Woodrow Hartzog Discusses How Contact-Tracing Apps Could Reshape Surveillance

The Centers for Disease Control and Prevention (CDC) and many health experts worldwide champion contract tracing as a crucial component to contain the coronavirus pandemic while supporting businesses, services, and schools in efforts to begin modified operations and activities. (See NPR story, “CDC Director: 'Very Aggressive' Contact Tracing Needed For U.S. To Return To Normal.”)

Several technology companies are developing smartphone apps to aid in the contact-tracing efforts. Early this month, “Apple and Google released a few new details about the Bluetooth system they're building into both Android and iOS that will let health care authorities track potential encounters with Covid-19.” (See “Google and Apple Reveal How Covid-19 Alert Apps Might Look,” Wired)

In an op-ed article for the Los Angeles Times, Woodrow Hartzog, Professor of Law and Computer Science at Northeastern University, examines Google and Apple’s contact tracing project, and he shares his insights into the “three concerns to keep in mind about relying on technology to mitigate the COVID-19 crisis.”

Below are a few excerpts from “Coronavirus Tracing Apps Are Coming. Here’s How They Could Reshape Surveillance as We Know It.”

Three Concerns About Contact-Tracing Apps to Keep in Mind

First, there are only so many things tech companies can control. Google and Apple are promising to serve as staunch gatekeepers of the system they are creating. They plan to allow only government health authorities to create the apps that can use the tracing capabilities. To protect civil liberties, the companies say they will not allow government agencies to mandate use of the app (presumably, by denying them system access). But, of course, that doesn’t prevent others like employers and schools, who aren’t bound by the companies’ terms of use for app developers, from requiring app participation as a condition of employment or entrance.

It’s also unclear how well Apple and Google will be able to police the app operators to ensure that the apps comply with the rules. How can policymakers help guarantee system-wide fidelity when it’s so easy for things to fall through the cracks?

Second, governments will want these tools for their own purposes. Google and Apple are creating a playbook for governments on how our phones can be repurposed for all kinds of surveillance. Apple and Google have been adamant about their intentions to restrict this system only to help mitigate the COVID-19 pandemic, and I believe them. But even large and powerful companies are subject to political pressure.

Finally, this technology, once deployed, will not be “rolled back.” We are repeatedly told that contact tracing apps and COVID-19-related surveillance are temporary measures for use until the pandemic passes. That’s likely to be a fantasy.

Surveillance inertia is remarkably difficult to resist. Norms get set and practices and tools become entrenched. And who can say when this will wind down? We’re still dealing with the supposedly temporary surveillance authorized almost 20 years ago in the wake of after 9/11. Rollbacks are rare and highly unlikely because the tools we build today will create a path dependency that will shape our future data and surveillance practices.

Long-term Consequences

Silicon Valley tries to make all tasks easier. Tech companies see the costs associated with searching, sharing and sorting as things to be eliminated. But in the wake countless privacy lapses on social platforms and an unending wave of data breaches, it’s clear that making tasks easier, even important ones, can cause great collateral harm.

Good privacy engineering is one piece of the puzzle for contact tracing apps. Perhaps even more difficult is weighing the long-term consequences of how these tools will be used after the pandemic ends.

Read the full op-ed by Professor Hartzog: “Coronavirus Tracing Apps Are Coming. Here’s How They Could Reshape Surveillance as We Know It” (Los Angeles Times, May 12, 2020).

Woodrow Hartzog is Professor of Law and Computer Science at Northeastern University School of Law and holds a joint appointment in the College of Computer and Information Science department. Professor Hartzog teaches privacy and data protection issues, and his research focuses on the complex problems that arise when personal information is collected by powerful new technologies, stored, and disclosed online. He is also an Affiliate Scholar at the Center for Internet and Society at Stanford Law School and serves on the advisory board of the Future of Privacy Forum.