Governments, scientists, and product designers are racing to find technological fixes for the spread of COVID-19. Some of these solutions — such as more efficient mass-production of masks, more accurate and prevalent testing, and efforts to create a vaccine — are valid and vital, and defend the health of citizens and strength of society without violating civil liberties. Masks can arguably even help promote freedom by disguising protestors and flustering increasingly prevalent public facial recognition cameras. And there are other key antiviral tactics that don't rely on cutting-edge technology: handwashing, social distancing, and contact tracing.
Contact tracing is the important practice of interviewing the sick to find out who they've met in recent days, so that health authorities can warn them, so they can take proper precautions, isolate themselves, and seek medical help if necessary. It is a resource-intensive practice, requiring tens of thousands of human "contact tracers" for large populations. Silicon Valley has clamored that there must be ways to automate this process. At least two dozen governments are already experimenting with or rolling out contact tracing phone apps.
Academics have provided ammunition for this approach, recently stating in Science that "controlling the epidemic by manual contact tracing is infeasible. The use of a contact tracing app... would be sufficient to stop the epidemic if used by enough people." Regardless of rationale, the immediate, often unsaid problem is that phone contact tracing is not accurate enough for medical use, and trying to implement this strategy will expose individuals and authorities to false positives and false negatives and bring false confidence. The bigger problem is that the promotion of phone contact tracing will help normalize mass surveillance and further erode our already endangered civil liberties.
There are two main approaches to phone contact tracing. The first is a centralized approach where citizens either don't know they're being tracked or trust authority figures with their location and health data. Dictatorships tend to rely on the former, but even democratic governments like South Korea and Taiwan are "waiving" the rights of citizens in the name of public health and pursuing aggressive surveillance schemes. Meanwhile, in Norway, authorities are experimenting with a contact tracing app that directly presents citizen movements to the government. A big problem with this approach is its inaccuracy: Tracking someone by their cellphone location is only accurate within 10 — 50 meters, far outside the accuracy needed to see if you've come close enough to a carrier to warrant concern.
A second approach, marketed as more accurate and privacy-preserving, is being promoted most notably by Google and Apple, and relies on Bluetooth Low Energy instead of the GPS or cell tower triangulation traditionally employed by centralized surveillance systems. As Sam Biddle writes, the hope is to "turn billions of Bluetooth-enabled devices into an army of public health automatons that can map anyone who came into contact with someone who tests positive."
In theory, a Bluetooth-powered COVID-19 app will broadcast digital "handshakes" on an ongoing basis with any other phones that come close. As you commute to work or walk through a city, your phone makes "handshakes" with any other phones crossing your path. If, later, you find out you are COVID-19 positive, you would tell your app, and anyone who came close to you over the past few days would get a message on their phone, warning of possible exposure. This kind of Bluetooth location tracking is more precise than traditional GPS or cell tower tracking, potentially accurate to around two meters, and can even work indoors. Google and Apple intend to push this kind of system out to Androids and iPhones in the near future. They've re-branded the concept, changing the name from the vaguely threatening "digital contact tracing" to a more acceptable "exposure tracking." Tech media have heralded this as "potentially a huge step forward in the fight against COVID-19."
In practice, however, Bluetooth exposure tracking is so fundamentally flawed that it amounts to little more than security theater. The virus has hit hardest in densely-populated areas like New York City, Milan, and Wuhan. How will your phone know that the handshake it just received was from someone sitting two meters next to you, and not the person sitting two meters away from you through a wall in a next-door cafe? Or that it was the person on a bus sitting near you on the upper level but not the person sitting underneath you? Sabotage will also be difficult to prevent, since someone could tell the app they are sick when they aren't, triggering a wave of false exposure notifications and mass panic. Signal creator Moxie Marlinspike has pointed out that even this more decentralized kind of system may enable new adtech and location tracking intrusions, and the actual inventors of Bluetooth have voiced concerns that the technology is not actually as accurate as some have claimed, opening the door for additional uncertainty.
Since virtually all smartphones run on Android or iOS, more than one-third of the world's population could end up in Apple and Google's tracking system. And yet, as of today, few, if any, independent studies prove with evidence that phone contact tracing has, all things being equal, been a significant factor in stopping COVID-19. In Taiwan, public health authorities have said that their mass surveillance strategy combining cellphone location data with user health data was only useful in one case. In Israel, the government recently announced it would stop using phone tracking to monitor quarantined individuals after it wasn't useful. In Singapore, a city-state often praised for its technological prowess, the government revealed even in its own propaganda that phone contact tracing is meant to be at best a supplement for traditional contact tracing, and not a replacement. Meanwhile, their omnipresent mass surveillance system has failed to stop an ongoing breakout.
Most surprisingly, just a few days ago, Taiwanese experts published a paper about the mass surveillance employed in the country in early February after the Diamond Princess ship docked in Taiwan. The government exploited data from telecommunications companies, payment processors, and transit organizations to spy on the whereabouts of more than 620,000 people who might have been exposed to the ship passengers. Despite all this, not a single person in this massive sample size was diagnosed with COVID-19, and yet all of them lost their civil liberties.
Despite a lack of proven effectiveness, governments in places like Britain and Australia seem to be zeroing in on a centralized solution that pushes privacy concerns to the side, where citizens will simply give up their data to the authorities in an exchange of privacy for promised improvements in public health. Controversial spyware companies like NSO Group are already advertising new "pandemic" services for regimes desiring a better way to track their population. A recent briefing in the Economist concludes that authorities would only be able to get the accuracy they need to stop COVID-19 by mixing Bluetooth tracking with location data, CCTV data, and communications data — defeating the privacy-preserving approaches in the first place with an omnipotent panopticon.
Regardless of whether a government opts for a centralized phone tracing approach or a more decentralized Bluetooth app strategy, both have major flaws and there is a strong possibility that the tracking doesn't end once COVID-19 dies down. Google and Apple have promised to stop their systems as soon as the pandemic is over. But as the old Soviet saying goes, nothing is more permanent than a temporary measure.
We must also grapple with the fact that the government with the most intense citizen surveillance system in history — the Chinese Communist Party (CCP) — couldn't, despite all the Orwellian tech in the world, prevent an outbreak, untold deaths, and economic devastation. In fact, the CCP knew about the danger of the COVID-19 outbreak by late December, but instead of using its enormous spy powers to quash the virus, it decided to try and cover up the outbreak, censor medical reports, and hide evidence. Local officials even ordered the destruction of novel coronavirus samples and arrested whistleblower doctors who spoke up about the danger of the emerging virus. The CCP could have implemented "pandemic tech" on December 31st, but instead, they chose to keep quiet about the outbreak until January 23rd, when they finally locked down Wuhan. By then, seven million people had already left the area and spread throughout China and the world. Phone contact tracing couldn't stop the pandemic.
After finally turning to iron-fisted mass lockdowns to try and stop the advance of the virus, Xi Jinping has now spotted an opportunity. As citizens get "back to normal" in areas like Hubei Province, they can't go to work or enter markets or ride public transportation without displaying a particular color on their mobile phone: red, yellow, or green. With a green, you're good to go. Otherwise, you're out of luck. These systems aren't biometric, as your status is given to you by an authority or an algorithm. Many are confused about why they are labeled a particular color. One can quickly imagine how these new powers of classification and control will be abused. This is where the slippery slope of using mass surveillance in the name of public health ends: the color coding of citizens.
Some have downplayed the Big Brother threat, suggesting that concerns over creeping authoritarianism are overblown. This is a dangerous dismissal. Today, according to data from the Human Rights Foundation, 4.2 billion people — 53 percent of the world's population — suffer under authoritarian regimes in 95 countries. And even in the heart of Europe, "creeping authoritarianism" in the name of public health is real. Viktor Orbán has used the COVID-19 pandemic to begin rule by decree, and so, 10 million EU citizens are now living under the dictionary definition of dictatorship.
A culture war over privacy looms. The Overton window on mass surveillance is shifting in front of our eyes. What was once unthinkable has become, overnight, not only acceptable but even sensible and popular. Privacy is a bedrock civil liberty, an essential component of a free society, and a factor that works hand-in-hand with the free flow of information and constitutional checks against government power to fend off tyranny. And will the Bluetooth tracking infrastructure implanted by Apple and Google into billions of phones simply go away? In China, banners proclaim, "Green code, travel freely. Red or yellow, report immediately." This could be your society too, if we aren't careful.
Surveillance erodes civil liberties, and ultimately, damages open societies. Some of our best tools to fight viral outbreaks like COVID-19 are the free flow of information, collaboration, innovation, and decentralized responses that don't require permission from a central authority. The Economist ran a study looking at the past 60 years of data, ranging from Ebola to Zika to smallpox, showing that over time, democracies performed significantly better than authoritarian regimes against epidemics. Which makes sense: It's hard to fight a virus in a climate of fear.
If we give into the idea that we need to go the authoritarian way to protect public health, we head down a centralized road that leads to color coding and social engineering. So before you get too excited about defeating COVID-19 with phone tracking apps and mass surveillance, ask yourself: Do we need them and will they work?
The answer is no. We don't need a police state to fight the virus.
Alex Gladstein is chief strategy officer at the Human Rights Foundation, a non-profit that supports civil liberties in authoritarian societies. You can follow him on Twitter @gladstein.
Comment: As John W. Rutherford states "this is just another wolf in sheep's clothing, a "show me your papers" scheme disguised as a means of fighting a virus. It lays the groundwork for a society in which you are required to identify yourself at any time to any government worker who demands it for any reason."
The Worst is Yet to Come: Contact Tracing, Immunity Cards and Mass Testing