Is Your Privacy Safe during the COVID-19 Pandemic?

Picture a scenario where citizens willingly have their every move tracked via their smartphones; their every bank transaction monitored; and have themselves tracked from CCTV footage. 

Pretty Orwellian, right?  Dubious tracking from smartphones and wearables by unscrupulous third parties is already on the dark side of health trackers.

However, this scenario is a reality in countries from East to West around the globe. Several countries have implemented digital surveillance to track the spread of the novel coronavirus. Others are contemplating this solution, while many believe it will linger after lockdowns are lifted.

Obviously, such drastic measures raise a whole new level of privacy issues. One can wonder what privacy means anymore and if there aren’t any alternatives to help track COVID-19 while preserving privacy. Join us as we intrude into the murky business of tracking in the age of the pandemic.
 

South Korea is already tracking their citizens

A classic example is South Korea which received praise for its effective management of the pandemic with over ten thousand positive cases and less than 300 deaths. Part of its success is thanks to its aggressive contact tracing which involved tracking bank transactions, CCTV footage and phone use.

The reasoning behind deploying such intrusive techniques is as a recent paper from the University of Oxford concluded. It reads that the “viral spread is too fast to be contained by manual contact tracing, but could be controlled if this process was faster, more efficient and happened at scale”. It further suggests the use of a contact-tracing app. This has become an increasingly attractive solution around the world.

As the simplest method, such an app will use a smartphone’s built-in GPS to find someone within meters of their actual location. Another method is to use scannable QR codes in public areas. This sends data to a server about who’s been where at a specific time. The latest method is the one pushed by Google and Apple’s surprise collaboration. It uses a phone’s Bluetooth to connect to another user’s phone and map a network from this data.

All of these methods have their pros and cons, but their aim is the same: identify who could potentially be infected with SARS-CoV-2 and alert those who’ve been in proximity to that person. Some methods claim that they “anonymize” location data; but we previously discussed the ease of connecting anonymized dots on a map to actual names. These pose a blatant breach in privacy and their true efficacy might only be evaluated once the pandemic subsides. Some experts even warn that for phone tracking to be effective, at least 60% of the population should use it, a figure that’s hard to reach.

Other countries in the race for smartphone data

South Korea isn’t an exception to the use of surveillance in the pandemic era. Such drastic measures are already in place in several countries around the world. In fact, there are at least 10 countries employing such methods, with more to follow suit.

Russia is using facial recognition to identify and fine violators of quarantines and self-isolation protocols. Moscow recently deployed a QR-based system, dubbed as a ‘cyber Gulag’, to monitor movements and track the contagion.

Israel allowed its internal security agency to use phone location data. They will use it to follow the movements of those tested positive, and identify others who should be quarantined.

Austria, Belgium and Germany’s telecom companies got the go-ahead to share location data with the respective governments. 

Singapore launched an opt-in downloadable app that uses Bluetooth and wireless signals to detect other users in proximity.

In early April, Bahrain launched a tracking bracelet dedicated to keep track of active and new COVID-19 cases. Those issued with one have to connect it to their phone via Bluetooth all the time to ensure that they remain in isolation, which is then verified via GPS data.

In the U.S., a controversial company Clearview AI, which made a facial recognition data database from social media pictures, is pitching its platform for the government to track the disease.

We’ve seen the case in South Korea, but more than to track the disease’s spread, it exposed embarrassing private information and led to rumor-mongering. As other countries adopt such strategies, we will understandably witness increasing complaints about privacy violation.

Is this the end of privacy?

Given the speed of COVID-19’s spread, traditional tracing methods won’t make the cut. As such, it’s understandable that we are asked to compromise between helping reduce transmission and preserving some privacy. In fact, most of these tracking options are opt-in, but the repercussions are severe if one doesn’t abide by confinement rules. However, where is the line between personal space and civic duty drawn? Or will this line blur post-pandemic?

In South Korea, authorities send “safety guidance texts”, reminding people to maintain hygienic measures as well as alerting them of details of people who tested positive of the virus. They can subsequently see a list of places this particular person visited prior to a positive virus test.

This method identified a man returning from China with his secretary, leading to speculations that they were having an affair and that the secretary underwent plastic surgery. That’s one of the many personal details laid bare and which will continue popping up as long as such tracking measures are in place.

How long will this remain in place?

A recent article from MIT Technology Review argues that “much of what we build for this pandemic should have a sunset clause—in particular when it comes to the private, intimate, and community data we might collect.” Ideally, this should hold true. Unfortunately, we don’t live in an ideal world; and the technologies employed in this crisis are likely to linger long after.

Even before the pandemic, some governments were investing heavily in tools like facial recognition and phone tracking. Concerns over another public health issue are valid but can also serve as an excuse to aggressively implement privacy-violating measures on a large scale.

Moreover, pertinent questions remain: what will become of these data after the pandemic situation is over? How securely do authorities store them? What if the black market will benefit from these information? We might never have conclusive answers for these questions, but the good news is that there are alternatives.

What about a privacy-friendly alternative?

Yes, privacy-preserving solutions are in the works. Such decentralized models aim to keep as much sensitive data on the users’ phones as possible and allow them to use a centralised server to trace contacts. 

A group of European universities open-sourced their proposal for one such system. The University of Cambridge‘s COVID-19 Sounds App uses crowdsourced data involving sounds made by people with the condition; no tracking involved.

MIT is developing an app that uses Bluetooth signals to record on encounters with other users on their phone. “I keep track of what I’ve broadcasted, and you keep track of what you’ve heard, and this will allow us to tell if someone was in close proximity to an infected person,” said Ron Rivest, an MIT Institute Professor and principal investigator of the project. “But for these broadcasts, we’re using cryptographic techniques to generate random, rotating numbers that are not just anonymous, but pseudonymous, constantly changing their ‘ID,’ and that can’t be traced back to an individual.”

“We’re not tracking location, not using GPS, not attaching your personal ID or phone number to any of these random numbers your phone is emitting,” added Daniel Weitzner, co-principal investigator of the project. “What we want is to enable everyone to participate in a shared process of seeing if you might have been in contact, without revealing, or forcing anyone to reveal, anything.”

Nevertheless, such solutions are in-development or in prototype formats. Before a final version is available, the novel coronavirus will continue to infect people. Meanwhile, governments have to resort to more intrusive methods in response to the speed of the virus. However, privacy should be made a priority once such secure options are ready to be deployed on a large scale.

Ref: 

https://medicalfuturist.com/your-data-privacy-during-a-pandemic/ 

https://www.technologyreview.com/2020/04/12/999186/covid-19-contact-tracing-surveillance-data-privacy-anonymity/