Infosecurity Magazine: COVID-19, Geo Tracking, and Privacy – Where to Draw the Line?

How much is privacy worth to you? The typical answer, in typical times, is probably “a whole lot.” You have spent a great deal of time and effort ensuring that your organization rigorously adheres to the relevant privacy regulations.

Moreover, you’ve done everything in your power to establish a thriving data privacy program, but you’ve likely noticed that these aren’t “typical times” and there are no typical answers.

Tracking in the Shadow of COVID-19 With the threat of COVID-19, or Coronavirus, hanging like a black cloud over the entire globe, countries are grappling to find ways to stem the tide and to keep their citizens safe. Amid national lockdowns and growing fear, governments are looking towards curbing the spread of the virus with unconventional means. One of the most promising means being explored is geo-tracking people carrying the virus and even those potentially carrying it.

Using geo-tracking to stop the spread of viruses is nothing new. In 2011, developers at Cambridge University developed an app called FluPhone which allowed people to measure the spread of influenza.

Basically, the way it worked is if you were using the app and you had lunch with someone who later got sick, for example, FluPhone would let you know. Besides slowing the spread of the flu, the app helped health authorities, monitor and model, its spread. Though the app never went viral, its potential power was evident.

China, Taiwan, and Israel? Fast forward to 2020. With an unfamiliar illness taking hold, Chinese authorities began implementing strict measures with the goal of slowing, and hopefully stopping, the coronavirus spread. One of the main tools used has been extensive monitoring and geo-tracking of citizens, and subsequent punishments or rewards for adhering to measures. In fact, China is now seeing a dramatic drop in new coronavirus cases.

Taiwan has also used drastic tracking measures to prevent the spread of the virus and it has worked wonders. According to The Journal of the American Medical Association: “Taiwan leveraged its national health insurance database and integrated it with its immigration and customs database to begin the creation of big data for analytics.”

In practicality, this meant that if someone went to a doctor complaining of certain symptoms such as a dry cough, the app would generate alerts based on those factors and others, such as travel history. Then the person would get texts telling them whether or not they were free to move about or if they needed to go into quarantine.

If they had been instructed to go into quarantine, they were tracked by their phones to ensure the terms weren’t violated. As a result, Taiwan had 50 cases of the virus, even though the surrounding countries have had hundreds and thousands of cases.

So naturally other countries are starting to follow suit. Israel is seriously considering using anti-terror tracking tools to follow the movement of the virus in those people who have tested positive. It will also allow the government to determine who was in the same area as the infected person, helping to better target quarantining efforts. The goal is to “flatten the curve,” so any means should justify the ends, right? That depends on whom you’re asking.

Life-saving Efforts? Or Big Brother State? Collecting personal data, such as geo-location, can be a data privacy nightmare. With the right data points, individuals can easily be identified. In a society that routinely tramples on human rights, such as China, outright data collection measures are simply par for the course.

In societies that place a high premium on data and the right to privacy, methods such as these ruffle feathers. The ultimate fear is that once countries begin to implement tools such as these, a big brother surveillance state is just around the corner.

In Israel, officials have promised that they will be using the technology to save lives. Once they have accomplished the goal of routing out coronavirus, the program will be disabled. If anyone remembers the United States’ Patriot Act after the September 11 terrorist attacks, it’s easy to see why some people may worry about allowing such programs to take place.

I, for one, share this sentiment. As the CTO of a privacy-focused company, the thought of data collection that doesn’t adhere to strict guidelines and is not being handled via the right processes is concerning. So much effort has gone into righting the past wrongs of data collection.

Regulations such as GDPR and CCPA are finally addressing these issues in a real and practical manner, with fines for violators and ways for individuals to take an active role in protecting their privacy.

The Way Back to Typical As I said at the outset, we aren’t dealing in the “typical” anymore. In light of the global danger surrounding this pandemic, I think that geo-tracking has the power to help reign in the spread and eventually flatten the curve. But this must be done with extreme caution and guidance. It also calls for a system of checks and balances, preferably conducted by an outside body to ensure every caution is taken.

Lastly, it must be disabled as soon as it’s no longer needed and this needs to be overseen by an outside body as well, both to ensure proper adherence to privacy regulations and to secure citizen data.

This is a confusing time, but thankfully we have technologies that can help us come out on top. Wishing you all safety, good health, and a speedy return to “typical times.”