Cellphone-Tracking Can Help Fight the Pandemic Only If Governments Resist Their Snoopy Instincts

Contact tracing might offer hope for slowing the spread of the pandemic—or fulfill every Big Brother-ish fear privacy advocates have ever raised.

In the battle against COVID-19, public health types desperately want the ability to track people's movements to test the effectiveness of social-distancing commandments and also to trace contacts between people who carry the disease and members of the public they may have inadvertently infected. Understandably in our device-crazed age, attention has turned to cellphones, those location beacons that most of us voluntarily carry.

Properly implemented, cellphone tracking might offer hope for slowing the spread of the pandemic. Improperly implemented—as has already happened—such monitoring promises to fulfill every Big Brother-ish fear privacy advocates have ever raised.

"When California officials wanted to see how closely people were following social distancing guidelines last month, they tapped a powerful new data set—a map that Facebook provided to state authorities derived from the location coordinates of tens of millions of smartphones," The Washington Post reported last week. "The map showed with alarming clarity that large numbers of people were still gathering on beaches and in public parks. Soon after, Gov. Gavin Newsom (D) ordered them closed to vehicles, sharply restricting access."

With its combination of the use of location data—however anonymous—shared without people's permission, and a resulting restrictive and likely counter-productive crackdown on the ability to escape to the healthy outdoors, the California case manages to be thoroughly creepy without any benefit.

South Korea's government at least manages to be creepy to some seemingly good end.

"South Korea quickly implemented legislation that would allow health officials to aggressively trace the footsteps of citizens who test positive for an emerging infectious disease. Using security camera footage, credit-card records, GPS data from cellphones and car navigation systems, they are able to pinpoint exactly where a person has been," notes MarketWatch.

South Koreans can also download apps that tap into government tracking data to get details on any infected people in their vicinity. The system is very intrusive, but arguably helps people reduce the risk of getting sick.

China cranked the creepy factor up to 11 by requiring people to use apps that monitor their movements, assess their supposed risk of infection, and then present the results as a color-coded QR code that has to be shown to authorities on request. "A green code shows the user is not under quarantine and can move around the city freely, but those with yellow and red codes need to quarantine themselves at home or undergo supervised quarantine respectively," according to the South China Morning Post.

Reports of privacy breaches, erroneous results, and an opaque appeals process were inevitable from any government-imposed system. They were especially unsurprising under an authoritarian regime.

Aware of earlier flaws and privacy invasions, public health scientists and their allies in the tech industry are pushing for contact-tracing that would be, well, less horrifying than what has gone before. Apple and Google are working together on a decentralized system that would use Bluetooth and pseudonyms to preserve privacy while alerting users to encounters with people likely to have the virus.

That sounds like a promising approach if it lives up to its billing. But already the tech companies are running up against resistance from French authorities, who want to preserve privacy between private citizens but allow governments to know people's identities.

European governments, overall, prefer systems they are developing themselves which are intentionally centralized and do away with anonymity.

"The Pan-European Privacy-Preserving Proximity Tracing system, or PEPP-PT, is supported by German authorities and French institutions," reports Slate. "Where the decentralized approaches propose to generate pseudonyms on your phone, the PEPP-PT protocols generate your pseudonyms on a centralized server. This server will be able to link each pseudonym back to your real identity. Worse: If you're diagnosed positive, your phone will not simply upload the list of its own pseudonyms; it will also upload the identifiers of every person you've come into contact with so the authorities can track them down and notify them directly."

A system that nosy and centralized might be a hard sell to populations that have grown increasingly disenchanted with the powers-that be in recent years. The Chinese government has been able to strongarm much of its population into downloading and using tracking apps (though not without significant pushback), but few other governments have the clout to make that happen. Interestingly, even the de facto one-party regime in Singapore, which enjoys high levels of public trust, hasn't been able to get people to adopt its TraceTogether tracking app.

"More than a million users, or about one in five people here, have downloaded TraceTogether," the Straits Times of Singapore reveals. But "in order for TraceTogether to be effective, Singapore needs about three-quarters of the population to have it."

Privacy concerns play a major role in resistance to adopting the app. "I have no idea what kind of data is being taken away from me," one Singapore resident told the Wall Street Journal.

Imagine the reactions French and German officials will run into with apps explicitly designed to bypass privacy protections in countries where the population generally doesn't trust the state.

And, unless people are going to be forced to use these apps, public cooperation will be necessary for any tracking effort aimed at fighting the pandemic. To get that cooperation, people will have to be persuaded of the benefits to be had—most especially from contact-tracing (there's no reason to try to salvage California's "too many people are walking around in public" approach). And they'll need to be able to trust assurances that their privacy is protected.

If that's not forthcoming, cellphone users can sabotage most of these tracking efforts pretty easily. Turning off Bluetooth would hobble just about all the contract-tracing apps. Disabling location services and WiFi would do that much more to shield users' whereabouts.

In China, where tracking apps are mandatory, people have taken to installing anti-spying software and to owning two phones—one with tracking software to show the police and the other for sensitive travel and unapproved uses.

There are sophisticated tracking techniques that might allow the authorities to bypass the permissions we give to apps on our cellphones, but those are more appropriate for monitoring specific targets than for contact tracing. If their use becomes widespread, the most appropriate reaction might be to shut our phones off or learn, once again, to live without them.

The burden is on public health authorities to convince us that, by working with them, the new COVID-19 pandemic can be battled without making ourselves vulnerable to the ancient pestilence of official nosiness.