Privacy in the age of COVID-19

-- By MarvinGalloway - 24 Nov 2020

Introduction

Privacy is often touted as being a core value of a free democracy, however, this premise is nowadays being tested more than ever. Increasing technological capabilities are viewed as helpful mechanisms to confront the SARS-Cov2 pandemic. And while the use of technology is certainly our best bet in terms of tracing infections, we must be aware of the privacy concerns that such use raises. Throughout the last few months, it has become clear that in order to effectively limit the spread of the novel coronavirus efficient contact-tracing, relentless tracking and enforcement of quarantines, and widespread testing are absolutely vital necessities. Many countries have approached this issue in varying ways and it may be useful to learn from each unique experience.

Tracking API's

More than 46 countries have enlisted the help of some form of a mobile app to limit the spread of the virus, among them Germany which directed its federal agency in charge of disease control, research, and prevention, the Robert-Koch-Institut, to develop a mobile app which had the intention of tracking infections and alerting users that they had been in close proximity to another user who tested positive for the novel Coronavirus. The German app was developed jointly by Deutsche Telekom and software giant SAP, along with support from various other firms and organizations, and relies on the Exposure Notification API jointly developed by Apple and Google, making it functionally similar to many apps used by other countries. The application uses low-energy Bluetooth technology to record and scan a user’s immediate surroundings. It tracks information regarding if and how long other users of the app were in close proximity to one another. Should a particular user test positive for COVID-19, and enter such positive result into the app, all users that were in close contact should theoretically be notified by their own cell phones and urged to get tested themselves. The entire process operates decentralized by design and is supposed to quell concerns regarding user privacy. Most notably, the use of anonymized codes that are sent back and forth between the various user’s mobile phones has been heralded by the Government as particularly privacy protection minded. These codes track time of contacts and distance between such, but do not record geographical location or movement profiles. Nevertheless, its success has been rather questionable as merely 130,000 infections have been recorded within it.

More effective contact-tracing?

The underlying issue may be that app-based contact tracing is not nearly as developed as other methods that aim to provide accurate tracking information. Traditional methods of contact tracing, paired with integrated data-management systems have proved to be most effective so far, however, they often depend on three things: adequate numbers of well-trained staff, effective control of quarantine orders, and a population’s trust and willingness to cooperate in providing valuable information. Examples of varying approaches to tracing are plenty and could provide insight into what level of intrusion into the private sphere may be needed to effectively control outbreaks.

In South Korea, which so far has had far fewer deaths than other developed countries, it has been common for quite some time to rely on a number of data points to identify chains of infection and to isolate individuals based on such. The health authorities have combined information ranging from CCTV surveillance, time and location of credit card transactions, and mobile phone GPS signals, to even monitoring of closed-circuit televisions in order to trace contacts. Once a positive case is identified, information regarding the time and date of an infected-persons location are published online, allowing the public to self-check whether they were in close proximity of the positive case, adding an additional layer of reporting.

Likewise, in Vietnam, GPS location tracing is combined with surveillance of social media channels to identify contacts. Contact-tracers there mainly supplement the information gained from directly checking in with individuals with the data points provided by technology to issue quarantine orders, which are aided by the fact that facilities are usually provided by the government to do so. It has thus far been an effective strategy. Whereas infection chains in many western countries are not detected until the virus has began to rapidly spread, Vietnam boasts a rate of 99% of traced infections, with only 1% of sources of infection being unknown. The total number of confirmed cases has been less than 2,000 and the number of deaths stagnant at 35.

Whether a similar use of datapoints would be a success in countries like Germany or the United States remains doubtful however, mainly due to one overarching reason, lack of trust. While staffing issues can be resolved through the use of adequate funding and training, a more vivid opposition to the use of things such as GPS data (primarily to enforce quarantine orders) or the providing of basic contact information is to be expected. Surveys have indicated that only 4% of Vietnamese citizens oppose volunteering information necessary to engage in effective contract tracing. In the United States and Germany on the other hand, nearly 21% of individuals surveyed indicated that privacy concerns and the like would prevent them from doing so.

Future Concerns

It may be accepted that technology can significantly aid in tracing and tracking COVID-19 infections and even monitor quarantine mandates, as apps currently do in Singapore for example. However, a lack of trust in not only the technology used to aid in contract tracing, but primarily in the motivations and competencies of the governments that are employing such means certainly hinders the success of efforts to curtail the current pandemic. Numerous developments that were once seen as temporary measures evolved too often into staples of our daily lives, ensuring that skepticism towards such means have become pervasive. A question that keeps some from volunteering information is often: what will happen to tracking protocols when the coronavirus is only a distant memory and a government pushes tracing onto its citizens for reasons that have little to do with curbing the spread of infectious diseases?

This draft could be improved if its understanding of the subject began from what the current draft ends on, namely that this had nothing to do with the German government, but was the result of the design for tracking APIs jointly developed by Google and Apple, to provide a worldwide technical solution. Countries like UK that began by designing their own approaches to the application mostly abandoned them to use the Google and Apple APIs, because they were otherwise too far from the crucial issue in the smartphone software: battery consumption. If the handset is to do the work, rather than a centralized surveillance system, which Apple and Google were designing to avoid, only the OS and hardware manufacturers can solve the relevant problem: a handset cannot help if its battery is dead.

In the end, it turned out that the smartphone proximity tracking solution might have been more useful with a different disease in a different set of societies. As you point out in the German example, which is just one example (the next draft would benefit from a little more information about the world, which does not only consist of Germany), the virus escaped control so rapidly that both the amount and the quality of mobile phone proximity data for tracking was inadequate to make a difference. The societies that did best at controlling the virus, like Vietnam, did not depend on smartphone applications at all.

Here too, you submitted a sketchy complete first draft days before the grading deadline, not leaving enough time for the required revision. You are better off with no grade on the transcript at this point than the marker of inadequate performance. Please submit an email message requesting an extension, so I do not have to submit a grade on Jan 8th, and we can work on the required revisions, which will undoubtedly make the draft better. You might find useful Andrew Roth, Stephanie Kirchgaessner, Daniel Boffey, Oliver Holmes and Helen Davidson, Growth in surveillance may be hard to scale back after pandemic, experts say, The Guardian, April 14, 2020

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, MarvinGalloway
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.