One of the most crucial tools for addressing the coronavirus (COVID-19) is contact tracing, a process designed to halt the chain of transmission of an infectious pathogen and slow community spread. Globally, digital contact-tracing applications have been deployed to enforce social distancing or map the movements of the infected to assist public health authorities curb the spread of COVID-19.
For any large-scale digital contact tracing system to work, people must trust that their data will be safeguarded. Percolating in the background, however, are thousands of people filling the streets across the nation to protest police brutality, showcasing that trust in authorities is something not widely felt in America. There is extensive evidence that communities of color distrust the healthcare system writ large due to pervasive discrimination and marginalization at every level of the medical system. This deficit of trust in the healthcare system and other institutions due to continued racial inequality ultimately hampers efforts to conduct effective digital-contact tracing.
Amid escalating tensions between protesters and the police—not only in the United States but around the world—these contact-tracing applications could potentially be potent surveillance targets for law enforcement authorities.
Disproportionate Impact of COVID-19 on Black and Brown Communities
Data revealed early on that communities of color were disproportionately affected by COVID-19. The racial and ethnic inequalities in COVID-19 are a result of pre-pandemic realisms. African Americans have higher rates of underlying conditions and less access to quality health care, and are disproportionately represented in essential frontline jobs. Latinos share this stark reality. Like African Americans, they are overrepresented in essential jobs, increasing their exposure to the virus.
In order to curb further spread of the virus, the United States took a lesson from South Korea—who pioneered drive-thru coronavirus testing—and began to set up drive-thru testing sites across the nation to screen patients for COVID-19. Yet, the drive-thru testing strategy proved to be ineffective because hot spots for the virus were predominantly located in African-American neighborhoods where residents lacked cars. This exacerbates the toll COVID-19 has taken on communities of color that already lack adequate access to health care.
If resources are not directed to Black and brown communities, it increases the chances that these communities will be less likely to buy-in to public health messaging needed to stem the pandemic. This trust is also a prerequisite to obtain the appropriate voluntary adoption needed in order for digital contact-tracing apps to work.
What Is Contact Tracing?
Contact tracing is a process designed to halt the chain of transmission of an infectious pathogen and slow community spread. Globally, contact-tracing applications have been deployed to enforce social distancing or map the movements of the infected to assist public health authorities curb the spread of COVID-19. The idea is to amplify—with speed and accuracy—containment and isolation, something that was not possible during prior pandemics.
There are two technological frameworks dominating disease surveillance programs across the world: exposure notification applications and location-based applications via smartphones. As technologists vet concept proposals and begin beta testing for applications, privacy advocates and industry experts are concerned with the inherent erosion of civil liberties that comes with invasive electronic tracking.
Contact-tracing apps are being developed by researchers across the United States, including those at MIT and Stanford. These applications rely on a contact-tracing technique, available through an API, that has been developed by Google and Apple. Apple and Google partnered to develop a technology that will be interoperable between iOS and Android phones and will provide public health officials and others with the ability to develop contact-tracing apps. The system uses Bluetooth beacons to log devices that phones have been near and anonymizes the data. The technology relies on a decentralized system—meaning that an individual’s data is stored locally on their phone rather than in a central database accessible to app developers or government officials.
To increase public trust in contact-tracing apps, some governments have committed to digital contact tracing that protects the right to privacy. But this may not be enough to quell mounting concerns about their potential for surveillance, especially in countries where police and security forces operate with impunity.
Can Contact-Tracing Apps Enable Mass Surveillance?
Contact-tracing apps that generate sensitive health and social networking data increase opportunities for abusive surveillance. Three hundred experts warned early on about the dangers of governments building digital contact-tracing apps that do not respect privacy and enable mass surveillance. Some countries are already deploying digital contact-tracing applications, resulting in invasive mass surveillance. A study conducted by Amnesty International found that Gulf states that deployed contact-tracing apps were among the most invasive, collecting and storing GPS data and making it easy for the government to identify someone based on their account ID.
We have seen many instances in the last several years of law enforcement monitoring protests, particularly those focused on police brutality. It was first reported .in 2017 that the FBI created an intelligence assessment describing a purported threat by “Black Identity Extremists,” and while the FBI has not discovered violent activity conducted within this category, the Bureau’s creation of the assessment has spurred increased surveillance of Black activists. Law enforcement entities have also conducted intense surveillance of other peaceful protests.
Protesters are at particular risk of surveillance by three technologies: phone monitoring, facial scanning, and aerial surveillance. A serious risk for protesters is that the government might use surveillance technology to identify demonstrators who would otherwise be anonymous in a large crowd, and then retaliate against them in some way such as subjecting them to additional unfounded investigative activities or singling them out in selective enforcement of unrelated matters.
It is no coincidence that many of the communities hardest hit by the pandemic have also suffered decades of abuse and neglect at the hands of the police, whether in the United States or elsewhere. In a worst-case surveillance scenario, communities that exhibit higher cases of the coronavirus infection can be subjected to geofencing by public health officials, which can be enabled through location tracking and creates limitations on the mobility of residents. Geofencing leverages GPS signals to identify where an individual is located, so when a patient with a smartphone enters into this virtual boundary, an ad will pop up tailored to the physical location.
In response to such concerns, tech companies have proposed a solution that relies upon advanced cryptography, where randomly generated IDs from devices are distributed through Bluetooth signals to others with the app. However, despite these advances in the technology, raising transparency concerns with government agencies and potential third parties is still important because they will ultimately have access to the data from individuals who test positive for COVID-19.
The Fourth Amendment and the Right to Privacy
The Fourth Amendment protects citizens from unreasonable searches and seizures by the government. Therefore in any Fourth Amendment analysis, the question is whether an activity being undertaken by the government is technically a “search.” An activity is defined as a search and thus triggers the Fourth Amendment if it infringes on a reasonable expectation of privacy or it involves a government trespass.
If the government were to track people’s movement by directly surveilling cell phones—for example, through the use of IMSI (international mobile subscriber identity) catchers which mimic cell towers—that might violate a person’s reasonable expectation of privacy. In 2018 the Supreme Court ruled in Carpenter v. United States that the government must obtain a probable cause warrant in order to engage in cell phone tracking, but left ambiguity as to whether short-term tracking—such as using a stingray to scoop up protesters’ phone information over the span of several hours—must abide by this same requirement. Different forms of disease surveillance could trigger the Fourth Amendment. If instead the government were to collect large amounts of location data from companies (in order to do contact tracing), that would likely trigger the Fourth Amendment and violate a person’s reasonable expectation of privacy.
Law enforcement officials across the United States have already demonstrated their willingness to arrest and surveil peaceful protesters. In response to governments around the world demanding new surveillance powers to contain the COVID-19 outbreak, several U.S. lawmakers have already called on the Trump administration to place strict limits on what contact-tracing data can be collected and shared.
Federal Exposure Notification Privacy Act
In June, Sens. Maria Cantwell (D-WA), the Ranking Member of the Senate Committee on Commerce, Science, and Transportation, and Bill Cassidy (R-LA) introduced the Exposure Notification Privacy Act, which would regulate the collection and use of consumer health data by disease contact-tracing technologies. The proposed legislation is the third such bill that has been introduced in response to the use of exposure notification applications to monitor and control the spread of COVID-19.
The act would first require all contact tracing to be opt-in only, requiring “affirmative express consent.” The text specifically mandates that every user of an app would have to consent clearly and voluntarily, rather than having consent be inferred from “continued use of a service or product,” as so many platforms currently do. Operators of such apps would also be required not only to gather the minimum amount of user information necessary and de-identify aggregate data but also to promise not to combine it with other data in order to identify “any individual or device.” App makers would also be required to use the data they gather for public health purposes only, not for any commercial purpose, and any entity to which they might transfer user data would be required to adhere to the same conditions.
There is a real risk that the expansion of state intrusion into individuals’ lives that occurs during emergencies could endure beyond the originating crisis. Technical and legal infrastructure built during this pandemic may be difficult to dismantle once it is over unless proper safeguards are in place.
Success of Contact-Tracing Relies on Public Trust
Contact-tracing apps are not a silver bullet that will end the COVID-19 pandemic. However, they might prove to be a useful tool for managing the health situation especially as lockdown restrictions are being relaxed. The success of such apps will depend on widespread adoption by the population. This depends in turn on the trust that people have in the apps and how transparent they are about user privacy, including questions such as what data will be collected for what purpose and who will be able to access it.
As governments rush to deploy these apps, it will be important to get these data protection considerations right so that local, social, and cultural differences are respected when balancing surveillance, user privacy, and civil liberties.
