Digital contact tracing will fail unless privacy is respected, experts warn
Digital contact tracing will fail unless governments build the technology in a way that respects user privacy, a group of nearly 300 experts have warned.
If public health bodies such as the NHS build centralised contact tracing apps that transmit superfluous data they will struggle to win the trust of enough citizens to ensure the activity is a success, the experts say.
The joint letter, signed by academics from 26 countries worldwide, highlights the potential that digital contact tracing has in helping prevent a resurgence of Covid-19 as countries come out of lockdown, but cautions that the effectiveness is no excuse for riding roughshod over privacy protections – and is, in fact, closely entwined with them.
“Such apps can otherwise be repurposed to enable unwarranted discrimination and surveillance,” the letter states. “It is crucial that citizens trust the applications in order to produce sufficient uptake to make a difference in tackling the crisis. It is vital that, in coming out of the current crisis, we do not create a tool that enables largescale data collection on the population, either now or at a later time.
“Thus, solutions which allow reconstructing invasive information about the population should be rejected without further discussion.”
On Monday, the justice secretary, Robert Buckland, told MPs any tracing app designed to mitigate the spread of Covid-19 would be “functionally limited” to prevent a “mission creep” that would change the relationship between the individual and the state.
Buckland told a remote session of the joint committee on human rights: “On every occasion that government or its agencies seek to create a device or mechanism that has potential of infringing rights or other fundamental civil liberties then the greatest care has to be taken.
“Thus far, I’m seeing a proper prioritisation of the need for privacy and indeed for security when it comes to the data that might be contained in such a tracing device.
“Clearly speed is of the essence, because of the situation we’re in, but the need for an ethical approach and legal approach is very much at the heart of what the NHS is doing.”
Digital contact tracing, pioneered by Singapore in late March, uses the Bluetooth connection in modern smartphones to keep track of meetings between individuals, in order to allow self-isolation instructions to be sent automatically to everyone a newly diagnosed patient has interacted with while infectious.
It is possible to carry out such tracing without needing to build a centralised database of every meeting between individuals, which could be abused by authoritarian governments or overzealous officials: one proposal, backed by Apple and Google, sees every smartphone build a decentralised record of only the other phones it has interacted with, and waiting to hear from the state if any of those phones have been marked as infectious.
But the NHS is understood to be focusing on a different approach, which uploads far more data. That brings with it numerous technological hurdles, since it won’t be supported by the two main smartphone operating systems, and has sparked concern among privacy campaigners.
In a statement, NHSX said: ““Users’ privacy is crucial, which is why we are working with other countries, a range of experts, stakeholders and industry to ensure the app under development is led by the best scientific and clinical advice to reduce transmission of the virus whilst protecting user privacy.”
The academics’ warning is backed up by a cautionary report from the Ada Lovelace Institute, an independent thinktank that focuses on issues around data and AI. The institute argued that any future contact-tracing app must be backed by specific legislation regulating the processing of data, must “encourage privacy-by-design in technical implementations and must choose privacy-preserving protocols to underscore technical measures”.
“There is a real risk that the expansion of state intrusion into individuals’ lives that occurs during emergencies endures beyond the originating crisis,” the report said. “Technical and legal infrastructure built during this pandemic may be difficult to dismantle once it is over unless proper safeguards are in place.”
“Open debate and scrutiny must be encouraged, to increase trust and raise public awareness of the complexity of the issues.”
Any contact-tracing app would need to be used by more than half the total population to be effective, according to research from Oxford University. Singapore’s app, TraceTogether, has currently achieved just 17% uptake. But if the NHS succeeds in getting 60% of the UK to install and run the app, says Christophe Fraser, the report’s senior author, it “has the potential to substantially reduce the number of new coronavirus cases, hospitalisations and ICU admissions”.