Coronavirus Surveillance Is Far Too Important, And Far Too Dangerous, To Be Left Up To The Private Sector
from the who-do-you-trust dept
Months into the global pandemic, governments, think tanks, and companies have begun releasing comprehensive plans to reopen the economy, while the world will have to wait a year or longer for the universal deployment of an effective vaccine.
A big part of many of these plans are digital tools, apps, and public-health surveillance projects that could be used to contain the spread of COVID-19. But even if they’re effective, these tools must be subject to rigorous oversight and laws preventing their abuse. Corporate America is already contemplating mandatory worker testing and tracking. Digital COVID passports that could grant those with immunity or an all-clear from a COVID test the right to enter stores, malls, hotels, and other spaces may well be on the way.
We must be ready to watch the watchers and guard against civil rights violations.
Many governments and pundits are turning to tech companies that are promising digital contact tracing applications and services to augment the capacity of manual contact tracers, as they work to identify transmission chains and isolate people exposed to the virus. Yet civil society groups are already highlighting the serious privacy implications of such tools, underscoring the need for robust privacy protections.
The potential for law enforcement and corporate actors alike to abuse these tracking systems is just too great to ignore. For their part, most democratic governments have largely recognized that the principle of voluntary adoption of this technology — rather than attempts at state coercion — is more likely to encourage use of these apps.
But these applications are not useful unless significant percentages of cellphone users use them. An Oxford University study suggests that for a similar app to successfully suppress the epidemic in the United Kingdom, 80 percent of British cellphone users would have to use it, which equates to 56 percent of the overall UK population. If the numbers for a digital contact tracing program to succeed stateside were similar, that would mean activating more than 100 million users.
The level of adoption will dictate just how well these technologies prevent the spread of the virus, but no matter how widespread such voluntary adoption may be, there is still potential for coercion, abuse, and targeting of specific users and communities without their consent. Some companies and universities are already planning to develop their own contact tracing systems and require their employees or students to participate. The consulting firm PricewaterhouseCoopers is advising companies on how to create these systems, and other smaller tech firms are designing Bluetooth beacons to facilitate the tracking of workers without smartphones.
An unaccountable regime of COVID surveillance could represent a great near-term threat to civil rights and privacy. Already marginalized communities suffering most from this crisis are the most exposed to the capricious whims of corporate leaders eager to restart supply chains and keep the manufacturing and service sector operating.
Essential workers are subject to serious health risks while doing their jobs during a pandemic, and employers mandating use of these technologies without public oversight creates another risk to worker rights. This paints a particularly tragic picture for the Black community which has been disproportionately affected by the pandemic in terms of sickness, death, and unemployment.
Black and Latinx people are more likely to work as cashiers in grocery stores, in nursing homes, or in other service-industry jobs that make infection far more likely. Many such workers are already subject to pervasive and punitive workplace surveillance regimes. But now, there may be real public-health equities at play. When these workers go to work, they have to do so in close proximity to others. Employers must protect them and digital tracking tools may well be part of saving lives. But that balance ought to be struck by public-health officials and worker-safety authorities in consultation with affected employees.
This system of private-health surveillance may not just affect workers. Grocery store, retail, and restaurant owners, eager to deploy this kind of technology to regain the confidence of shoppers, may well see the logic in incentivizing widespread public deployment as well.
Those same stores could offer a financial incentive to customers who can prove they have a contact-tracing app installed on their phone, or they could integrate it into already existing customer loyalty apps. Coordinated efforts from businesses to mitigate losses due to sick workers or the threat of repeated government shutdowns could make incentivizing or demanding COVID-passports worth the investment to them. We may well find ourselves in a situation where a digitally checkpointed mall, Whole Foods, or Walmart feels like an oasis — the safest place in the world outside our homes.
Unaccountable deployment of these systems threatens to create further divides between workers and consumers, the tracked and untracked, or perilous division between those who can afford repeated testing and those who can’t.
So far, few officials have weighed these tradeoffs. As of yet, the only federal legal guidance on these questions has come from the Equal Employment Opportunity Commission, which has ruled that employers can legally institute mandatory temperature checks and other medical exams as conditions of continued employment.
Lawmakers have to do more. They must provide protections for the unauthorized use of this information and not allow access to places of public accommodation - a core civil right - to be determined by a mere app. We must seriously consider what it would mean for a free society, should businesses find it makes financial sense to invest in their own health-surveillance systems or deny people access to corner markets or grocery stores if they aren’t carrying the right pass on their person.
We do not have to be resigned to the deployment of a permanent state surveillance apparatus or the capriciousness of the private sector. If our post-9/11 experience is a guide, then we know that unaccountable surveillance infrastructure implemented during a crisis is wildly difficult to dismantle.
We must not construct a recovery that casts a needless decades-long shadow over our society, entrenches the power of large corporations, and further exacerbates class and racial divides. Governments must proactively decide the permissible uses and limits of this technology and the data it collects, and they must demand that these surveillance systems, private or otherwise, be dismantled at the end of the crisis.
Gaurav Laroia is the Senior Policy Counsel at consumer Group Free Press, working alongside the policy team on topics ranging from internet-freedom issues like Net Neutrality and media ownership to consumer privacy and government surveillance.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: contact tracing, covid-19, privacy, private sector, public sector, surveillance
Reader Comments
Subscribe: RSS
View by: Thread
Sadly, often the largest of corporations are the only ones able to live up to government regulations. Regulation and oversight comes with a tradeoff, and I'm not just talking about the taxpayer cost to hire the oversight. Big corporations love government regulation because they are the only ones who can afford the cost of compliance. I've seen this happen in the credit industry, so subjecting the contact tracing industry to scrutiny straight out of the gate will most certainly entrench it.
[ link to this | view in chronology ]
There wont be any accountability
[ link to this | view in chronology ]
Re: There wont be any accountability
HIPAA "privacy" is mostly implemented so as to make it difficult for family members to handle care of an ill relative. The "provider" (doctor, hospital, labs, etc.) can share your information with few restrictions, your insurance carrier has even fewer restrictions, and any type of "official" from a school nurse to the CIA has free access.
Generally, what little privacy you do have, you have to give away when you sign the release to get care in the first place. So, yeah, belief in medical privacy is about like belief in the Tooth Fairy.
[ link to this | view in chronology ]
Don't buy into it
I don't care who creates a coronavirus tracking app. I won't use it. I don't even leave location services enabled on my devices and have "Find My iPhone" completely disabled. It's bad enough that I can be tracked via cell tower connection locations and often put my phone in airplane mode just to avoid that, if I take it with me at all.
The only "smart" devices in my home are Rokus (at least the only ones connected to the internet) and I don't use social media apart from commenting on blogs such as this one. I don't feel any of that crap is necessary, offers primarily cons with very few pros. Not worth the trade-off. And I'm a multi-decade career software engineer building web-based apps so it's not about an irrational fear of technology. I know what that crap does...
[ link to this | view in chronology ]
Re: Don't buy into it
The API that Google and Apple have created for contact tracing doesn't use location services at all. Since you're a software engineer you should be able to understand its features the documentation is located here. In fact, the French government decided to roll their own because it doesn't track location and they wanted that information.
The best thing for those of us who truly understand how the technology works to do is to make sure that we fully examine apps like this one and make decisions and recommendations based on that. If we simply refuse without knowing how a specific application works then we risk misrepresenting it. That's especially bad in this environment with contract tracing.
[ link to this | view in chronology ]
Re: Re: Don't buy into it
Why should we trust the docs? Apple, maybe. Google, you got to be kidding. Both of them in this together? The docs are suspect.
[ link to this | view in chronology ]
Re: Re: Re: Don't buy into it
R.H. makes a good point. As a software engineer I really should go try to understand how those apps are meant to work before shouting them down.
I've now had a read of the abstract for this API and I'm very pleasantly surprised to see they found a way to drastically limit any kind of tracking info. The app itself, not Google or Apple, issues randomized identity tokens to each app user and frequently replaces them with new random tokens. This prevents other people using the app from using this data to track others. The app itself records the tokens of others who you get close enough to for bluetooth to send out a beacon and that range is fairly short.
Currently, however, Google and/or Apple gather all of that beacon data from the apps to record in a database for tracing outbreaks. Though all they gather are the randomized tokens and the beacon'ed tokens of those the first token might have been exposed to, the act of pulling that data from the device identifies that device. Not by location, not directly, but by clustering other devices your device has been near in a graph. With the device ID that comes with transmitting your tokens to the central server law enforcement could use this data to not just track location by cellular records but now also track possible association via the token graph, particularly if the token data also records the duration of the contact.
I think Google and Apple have done all they can to limit data exposure and tracking while also effectively tracing contact to help curb the spread of this virus. I do still have a problem with it and that is that I no longer trust our government and law enforcement not to weaponize data like that against citizens.
I haven't committed a real crime -- other than driving a little over the speed limit -- and have no plans to start now. But I strongly feel that all this tracking of citizens is an unconstitutional invasion of privacy. I opt out wherever possible. I want to help with COVID tracing but I'm not willing to load a cop's gun for him.
[ link to this | view in chronology ]
Private vs Public Contracts
I don't even see what the purpose of putting the government into the middle of all this, they are just going to outsource these to the same companies anyway. And we've seen from pretty much every government agency that any meaningful oversight is impossible. They are all either underfunded, lack punishment authority, or both.
[ link to this | view in chronology ]
Re: Private vs Public Contracts
Yeah, defund the police. Take away their authority. Give it to local leaders, they deserve it. They're ready. #defundthepolice
[ link to this | view in chronology ]
Whether public or private...
...just say "No!" to any form of cootie cops. Both the government and corporations have long track records of not respecting (read "abusing") our privacy, and we are all going to pay the price for it in the form of less effective pandemic control because many of us will not trust either of them to handle tracking properly.
[ link to this | view in chronology ]
I second (or third or whatever that...) Just Say NO! I'm not about to join into some sort of tracing that follows me around everywhere whether it's private corporations or government.
[ link to this | view in chronology ]
Re:
I think Antifa has an app. It tracks all it's members at all times. Really cool. You should join. If you don't, how will you prove you're not a fascist?
[ link to this | view in chronology ]
Right. But it's a scientifically proven fact that if you are protesting, the virus doesn't spread. That's science. There's a letter from 600 health professionals and public health officials that guarantee this is a fact and not propaganda. So we only need to follow people who don't protest, they have to stay inside. Simple, easy to understand, and based on science. If you're not protesting, stay inside and wait for us to come burn down your house to "disinfect" your white privileged.
[ link to this | view in chronology ]
Hard Stop
This is not a movie script right? Sorry, may as well RFID chip my body too.
Good plan but it is too intrusive:
1) NO --"Digital COVID passports that could grant those with immunity or an all-clear from a COVID test the right to enter stores, malls, hotels, and other spaces may well be on the way."
2) THEY WILL -- "The potential for law enforcement and corporate actors alike to abuse these tracking systems is just too great to ignore."
3) And because Latinx people do not exist i have to pull the emergency brake: The workers don't need tracking, they need to be tested at the work site. And work site needs to do the recommended procedures to control virus(s).
'Black and Latinx people are more likely to work as cashiers in grocery stores, in nursing homes, or in other service-industry jobs that make infection far more likely. Many such workers are already subject to pervasive and punitive workplace surveillance regimes. "
TRACKING: No, it is bad in more ways than I can imagine.
latinx -- Don't say that my hispanic stepsister in Miami would say. She teaches.
[ link to this | view in chronology ]
Re: Hard Stop
Well, if she doesn't teach people that white people have had their boot on the neck of black people for 200 years, she's doing it wrong. Don't you get it? White people are the problem. Defund the police. Defund white people. Spread their wealth around just like Obama did when he partied with black people in the white house. White people paid for that. Great, no? All them niggers dancing and singing and swinging their hips in the white house, while hard working white people paid the bill - great, no? That's how it should be! You Pay! We Dance!
[ link to this | view in chronology ]
Ministers begging can't compare with LOOTING and BURNING
ARI MELBER: As you look back then and look at the work you did then, what’s on your mind in what has and hasn’t happened since then?
REP. MAXINE WATERS: It has been many years since Rodney King, and before that, I was confronting the then-chief of Los Angeles police Daryl Gates, and not a lot has happened. Normally, when an officer kills even an unarmed person, usually a black man or woman, it is deemed a justifiable homicide.
But I want to tell you, I have a very special feeling about what is going on now. I believe that these young people in the streets are truly creating change. I think we’re on our way to the development of laws and practices that we’ve not been able to achieve with all of the struggles we’ve been in about law enforcement, the abuse, and the targeting, and the killing of blacks in particular.
While there are many who are concerned about the protests, I don’t think people need to be concerned about the protests. People should be thankful because these young people are doing what legislation has not been able to accomplish, the ministers begging and praying have not been able to achieve, and it goes on, and on, and on.
[ link to this | view in chronology ]
Flip side, once they start collecting data, it becomes a legal liability. Ain't no free lunch. Not yet, anyway.
[ link to this | view in chronology ]
The tracing app ..
... will be as powerful for fighting Corona as the NSA-surveillance was against terrorism: Completely useless.
The first challenge is that we do not even begin to understand how Corona transmits from one person to another. Studies show that people living in the same household as an infected person - sharing kitchen, bathroom and possibly couch and bed - have a 1 in 4 chance to get infected. The odds are 75 % to walk away uninfected when spending an entire week (the time someone can pass the infection) with an infected person.
In the light of this finding - what constitutes a "contact" that requires quarantine? Waiting in line next to infected person for 5 minutes? Sitting next them on the bus for 15 min? Eating next to them in a restaurant for an hour? Walking past on the sidewalk?
The next challenge is the infections are (mostly) spread through air. One needs to face the other person, or share a (closed) space for a while. How does an app know if the infected person is facing me? Or that the space we shared was badly ventilated?
Finally, how does the app know there was a screen (or even a face mask) between people who shared a space? In reaction to stories of bar men or check out assistants infecting entire neighborhoods, screen have been installed to stop the virus. Would anybody still want to quarantine hundreds of customers of a supermarket on the basis of a bluetooth device suggesting a dangerous contact?
Corona apps have been in use for while in some countries, with very disappointing results.
It would appear that the only advocates left are "security agencies". Who seem to have completely different applications in mind than stopping Corona.
Maybe it is not a bad idea if it wasn't the government who build the app, and mandated its use.
[ link to this | view in chronology ]
Sadly,
Sadly, as a lifelong capitol L Liberal American Citizen, I trust neither the government of the U.S. or ANY (worldwide) private industry actually capable of implementing contract tracing to ACTUALLY allow itself be subject to rigorous oversight and laws preventing the abuse of contact tracing.
We can't even get police departments to condemn the officers that crack 80 year old mens skulls for no reason at all, nor the ones that walk past the victim like nothing happened without public outcry.
And far too often, we cant get them to decry it even in the face of massive public outcry, they just lie in the face of existing video evidence and say the man tripped.
Is it possible to get some international body to do contract tracing and not share the information with the US government or US law enforcement?
Because seriously, anything that involves the US government or US law enforcement is going to end up being a bloodbath.
The proof is their "handling" of all of the peacful protests against police violence eventually ending up with the police USING violence proves that the only tool the authorities care to even try to use is violence.
Cops kneel with anti-violence protesters at noon and then kettle them at 8pm to prevent them from lawfully dissipating before curfew at 9pm.
When does this stop being acceptable?
[ link to this | view in chronology ]