A growing mix of health and technology experts are convinced that if the United States is to ever effectively track the coronavirus and slow its spread, then both self-reported and more surreptitiously gathered personal data — a mix of information about location, travel, symptoms and health conditions ― must be gathered from millions of Americans.
With the pandemic far from over, public health needs are paramount. Public health experts say that collecting personal data may be the only way to analyze information on the massive scale needed. But how that information is used and by whom worries some privacy advocates.
A number of academics, data firms and technology companies are using mobile devices to gather data. Some use the phones’ Bluetooth signals to aid in contact tracing by registering other nearby devices. Location information recorded on smartphones can help them map whether people are staying home and where they do venture out. Others have built symptom-tracker apps designed to predict where the virus might turn up next.
And more may be coming. Just look to other countries, including Taiwan, Singapore and Ireland, which are using big data or apps to aid in their pandemic responses. As the United States contemplates its move to open back up for business, organizations such as the left-leaning Center for American Progress and the conservative American Enterprise Institute have recommended a range of steps, including much more testing and digital surveillance.
A report from Johns Hopkins Bloomberg School of Public Health noted that such tech-heavy efforts might not fly in the U.S. because of privacy concerns. Privacy advocates have long argued for increased protection of personal health information on fears that marketers, data bundlers or even hackers could sell or divulge the information, possibly affecting people’s jobs and credit or leading to identity theft. This tracking and tracing of data could include comings and goings normally closely guarded — from doctors’ or therapists’ visits, pot dispensaries and any number of activities one might want to keep secret.
But, in the current situation, some say privacy concerns must take a back seat.
“In a plague, civil liberties have to be suspended. There are good reasons for that,” said Arthur Caplan, a professor of medical ethics at NYU Langone Medical Center. He noted that because of the enormous amount of data already collected about Americans by marketers, the “genie is already three-quarters of the way out of the bottle.”
So the benefit of increased surveillance and contact tracing will be a loosening of stay-at-home restrictions, he said. “If it gets us back to work and school, we don’t care. We can fix it later.”
However, the pandemic may be pushing the United States to a point of no return.
Jake Laperruque, senior counsel and a privacy expert at the Project on Government Oversight, likens the current circumstances to the period after the terrorist attacks of Sept. 11, 2001, when former President George W. Bush signed into law the Patriot Act. The measure allowed the government to more easily surveil Americans’ phone and computer records in the name of national security.
“A lot of times during various types of emergencies, we see things happening that we’re doing just because it’s an emergency. It’s really hard to claw back from those and turn them off,” said Laperruque.
Contact Tracing Via Bluetooth
A longtime public health strategy, “contact tracing,” involves identifying individuals who have contracted an infectious disease, notifying others who have been in contact with them and ensuring that those with the disease manage it safely. South Korea and Singapore have reported some success in managing the outbreak in part because of aggressive contact tracing.
Typically, public health workers handle the tracing. But the sheer size of this pandemic calls for more automation, said supporters of a data-driven approach.
On April 10, Google and Apple announced they were teaming up to develop smartphone software that would allow phones to sense via Bluetooth whether a phone user had been near someone who has the coronavirus, similar to the TraceTogether app used in Singapore. For it to work, phone users must download an app provided by public health officials and be willing to share their health information, including whether they’ve tested positive for the coronavirus.
The companies said that they won’t collect user location data or personally identifiable information and that those who test positive would not be made known to Google or Apple.
Ideally, the information could be useful to public health departments, said Dr. Georges Benjamin, executive director of the American Public Health Association.
While he has no problem with public health officials getting data ― after all, laws already require reporting of infectious diseases to try to thwart outbreaks — he cited potential privacy problems if it’s a commercial venture doing the gathering.
In an interview on Snapchat’s “Good Luck America,” Dr. Anthony Fauci, a member of the White House coronavirus task force and director of the National Institute of Allergy and Infectious Diseases, had a similar take, saying that from a public health standpoint, “it makes absolute sense.” He also noted that pushback on privacy issues and civil liberties “would be considerable.” In his view, government rather than private-sector involvement might amplify these concerns.
Ultimately, though, public health officials ― including Centers for Disease Control and Prevention Director Robert Redfield — are clear that finding a doable means to advance contact tracing is critical to getting the country back to normal.
Caplan agrees.
“That’s the biggest reason to want to yield on privacy,” said Caplan. “If we don’t get a vaccine or a cure miraculously soon, the only way we’re getting out of isolation and quarantine is to track who is positive and who isn’t and who they are around.”
But questions remain ― while the apps may indicate whether a person has come within a few feet of someone with the virus, the smartphone can’t differentiate between close, person-to-person interaction or a signal detected from the other side of an apartment wall, possibly resulting in people being asked to self-isolate who don’t need to. Issues could also arise if those who have been exposed cannot access coronavirus tests, or if the self-quarantines of those who receive alerts about their exposure are not enforced. There is also the possibility that users’ phones or the database holding the coronavirus test results could be hacked.
Location Tracking
Smartphone users are constantly sharing their location information, often unknowingly, through apps. That data can be shared with advertisers, data collection companies and other third-party groups.
And it is now being harnessed to understand how well Americans are complying with “stay-at-home” orders.
In early April, Tennessee Gov. Bill Lee said he looked at a movement map from a data collection company called Unacast to help make his decision to issue a “stay-at-home” order since he saw movements around the state remained at “pre-COVID-19” levels.
Google has also started sharing public county and state “community mobility reports,” which show how people’s movements among grocery stores, parks, workplaces and residential homes have increased or reduced, compared with their normal baseline movements. Apple just released a similar initiative.
These companies say they protect user privacy by keeping information aggregated and anonymous.
Laperruque said as long as data stays aggregated, or combined and sorted into groups, he thinks it can provide valuable information, but it must be summarized to ensure the information remains anonymous. If reports started including certain features, such as addresses or neighborhoods, it could make identities “pretty easy” to figure out, he said.
Indeed, research studies and a 2019 New York Times investigation have shown that it can be relatively simple to identify individuals from anonymized data.
Symptom Tracking
Another type of data sharing aims to crowdsource COVID-19 symptoms and pinpoint ongoing and emerging hot-spots.
The COVID Symptom Tracker, for example, is a mobile app created by researchers at Harvard with data firm Zoe and Kings College London.
After downloading the app, users give their ZIP code, age, gender at birth, height, weight and general questions about health, then check in every day. If they feel fine, it’s a 10-second effort. If they’re feeling unwell, they note what symptoms they are experiencing. Rolled out initially in parts of the United Kingdom, where it now has more than 2 million users, the COVID Symptom Tracker launched in the U.S. the first week of April.
One of the app’s creators, Andrew Chan, a professor of immunology and infectious diseases at the Harvard T.H. Chan School of Public Health, said they have no intention of ever commercializing the data, and it is aggregated and anonymized.
The group plans to share information with other researchers, some of whom aim to launch similar trackers. New York City also created its own tracker, a website that asks users to self-report symptoms, COVID-19 diagnoses and quarantine statuses.
Questions remain, however, about how useful such data will be. It depends on how many people sign up and how accurate they are in reporting.
Even if something is opt-in, privacy advocate David Carroll, an associate professor at the New School in New York, recommended that anyone who wants to use it first read the privacy policy carefully. Those that follow European or California privacy rules are providing the most protection.
“It’s still the wild West.” he said. “You have to do your work and read your policies and try to make sense of them. I read the policy of the NYC tracker. It was pretty clear, but I didn’t see enough information about how long the data will be held.”
Weighing The Trade-Offs
To be sure, there could be benefits of sharing data via our mobile phones.
Public health officials may be better equipped to track who has the coronavirus and warn those who have been in contact so they can self-isolate. State and local governments can understand whether stay-at-home orders are working. And researchers may be able to pinpoint emerging hot spots.
But, privacy experts say these measures should be taken only if responsible consumer protection policies are put in place: obtaining clear consent from users, ensuring public presentation of data remains anonymous and implementing limits on what data is gathered and how long it is held.
Many also note that after this crisis ends, it will be a struggle to recover the protections set aside.
“We will have overcompensated, and we should plan for that,” Carroll said.