Safety vs. privacy in the age of coronavirus raises tech questions

Contact tracing

In a rare coming together at the height of the pandemic, longtime arch-competitors Google and Apple unveiled a joint initiative to help track the coronavirus by installing a Bluetooth-based contact tracing platform in the firmware of iOS and Android devices. This opt-in program would enable iOS and Android users to receive notifications on their devices when they come into contact someone with the coronavirus.

Users would have to give their explicit consent to allow the platform to collect and use their data.

That initiative, made public April 10, will roll out in the coming months and will follow a release of APIs in May that will enable interoperability between Android and iOS devices using apps from public health organizations. It's unclear at this time what those apps would look like, however.

Google also earlier this month said it is opening its cache of digital records about people's whereabouts to government experts in 131 countries to help governments track the coronavirus. The records will show as aggregated statistics and will not contain any information about individuals' movements, the tech giant said.

In light of such tracking technologies and to protect privacy, tracing should follow certain guidelines, said Jena Valdetero, a data security and data privacy lawyer and a partner at Bryan Cave Leighton Paisner, a St. Louis law firm.

"The key to any type of tracing is to make it voluntary, have appropriate oversight to ensure that the data is protected and utilized only as disclosed, have security measures in place, such as encryption, to prevent a data breach, and to have an exit plan -- when this is all over (because it will end), we have to be able to destroy the data and ensure that it is not used for other purposes," Valdetero said.

Problems with tracing tech

Another problem with tracing is whether anonymization is possible, Valdetero continued. The more data that's collected, such as a person's age, gender or ZIP code, the more likely it is that data can be traced to a specific individual, especially in less populated areas.

Also, without enough volunteers, a voluntary contact tracing program may not work as intended, or it could have negative consequences. A participant could assume they haven't been around anyone with the coronavirus if they don't get an alert, but they may not have gotten an alert because others around them simply didn't sign up. That could give participants a false sense of security, Valdetero said.

"It will be important to let people know that the data is one useful tool in their COVID-fighting arsenal, but it isn't 100% determinative of whether they could have been exposed," she said.

Yet another concern is that the U.S. still has a problem with a lack of testing, Valdetero continued.

Contact tracing has to be viewed as one of a number of ways to keep yourself informed.

"You could have been near someone with COVID-19, but if the individual isn't able to confirm the diagnosis through testing, the information may be underreported," she said. "Conversely, if someone does get an alert that they were exposed to someone with COVID-19, that doesn't mean they contracted the virus."

Still, Valdetero continued, contact tracing will likely help inform people whether they should continue to self-isolate or not.

"The bottom line though is contact tracing has to be viewed as one of a number of ways to keep yourself informed so you can make the best decisions about avoiding possible exposure," she said.

Safety vs. privacy in Europe

While the Google-Apple initiative has been greeted fairly positively, it has also been met with some scrutiny. The EU, which pioneered enforceable data privacy regulations when it approved the GDPR in 2016, on April 15 published guidelines for developing and using contact tracing platforms.

The guidelines note the importance of tracing apps in the fight against the coronavirus, and highlight the work being done to create a tracing app by the Pan-European Privacy-Preserving Proximity Tracing consortium, a group of 130 scientists, technologists and experts from eight European countries.

The guidelines note that member states will seek clarification on the Google-Apple initiative to ensure it follows the EU's privacy regulations.

In addition, the EU appears to want a distinctly European approach to contract tracing and public health technology.

EU member states have begun creating and deploying their own health platforms. The Robert Koch Institute, a public health institute in Berlin, for example, partnered with Berlin-based health tech startup Thryve to create an app that uses smartwatch and fitness tracker data to predict if an individual is sick.

It's not contract tracing, strictly speaking, but the app requires users to opt in, and collects information on a person's sleep schedule, daily activity and heart rate to determine if they have a fever. Users are given a unique ID, rather than their name, which is sent to the Robert Koch Institute along with their health data.

Other countries, including Singapore, China and South Korea have launched tracing apps to varying degrees of success, while several other countries have discussed plans to launch tracing apps, including the U.K., France and Australia.

Singapore, which launched its TraceTogether contact tracing app in March, open sourced the app, enabling countries that want to implement similar programs to use TraceTogether's source code. So far, however, TraceTogether has had moderate success; it appears to work in areas where large numbers of people have the app, but so far, only around one in five people in the country have downloaded it.

While these types of government-developed applications may offer some success, initiatives based on the apps depend on people trusting their government.

Yet public trust in the U.S. government is low.

Meanwhile, contact tracing and government-led initiatives are just a few of the ways technology can help slow the spread of the coronavirus and try to keep people safe.

Visual identifiers

Kogniz, for example, a 2016 startup facial and visual pattern recognition software vendor, developed a camera-based approach to the coronavirus problem.

The vendor, which has offices in San Francisco and Montreal, sought a plan that would help them during the economic fallout of the coronavirus. Using its AI-powered visual detection platform, it created a hardware-based system on its platform that uses thermal cameras to detect fevers.

"For fever detection, this is going to be a long-term important piece of equipment," said Daniel Putterman, co-founder and co-CEO of Kogniz.

The AI-powered system, which Putterman said takes only minutes to install and set up, can detect a person's temperature. A person's temperature may vary based on the clothes they are wearing, the weather or other factors. So, a running histogram of temperatures, combined with machine learning, helps the system determine what a "normal" temperature is, and picks out outliers.

Users can program the system to alert security guards when it detects someone with a high temperature. In the near future, the system could be used to enforce social distancing rules by sending automated alerts when people appear too close to each other. 

The cameras can be permanent installations, said Putterman, adding that he believes temperature monitoring will remain in place even after the coronavirus pandemic has passed. Sales of the cameras have outpaced their current inventory, and customers have said they plan on using the cameras after the coronavirus crisis.

Marty Sprinzen, CEO of 2014 startup Vantiq, said he also thinks organizations will continue using thermal imaging to detect fevers after the pandemic has passed.

Vantiq, headquartered in Walnut Creek, Calif., sells an IoT platform that enables users to link their IoT devices and deploy AI-powered applications on them. The startup has seen an uptick in business as more customers use the platform to power thermal cameras to detect fevers.

"We don't sense [these use cases] will go away," Sprinzen said. "There will be other pandemics or other reasons to separate people and know what's going on."

For Putterman, the health benefits of using thermal imaging to detect fevers outweigh potential privacy violations.

"Is it acceptable for someone who is actively contagious and sick to walk into a building and infect a lot of people?" he asked rhetorically. Thermal imaging, he asserted, can help prevent that.

Some organizations now are taking people's temperatures manually before they enter the workplace, and most people do not seem to have objections to that. A camera-based approach is essentially the same thing, because it can detect people from a distance, Putterman said. And it's actually a safer approach, he argued, as it keeps personnel at a distance from potential disease carriers.

Yet, privacy advocates may disagree.

It's unclear how these types of technologies will hold up in court, and "companies considering using these products will want to evaluate laws regulating the use of biometrics," Valdetero said.

The California Consumer Privacy Act (CCPA), for example, requires disclosure of this type of data collection, as well as the purpose of the collection. Similarly, the Illinois Biometric Privacy Act requires informed consent in the collection of biometric data.

From a legal standpoint, it's arguable that "someone's temperature doesn't meet the definition of biometric information if it can't be used to identify an individual ... but these issues should be carefully evaluated," Valdetero said.

While strengthening safety in a time of crisis can require people to give up some privacy, for Forrester Research analyst Mike Gualtieri, "It is frightening to think how easily many people are willing to give up freedoms and privacy for real or perceived threats."

"Using thermal imaging to identify potentially sick people is an extension of another big privacy controversy -- facial recognition," Gualtieri said.

Privacy advocates in recent years have debated how facial recognition technology should, or shouldn't, be used. Increasingly, law enforcement agencies have turned to facial recognition platforms to identify criminals. Some of these technologies, notably the Clearview AI platform, can identify essentially anyone they run a scan on without their consent.

Governments, too, have used facial recognition technology to prevent crimes and even spy on their own citizens. China, for example, recently made it mandatory for anyone registering for a new SIM card to submit to a facial recognition scan. The country has hundreds of millions of cameras set up in its cities, schools, public buildings and event venues, and can use facial recognition technology on nearly anyone in those areas, all without consent.

Thermal imaging is one of many new approaches to detect the coronavirus and other viruses, Gualtieri noted. Researchers are working on an app that will analyze the sound of a person's cough to detect a disease as well, he added.

"If a sensor exists, researchers will figure out how to use it to profile people. Whether or not that is an invasion of privacy is on the eye of the beholder and ultimately laws that regulate what can and cannot be used," Gualtieri said.