Government Surveillance in an Age of Pandemics

For most people—and especially Lawfare readers—the word “surveillance” conjures up images of law enforcement investigations and foreign intelligence operations. But surveillance plays a major role in an equally important way of keeping people safe: public health. One of epidemiologists’ most powerful tools is disease surveillance—the monitoring, at both the population and individual levels, of who’s been infected and with whom they’ve interacted. And as the outbreak of the novel coronavirus and the disease it causes, COVID-19, brings American economic and social life to a halt, it is worth asking: What will be the effects on government surveillance? And while even the precise short-term effects are still hazy, we can already see signs that the outbreak may usher in a permanent and far-reaching expansion of the surveillance state.

Government-mandated disease surveillance has a long history in the United States, from the first reporting law (in colonial-era Rhode Island, for smallpox, yellow fever and malaria) to the sophisticated programs that the Centers for Disease Control and Prevention and state public health agencies run today. But COVID-19 could drive surveillance to a much higher level, for two reasons.

First, the COVID-19 pandemic is the most serious pandemic that the United States, indeed the world, has dealt with since the 1918 influenza outbreak. The coronavirus outbreak may well prove to be the most socially disruptive event of the past 100 years—even World War II did not require hundreds of millions of Americans to effectively shelter in place for an indefinite period. Whether one is chiefly concerned about the public health impact of COVID-19 or the economic and social toll of the response (or all of the above), this episode will no doubt convince policymakers that drastic steps may be justified to stop this outbreak and prevent future ones.

Second, technological advances make it possible to collect a vastly larger and more precise trove of information. Internet-connected thermometers, thermal-imaging cameras (especially when combined with facial recognition software) and algorithms that scrape and process social media posts can all help detect the spread of disease in near real time and at an individual level. The ubiquity of GPS-enabled smartphones can allow health authorities to determine with whom infected individuals may have had contact, thus allowing for faster and more precise contact-tracing. Governments can use databases of individuals’ phone numbers and email addresses to proactively notify them of exposure and then use location data to monitor and enforce quarantines.

Countries worldwide are already stepping up surveillance in hopes of “flattening the curve.” In particular, China, which appears to have managed to all but eliminate local transmission of the virus, has, in addition to locking down hundreds of millions of people, adopted some of the most extreme surveillance measures, from using data from telephone companies to monitor quarantine compliance to developing apps that assign color codes to individuals based on their health status.

But increased surveillance has not been limited to authoritarian states. Other Asian countries, such as Taiwan, Singapore and South Korean, have also used aggressive surveillance and tracking to keep coronavirus infection rates low without resorting to mass lockdowns. Perhaps taking notice, liberal democracies are stepping up as well. Israel has repurposed its domestic spy agency’s trove of cell phone data to notify individuals who may have come into contact with those infected with the coronavirus. The United Kingdom is developing an app that would do the same thing, but on a voluntary basis. Even the European Data Protection Board, perhaps the world’s strictest privacy regulator, has clarified that individualized phone-based tracking may be permissible, assuming legislative authorization and adequate safeguards.

In the United States, which seems perennially behind the curve on all things coronavirus, there has not yet been (at least not publicly) an expansion in individual electronic surveillance to fight the pandemic. But the longer it continues, the more likely that federal, state and local governments will turn to such technologies to enable a more targeted approach to coronavirus management. The federal government is already in talks with tech giants to use cell phone data to track the virus (though for now the discussion seems to be limited to anonymized data). Strikingly, even the Electronic Frontier Foundation has conceded that more surveillance will be necessary, noting, “In the digital world as in the physical world, public policy must reflect a balance between collective good and civil liberties in order to protect the health and safety of our society from communicable disease outbreaks.” When it comes to increased surveillance to fight the coronavirus, the question seems to be not if, but when.

Although the outbreak will at some point be controlled, the expansion of government surveillance is likely to be permanent, for two reasons. First, the cost of the coronavirus response is proving astronomical. The public may well decide that it was justified, given the potential severity of the outbreak, but it will surely expect the government to put in place measures to deal with future outbreaks in a less socially disruptive way. COVID-19—which is on track to cause thousands of deaths and trillions of dollars of economic destruction—is public health’s 9/11, and it will serve as a “never again” moment that will drive policymaking for years to come.

Second, surveillance programs tend to stick around long past when the emergency that initially justified them has faded. Some of this is due to bureaucratic inertia and path dependency, and some to mission creep as the government finds additional ways to use the data. Either way, now is the time to start thinking about the short- and long-term future of disease surveillance—and how it may interact and overlap with law enforcement and national security surveillance.

Some of the questions are legal ones. For example, does the Stored Communications Act—which permits companies to voluntarily share data with the government in case of an emergency but does not permit the government to require data disclosure outside a criminal investigation—need to be modified? And if so, what should be the corresponding privacy protections? What limits might the Fourth Amendment impose on searches and seizures performed for “administrative” or “special needs” purposes, like public health, and can the data obtained also be used for law enforcement investigations?

Other questions will be about policy. Here public health and legal experts could fruitfully come together to develop evidence-based, constitutionally permissible reforms to surveillance laws and programs. In doing so, they should be particularly wary of exaggerated claims of surveillance effectiveness, either from companies trying to hawk their products or government officials seeking to exploit this crisis for their own purposes not related to public health (as already appears to be taking place, both in the United States and in authoritarian countries such as Russia, China and Iran). But they should also resist privacy absolutism.

Difficult as these questions will be, we’ve no choice but to face them. As our current situation makes clear, pandemics pit one kind of liberty against another: the liberty to be free from intrusive government monitoring against the liberty to be free from disease and, in due course, from the heavy-handed measures needed to bring it back under control. As our national lockdown grinds on, Americans may decide that the freedom to avoid being monitored is less precious than the freedom to leave their homes.