吃瓜大本营

At the start of the pandemic, technologists and policymakers touted the promise of technology to track and warn individuals of potential COVID-19 exposure and high-risk areas. But whether due to overburdened contact tracers or the lack of early and coordinated adoption, those technologies never became a central part of the public health effort against the disease.

With attention now on various schemes for 鈥渧accine passports,鈥� a concept posing threats to privacy and other civil liberties, and as the country nears adults fully vaccinated, civil society, policymakers, and the public must remain wary of efforts to cement health and contact-tracing apps into everyday life, and continue to ask targeted questions of their use.

If not, such health surveillance apps 鈥� justified as necessary to monitor lingering cases, verify vaccination and health status for travel, and predict future outbreaks 鈥� may well become a lasting and increasingly invasive feature of public life.

Since the outbreak of the virus, at least have rolled out exposure notification apps through Google and Apple鈥檚 Exposure Notification framework, GAEN (using Bluetooth signals and randomly generated keys to track possible exposures), and Exposure Notifications Express (allowing public health authorities to access the framework without maintaining or building their own app). These tools are more privacy-protective than other location-based tracking proposals we have seen. Save for a few worrying instances, the vast majority of state contact tracing apps have remained voluntary and largely developed through GAEN, something cannot say.

Still, several privacy-violative deployments in the U.S. should not be replicated. In North and South Dakota, the developer of the states鈥� app 鈥� designed to 鈥渁nonymously鈥� cache locations visited by users for more than ten minutes 鈥� was found to have secretly its own privacy policy by sharing users鈥� location data and personal identifiers with third-party apps, including Foursquare. In Utah, a $2.75 million app called Healthy Together, touted to utilize GPS and Bluetooth to augment contact tracing, became largely three months after its launch when state officials shut off the location tracking feature because of widespread refusal to download the app.

College campuses were home to some of the most egregious cases of technology-assisted contact tracing, reflecting administrators鈥� wide latitude to effect mandatory policies as well as the influence of aggressive tech company marketing on unwitting administrators. At Michigan鈥檚 Albion College, a mandatory app called Aura used to ensure students never left grounds, nor switched off their location 鈥� and, if they did, were locked out of buildings and faced suspension. One looking into the app鈥檚 source code found the security keys to the app鈥檚 backend servers, revealing students鈥� names, addresses, test results, and dates of birth.

Other schools like and have used Wi-Fi tracking to monitor students鈥� movements and crowd flow. As a general rule, the use of location tracking is extremely problematic. It is both insufficiently accurate for contact tracing and violates the Fourth Amendment when used by law enforcement without a warrant.

We were also unhappy to see policies like those at that mandated the use of tracking apps. With no formal appeals process, students and faculty could be reported to campus police and academic heads for failing to pass a five-question symptom survey, and campus community members were encouraged to inform on one another regarding suspected violations. Beyond being an instance of health theater, such coercive policies heavily incentivize false responses and risk being disparately enforced.

We鈥檝e also seen the deployment of facial recognition and physiological surveillance on some campuses to fight COVID-19. , for example, installed face recognition temperature kiosks, despite the technology鈥檚 highly dubious effectiveness, placing them in central campus buildings and dormitories and linking them to campus identification systems. The , one of the earliest campuses to adopt fingerprint scanning technology for access to certain campus buildings and dorms, recently replaced them with mandatory facial recognition scanners. In Michigan, Oakland University has distributed a , known as the , with a 90-day battery life to continuously log skin temperature, respiratory rate, and resting heart rate. Although voluntary, the technology is an example of continuous surveillance hastily implemented, large-scale testing or FDA certifications as to effectiveness 鈥� and which puts the burden on students to ensure their private health information is expunged from third-party company records.

Though these instances of campus and state overreach are far from the norm, overbroad efforts to curb and track COVID-19 leave the door open to an abiding surveillance apparatus that won鈥檛 be dissolved once the public emergency dust settles. As the looks into the interoperability of contact tracing apps, tech companies like 鈥� the creators of the controversial neighborhood safety app Citizen 鈥� are partnering with cities for digital contact tracing, while others how contact tracing apps might double as digital immunity and vaccination passports for global travel.

As always, we ought to remain open to creative and privacy-protective ways of using technology during disease outbreaks. Concurrently, we have a duty to ensure that temporary COVID-19 data surveillance infrastructures do not take hold to outlast the effects of this once-in-a-century pandemic.