FreedomWorks Foundation Content

Contact Tracing: Strict Guidelines Are Needed to Prevent a Civil Liberties Nightmare

As both the federal and states’ governments wrestle with what policies to use in addressing the coronavirus outbreak moving into the summer and beyond, one potential solution that has been touted as a key component of getting life here back to something like normal is “contact tracing.” In particular, governments and tech companies alike have become interested in digital solutions to track the spread of the virus in order to better contain it. However, depending upon how it is done, there are a number of concerns with how contact tracing – whether done in person or digitally – interacts with our basic rights to due process and civil liberties.

The basic concept of contact tracing is simply to ascertain who has been in close contact with someone who has tested positive for a disease in order to warn those contacts that they may have been exposed. Center for Disease Control and Prevention (CDC) guidelines set out to do this by training teams of people in all the states and territories to interview patients and conduct this sort of tracing in person, to check in with those potentially exposed to see if they, too, have become symptomatic. Obviously, this method is time and labor-intensive, relies on individuals’ cooperation and often-faulty memories, and is relatively intrusive in that it involves contact tracers calling or even visiting individuals in person to warn them that they may have been exposed to the virus.

A more efficient way to go about the same process is to leverage technology, using a ubiquitous tracking device that a majority of Americans already carry with them everywhere – their cell phone. There are many ways the government could go about this, many of them alarming. Recently, as part of the CARES Act, the CDC was given “no less than $500,000,000” in order to figure out how to implement “public health data surveillance and analytics infrastructure modernization.” There is talk of increasing that level of funding in the next episode of the seemingly endless coronavirus federal spending spree.

The obvious and easiest way to conduct contact tracing via cell phones is to use cell tower data or even Global Positioning System (GPS) data. How invasive this is depends on how it’s done. In Europe, privacy laws have restricted location tracking to anonymized bulk data that merely gives governments an idea of how many people are moving around as opposed to sheltering in place. This is a relatively innocuous sharing of data with limited potential for abuse, and Google has released similar data in the US.

On the other hand, there is the sort of contact tracing in countries like China, Taiwan, Israel, and South Korea, which is compulsory and incredibly intrusive. South Korea’s effort to stop the coronavirus’ spread has been hailed as particularly effective. Certainly, the way they were able to mass-deploy testing to figure out who had the disease was an example that makes our CDC’s botched testing process all the more galling. But South Korea’s contact tracing alert system has horrified many observers by broadcasting an incredible amount of detail about who is sick and everywhere they’ve been. Besides revealing a disturbing amount about the private lives of some of the afflicted, the alerts also imperiled any businesses they were listed as having visited, while also inundating some Koreans with alerts to the point of over-saturation.

Taiwan’s response went a step further, tagging people under quarantine orders with a geofence radius around their residence that they could be fined or arrested for being caught leaving. Israel’s citizens, too, were surprised by their cell phones being involuntarily turned into tracking devices for a mass surveillance program tracking anyone even suspected of being exposed to COVID-19, along with their contacts. The Israeli program has been tied up in litigation in the Israeli Supreme Court, as such a program hopefully would be here in the U.S.

Any government regime would have to pair this Orwellian level of tracking with an incredibly high volume of testing to hope to be effective in actually containing the disease. And even if made mandatory, such a system would depend upon a high level of voluntary cooperation with quarantine orders (which has been the case in South Korea and would doubtless be less the case here), and can be dodged to some extent by merely leaving your cell phone at home.

Aside from the obvious civil liberties concerns about such mass surveillance, GPS and cell site data are also flawed because they are only so accurate in terms of knowing exactly where you have been. Merely having been in the same building or general area as someone who was infected doesn’t mean you had the kind of close contact that would be necessary to predict your likelihood of exposure.

This is why Google and Apple have teamed up to propose a far more accurate method of digital contact tracing that they also believe will also better protect individual users’ privacy. They accomplish this by using your phone’s bluetooth signal to ping other devices around you, and if you spend enough time in proximity to someone else who is also using this tracking app and who later tests positive for COVID-19, you can be sent an alert that you’ve been exposed.

Privacy concerns aside, there are some security concerns with having your phone constantly reaching out to other devices via bluetooth, and some technology experts have raised concerns about the security of the data once collected as well. Nevertheless, if implemented transparently and with strong restrictions on how the data is shared, a bluetooth-centered approach could be both less intrusive as well as more accurate and useful to users than either using human contact-tracing teams or an unconstitutional mass surveillance program.

With these examples in mind, a few principles can be derived for what sort of contact tracing may be most compatible with Americans’ rights to due process, freedom of association, and civil liberties.

  1. Participation in contact tracing must be voluntary. People should not be mandated to download an app nor should personally identifiable data about them be made available by private companies to governments.
  2. Data provided for any contact tracing must be strongly anonymized and must be subject to data minimization. In other words, the government should not be able to tell who you are within a given data set, and should have to delete contact tracing data after the shortest reasonable period of time.
  3. Law enforcement should not have access to contact tracing data. The response to this disease should not be a police action, and the data should not be allowed to be used for any other purpose besides advancing scientific understanding of the disease spread, notifying individuals of possible exposure, and helping to more efficiently allocate medical resources where the outbreak is most active.
  4. Any such programs must have a defined end date tied strictly to the present coronavirus outbreak.

In other words, any large-scale contact tracing, paired with much more robust testing for both positive disease cases and antibodies, needs to be focused on increasing our knowledge and combating the disease, not fighting against the people and restricting liberties. Unless it is imposed as a mandatory regime like under an authoritarian government such as China, contact tracing is only as useful as people are cooperative. Tie contact tracing to a hostile quarantine enforcement effort, and you will only see low levels of participation and a large increase in resistance to voluntary quarantine and social distancing.

And especially as we continue to fight to reform a national security surveillance apparatus that has been used lawlessly and unconstitutionally to collect the data and communications of millions of Americans without any due process, any collection or sharing of our location or other private data that can be identified to specific individuals only sets a precedent for further such abuses in the future.