Georgetown University SCS would like to acknowledge Shady Abouzeid, Kathleen Moriarty, Muhammad Islam, Bayo Oresegun, Scott Rubin, and William Yurek for their contribution to this article.
With COVID-19 continuing to spread and impact lives around the world, many technology providers and nations are taking steps to implement contact tracing applications to minimize the spread of the disease. Digital contact tracing applications work in different ways utilizing mobile phone location or Bluetooth signal. Even though most countries are implementing this tool on a voluntary basis, some nations are opting in their citizens to slow the COVID-19 spread. Here are four perspectives related to the challenge and opportunity ahead: (1) innovative technology; (2) cultural dimensions; (3) limitations of privatized contact tracing; (4) privacy and security issues.
Innovative Application
In public health, the practice of contact tracing is not new. For every major pandemic outbreak over the last few decades, from HIV to Ebola, contact tracing has been utilized. But this time it's different because of the advancement and proliferation of modern digital technology solutions.
Let’s assume two people, Shoppers A and B, are inside a store and come reasonably close to each other: their devices would exchange an anonymized encrypted token indicating that they were in close contact. After a few days, Shopper A gets tested positive for COVID-19. The contact tracing application would send out a notification to everyone who came into proximity of that shopper within two weeks, for example. Not knowing exactly who the infected person is, Shopper B would be instructed to self-isolate to prevent further spread of the disease.
On the one hand, modern technology makes for a more effective contact tracing solution, but on the other hand, it fundamentally tests our core notions of privacy and ethics. We would need to explore data privacy considerations; consequences of tracking an individual’s location; consequences of false positives; possible HIPAA violations; and many other societal implications.
Cultural Dimensions
Considerations for security and privacy on contact tracing rely not only on a risk-based assessment but must also factor in cultural norms that influence how a solution is received. The United States is still debating such application use, while nations such as China were able to repurpose existing technology and apply it to the problem almost immediately.
A majority of the American public have indicated they would use an app to share the results of a coronavirus test. One-third of those who identified as Republican would be willing to do so, while two-thirds of the participants that identified as Democrats are on board with the approach.
People might be more inclined to allow a state or local health organization to conduct digital contract tracing, however, political party lines will impact any government organization’s use and deployment of technology that develops such sensitive personal data. In the United States, government mass surveillance has been a heightened concern since the Edward Snowden revelations in 2013, and more recently service and application providers with either direct access to your data or access to your encrypted data are part of the concern.
Limitation of Privatized Contact Tracing
A digital contract tracing system that works on a global scale to defeat pandemic outbreaks requires significant investment and coordination, which might only be achieved through legislation, treaties, multinational agreements, and support from government and multinational organizations. That’s because contact tracing provides the private sector free access to snoop on a dimension of our lives that until now was relatively untapped.
Before cheering and applauding such a move, take a moment and imagine what the private sector—with their non-publicly elected CEOs and whose loyalty is to shareholders—do with such access. The troves of new data, combined with the ever-increasing power of AI, provide the private sector with an enhanced ability to influence people’s behavior in subtle manners that potentially crosses the line to outright manipulation.
Additionally, history has shown that even anonymized data can sometimes be de-anonymized through careful analysis, including the use of artificial intelligence and machine learning technologies.
Privacy and Security
While personal data and location may be encrypted, inferences on activity may be possible. Just as importantly, the companies or organizations most technically capable of providing tracking applications quickly are capable of storing vast amounts of information, and the public is reliant upon those organizations to maintain confidentiality and privacy.
Again, history has shown that collected data may be used by third parties even if the controlling organization doesn’t intend such use. Conversely, while preventing third-party access to the data may increase both opt-in and benefit to individual users, it limits the broader epidemiological and public health benefits that could come from the data. Those who opt into information sharing are those who feel they have a personal gain in doing so, in this case those who are willing to trade personal information for a potential early warning they can use to protect themselves and their families.
The US model of information sharing has historically been one of opt-out, not opt-in. Those companies using an opt-in model for contact tracing will have to change the fundamental way in which they process and share information. This fundamental shift presents technical, legal, and process challenges that, when faced in the tight timelines of COVID-19 response, may easily be overlooked.
We also need to exercise some level of technology restraint and discipline. Just because the technology exists, does it mean we should deploy it? We should be asking ourselves what a contact tracing solution should be doing and not what it can be doing. Granted, utilization of contact tracing has the immense benefit of curbing the spread of COVID-19, but we need to consider the precedent we are setting for all future pandemic outbreaks knowing this same model can be utilized for other issues outside healthcare.
Learn more
