A Few Things You Wanted To Know About Tech for Covid Tracking & Tracing But Were Afraid To Ask Because of Privacy Rules
Tech will help reopen economies, but not so fast: the trade-off is public health-individuals’ privacy. Asia, EU, US… there is no pain-free way out.
Privacy or beating the virus? Privacy or the economy? Privacy or a fresh wave of infections and dead? Governments across the world know they need to answer these hard questions as pressure mounts for resuming activity, for the sake of social cohesion and the sanity of everyone. On the one hand, there is scientific consensus that beating Covid-19 over the medium-term requires very well thought, swiftly applicable and tough strategies and decisions, lest having to revert to general lockdowns. On the other, the sensibility of these measures calls for a public debate. Do the virus and the endurance capability of our social and economic fabrics allow for space for this debate?
The path to Phase II of the pandemic is best explained in a recently released report by The American Enterprise Institute, in collaboration with faculty from the Johns Hopkins Center for Health Security, “National Coronavirus Response: A Road Map to Reopening.”
A take-away is that it is not going to be “an on/off switch …, that we will have to be creative …, to constantly reevaluate our measures based on data … (and) to revert to Phase I if there’s a surge in cases.”
One of the milestones that need to be reached, it reads, aside from extensive testing, is the ability to “massively scale contact tracing and isolation and quarantine”.*
Technology comes to help
Dozens of solutions have been concocted around the world. However, what is clear is that tracking, tracing and monitoring, the sine qua nons for reopening our economies, require that government bodies, public-private partnerships or private partners get hold of lots of people’s data, read privacy issues.
A “dangerous debate has emerged on whether key tenets of European democracies, (like the right to data privacy), should be set aside during the pandemic to enable a more effective response,” Andrea Renda, a scholar at CEPS, Brussels, writes. “This is why the EU needs to establish clear boundaries.”
The EU, however, is giving its members just until April 15, to develop a toolbox for the use of apps that fully respect EU data protection standards (my emphasis). So, is there time to discuss such boundaries?
What are other countries doing?
New Zealand, for one, has adopted a very clear and comprehensive “Covid-19 Elimination strategy” to be applied “before New Zealand can consider moving out of lock-down” (my emphasis again). Surveillance systems “and contact follow-up (will need to be) operating at very high levels of performance”, a group of scholars of the Universities of Otago and of Auckland write, concluding that managing the risks and the public’s welfare during the recovery “brings difficult political choices” that will require the government to build confidence in “measurement processes that have to be more frequent and timely than we are used to.”
While the EU plans a peer review of its apps by May 31, New Zealand’s approach draws on building trust among the population that the government will handle with extreme care all sensible data collected through the measures adopted.
On the other side of the spectrum, Russia is resorting to the high-tech resources of its “coronavirus information center”, which include 170,000 surveillance cameras, artificial intelligence and social media monitoring, the International Observatory on Human Rights reports.
China has utilized apps which mark down peoples’ exact locations and information, all of which is shared with authorities.
Israel has approved the electronic tracking of Covid patients using a technology designed for counterterrorism. The Israel Security Agency (ISA, or Shin Bet) will use it on the civilian population for the first time to track individuals’ phones and the details of all of their calls, Haaretz reads. The tool was pushed through as an emergency regulation without approval or oversight from Israel’s parliament raising constitutional privacy questions and criticism.
Moving away from “Big Brother” solutions, there is a good case of “human” tracing and monitoring system: Gov. Charlie Baker of Massachusetts announced in early April a Community Tracing Collaborative between the state and a health nonprofit — Boston-based Partners-In-Health, deemed a “proven player with a reputation and a track record”, which will hire, train and supervise the virtual call center. After obtaining contact information for as many (potentially exposed) people as possible, Baker said, “the call center will contact and inform them, so that they can … isolate when appropriate.”
Germany, as the Health Minister told CNN on April 16, is doing manual tracing too, and this contributed to its low mortality rate.
A non-intrusive alternative to direct tracking appears to be bluetooth, as featured in any smartphone. Technically, if one person tested positive or has been in contact with an infected person, health authorities will send a code to that person’s phone, which the bluetooth of other people coming in its proximity will decode, alerting of the risk of contagion or that he or she has been close to potential contagion, and needs to seek testing.
In the EU, researchers at the Pan-European Privacy Preserving Proximity Tracing (PEPP-PT) are working to develop the building blocks of an open app that any country could use, thus allowing national apps to interact across borders, while observing the strict EU privacy rules. The app is being tested in Berlin, will work with anonymized user smartphone’s identification data, and the contacts of the person who tested positive won’t know (theoretically) who that person is.
MIT is working at a very similar solution called Private Automated Contact Tracing (PACT).
Based on their mathematical modelling, at Oxford University, the experts working with Data Science Professor Christophe Fraser suggest that “traditional public health contact tracing methods are too slow to keep up with this virus”, because “patient histories are incomplete — we don’t know the details of the person we sat next to on the bus. We need an instantaneous and anonymous digital solution to confirm person-to-person contact histories, … (and) message the people you’ve recently come into contact with.”
In several Asian countries new infections come with visitors or citizens repatriating. In Singapore arrivals must share their phones’ location data with the authorities each day to prove they are sticking to quarantines. The government says that the information on the app is encrypted and will be deleted after 21 days.
Starting April 1, South Korea placed all new arrivals in mandatory self-quarantine for two weeks. “About 7,000 people enter Korea each day,” an editorial in the Korea Herald on April 2 read. However, “the number of people to be monitored is expected to hit around 100,000 in just two weeks. Case officers, who are required to get in touch with them daily on a one-on-one (to check for violations or symptoms), say that effective supervision will be impossible when the people to be monitored approach 100,000.”
Violations are numerous across the world. There are cases of infected foreigners travelling around in Korea and Singapore; Italy is still fining unruly citizens by the thousands every couple days.
This is a critical threshold to make reopening safe: for authorities being able to move from community-wide interventions focused on large populations to case-based interventions, as the mentioned Roadmap states, but re-igniting infection among the population exponentially could take just a few offenders.
This is one of the issues all countries need to tackle over the next couple weeks rather than months
A first problem with smartphone apps is that their use in most Western countries would be voluntary — as Chancellor Angela Merkel stated, for one.
A second problem is that smartphone apps require mass public adoption. “To be effective, an estimated 60% of the U.S. population needs to opt in,” Mark Zissman, at MIT’s Lincoln Lab said. Professor Fraser at Oxford University shares this view.
A third problem is that if not coupled with a one-on-one daily monitoring system, violators can simply leave their phones behind. Even “big brother” control systems will miss these offenders.
Another tool are bracelets connected to the quarantined person’s smartphone via bluetooth. As soon as the devices move apart farther than an established distance, the bluetooth sounds an alarm at the monitoring point. However, and this is a forth problem, if GPS is not used alongside, quarantined people could leave the quarters carrying both bracelet and phone.
In the wake of a growing number of violations, South Korea’s officials believe it is worth considering bluetooth bracelets, KBS reported on April 7, as already in use in Hong Kong and Bahrein.
Bahrain launched the wristbands of the tracing app “BeAware” in the first week of April to keep affected individuals connected at all times via bluetooth with GPS enabled. Health officials may randomly send picture requests.
Conclusion
All of the best technology combined and the best and strictest data anonymization and encryption, even in a “human-managed” tracking solution, cannot guarantee full efficacy, i.e. that offenders are detected with all of their contacts traced back and positive testing people stay in isolation, without breaching some privacy standards — or most, in the case of the EU.
Subhajit Basu, an IT professor at University of Leeds, believes though that GDPR could encourage people to opt in because it promises transparency, if not total privacy, “even if it is a Chinese-style individual level location tracking,” Basu told CNN Business. Privacy advocates like David Carroll, at the New York New School, who helped expose Facebook’s Cambridge Analytica scandal, are warning that the pandemic could be used as a way to undermine American civil liberties.
One solution could be guaranteeing that all data is destroyed at the conclusion of a set period of time, as the policy dictates in Singapore. A New York Times editorial on April 7 suggested a similar solution: “Consumers need the option to delete user profiles after the crisis has abated … and they deserve easy access to what has been collected.”
So, do we have any more clarity about what should have priority in the balance between public health and individuals’ privacy? — a debate that dates back to 52 BC, when Cicero observed in his De Legibus that “salus publica suprema lex esto” (people’s well-being shall be the supreme law), as Mr. Renda notes.
Prominent New Zealand scientist Nick Wilson believes that electronic bracelets should be strongly considered for citizens in quarantine. Although there might be pushback, he hopes most people would understand. New Zealand, helped by its territory being islands, had only two victims, and is about to enter the second part of its Covid-19 “full elimination” roadmap.
“The country is making enormous sacrifices to try and achieve elimination,” he said, “so it’s a relatively small ask that quarantined people do have some of these electronic monitoring devices.”
*“Testing and contact tracing are one of the key reasons why a lockdown has not been considered necessary (in Iceland) up to this point,” its Directorate of Health said in a statement to CNN.
