With the coronavirus outbreak in the past, it’s a rainy evening in September 2020. With a box of pizza, you slide into the front seat of your car to meet your friends. It’s been eight months since you’ve seen most of them, at least not without the help of technology and phones. You’re full of excitement.
As you’re pulling out of the neighborhood, you feel your phone buzz. It’s an alert from the CDC officials overseeing the coronavirus outbreak. On the lock screen, you can read the words “be advised”. Your heart sinks as you unlock the phone to read the rest of the message:
We have determined that in the past few days, you may have interacted with somebody who has recently tested positive for COVID-19. There is no need to panic. But for the sake of your family, friends, and neighbors, we are relying on your support. As soon as you can, please …
You stop reading and follow the drill. You turn off the car, walk back into the house, and open the box. It will be a pizza party for one. And until you are tested to prove that you are virus-free, self-isolation continues.
This could be a vision of our future. It is a world in which many businesses go back to normal, millions of people return to work and social-distancing measures are relaxed; while we anxiously navigate a purgatory between the virus’s early-2020 outbreak and its possible resurrection.
It is also a world in which the return to normal is dependent on the introduction of a novel technology. Millions of people—many of whom might be deeply skeptical of their government surveillance, or Big Tech—may become participants in a national project to track their own movements and interactions. Imagine losing all of your privacy to help public-health experts map out the spread of an invisible enemy.
This is the world of “test and trace.”
What is ‘test and trace’?
In the past month, the coronavirus pandemic has necessitated a deep freeze of worldwide activity. Storefronts are closed, millions have lost their jobs and millions more are putting their health at risk in hospitals and grocery stores. This apocalyptic reality may not end until a reliable antiviral treatment or COVID-19 vaccine is widely available.
"Masks alone cannot stop the #COVID19 pandemic. Countries must continue to find, test, isolate and treat every case and trace every contact," says @DrTedros
#coronavirus at @WHO #COVID19 briefing 6 Apr. pic.twitter.com/OzDkgmyGOo
— Global Health Strategies (@GHS) April 6, 2020
That day may be a year or two away. But, until then, our best hope in the fight against the coronavirus is to play a game of sophisticated Whack-a-Mole that often goes by the name of “test and trace”. It’s basically like stopping something as soon as it occurs, without any strategy to stop it from appearing. Just like, closing pop-up advertisement windows.
One can imagine the testing half of the method: blood tests, nasal swabs etc. However, the tracing half of the equation is less understood. But it is more likely to leave its mark on global politics and society.
In its most basic form, tracing—otherwise known as tracking, or contact tracing—means identifying all the recent interactions of sick individuals to determine whom they might have infected. Testing plus tracing can besiege the virus, starve it of new bodies, and return the world to its pre-viral routine, or something like it.
Until recently, tracing relied on an old-fashioned technology: interviews. To stop the spread of Ebola, authorities from the Centers for Disease Control and Prevention asked sick people to list recent interactions with family, friends, and businesses. That interview would produce a list of contacts, who would be monitored for illness for several weeks. The state of Massachusetts recently announced plans to hire 1,000 people to do these sorts of contract-tracing interviews.
But that old-school approach might not be enough. People have faulty memories about who or what they’ve touched, or where they’ve been. More importantly, person-to-person interviews might be too slow to arrest an international pandemic accelerating through the population.
The solution? Your phone.
How can your phone be used to trace you?
Our cellphones and smartphones have several means of logging our activity. GPS tracks our location, and Bluetooth exchanges signals with nearby devices. In its most basic form, cellphone tracing might go like this: If someone tests positive for COVID-19, health officials could obtain a record of that person’s cellphone activity and compare it with the data emitted by other phone owners. If officials saw any GPS overlaps (e.g., data showing that I went to a McDonald’s hot spot) or Bluetooth hits (e.g., data showing that I came within several feet of a new patient), they could contact me and urge me to self-isolate, or seek a test.
Ramesh Raskar, a computer scientist at the MIT Media Lab, is working on an app that uses GPS to create maps. This app shows the movements of people recently diagnosed with COVID-19. “In an early version, you might see a map with hotspots—2 p.m. at Starbucks, 3 p.m. at the library—that would tell you where people with the disease had recently been,” explained Raskar. “All the government has to do is demand that every test facility release the trails of infected people in an anonymous manner, so that healthy people know where to avoid.”
Our daily update is published. We’ve now tracked more than 2 million tests, up ~137k from yesterday.
Note that we can only track tests that a state reports. And not all states report all tests.
— The COVID Tracking Project (@COVID19Tracking) April 7, 2020
For privacy advocates, “Waze, but for the sick” might seem harvested from their darkest nightmares. But Raskar is insistent that his code is open source, “every part of the code should be visible to everybody, every day”. Also, that no government or tech company would have exclusive control over a centralized database that it could abuse. Users wouldn’t learn anything else about the infected person, such as age or sex.
The technology and privacy challenges of tracing will nonetheless be complex, and could normalize a level of surveillance that might seem totalitarian. If we want to get it right, we should learn from the experiences of other countries. In eastern Asia, tracing has already become a part of daily life.
Many countries are already tracking their citizens
Let’s start with China, where residents in hundreds of cities have been required to download cell phone software that broadcasts their location to several authorities, including the local police. The app combines geo-tracking with other data, such as travel bookings, to designate citizens with color codes ranging from green (low risk) to red (high risk). Many human-rights advocates fear that what has been rolled out as a public-health app is moonlighting as a tool of government espionage and mass discrimination.
Next, let’s look at South Korea – a democracy that has arguably been more successful than any other in containing the spread of the virus. The government uses several sources, to broadly monitor citizens’ activity. When somebody tests positive, local governments can send out an alert, a bit like a flood warning, that reportedly includes the individual’s last name, sex, age, district of residence, and credit-card history, with a minute-to-minute record of their comings and goings from various local businesses. “In some districts, public information includes which rooms of a building the person was in, when they visited a toilet, and whether or not they wore a mask,” Mark Zastrow, a reporter for Nature, wrote.
Test, trace and track.
— World Economic Forum (@wef) April 4, 2020
New cases in South Korea have declined about 90 percent in the past 40 days, an extraordinary achievement. But the amount of information in South Korea’s tracing alerts is a gross breach of privacy. Choi Young-ae, the chair of South Korea’s Human Rights Commission, has said that this harassment has made some Koreans less willing to be tested.
Singapore offers perhaps the most likely model for the West. Residents can download an app called TraceTogether, which uses Bluetooth technology to keep a log of nearby devices. If somebody gets sick, that user can upload relevant data to the Ministry of Health, which notifies the owners of all the devices pinged by the infected person’s phone.
The downside of Singapore’s app is that you have to register with your phone number. The authorities easily match the IDs with associated home numbers and impose restrictive measures directly on people with confirmed infections. Germany, which is helping to lead Europe’s tracing efforts, is looking to tweak the Singaporean model in a way that might make it more amenable to Western sensibilities.
A brief scenario of how you can experience such tracking
Ulf Buermeyer, is a privacy advocate, an officer at the Berlin Department of Justice, and the president of Germany’s Society for Civil Rights. According to him, one possibility is to program phones to broadcast a different ID every 30 minutes. So, for example, if I went to a café in the morning, my phone would broadcast one ID over Bluetooth to all the other phones in the café. An hour later, at lunch with a friend, it would broadcast a different ID to all the other phones at the restaurant. Throughout the day, my phone would also receive and save IDs and log them in an encrypted record.
Days later, in case we are diagnosed with the coronavirus, our doctors will ask us to upload our app’s data to a central server. That server would go through our encrypted records and find all of the temporary IDs we have collected. An algorithm would match the temporary IDs to something called a push token—a unique code that connects each phone to the app. It could then send each phone an automated message through the app: please be advised: We have determined that in the past few days, you may have interacted with somebody … At no point in this entire process would anybody’s identity be known to either the government or the tech companies operating the central server.
What does this teach us?
This brief global tour of tracing technology provides at least three lessons.
Firstly, ‘test and trace’ seems to work—period. Singapore and South Korea are very different countries from each other. Yet, they have learned from previous outbreaks. Through tracing, both countries have reduced COVID-19 deaths much more successfully than many similarly dense countries.
Secondly, the information made available by tracing apps will be tantalizing for power-hungry governments and data-hungry corporations to monopolize. A tracing app made necessary by the pandemic cannot become an indefinite surveillance system run by some occult government agency.
Thirdly, the virus creates a dilemma of data. At the moment, it is reckless to not know who is infected and where they are. ‘Test and trace’ offers a road out of ignorance. But the more learn about the whereabouts of the sick, the more we begin to violate their privacy.
The dilemma of privacy infringement
For the past few years, privacy advocates have criticized advertising giants such as Google and Facebook. These companies follow us around the web and harvest our data to anticipate future behavior. Whether you found these critiques compelling or overwrought, the accusations certainly apply to tracing technology. This explains why many test-and-trace apps are considered “swabs and surveillance” and rejected outright.
While online advertising technology might mislead consumers about the nature of their tracking, the aim of smartphone tracing is straightforward. This software shows if your phone signal or daily routine intersects with a deadly contagion that is destroying the economy.
The pandemic has already taught us to embrace extreme behavior in the name of saving lives. Billions of people, worldwide, are living under house arrest. Many chief executives and entrepreneurs have agreed with the government mandate to shut down their businesses. In these strange times, common rights are going through a renegotiation, with new loose definitions.
Compared with our life just six weeks ago, smartphone tracing might seem like a violation of our dignity and privacy. And compared with our life six years from now, let’s hope that it will be. But compared with our present nightmare, strategically sacrificing our privacy might be the best way to protect other freedoms. Life and health come above human rights.