National Post (National Edition)
Trace me on my cellphone
THE DIFFERENT WAYS GOVERNMENTS ARE USING PHONES TO FIGHT COVID-19
Governments around the world are finding new uses for cellphone location data as they try to enforce social-distancing measures and track the spread of the COVID-19 pandemic. Authorities in Canada have signalled they’re considering such measures.
On Friday, Canada’s chief public health officer Theresa Tam told reporters she was convening a federal-provincial-territorial group of officials on the use of cellphone location data. “I do believe there’s a significant amount of interest,” she said, but noted that there are “many innovators with lots of different ideas,” each of which would need to be evaluated on metrics like privacy. Her comments came after Alberta Premier Jason Kenney said one way for the province to enforce quarantine orders would be through “the smart use of applications — of wireless technology,” a comment that piqued the interest of Ontario Premier Doug Ford.
Not all cellphone location-data based antiviral measures are equally effective — or protective of people’s privacy. Here’s how different governments are using our phones to combat COVID-19.
Countries like China and South Korea have used cellphone location data to track people who might have been exposed to carriers of the virus before they tested positive.
South Korean health authorities and local governments have sent text messages to residents with links to information about the movements of infected people. While patients’ names aren’t included, the dossiers do include potentially identifying details such as gender, age range and shopping history.
But Christopher Parsons, senior research associate at the Citizen Lab at the University of Toronto’s Munk School of Global Affairs & Public Policy, said he had questions about the efficacy of location-data-based tracing. For example, analysis based on the triangulation of which wireless network towers a device is pinging doesn’t reliably show when people are within six feet of one another. It’s even harder to draw conclusions when so many people are in their homes. “I’m sure it looks like I’m in my neighbour’s living room and vice-versa, living in a condo,” Parsons noted. The accuracy of GPS-based tracking also varies significantly.
Authorities would have an easier time spotting people who are breaking social-distancing rules or quarantine. But Parsons said that raises serious privacy implications, since individuals could be identified using their home address — the location to which they routinely return. And enforcement could target vulnerable people, such as a woman and her children who repeatedly move between addresses because they’re fleeing an abusive situation, said Parsons. Canadian shelters have received more calls than normal since people began self-isolating in large numbers. Surveillance technology has also repeatedly been found to disproportionately misidentify and target people of colour.
Other governments can’t easily replicate the South Korean example, which added credit-card records and CCTV footage to cellphone location data in order to trace movements. “They built this infrastructure ahead of time, because they were concerned,” said Parsons. South Korea also had widespread and quick testing to identify those infected, and Canada doesn’t appear to have enough kits to replicate that.
“We know that a very large number of people are asymptomatic and can spread the virus,” said Parsons. Regardless of the location technology used, “absent significant and rapid and accurate testing — to identify these asymptotic persons in as close to real-time as possible — it will likely be functionally impossible to do effective tracing of specific persons who may be spreading the disease.”
Some governments and technology companies are pushing voluntary tracking systems. On Friday, Apple and Google said they were setting up a Bluetooth-based system through which users can opt to have iOS and Android devices store information about other phones to which they have been in close proximity. The two firms will launch APIs for public health authority-issued contract-tracing apps by mid-May; patients will log positive tests on the apps, which will use the device-based records to notify past contacts. Britain’s National Health Service is reportedly already working on such an app.
The system uses constantly-changing anonymous keys to share information between devices, and doesn’t maintain a centralized database of contacts, to protect users’ privacy. But Ashkan Soltani, former chief technologist at the U.S. Federal Trade Commission, tweeted it could produce both false positives, because devices could pick up signals from other rooms, and false negatives, because it relies on people having phones and carrying them at all times.
Google and Apple’s move could “act as a hedge so that governments are less able to compel these companies to develop comparatively privacy-harmful systems or applications,” Parsons said. But he said it “remains to be seen” whether using Bluetooth “will be any more effective” than proposals based on other technologies, citing the risk of over-identifying contacts.
The outcome will also depend on which organizations have access to the APIs and how widely people adopt the apps. And while Google plans to integrate some of the necessary technology into an Android update, older and non-Google-made phones have been slow to receive past operating system upgrades.
Health Canada did not respond by deadline to The Logic’s questions about whether it planned to adopt the Google-Apple system.
The Mila AI institute in Montreal has helped develop an app that uses Bluetooth technology on people’s smartphones to monitor their movements and warns them of contacts with COVID-19 patients. The organization is in talks with federal and Quebec governments over supporting the effort, and co-developer Yoshua Bengio told The Logic the system would be ready to launch imminently. Mila declined to comment on how Google and Apple’s efforts might affect its project.
In the U.S., MIT researchers are leading the development of a Bluetooth-enabled contact-tracing app. Three U.S. local governments are reportedly planning to adopt the app, called Private Kit, and an additional 17 states and municipal governments are considering introducing it.
In Europe, the Irish, French and Czech governments had announced plans to roll out opt-in contact-tracing apps before Google and Apple went public with their plans. The European Data Protection Supervisor has called for a pan-European mobile tracking app instead of individual systems in different countries, and the European Union is working on a unified set of rules.
Singapore similarly used a voluntary, Bluetooth-based app to notify people who had close contact with COVID-19 patients. The system is “designed to encourage individual consent,” said Parsons. But voluntary adoption meant low numbers, he said: “That application wasn’t sufficient because it was installed on one in six persons’ device, and so ultimately wasn’t that effective for doing the tracing.” Earlier this month, Singaporean National Development Minister Lawrence Wong said about three-quarters of the population needed to download the app — and turn on Bluetooth functionality on their phones — for the system to work well.
Policy-makers need to ensure they don’t interpret partial data from voluntary measures as representative of the whole population, or “they may end up making decisions that are not ideal for public health outcomes,” Parsons said. Tracing apps could also “cause people to tie up resources as they call helplines upon discovering that they may have potentially been exposed to a person who’s tested positive,” systems that he said are already “massively overburdened.”
And the effectiveness of such apps depend on public health agencies being able to offer sufficient COVID-19 tests and process them quickly.
Some governments are using aggregated data to spot places where people are gathering, despite requests or orders to maintain social distance or remain in their homes to prevent viral transmission.
As The Logic first reported, in March Toronto Mayor John Tory told a local tech event the city was obtaining data from wireless carriers “so we could see, ‘Where were people still congregating?’” The information would be used to generate a heat map, he said. The City of Toronto subsequently said that it was not in possession of and would not acquire such data, and Tory retracted the claims.
But other governments are similarly trying to track compliance with social-distancing suggestions or rules at the population or regional level using such data. Aggregate assessments “might be very helpful” to make decisions like whether to send enforcement officers, put up signs or undertake other public health measures “to encourage people not to cluster together,” said Parsons.
Health authorities in Germany, Italy and Austria have received aggregated, anonymous information they can use to spot concentrations of wireless carriers’ users in “hot zones.” In Italy’s Lombardy region, for example, telecommunications companies’ data showed people moved around significantly less in the month after the first case was discovered in the area, in late February.
In the U.S., the Centers for Disease Control and Prevention as well as state and local governments have reportedly obtained location information from mobile advertisers to identify still-crowded areas, such as Brooklyn’s Prospect Park.
In Canada, marketing firm Environics Analytics found that one in six people ventured beyond their neighbourhood the first weekend in April, down from one in three two months before. Its database used anonymized location data from thirdparty apps that 2.3 million users installed on their phones.
Last week, tech giant Google published “community mobility” reports for 131 countries and regions, showing the change in visits to places like restaurants, movie theatres, and workplaces using “aggregated, anonymized data” from Google Maps. The Canadian report showed a 59 per cent drop in traffic to retail and recreational locations between Feb. 16 and March 29, while park trips dropped only 16 per cent.
Google Maps is more deeply integrated into Android phones than iOS devices, “so the information provided by Google … also is missing a subset of typically more affluent users,” Parsons said. That limits the usefulness of the data for “society-wide epidemiological tracing and analysis.”
Even when data is aggregated, “it’s never anonymous,” said Parsons. Imagine a government legally tasks a telecommunications company to “be on the lookout for clustering or provide hourly updates,” he said. The carrier could remove user-specific information and just pass on the clumpings; authorities wouldn’t typically be able to identify them. But the government could always compel disclosure of the identities of those captured by the data later, if it had the legal power to do so. Even if health authorities are the information now for antiviral efforts, the public needs to consider with whom the data may be subsequently.