COVID-19 vs. Our Privacy: The Dilemma of Contact Tracing

Imagine this scenario, you’re standing outside of the grocery store – six feet away from everyone, as you should be. You’re even wearing a mask and gloves – maybe you’re just being cautious, maybe you live in a city that requires it.

It’s going to be about a 45-minute wait before you can get inside do your shopping. Like anyone else you decide to kill time on your smartphone – Pokemon don’t catch themselves after all.

Suddenly, you’re given a push notification: You may have contracted the novel coronavirus. Some time in the last week or so you’ve come into close contact with someone who has been confirmed as having COVID-19, the disease caused by the novel coronavirus.

The app on your phone advises you to go home, contact your medical authorities, and get yourself tested. Should you test positive everyone you’ve been in close contact with – including potentially those people you were in the grocery line with – will receive similar notifications...

This is not a scenario from the latest episode of Black Mirror. It’s real and it’s happening all over the world. Contact tracing technology, which uses your mobile device to track those you’ve been in close proximity with over a given period of time, is becoming the latest tool in the fight against COVID-19.

The question for each of us then is: Would you allow access to your phone and personal data for the sake of public health?

On one hand, contact tracing could be seen as a novel and innovative means of combating a global pandemic. But what happens when the pandemic is over? Do the technologies stay in place? Human rights advocates in China, for example, have expressed feelings that COVID-19 has just become a convenient excuse for China to beef up its surveillance state.

Maya Wang, senior China researcher for Human Rights Watch, told The Guardian that China is experiencing “mission creep” and that the virus outbreak will be a catalyst for further expansion of surveillance technologies. “With the coronavirus outbreak the idea of risk scoring and restrictions on movement quickly became reality,” Wang said. “Over time we see more and more intrusive use of technology and less ability of people to push back.”

Your Data, Our Safety

Earlier this month Google and Apple made a surprising announcement. The tech giants were working together. But not on a new commercial product or device – an app and API that would allow for contact tracing of coronavirus carriers across iOS and Android devices.

Apple and Google said the platform will be strictly opt-in, but once you do the platform will ping any contacts that you come into close proximity with and store this information up to several days. If at any point you discover you have COVID-19 you can upload your medical test results to an online portal. Once this happens the platform will anonymously inform any of your recent contacts that they’ve recently come into contact with someone infected with COVID-19.

Both companies have pledged that maintaining user privacy is of the utmost importance (it also doesn’t hurt that the US has HIPPA rules around medical privacy).

However, that hasn’t made skeptics turn a blind eye to contact tracing. Remember, Google in particular is in the business of selling data. Should we trust a company that big to be completely honest with us about the implications of contact tracing?

"Using public data from Google raises a key conflict between the need for mass surveillance to effectively combat the spread of coronavirus and the issues of confidentiality, privacy, and consent concerning any data obtained,” Mark Skilton, a digital communications expert and Director of the Artificial Intelligence Innovation Network at Warwick Business School said in a statement released to Design News. "Anonymous data is commonly used in medical trials to test new and existing drugs, but that is consensual because participants are asked at the outset for permission to use their medical data.”

“People will only trust these systems if they protect privacy, remain voluntary, and store data on an individual's device, not a centralized repository, Jennifer Granick a surveillance and cybersecurity counsel with the ACLU, told Design News. "To their credit, Apple and Google have announced an approach that appears to mitigate the worst privacy and centralization risks, but there is still room for improvement.”

The ACLU has committed to remain vigilant about contact tracing, to help ensure the technology remains voluntary and decentralized and is only used for public health services, and only for the duration of the COVID-19 pandemic. In a recent AMA (Ask Me Anything) on Reddit, Daniel Kahn Gillmor and Jon Callas, two technologists with the ACLU, answered public questions around the use of technologies to combat COVID-19 and privacy concerns.

“All contact tracing needs to be backed up with testing.,” Callas wrote in one thread. “We may find out that contact tracing apps don’t help flatten the curve. If we find that out, we should stop using them. I believe they must be a part of a complete public health response that includes testing, sick leave for people who are sick, and more. Technology alone can’t do much.”

But It Needs People

Beyond the pandemic itself, contact tracing apps like Google and Apple’s could change the way we think about privacy forever, particularly with our healthcare data.

Danielle Bradnan, an associate with Lux Research, believes the Google/Apple partnership will mark a shift in how consumers think about their personal healthcare data in particular.

“The first proposed API rollout will allow both tech giants to access [electronic health records] that were previously siloed via partnerships, giving them access to an enormous volume of development data,” Bradnan said in a statement released to Design News. “The second rollout, the tracing app itself, will set a precedent for individuals to use their data to achieve a meaningful personal goal – ultimately planting a flag on the idea that healthcare data belongs to the consumer. This partnership is a watershed moment for data access and will set a precedent for determining what privacy and healthcare data ownership means in the modern digital health landscape."

What complicates these privacy concerns further is that contact tracing does seem to actually work. Contact tracing is already proving effective in curbing the spread of COVID-19 in China, South Korea, and India.

In China a mobile app called Close Contact Detector, works similarly to Google and Apple’s planned app, alerting users who have been in close contact with people who are confirmed or suspected carriers of the novel coronavirus.

South Korea’s Corona 100m app pulls data from the Korea Centers for Disease Control to send people push notifications if there are any COVID-19 patients within 100 meters of their current location. According to GlobalData, the app has been downloaded over a million times since its launch in February 2020.

Meanwhile in India, an app called Aarogya Setu (Sanskrit for “a bridge of health”) uses Bluetooth and GPS to let people know if they’ve come into close contact with someone who has been placed under a COVID-19-related quarantine. Since its launch in April 2020 Aarogya Setu has become one of the most-downloaded apps in India with 50 million total downloads, according to GlobalData.

“Digital apps have the potential to help authorities know everything about the pandemic – its place of origin, where it's heading next, and other crucial epidemiological insights to mitigate it,” Venkata Naveen, Disruptive Tech Analyst at GlobalData, said. “Taking cues on how various Asian countries are leveraging smartphones to slow the spread of the novel coronavirus, the US, UK, and European countries are fast catching up to develop similar digital contact tracing tools.”

But none of those benefits matter if people don’t opt in, Lux Research’s Bradnan said. “"While contact tracing is an important part of managing the spread of the disease, and digital tools like this app offer significant aid to that cause, compliance and actionability will remain significant hurdles regardless,” she said.

In the UK the National Health Service (NHS) has been working with Apple and Google to release its own version of a contact tracing app. But even UK Health Secretary Matt Hancock has acknowledges the app comes with privacy hurdles. "The more people who sign up for this new app when it goes live, the better informed our response will be and the better we can therefore protect the NHS," Matt Hancock told the House of Commons.

Those benefits all go out the window if privacy concerns ward people away from the app, Bradnan said. “The app relies on the majority of citizens downloading and using it, which has not even happened in Singapore, the progenitor of this app – and a city-state with greater comfort with state surveillance than most of the West. Additionally, if compliance is achieved, widespread testing will have to be available in order for the app to have real meaning."

For those who live in countries that cannot compel its citizens to use contact tracing apps the question may ultimately come down to personal ethics – do you weigh any potential privacy violations and access to your personal data more than any potential help in stopping the COVID-19 pandemic?

“While we do have legal precedent for law enforcement accessing mobile phones and private data in the case of terrorism and cybersecurity breaches, this use of large-scale data is ethically more difficult,” Warwick Business School’s Skilton said.

"However, with this pandemic turning into a long game, we may need to use all the digital tools at our disposal. COVID-19 is an emergency on such a huge scale that, if anonymity is managed appropriately, internet giants and social media platforms could play a responsible part in helping to build collective crowd intelligence for social good, rather than profit."

RELATED ARTICLES:

Chris Wiltz is a Senior Editor at  Design News covering emerging technologies including AI, VR/AR, blockchain, and robotics.