In order to familiarize Russian-speaking libertarians with English-language libertarian discourse, we intend to occasionally post translations of articles from major libertarian websites. Today, we present for your attention an article about contact tracing apps, which have become a challenge to privacy due to the pandemic.
The pandemic provided governments with a pretext to justify the mass collection of geolocation data.
Many academics, entrepreneurs, and governments claim that new technologies are a critical part of the fight against the coronavirus pandemic. They argue that by using the latest tracking methods to obtain information, people will be able to easily check whether they have come into contact with identified COVID-19 carriers.
Contact Tracing Apps
Two models for such apps are proposed. The first model involves the collection and processing of a person’s location information by governments. Such proposals were met with a barrage of criticism from privacy and consumer rights groups, as they involve unprecedented total surveillance. Given that many tech companies already provide such services to their governments—YouTube, for example, blocks any information contradicting WHO statements—these fears seem quite real.
The second model is the collection and processing of information about movements and contacts directly on users’ devices. This decentralized form of data collection has received broad academic support because, in theory, it would allow for contact tracing without giving companies and governments real-time access to data on citizens’ movements and habits.
But even this decentralized data collection scheme raises many questions. Even with the development of a legal framework for privacy protection—which currently simply does not exist—the level of public awareness regarding information protection makes these apps extremely dangerous.
In this article, we will examine how contact tracing apps are developed and why they pose a threat.
Centralization or Decentralization?
Let us first note that some contact tracing apps implemented by governments outside Europe and the US are a serious problem. The Israeli government recently passed a law giving its security services the right to access the personal data of all users, as well as allowing the centralized storage of the obtained information. South Korea and China have done the same.
The danger of involving governments in the collection of such data is noted by many personal data protection organizations in Europe and the US. Despite this, the governments of these countries believe that such apps are necessary, also because these governments themselves were unable to develop contact tracing apps on their own.
It is intended that contact tracing apps will be developed according to a decentralized model. In theory, the user’s phone will store data about contacts with COVID-19 owners itself and exchange data with other devices. Information will not be transmitted to centralized cloud storage, and even the companies developing the apps will not have access to users’ personal data or their location.
This model was proposed by companies such as Apple and Google, the PACT project from MIT [Massachusetts Institute of Technology], and many European groups. Most proposals include Bluetooth technology, which will notify the user if there is another user nearby who has been in contact with the virus.
(Missing) Legal Framework
At first glance, apps with a decentralized data collection model are flawless in protecting users from surveillance. They are built on a policy of individual responsibility, comparable to the policy of the Swedish government, which proved its effectiveness despite non-interference in the private lives of citizens.
However, two unresolved problems remain with decentralized contact tracing apps. First, there is currently no legal framework to protect users of these apps from surveillance. Second, even if such a framework were created, any data from smartphones could be stolen by hackers or security services.
To start, let’s consider the legal aspect of the issue. In our article on the legality of such apps, we already pointed out that the lawfulness of such a form of mass surveillance is questionable at best. With the increasing instances of internet censorship, there is a possibility that governments will use such apps to create databases of users and track them.
But the questions related to contact tracing apps—centralized or not—are much deeper. It is unclear even if these apps will fulfill their original function. For these apps to be effective, people would need to be required to install and use them. Otherwise, an infected user could simply delete the app, which undermines the effectiveness of the entire system. Giving governments the right to impose the use of a specific app on citizens would be an unprecedented and extremely dangerous step.
Privacy and Security
Even with the most thoughtfully designed legal framework for such apps, even if it truly protects the user’s personal data, these apps will still pose a threat. Companies are making great efforts to increase cybersecurity, especially now that many are working remotely, and are surprised to find that their employees know very little or nothing at all about cybersecurity. This means that any data obtained through contact tracing apps—even if stored on the user’s smartphone—is very vulnerable.
And this circumstance, of course, is taken into account by existing data privacy legislation. The European GDPR [General Data Protection Regulation]—widely accepted as the gold standard when it comes to data protection—unequivocally states that data privacy cannot be achieved without information security. This is intended to be achieved through a simple rule: companies cannot collect data they do not need. In other words, the best thing that can be done for the safety of user data is not to collect it at all.
In the context of contact tracing, this means that even if user data on contacts and location is stored on the user’s smartphone—rather than in a centralized accounting system—no one guarantees its safety. This data can be stolen, or national security and surveillance services may gain access to it. Research also proves that even when users try to secure their data, their attempts may only undermine their information security.
On the other hand, a counterargument naturally arises that many apps already collect geolocation data and one more app cannot become critical for privacy. However, the most important difference of such new apps is that they collect data about the user’s contacts. This data could be used by law enforcement agencies to obtain information about citizens’ movements in real time.
The Future
There is no need to pretend that these are new problems that we have never encountered. Activists , defending privacy, have been talking about the illegitimacy of mass surveillance for over ten years. The pandemic only gave governments a pretext to justify the mass collection of geolocation data. As we have already pointed out, there are currently no technologies capable of collecting this data without violating the fundamental human right to privacy. There are no legal acts that regulate the use of contact tracing apps. Even if there were, the insecurity of data on most smartphones makes this data extremely vulnerable to theft or legal requests from law enforcement agencies.
It is important that later, after the pandemic, we remember the lessons of the present. We must, of course, rebuild our economic policy, which made the world so vulnerable to COVID-19. But we must also use this opportunity to challenge the level of surveillance that has become possible in our new digital world.
It all comes down to the fact that we must make technology serve those who use it, rather than as a tool for building a “surveillance economy” that is so rapidly enslaving our society. And resistance to tracking apps is only the beginning of this struggle.
Original text: Sia Mohajer, Contact Tracing: Laying the Foundation for Real-Time Social Tracking, June 1, 2020, FEE Foundation for Economic Education