Virus-tracking technology putting privacy at risk

The use of smartphones to trace contagious diseases poses dangers to privacy and civil liberties, contends the Electronic Frontier Foundation.

The group noted Apple and Google already have announced they will roll out in May joint application interfaces that will allow "proximity tracing."

The apps in iOS and Android will measure Bluetooth signal strength to determine whether two smartphones are close enough together for their users to transmit the virus.

EFF argued no such application can solve the crisis or make up for "shortages of effective treatment, personal protective equipment, and rapid testing, among other challenges."

Crises such as the coronavirus pandemic often have been used to create "exceptions to civil liberties protections [that] often persist much longer than the crisis itself," EFF pointed out.

If two people with the apps come close enough together, they exchange identifiers.

If either person is identified with COVID-19, the others who have been close to the person are notified.

While that is a valid goal, "there are many open questions," EFF said.

The organization contends the system would not be effective at a time like the present when there are so many cases of undiagnosed infection.

It might "in a time we hope is coming soon, when community transmission is low enough that the population can stop sheltering in place, and when there is sufficient testing to quickly and efficiently diagnose COVID-19 at scale," EFF said.

Among the issues is how accurate the system will be. Will it detect only when people actually meet each other, or will it also pick up people who merely pass by each other on a sidewalk. What about people on either side of a wall of an apartment building? And how about people in adjacent cars at a stoplight?

"We cannot solve a pandemic by coding the perfect app. Hard societal problems are not solved by magical technology, among other reasons because not everyone will have access to the necessary smartphones and infrastructure to make this work," the organization said.

Another danger would be the creation of a log of a user's proximity to others, EFF said. That could "be used to show who they associate with and infer what they were doing."

One requirement, the analysis said, should be "informed, voluntary, and opt-in consent."

"Individuals should also have the opportunity to turn off the proximity tracing app. Users who consent to some proximity tracking might not consent to other proximity tracking, for example, when they engage in particularly sensitive activities like visiting a medical provider, or engaging in political organizing. People can withhold this information from traditional contact tracing interviews with health workers, and digital contact tracing must not be more intrusive," the foundation said.

EFF said any tracking should provide for the "least possible information."

"The system should retain the information for the least possible amount of time, which likely is measured in days and weeks and not months. Public health officials should define the increment of time for which proximity data might be relevant to contact tracing. All data that is no longer relevant must be automatically deleted," it said.

There also would need to be a way to prevent unnecessary loss of privacy, ensure transparency and avoid bias.

And when the crisis ends, so should the monitoring, EFF said.

"Defining the end of the crisis will be a difficult question, so developers should ensure that users can opt out at any point."