Off

contact tracing, COVID-19, disease detectives, pandemic

Thousands of amateur sleuths – and expanded digital surveillance – are being deployed to contain the pandemic, raising concerns over privacy, liability, security and effectiveness.

Bipartisan public health experts estimate 180,000 contact tracers will be needed to contain the coronavirus pandemic in the U.S., forming a scattered corps of disease detectives larger than the NYPD, LAPD, FBI, DEA and CIA combined. Contact tracers try to prevent new outbreaks by identifying anyone exposed to an infected person, so they can promptly be tested and, if necessary, quarantined.

Contact tracing remains unfamiliar to most people outside the field of public health, and its rapid rollout has raised concerns over personal privacy, employee rights, financial liability, data security and corporate surveillance. Critical questions remain unanswered on whether, and how, contact tracing will actually work under current conditions in the U.S.

Traditional Methods for Contact Tracing

As a professional investigator, I know the new jobs awaiting the “army of tracers” being mustered in New York and 1,000 tracers in Massachusetts will involve deep dives into sensitive data and careful compliance with privacy laws. Their work will also require persuading people to answer difficult questions under adverse circumstances. This kind of “elicitation” process is central to traditional contact tracing models promoted by the U.S. Centers for Disease Control and Prevention (CDC) for state-level task forces of community health workers and volunteers.

Interview-based contact tracing has been used for decades to contain sexually transmitted infections like HIV and syphilis, but this model may be poorly suited to the speed and scale of the coronavirus pandemic. STI carriers can be reasonably expected to recall the names of their romantic partners, but once social distancing rules are relaxed and local economies revive, how is anyone supposed to identify every stranger who passed within coughing distance over the past two weeks? Moreover, critically ill patients intubated in ICUs – and isolated cases who succumb at home – will obviously not be available for interviews.

“Interview-based contact tracing has been used for decades to contain sexually transmitted infections like HIV and syphilis, but this model may be poorly suited to the speed and scale of the coronavirus pandemic.”

Deploying teams of contact tracers makes sense in New Zealand, where the virus has been nearly eliminated through nationwide lockdown, and their work can focus on isolated new outbreaks. This strategy worked in Wuhan after the city had been sealed off. But in the U.S., where until recently fewer than 8,000 contact tracers were employed by state agencies, the latest projections from the White House suggest the U.S. could be facing 200,000 new coronavirus cases per day by the end of May. That would be an overwhelming caseload for investigators, particularly for a corps of new recruits, trainees and volunteers.

Digital Tools and Privacy Rules

Digital solutions for disease tracing and containment were piloted with success in South Korea, where virtual roadmaps of ill patients are drawn from external sources such as credit card activity, cellphone GPS data and CCTV security cameras. Pervasive state-sponsored electronic surveillance would be impossible to reproduce under U.S. privacy protections, as observed in a report by the Center for Health Security at Johns Hopkins.

Yet it was with a promise to preserve privacy that Apple and Google announced their joint Bluetooth-enabled Exposure Notification framework that will be integrated into operating systems for iPhone and Android smartphones. A beta version of this application programming interface, or API, was recently released to allow developers to begin building apps for people to voluntarily report a positive diagnosis of COVID-19 to public health authorities. Contact-tracing apps will send automated alerts to other users who crossed paths with a sick person, notifying them of potential exposure.

Phone alerts will be “anonymous” to the extent that the infected person is not named. However, an infected person may be readily identifiable to others who receive a notification, particularly if several people within the same organization receive an alert. How long will it take a human resources department, for example, to determine who was in the conference room at 9:30AM on Monday?

A mass-communication platform transmitting an individual’s health information to unauthorized third parties may violate healthcare regulations under the HIPAA Privacy Rule or state privacy laws. The federal government could suspend the provisions of HIPAA as it did after Hurricane Harvey in 2017, and states could create public health crisis exceptions under their privacy laws, but that will not dispel concerns about user confidentiality, data security, false positives, Russian trolls, malicious hoaxes and finger pointing.

“For Bluetooth-based tracing to be truly effective nationwide, a majority of people – more than 150 million in the U.S. – will need to actively use the technology.”

For Bluetooth-based tracing to be truly effective nationwide, a majority of people – more than 150 million in the U.S. – will need to actively use the technology. People who are already protesting or flouting social distancing rules may refuse to participate. Desperate workers who can’t afford to be re-quarantined will not want to receive automatic alerts if they trigger furloughs or job losses. Undocumented immigrants will be reluctant to expose their extended families to 24/7 monitoring. Other people may opt out from voluntary disclosure due to liability concerns, particularly if courts begin to fill with a tidal wave of pandemic torts, or if contact tracing data becomes a prosecutorial tool by government agencies.

Regardless of whether they download a tracing app, most people’s day-to-day locations and activities are already being tracked by cellular providers, app developers, social media platforms and financial institutions that collect and resell their personal data. This data is routinely made available to third-parties for targeted advertising. Conspicuously, there has been no call to share this highly profitable information with disease detectives.