Every country has to address the challenges of the Covid 19 pandemic. Solutions are needed to contain or even stop the virus spreading, and tracking apps seem to be a promising tool as they can help to identify the contacts a person tested positive for Covid-19 had.
Covid-19 tracking apps provide a good example of the possible benefits of Smart Information Systems and the possibilities of unforeseen use or even misuse that can come along with them as well.
This technology could be very beneficial as individuals at risk of an infection could be tracked accurately and the spreading of the virus contained – possibly even without countrywide lockdowns that pose a great risk to economies.
South Korea has been praised for dealing well with the pandemic without a lockdown. Part of this success is the use of a tracking app that collects personalised geolocation data together with other data (e.g. from credit cards) to build a map of where individuals have been and who they were interacting with.
But this approach has been criticised on the basis that solutions on sharing geolocation data are not accurate and also carry massive privacy risks. This is particularly true if the GPS data is sent to a centralized location.
For this reason, a Bluetooth-based solution has been developed by 130 scientists from all over Europe that could trace contacts precisely without violating data protection: Pepp-Pt – Privacy-Preserving Proximity Tracing. Bluetooth Low Energy is used to log a user’s proximity to other mobiles. If a user has been in close contact with a positively tested person, she gets a warning message (provided she has given consent to share her contacts). This technology would comply with the EU General Data Protection Regulation (GDPR) if the technology would use the data anonymously via a number code and without storing data from location tracking centrally.
After the initial commitment to using a decentralised protocol in the technology PEPP-PT changed sides to centralised data storage. Former leaders of the project withdrew their participation. 300 scientists warned in a public letter to “create a tool that enables large scale data collection on the population, either now or at a later time. Thus, solutions which allow reconstructing invasive information about the population should be rejected without further discussion.” Central data collection could be attacked or used in another way as it was originally intended for.
One such possible risk is ‘surveillance creep’. States could use the crisis as an opportunity to establish and retain tracking of citizens. Social graphs could be constructed that demonstrate who has had close contact with who, which could be used for profiling e.g. in the context of law enforcement and predictive policing.
These issues should be taken seriously, particularly for an app that is based on trust and voluntary use.
Accordingly, EU parliamentarians stressed that “generated data are not to be stored in centralised databases, which are prone to potential risk of abuse and loss of trust and may endanger uptake throughout the Union”. They also demanded that “all storage of data be decentralized.
Experience shows that surveillance is usually not taken back once a crisis is over. The SHERPA scenario on predictive policing gives an idea of what a future with predictive policing could look like in 2025.
Article author: Renate Klar, EUREC
