COVID-19 and Privacy

-- By ElaineHuang - 31 Dec 2020

Introduction

In May of this year, there was an outbreak of COVID-19 in the Itaewon district of Seoul tied to a string of nightclubs there. The Seoul Metropolitan Government quickly traced anyone who had visited one of the major nightclubs by using data from credit card records, lists of nightclub visitors, public transportation records, and surveillance cameras to eventually identify 5,517 people. They also used cell phone location data to identify another 60,000 people who had spent at least half an hour around the area. With this data, the South Korean government monitored these people and had them get tested.

This sort of digital contact tracing is not unique to South Korea, as we have seen countries like Singapore, Israel, and China, amongst others, implement similar strategies in an attempt to identify those who have potentially been infected. The extent to which these governments are able to use data, and the lack of safeguards against the data being used for other surveillance purposes after the pandemic, is alarming. But is this digital surveillance even effective enough against COVID-19 to warrant less privacy?

Data and Privacy

Efficacy of Digital Contact Tracing

Traditionally, the spread of a disease was tracked by trained interviewers who collected a list of people who have been in contact with the infected interviewee and then informed those individuals and observed them for symptoms. Researchers at Oxford have argued that the virus spreads way too quickly for traditional methods to be used and suggested that digital contact tracing is more reliable, assuming that all of those contacts will be quarantined. However, as Natalie Ram and David Gray point out, this assumption that everyone who has potentially been infected will quarantine for at least a two-week period is a generous one (Natalie Ram & David Gray, Mass Surveillance in the Age of COVID-19, 7 J.L. & the Biosciences 1, 12 (2020)). Digital contact tracing can only be beneficial if we have the capacity to provide COVID-19 testing to all of those identified and the confidence that they will self-isolate.

In addition, current technology might not even be able to reliably find potentially infected individuals. We have been told to stay at least six feet away from others. GPS location data has a margin of error wider than six feet, cell phone data is even less precise, and Bluetooth data might say that two people separated by a wall or who are on different floors might be in close proximity to each other.

In Singapore, about 12% of the population downloaded an app that uses Bluetooth to track contact, and according to the Verge, should a similar proportion of the U.S. download a similar app, the probability of getting notified of possible infection by passing someone else with the app is only 1.44%. While this could be improved by encouraging more people to download the app, it seems like an awkward solution considering the severity of the pandemic, along with the aforementioned problem with Bluetooth technology. In addition, over-identifying infected individuals may lead to less confidence in the system and lesser compliance. Instead, traditional methods may lead to more accurate notifications of people who might have been in close contact, encouraging a greater percentage of those people to get tested and self-isolate (Id. at 13).

Anonymity and Privacy Problems During a Pandemic

As stated by Professor Moglen previously, anonymity is more than just hiding away one particular thing we do—it is also about what we read, what we see, and what our preferences are. The Korean nightclubs were frequented by the LGBTQ+ community, which is still stigmatized in South Korea, and while the government offered anonymous testing to encourage them to get tested, the data from cell phones, credit cards, public transportation records, and cameras still outed the people who visited Itaewon and exposed their preferences (e.g. their preference for other people). Even if this data didn’t include names per se, the aggregate of all of the information may still have allowed the government to personally identify individuals.

The collection of such data is much more invasive than simply writing down a name and contact information, and perhaps the supposed benefits of such privacy invasion are not that much greater than that of the traditional method. It is difficult to look at the relative success in South Korea or elsewhere as the direct result of using surveillance data. Other variables, such as the willingness of people wearing masks, effective government response, and voluntary self-isolation, have definitely contributed to faster containment. In the United States, the official response was slow; there was a shortage of masks, especially for the health care workers; and even now, many people refuse to wear masks and self-isolate. It is premature to declare that digital surveillance has positively caused a slowdown of spread without looking at the data and the effects of these other variables on the outcome. Even if it is effective, there is little to prove that measures with lesser privacy concerns, such as the traditional method, would not be just as, or even more, effective.

What Can Be Done?

Rather than spending resources on developing the technology to track COVID-19, the United States should instead focus on building up its public health infrastructure. Since the beginning of the pandemic, hospitals have been at over-capacity, while nurses and doctors lacked appropriate PPE. There has also been a shortage of reliable COVID-19 tests available for those who are concerned about their exposure, and even then, the cost of taking a test may dissuade those who should get tested.

In terms of tracing the virus, the slower traditional method of contact tracing may lead to better results in the long run. Training and hiring more of those workers may be a better use of resources. So, before rushing to build digital contact tracing, we should seriously consider whether it provides that much more benefit in relation to its invasion of our privacy.

---

You are entitled to restrict access to your paper if you want to. But we all derive immense benefit from reading one another's work, and I hope you won't feel the need unless the subject matter is personal and its disclosure would be harmful or undesirable. To restrict access to your paper simply delete the "#" character on the next two lines:

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, ElaineHuang
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.