Contact Tracing, Machines, And Civil Liberties

Already five regions within New York State have reopened for business, ushering in a new reality of “test, isolate, and trace.” The United States estimates it will hire close to 300,000 people to become contact tracers, identifying potential spreaders of the virus. Governor Cuomo has appointed former New York City Mayor Michael Bloomberg to head up its army of tracers, equipping each with access to citizen geo-tracking data. Bloomberg explained, “When social distancing is relaxed, contact tracing is our best hope for isolating the virus when it appears and keeping it isolated.”

As roboticists, and venture capitalists join the fight to flatten the curve with an array of sensor-based technologies, privacy advocates caution against following the invasive examples of China, South Korea and parts of Europe. The optimism of new innovations to augment human tracers is best expressed by Evan Nisselson of LDV Capital, “Many of the technologies that we are depending on today to help us flatten the curve are leveraging cameras and other visual technologies to capture and analyze visual data. These visual technologies can make the difference between life and death for the millions of people who will be infected or exposed to COVID-19 over the course of this pandemic.” Pollyanna Sanderson, Policy Counsel for Future of Privacy Forum (FPF), has been consulting with members of Congress to draft legislation to protect civil liberties as States race to adopt such tracing technologies. Sanderson shared with me the alarming reports from South Korea of publicly shaming infected individuals, via mobile apps, to force quarantine adherence. “There have been reports of humiliated individuals committing suicide, and South Koreans are just as terrified of the public humiliation as of catching the virus itself,” she cites.

Israel has been one of the most successful countries in combating novel coronavirus with less than three hundred deaths out of 16,700 total cases. Earlier this week, the Middle Eastern democracy announced it will begin lifting its national lockdown order to facilitate the reopening of offices, schools, and prayer services. Its secret lies in leveraging its famed terror fighting internal security force (the Shin Bet) to track its entire citizenry by harnessing cellular data to identify and isolate infections. While Sanderson reports that the Shin Bet (Israel’s equivalent to America’s FBI) has come under stiff criticism for “raising serious civil liberties concerns,” the government extended its emergency powers on May 5th for three more weeks. According to Ayelet Shaked, a former justice minister and member of the intelligence panel, “Although it is aggressive and has privacy (issues), there is no other tool right now.” This action comes on the heels of condemnation from Israel’s Supreme Court that ordered the government to find “a suitable alternative, compatible with the principles of privacy.” This has led the Ministry of Health to promote its own voluntary app, HaMegen, to trace contaminations. Sanderson explains that users of this open-source mobile application enable the sharing of their “GPS data, Wi-Fi data, Google Timeline history.” The Health Ministry alerts users in exchange, through Bluetooth notifications, of the proximity of known Covid cases. Sanderson further comments, “The number of downloads has been underwhelming, which greatly reduces its utility. The effectiveness of exposure notification apps relies on widespread adoption. This requires trust…It is too early to tell how effective this alternative approach will be.”

Other countries struggling with the rising death toll have begun embedding intrusive spyware inside mobile robots and wearables. “China is relying on its vast surveillance network to combat COVID-19. It is using a mixture of location data, data mining, and drones to combat COVID-19, but there is little public information about how China’s technology works,” reports Sanderson. She cautions, “When technologies are deployed, there is always the inherent risk of ‘mission creep; whereby a government could always use the data for an unrelated purpose in the future.” The privacy advocate is especially concerned about China, “given their track-record on surveillance and human rights.”

In the United Arab Emirates, police officers are outfitted with Robocop-looking surveillance helmets to monitor pedestrian body temperature. Sanderson expresses, “Privacy concerns arise when data relating to the temperature of a person is combined with facial recognition technology, or other techniques to identify an individual and link it to their temperature.” Furthermore, thermal scanners have led to a high rate of false positives. As Ryan Barnett of Vetted Security Solutions describes, the marketing of “fever detection,” devices is misleading; “The system isn’t magic. It’s just reading external temperatures. You don’t want to be publicly shaming somebody or drawing negative attention to somebody because their temperature might be too high.” High readings could be contributed to a number of factors beyond fevers, such as weather, exercise, and diet. Yet, this has not slowed the industry as image manufacturer FLIR has sold more than $100 million worth of scanners in the first three months of 2020. Sanderson stressed that a number of widespread scanner deployments “lack data protection frameworks or adherence to human rights.”

In Singapore, officials have utilized packs of SPOT robot dogs to police social distancing policies in and around city parks. Earlier this month, the tech-savvy Asian state announced, “SPOT will be controlled remotely, reducing the manpower required for park patrols and minimizing physical contact among staff, volunteer safe distancing ambassadors and park visitors. This lowers the risk of exposure to the virus. Unlike wheeled robots, SPOT works well across different terrains and can navigate obstacles effectively, making it ideal for operation in public parks and gardens.” In proactively addressing potential criticism, the park authorities made sure to detail the mechanical canine’s sensor package and specific mission objectives: “SPOT will also be fitted with cameras – enabled with GovTech-developed video analytics – to estimate the number of visitors in parks. These cameras will not be able to track and/or recognize specific individuals, and no personal data will be collected.” These video analytics are part of a larger effort by the municipality to report on visitor data to enable social distance planning through its online portal, The Safe Distance @ Parks. Utilizing a network of 30 drones, and now fleets of Softbank’s robot dogs, citizens are able to access up-to-the-minute reports of visitor density levels before embarking on recreational activities. Many public heath experts have sited Singapore as an example of smart reopening policies, leveraging robots and sensors to monitor safe behaviors while balancing privacy concerns.

As America is on the cusp of reopening, with each of the 50 states deploying its own strategy, Sanderson indicates that there is a clear role for federal government to provide oversight in protecting civil liberties. In advising technologists, she recommends that tracking apps should be “based on user consent (voluntary); feature data minimization; decentralized device-to-device signaling; on-device processing; transparent source code; and technical and administrative safeguards to prevent abuse or mis-use.” She points out that one of the most debated issues is exposure notification. Singapore, Australia, and the UK have opted for a centralized system whereby the data is reported directly to the government. Sanderson hails the examples set by Apple and Google in architecting its software with built-in privacy protections, “In contrast, the Apple/Google API does not involve the creation of a centralized database of personal information for the government to access (or Apple/Google themselves). This approach is a more privacy-preserving method, and reduces the ability for governments or companies to repurposes data for other non-COVID purposes.” She notes that Austria, Germany, Ireland, Italy, the Netherlands, Switzerland, and Malaysia have all adopted the Apple/Google framework. I pressed the FPF executive on her thoughts about government overreaching, she retorted, “It is essential to learn lessons from the 9/11 disaster to strike the right balance between human rights and surveillance. This requires transparency and oversight, data retention limitations, purpose limitations, for apps and other emergency technologies to shut down after the immediate threat has ceased, and for governments and companies to publicly commit to adhere to appropriate safeguards.”