(Bloomberg) — Contact-tracing apps rolled out by Bahrain, Kuwait and Norway to track the spread of the coronavirus have endangered the privacy and security of hundreds of thousands of people by marking users’ locations in real time, human rights group Amnesty International said.

Bahrain’s “BeAware Bahrain”, Kuwait’s “Shlonik” and Norway’s “Smittestopp” apps stood out as some of “the most alarming mass surveillance tools” in an analysis of 11 apps across Europe, the Middle East and Africa, the group said. The survey was carried out by Amnesty’s Security Lab, which conducts technical investigations into cyber-attacks against civil society.

The three apps frequently capture users’ GPS location data and upload it to a central government database, effectively tracking users’ movements as they happen, Amnesty said. The location information can be easily linked to an individual given that users are required to sign up to the app with a national ID number in Bahrain and Kuwait and with a valid phone number in Norway.

“Bahrain, Kuwait and Norway are running roughshod over people’s privacy, with highly invasive surveillance tools which go far beyond what is justified in efforts to tackle Covid-19,” said Claudio Guarnieri, head of Amnesty International’s Security Lab. “These governments must immediately halt the use of such intrusive apps in their current form.”

A representative Kuwait didn’t immediately comment late Monday. Amnesty said it notified authorities in the three countries of its findings ahead of publication of the report.

“The ‘BeAware’ app was designed for the sole purpose of advancing contact tracing efforts and saving lives,” a Bahraini government spokesperson said. “It is an entirely voluntary opt-in app, available free of charge on iOS and Android, and all users are informed of its use of GPS software before downloading.”

Bahrain said that users who aren’t under quarantine or mandatory self-isolation orders can turn off the GPS feature of the app, which it said has contributed to a low death rate from the virus.

Norway

“Downloading the app is completely voluntary. Many people download apps that store sensitive information centrally and that’s used for commercial purposes,” Norway’s Health Minister Bent Hoie said in an email. “‘Smittestopp’ is an app that’s used and owned by society to fight a pandemic.”

Hoie had responded to Amnesty in a letter dated June 12 defending the app, which he said followed the European General Data Protection Regulation as well as local privacy-protection rules and was crucial in fighting the spread of Covid-19 and preventing a longer lockdown.

Still, the Norwegian Institute of Public Health on Monday had already halted the use of its mobile phone tool and deleted all the data it had collected after the country’s data protection authority warned it would temporarily ban the processing of personal information associated with the app.

The Norwegian watchdog also questioned how useful the app is given its low usage and also warned that pairing Bluetooth technology for contact detection with location data for analysis went too far.

Hoie said in the letter that the public health authorities were investigating some of the issues that Amnesty had brought up and had reduced the amount of time data would be stored to 10 days from 30.

Read more about Norway’s decision to pull its app here

Amnesty said both the Bahraini and Kuwaiti apps can pair with a Bluetooth bracelet used to enforce quarantine measures by ensuring the user remains near their phone. The Kuwait app regularly checks the distance between the bracelet and the device, uploading location data every 10 minutes to a central server, the group said. In Bahrain, users registered for home quarantine who don’t wear the bracelet face fines or imprisonment, it added.

Governments around the world have developed mobile apps to trace possible infections of the coronavirus, alerting users when they may have been near someone infectious. Authorities say the tools can help track and contain any resurgent outbreaks of the virus.

But since their inception, contact-tracing apps have raised concerns about their potential to infringe on people’s rights to privacy by collecting sensitive data about location, health and information about who people interact with.

Read more: Coronavirus Newsletter: Protecting Privacy in a Pandemic

Amnesty said it chose not to analyze apps that are based on a decentralized system, which is supported by a joint tool developed by Apple Inc. and Alphabet Inc.’s Google. It said such apps, which store data on people’s phones instead of on government servers, tend to be less concerning from a privacy perspective.