Covid’s real cost could well be eternal spying
Much of our pre-coronavirus lives may be reclaimable with some modifications around how we work, socialise and travel. In one crucial way, though, the postpandemic landscape will be very different: The individual’s autonomy over her data may be lost forever. Our mobiles will keep us safe — by spying on us.
This will have important consequences for the relationship not just between citizens and governments, but also between consumers and businesses.
Blame the coming end of privacy on success. South Korea and Taiwan have won acclaim for flattening the Covid-19 curve by digitally tracking infected persons. As my colleague Anjani Trivedi described in March, no government was using dispersed databases as extensively to fight the spread of the disease as Seoul. Before an explosive outbreak in its worker dormitories, Singapore earned praise for TraceTogether, which claims to be the first contact-tracing app covering an entire nation.
It hasn’t gone unnoticed that enthusiastic adopters of such software are in East Asia where, as MIT Sloan School of Management professor Yasheng Huang and others note, “a collectivist spirit may encourage civic-minded embrace of and a more willing compliance with governments’ infection control.”
But while cultural differences can help explain the beginning, the end game may be more universal: power and profit. Safely restarting economies will require governments to restore trust in people mingling in factories, offices, cafes and trains. It can supposedly be done with data more granular than what can be obtained from cellphone networks. Hence states want access to phones, with or without informed consent. Turning the clock back will be hard, if not impossible.
Take India’s Aarogya Setu, or Bridge of Health, Covid-19 contact-tracing app. It’s got privacy warriors worried because the country lacks a data protection framework. Among other things, activists want the government to ensure that “any data collected in an external server is designed to be deleted and that it won’t be integrated with other databases,” according to a working paper by the New Delhi-based Internet Freedom Foundation. For now, there are only assurances that the app will wither away once the outbreak is contained, but no legal guarantees.
The Singaporean app records physical proximity in an anonymised form on smartphones. Minimal data is stored on servers. Only if a user falls sick are his contacts tracked and alerted. Given that it’s been less than two years since the revelation that Prime Minister Lee Hsien Loong’s health records were hacked, I’d hesitate to brand the experiment as foolproof. But it’s at least a voluntary exchange. India’s app is anything but. As the country tentatively reopens after a 43-day lockdown, it’s been made mandatory for public and private-sector workers. Company bosses are liable to ensure their workers download the app, though nobody is accountable for misuse of data.
Where boundaries between private and public are thin to begin with, a pandemic can make them disappear. A New York Times analysis of China’s Alipay Health Code software, which mixes a cocktail of data to colourcode a person’s health status, found that some information is shared with the police.
Just as the Sept 11 attacks irrevocably shrank personal freedoms as security-at-allcosts became a policy driver, Covid-19 will erode privacy in the name of public health. The potential market is immense for instruments far more intrusive than Big Brother’s telescreens. Richard Brooks, a computer engineering professor at Clemson University said: “If the ability to track social contacts exists to stop a contagion, I can guarantee you it will be used to track the spread of dissent.”
An Israeli court verdict that banned Shin Bet, the internal security agency, from using its Covid-19 tracking app shows the discomfort societies have with handing over a shiny, new lever of control to governments. Europe’s data protection laws will try to ensure that the emergency collection and processing of personal information is conducted with accountability, and for a limited purpose.
Tracing in Korea went overboard in the early days, when the authorities released so much data that anonymous patients became identifiable — and got harassed. A strong data protection law forced Korea to limit disclosure.
The bottom line: Where they exist, robust institutions could still offer resistance. In most other places, the individual’s autonomy has already become a virus casualty. Poorer countries where consumers have only recently started going online will see states insist on devices that come with pre-loaded tracking apps. More information will reside on central servers than epidemiologists have asked for or need. But who will stop the juggernaut?