities had a negative effect on ISA routine operations and resulted in some exposure of ISA capabilities, which may be detrimental to its future services, “when it will be required to fulfill its mission and fulfill its functions.”
Considering the relatively small percentage of patients who were identified based on ISA tracing and notification as being in close contact with a verified coronavirus patient, the ISO recommended that the ISA tracing assistance efficiency and its impact on the right to privacy and to freedom of movement should be periodically reexamined. Among other recommendations, the ISO proposed to examine the possibility of “proactively integrating information received from the ISA in the process of epidemiological investigations carried out by questioning the patient.”
According to an Israeli media report, data presented at a recent KFADC meeting was inconsistent and conflicting. For example, the “Privacy Authority—the regulator that oversees the preservation of the fundamental right to privacy—claimed that the [ISA surveillance] tool had a success of only 6%.” Additionally, the use of ISA technology for contact tracing has resulted in the avoidance of use of cellular phones by many Israelis, in an effort to prevent being identified as having been in close contact with coronavirus patients, which would result in mandatory quarantine. Specific ways to avoid being detected by the ISA as having been in contact or in the vicinity of a diagnosed patient were posted in the Israeli press.
Prepared by Ruth Levush
Senior Foreign Law Specialist
 HaMagen, MOH, https://perma.cc/7CSC-8TMS. On efforts to improve its technology, see Sagi Cohen, Ministry of Health in Contacts to Connect the HaMagen App to Apple and Google’s Corona Venture, Marker (May 4, 2020), https://perma.cc/F9VF-9WSE (in Hebrew).
 For a discussion of privacy and patients’ rights under Israeli law, see Ruth Levush, Israel: Regulating Electronic Means to Fight the Spread of COVID-19, Law Library of Congress (June 2020), https://perma.cc/TX2J-UAN4.
 Law on ISA Authorization to Assist in the National Effort to Reduce the Spread of the Novel Coronavirus and to Promote the Use of Civilian Technology to Trace Those Who Have Been in Close Contact with Patients (Temporary Order), 5780-2020 [ISA Authorization Law], SH No. 2816 p. 166 (July 1, 2020), https://perma.cc/A8XX-XSXC (in Hebrew); amended on July 21, 2020, SH No. 2829 p. 234) https://perma.cc/8WNE-8F45 (in Hebrew).
 Emergency Regulations (Authorization of the ISA to Assist the National Effort to Reduce the Spread of the Novel Coronavirus), 5780-2020, https://perma.cc/NNG9-U48H (in Hebrew). The emergency regulations were in effect for a period of 14 days and were temporarily extended by government decision No. 4916, issued on March 24, 2020, https://perma.cc/Z6HQ-LX44 (in Hebrew), and subsequently replaced by government decision No. 4950, issued on March 31, 2020, extending surveillance authorities to April 30, 2020, at https://perma.cc/M2KV-8X7W (in Hebrew).
 HC 2109/20 Ben Meir v. Prime Minister, Israeli Judicial Authority, https://perma.cc/P999-T2X7 (in Hebrew). For analysis of the decision, see Ruth Levush, Israel Security Agency’s Involvement in COVID-19 Tracing Scrutinized, In Custodia Legis, Law Library of Congress (May 7, 2020), https://perma.cc/R9QW-W38P.
 ISA Authorization Law § 24.
 Id. § 1.
 Id. §§ 3(a-b), 5.
 Id. § 12.
 Id. § 3A.
 Id. § 3(c-e).
 ISA Authorization Law § 3A.
 Id. § 5(a)(1), (c).
 ISA Authorization Law § 5(a)(2).
 Id. § 5(d).
 Id. §§ 6-8.
 Id. § 9.
 Id. § 10.
 Id. § 12A.
 See infra under section VIII. A.
 ISA Authorization Law §§ 13-14.
 Id. §§ 15-16.
 Id. § 19(a).
 Id. § 20(b).
 SCO report at 6.
 Id. at 5.
 Id. at 6.
 Id. at 42.
 Id. at 43.
Last Updated: 12/30/2020