April 30, 2020

Coronavirus and Surveillance


  • As the country considers potential privacy and public health tradeoffs in response to the coronavirus pandemic, the lessons of 9/11 may help guide us.
  • Contact tracing, one potential tool in containing the virus, presents significant privacy and Constitutional issues.
  • Governments across the globe are responding to the pandemic by imposing surveillance measures on their citizens.

As the world searches for ways to restart shuttered economies, governments and private sector companies have proposed a number of surveillance measures to help limit the spread of the virus. Technology may enable governments to more easily track who has been exposed to the virus, but we will need to ensure people’s privacy is protected. Some people worry the pandemic will be used as an excuse to expand surveillance.

lessons from 9/11

The lessons of 9/11 may help guide Congress as it considers potential privacy and public health tradeoffs in response to the coronavirus. These include being cautious about claims that one single technology or law can solve the problem, and the recognition that powers granted for one reason may be used for others.

The country responded to the attacks of September 11, 2001, by instituting a variety of measures and laws designed to protect Americans from terrorists. Congress created the Transportation Security Administration to protect people while flying, and people agreed to endure extensive security checks in order to exercise their Constitutional right to move about. Laws like the USA Patriot Act gave our intelligence agencies sweeping new authority in the hope that they would spot and disrupt the next terror attack.

The tradeoffs that came with those choices have been highlighted recently by the abuses of power the FBI committed during its 2016 “Crossfire Hurricane” investigation.

contact tracing and location data

Public health officials have argued that the effort to slow the spread of the coronavirus would benefit from being able to identify the actual paths by which it is being transmitted. This “contact tracing” involves identifying all of the people an infected person has interacted with during the time he or she might have been contagious. Officials would interview infected people in order to obtain a list of friends, family, and coworkers, then contact those people to inform them they may have been infected. Historically, contact tracing has been a labor intensive process. Massachusetts recently said the state would hire and train 1,000 people to do these types of interviews. The District of Columbia has announced plans to hire as many as 900 contact tracers. One former director of the Centers for Disease Control and Prevention has estimated the U.S. will need 300,000 people doing this work across the country. This kind of tracing also has a high rate of errors, as people’s memories of every person they have encountered or place they have visited in the preceding weeks can be extremely unreliable.

One potential solution involves using technology to trace infected people’s contacts. Smartphones contain GPS technology, and many apps also use the technology. Many phones connect with Wi-Fi hotspots at coffee shops and other places during the day; and phones contain Bluetooth technology, which allows them to communicate with one another.

One Way Contact Tracing Could Work

Contact Tracing

Source: BBC

These technologies and data can be used to track an infected user’s movements and then identify people that the infected person came into contact with. For example, if an infected person went to a store and phone or app records showed three other phones at the store at the same time, officials could identify the owners of those phones and contact them to let them know they may have come into contact with an infected person. This notification process could be automated, allowing people to be traced and notified on a scale that would be impossible without the technology. It could also be anonymized, something privacy advocates have called for. The American Civil Liberties Union has outlined several principles it says should govern the use of contact tracing apps and technology. These include making it voluntary, minimizing the data used, and ensuring that the systems can be audited.

Apple and Google recently announced a partnership to create a coronavirus tracing app. It would use Bluetooth technology to identify which phone users needed to be notified of possible contact with an infected person. Users would opt in to the system, and it would require people to download the app. Future systems may eliminate the download requirement by building the technology into the phone’s operating system. The companies have built some privacy protections into the system by requiring consent, encrypting metadata, and promising to shut down the apps when the pandemic is over. Senator Josh Hawley has called for the CEOs of Apple and Google to be personally liable if the companies cease protecting privacy as promised or violate those promises. The University of Oxford’s Big Data Institute recently estimated a contact tracing app could help stop the coronavirus pandemic, but 80% of smartphone owners would need to use it.

As governments across the globe deploy various surveillance measures, security and privacy experts warn the coronavirus pandemic could become a watershed moment. Policymakers may need to decide whether these systems should be mandatory or voluntary; whether the data should be anonymized or not; how to notify people they may have come in contact with an infected person; and what privacy protections should apply to the data collected. Technical limitations of the technology will also affect how to weigh potential privacy tradeoffs. Bluetooth technology might identify two people being in contact when they were never within six feet of each other, potentially leading to a high percentage of false positives. Or if the app does not update locations constantly, it might vastly undercount the number of contacts.

global surveillance

The United States. The CDC is reportedly leading a federal effort to use cellphone location data to track the presence of crowds. The White House “Guidelines for Opening America Again” list testing and contact tracing as core responsibilities for states, and Dr. Anthony Fauci, director of the National Institute of Allergy and Infectious Diseases, has said community surveillance is “critical” to stopping the spread of the virus.

China. The Chinese government, which has been accused of covering up and lying about the coronavirus in the early days of its spread from Wuhan, has used the pandemic to impose ever more surveillance on its people. Citizens are required to download an app that collects personal information including location. The app uses a red, green, yellow color system to indicate health status and authorize and restrict movement. Chinese citizens are required to carry the app with them when they travel and show it to hail a taxi, go to the grocery store, or use the subway. The Chinese government has not disclosed how the classification system works. Human rights experts fear that what is presented as a public health app will be used as a tool for mass surveillance, oppression, and discrimination.

South Korea. One of the most successful countries at flattening the curve and limiting the outbreak of the coronavirus, South Korea has deployed widespread testing and contact tracing as part of its efforts. The government sends South Koreans notices on their phones whenever a new case is discovered in their area. Websites and smartphone apps offer detailed timelines of infected people’s travel. The alerts reportedly include last names, sex, age, and district of residence. People who may have come in contact with an infected person receive a notice and are told to report to the nearest testing center. The government also uses information from CCTV cameras, credit card records, and public transit to monitor citizens’ movements and activity.

Singapore. In Singapore, residents can download an app that uses Bluetooth technology to keep a record of nearby devices. If a user gets sick they can upload the data to the Ministry of Health, which notifies the owners of the devices that have been near the sick person’s device.

Europe. Germany is leading Europe’s efforts to trace the virus and is reportedly looking to Singapore as a model. Germany and France had backed storing the data in a central server but recently reversed course and agreed to back a decentralized approach favored by privacy advocates. Three hundred scientists and researchers signed a letter stating the centralized approach “would allow unprecedented surveillance of society at large.” Apple and Google have pushed back on this approach on privacy protection grounds, and Apple has refused to allow Bluetooth monitoring of other devices to run in the background on its iPhones. European governments also have accessed telecommunications data to monitor citizens’ movements.

Israel. Police in Israel had been accessing location data from mobile phones, but recently halted the practice after parliament declined to extend the emergency measures over privacy concerns.

Australia. As of April 27, more than 2 million Australians had downloaded a national coronavirus tracing app, with the hope of signing up at least 10 million users – 40% of the country’s population. The government has promised to enact privacy-protection legislation later. Australia has had a number of high profile technology and privacy stumbles in recent years, including passing a heavily criticized encryption bill and suffering a cyberattack of its census in 2016.

Russia. Russia is reportedly using facial recognition technology to enforce quarantines and ensure people who have been ordered to remain at home do so.

Issue Tags: Technology, COVID-19