White Paper 22 Digital Tools for COVID-19 Contact Tracing: Identifying and Mitigating the Equity, Privacy, and Civil Liberties Concerns
Total Page:16
File Type:pdf, Size:1020Kb
COVID-19 Rapid Response Impact Initiative | White Paper 22 Digital Tools for COVID-19 Contact Tracing: Identifying and Mitigating the Equity, Privacy, and Civil Liberties Concerns July 2, 2020 Koustubh “K.J.” Bagchi1 Christine Bannan2 Sharon Bradford Franklin3 Heather Hurlburt4 Lauren Sarkesian5 Ross Schulman6 Joshua Stager7 Abstract Many state governments and public health authorities in the United States are turning to digital tools to assist contact tracing efforts in response to the coronavirus pandemic despite equity, privacy, and civil liberties concerns. The digital divide, pronounced lack of trust in government among certain com- munities, and privacy risks posed by collecting personal data at scale make effective deployment of digital contact tracing tools challenging. But if governments decide they need to supplement manual contact tracing due to capacity issues, digital tools that use exclusively Bluetooth-based technology may be useful, as long as public health authorities implement proper safeguards. This paper outlines the equity, privacy, and civil liberties risks posed by digital tools as well as safeguards that policymak- ers can adopt to mitigate these concerns. Further, the paper recommends that policymakers take affirmative steps to address vulnerable populations that are unlikely to be reached by digital apps, partner with developers and community organizations, promote public education campaigns when deploying digital tools, take steps to close the digital divide, and pass comprehensive privacy legisla- tion with effective enforcement mechanisms. 1 Senior Policy Counsel, New America’s Open Technology Institute 2 Policy Counsel, New America’s Open Technology Institute 3 Policy Director, New America’s Open Technology Institute 4 Director, New Models of Policy Change, New America’s Political Reform Program 5 Senior Policy Counsel, New America’s Open Technology Institute 6 Senior Counsel & Senior Policy Technologist, New America’s Open Technology Institute 7 Senior Policy Counsel, New America’s Open Technology Institute 2 Edmond J. Safra Center for Ethics | COVID-19 White Paper 22 Table of Contents 01 Introduction 4 The Components of Contact Tracing 8 02 Traditional Contract Tracing Methods 8 and New Challenges What Digital Tools May Be Helpful 11 Equity and Effectiveness Issues 14 03 with Contact Tracing Effectiveness Issues in 14 Bluetooth Technology Biggest Hurdles: Public Trust and Equity 16 Issues which Impact Effectiveness Public Trust 16 Equity Issues 20 Privacy and Cybersecurity/DataSecurity 24 04 Threats from Contact Tracing Privacy Threats 24 Anonymization and Cybersecurity Issues 28 Recommendations 32 05 Recommendations for Policymakers 32 Recommendations for Platforms 39 and App Designers 06 Conclusion 43 References 44 07 3 Edmond J. Safra Center for Ethics | COVID-19 White Paper 22 Digital Tools for COVID-19 Contact Tracing 01 Introduction As states, counties, and foreign governments move to reopen society amid the ongoing coronavirus pandemic, most are relying upon models that center around testing and extensive contact tracing. The Safra Center’s “Roadmap to Pandemic Resilience,”8 released in April 2020, sets out a comprehensive approach to enabling society to reopen, based on testing, tracing, and supported isolation (TTSI). The contact tracing envisioned in the Roadmap involves a robust combination of traditional manual approaches and reliance on digital tools. Likewise, as state governments are now planning and imple- menting their reopenings, many are considering combined approaches that supplement manual tracing with digital tools. A number of Asian and European countries have also instituted such mixed systems in recent months. A variety of policy experts, technology companies, and public health officials have argued that digital tools may be able to expand the reach of traditional manual contact tracing systems and provide a rapid alert system that enables potentially exposed individuals to seek testing.9 While, as this pa- per describes, it is not clear that such tools can be effective given the scale and rapid spread of the coronavirus pandemic, we should consider how they might play a role in the United States’ pandemic response. This white paper aims to examine the equity, privacy, and civil liberties concerns raised by digital contact tracing tools, to outline safeguards that promise to mitigate these concerns, and where possible, to explain how to incorporate these safeguards. We recognize that traditional manual contact tracing techniques also present equity, privacy, and civil liberties issues. Traditional contact tracing requires the collection of personal medical and behavioral 8 Allen et al., “Roadmap to Pandemic Resilience: Massive Scale Testing, Tracing, and Supported Isolation (TTSI) as the Path to Pandemic Resilience for a Free Society.” 9 Simpson and Conner. “Digital Contact Tracing To Contain the Coronavirus”; Kahn and Johns Hopkins, Digital Contact Tracing for Pandemic Response: Ethics and Governance Guidance. https://ethics.harvard.edu/digital-tools-for-contact-tracing 4 Edmond J. Safra Center for Ethics | COVID-19 White Paper 22 Digital Tools for COVID-19 Contact Tracing Introduction information from infected individuals, and just as with digital data, this collected information is subject to risks of misuse and oversharing. For example, the Cook County Board of Commissioners passed a resolution—later vetoed by the Board’s president—that would have required the personal information of those who tested positive for COVID-19 be disclosed to law enforcement.10 Such a requirement would have severe implications for equity, privacy, and civil liberties. However, an extended discussion of the risks associated with manual contact tracing techniques is beyond the scope of this paper. This paper focuses on the issues presented by digital tools because they create novel and additional risks relative to traditional manual contact tracing. First, digital tools collect an exponentially greater volume of data, including data on vast numbers of individuals who are not infected and have not even been in contact with infected individuals. Manual contact tracing, by contrast, is limited to infected individuals and their contacts. Second, because public health agencies generally lack in-house technical expertise and capacity, digital tools are designed and operated by private companies in partnership with public health authorities, rather than by public health authorities directly. This creates questions about corporate access to data that do not arise in manual contact trac- ing. Third, the risk of data breach is much more significant: an attack could expose the data of millions of individuals. And finally, while law enforcement access is also a risk in manual systems, the volume and types of data collected by digital tools make these systems more attractive to law enforcement and more vulnerable to mission creep. Before seeking to outline a rights-protective approach to using digital tools for contact tracing, we must set forth some key principles that frame our analysis. First, when policymakers use big data solutions as part of pandemic response, they should follow the guidance of public health experts to determine 10 Yin, “Cook County Board President Toni Preckwinkle Vetoes ‘Extraordinarily Bad’ Plan to Share Coronavirus- Positive Addresses with First Responders.” 11 Amnesty International USA, “Contact Tracing App Exposed Sensitive Personal Details of over One Million.” https://ethics.harvard.edu/digital-tools-for-contact-tracing 5 Edmond J. Safra Center for Ethics | COVID-19 White Paper 22 Digital Tools for COVID-19 Contact Tracing Introduction what is necessary and efficacious in combating the virus. Technology is not the solution for every problem, and we must be guided by experts in epidemiology and public health in designing solutions that will work. Additionally, while effectiveness of contact tracing may come in degrees, three conditions should be met for a large-scale contact tracing system to be most effective. First, very widespread and accessible test- ing must be available, as laid out in the first pillar of the “Roadmap to Pandemic Resilience.” If people cannot easily get tested, tracing will be far from complete. Countries that have had some success with limiting the spread of the coronavirus (albeit with setbacks in the cases of Singapore and South Korea, and with invasive government surveillance approaches in China and South Korea) have first had wide- spread testing available. There is no model for successful COVID-19 containment that does not include an extensive testing regime. Although some states are making progress in developing testing capacity,12 it is not clear if or when the necessary level of testing will be available across the United States.13 Sec- ond, the structures to permit supported isolation—the third pillar of the Roadmap—must also be in place, so as not to create disincentives for individuals to either get tested or to participate in contact tracing ef- forts. These supports include job protection and income compensation, health care and family support, and protection for vulnerable communities reluctant to engage with the authorities. Third, global and U.S. experience suggests that contact tracing regimes are more effective when they are designed and implemented in partnership with vulnerable communities and those most impacted by the virus. Each of these conditions brings with it important equity concerns that cannot be ignored, especially