Protecting Public Health and Civil Liberties

By David K. Shipler

                The novel coronavirus is giving rise to novel surveillance tools. They can help contain the sweep of COVID-19, which is an urgent need, but the monitoring and categorization of citizens could also survive the pandemic with undue invasions of privacy. Legal safeguards are necessary to make sure that doesn’t happen.

                Innovative hardware and software, some rushed into production by profiteers, are aimed at recording and storing peoples’ physiological functions, locations, and immunity levels. As in any new technology, error rates are high, and the consequences of mistakes will be magnified if used to require quarantine or exclude non-immune people from jobs, housing, courthouses, and public transportation. Furthermore, unless information is automatically erased or sequestered, medical records could be combined in databases of extensive personal files accessible to law enforcement and immigration authorities.

The virtue of monitoring is self-evident during the crisis; less obvious are the longer term dangers of doing so. With no treatment or vaccine, self-quarantine and social distance are primary means of curtailing the spread. If people don’t know they’re sick—and neither do their fellow workers, diners, shoppers, passengers, theatergoers, sunbathers, gym users, and the like—the disease cannot be contained as public spaces reopen.

This is a matter of security, and as seen after 9/11, public acceptance of extraordinary measures soars in the moment, then persists long after the need abates. The Patriot Act, which Congress passed hastily in 2001, created exceptions to legal protections that had been enacted in the 1970s. Government agencies had been violating the Fourth Amendment by spying on antiwar campaigners, civil rights leaders, and other political activists. But it’s been nearly two decades since the 9/11 attacks, and Congress has applied only minor patches to the holes the Patriot Act tore in the fabric of civil liberties.

The same thing could happen now.
The COVID-19 pandemic has spurred particular interest in three areas of data collection: 1) temperature-taking before admitting people to certain places, 2) testing them for the virus and tracing their contacts, and 3) testing them for antibodies to issue “immunity passports,” a prospect raised by officials in the U.S., Germany, and the U.K.

                There are pluses and minuses in each of these areas, according to a series of carefully drawn white papers by the American Civil Liberties Union. They are sensibly balanced and worth summarizing. (Full disclosure: I donate to the ACLU.)

1) Temperature checks as a price of admission might pick up infected individuals, but also generate false positives and false negatives. Many with the virus don’t have a fever, and many who do, don’t have the virus. As Jay Stanley of the ACLU observes, skin temperature can be elevated by sunburn, exercise, menopause, cancer, and other non-COVID conditions. And readings from the skin are less accurate than core body temperature taken by oral, anal, or ear thermometers.

Furthermore, heat emanating from skin can’t be reliably determined unless the measuring device is repeatedly calibrated and held close to a person who stays still. Stand-off sensors and drones, which are being advertised as unobtrusive means of checking heart and breathing rates as well as temperature, do not work well when surveying groups of moving individuals, Stanley says. He notes that the Transportation Security Administration considered, then suspended, a plan called Project Hostile Intent designed to identify potential terrorists by checking temperatures, heart rates, eye movement, and facial movements. Something of the kind could be revived under the guise of COVID screening, which risks being what he calls “public health theater.”

2) Contact tracing by real human beings can work, but automated systems use cell phone locations that are imprecise. They also threaten privacy if their location logs are kept in a central database, according to Neema Singh Guliani, the ACLU’s senior legislative counsel. She urges that any such tools be voluntary and their use transparent. The information, already collected by some companies, can reveal where a person goes to church, shops, works, attends meetings, visits medical facilities, or has late-night visits with someone outside the home. The results can be so extensive that the Supreme Court ruled in 2018 that under the Fourth Amendment, police need a warrant first. But the Fourth Amendment generally applies only to government, not private companies.

Since the CDC recommends at least six-foot distances from someone who might be infected, most phone data are inadequate. Connections with cell towers can determine an area or a direction of movement but not a precise location. A phone’s GPS receiver can fix a position within six feet only with strong signals from multiple satellites; a more common margin of error is fifteen to fifty feet. Nor can signals usually be picked up inside, so it’s no good for contact tracing if you’re in a store, office, or theater.

China has begun using QR codes that citizens must scan with their phones to get into buses, taxis, subways, and some buildings. That tells authorities when someone enters but not who is close by unless combined with Wi-Fi and Bluetooth connections.

The most promising method so far appears to be the Exposure Notification API (application programming interface) developed by Apple and Google to allow state health authorities to offer people an app that would tell them if they came close to an infected person. Use is purely voluntary, according to Jason Cross, writing in Macworld. You would request the state’s app and could disable it at will. People testing positive would take the initiative to register through the app, but with no identifying information.

If you’re not ill and you sign up, and you get close to a virus carrier who’s also in the system, your Bluetooth connections will trigger a text giving the date and length of your encounter, but not its location. Cross reports that the information is anonymized—only a phone’s Bluetooth code, which changes every several minutes, would be uploaded to a database, with no personal identification. Once a person tests positive, she could authorize the disclosure of her proximity information from the previous fourteen days. Again, no names and no locations. Cross writes that three states so far—Alabama, South Carolina, and North Dakota—have decided to try the system. Others might prefer one that identifies participants so health authorities can follow up.

One flaw, the ACLU notes, is that safe contact might be flagged. Guliani reports that in Israel, where security services have used location data to enforce quarantines, a woman who merely waved at her infected boyfriend from the street was told to stay home. If Bluetooth penetrated walls, neighbors in an apartment building might be falsely alerted. So might drivers near pedestrians, although the Apple-Google system would report the duration’s brevity.  

This would work only with widespread enrollment. Yet about 40 percent of Americans over 65 and 30 percent of those earning under $30,000 a year do not have smartphones, Guliani says. And reliance on voluntary cooperation is both bad and good: bad because most people probably won’t participate, good because an alternative of “coercive health tactics often backfire,” she notes. Individualistic, anti-government impulses run strongly through American society. Witness those protesting stay-at-home orders.

Nevertheless, what seems voluntary can easily become required if landlords, employers, or government officials demand testing or enrollment before renting, hiring, or granting benefits. Current laws probably don’t prevent such compulsion.

3. Immunity Passports would be highly problematic for similar reasons. Esha Bhandari, an ACLU senior staff attorney, argues that since antibodies’ true level of protection from COVID-19 is not yet known, relying on positive tests could produce complacency, endangering both individuals and institutions.

Requiring an immunity certification for work might divide populations between the haves and have-nots—those with antibodies and those without. It could exacerbate racial disparities, Bhandari says, since low-wage employees in jobs that can’t be done at home are disproportionately black and Latino. The non-immune “might never be eligible for a given job short of contracting and surviving COVID-19 if an immune worker is available to take the slot.”

Therefore, immunity passports could also “create perverse incentives to contract COVID-19 for people who are the most economically insecure,” Bhandari argues. This is not as fanciful as it sounds. It happened in New Orleans during a yellow fever epidemic in 1847.  “Without immunity to yellow fever,” writes Sarah Zhang in The Atlantic, “newcomers would have difficulty finding a place to live, a job, a bank loan, and a wife. Employers were loath to train an employee who might succumb to an outbreak. Fathers were hesitant to marry their daughters to husbands who might die.” Slaves who had acquired immunity were worth 25 percent more, she says.

Finally, the ACLU worries—as it always does—that personal information collected in a good cause will be aggregated by corporations and government, in this case forming what Bhandari calls a “health surveillance infrastructure that endangers privacy rights.” Existing laws probably don’t prevent data sharing by private firms, so opportunities are legion for intense discrimination in work, housing, travel, immigration applications, and other areas.

A good deal of legislation is needed to channel data and set limits. Otherwise, once the pandemic passes, Jay Stanley argues, “routine and suspicionless collection” could make physiological surveillance the norm. “We don’t want to wake up to a post-COVID world where companies and government agencies think they can gather temperature or other health data about people whenever they want.”

Previously published by The Washington Monthly