Location Surveillance to Counter COVID-19: Efficacy Is What Matters

As the novel coronavirus spreads, governments have turned to surveillance to counter the pandemic. Most recently, Israel implemented emergency regulations using cellphone location histories to warn people about coronavirus exposure and require that they self-quarantine. It's notable that recipients of the warnings aren’t receiving them because of voluntary sign-ups. Shin Bet, the Israeli internal intelligence service, obtains location information from the telephone companies and then sends out the quarantine notices to exposed individuals. As the Washington Post notes in its report on the program, "No one can opt out."

The Israeli High Court of Justice has limited the government’s ability to enforce the new regulations. Even so, the Israeli remedy for the exponential spread of the coronavirus raises serious privacy and civil liberty concerns. One can already envision the ensuing debate in the United States: whether, in the midst of a pandemic, privacy and civil liberties issues need to be put aside momentarily.

But is the Israeli solution efficacious? This is the first, and crucial, question to ask about any action that infringes on privacy and civil liberties. If a privacy- and civil liberties-infringing program isn’t efficacious, then there is no reason to consider it further.

Determining whether surveillance will help combat the virus requires understanding how the coronavirus spreads and how cellphone tracking works. According to the Centers for Disease Control and Prevention (CDC), the coronavirus spreads largely person to person. The CDC reports that infection circulation happens "between people who are in close contact with one another (within about 6 feet)" and is the result of airborne droplets "produced when an infected person coughs or sneezes." Yes, there are other ways for the virus to spread. For example, someone could become ill "by touching a surface or object that has the virus on it and then touching their own mouth, nose, or possibly their eyes." But the CDC says that's not the main way.

In other words, a person is at risk of being infected if they're in close proximity to an already-infected person, either within six feet inside or in a crowd outdoors. The CDC's information is very clear: "Your risk of exposure to respiratory viruses like [the] coronavirus may increase in crowded settings, particularly closed-in settings with little air circulation. This may include settings such as conferences, public events (like concerts and sporting events), religious gatherings, public spaces (like movie theaters and shopping malls), and public transportation (like buses, metro, trains)."

Some government officials believe that the location information that phones can provide will be useful in the current crisis. After all, if cellphone location information can be used to track terrorists and discover who robbed a bank, perhaps it can be used to determine whether you rubbed shoulders yesterday with someone who today was diagnosed as having COVID-19, the respiratory disease that the novel coronavirus causes. But such thinking ignores the reality of how phone-tracking technology works.

Let's look at the details of what we can glean from cellphone location information. Cell towers track which phones are in their locale—but that is a very rough measure, useful perhaps for tracking bank robbers, but not for the six-foot proximity one wants in order to determine who might have been infected by the coronavirus.

Finer precision comes from GPS signals, but these can only work outside. That means the location information supplied by your phone—if your phone and that of another person are both on—can tell you if you both went into the same subway stop around the same time. But it won't tell you whether you rode the same subway car. And the location information from your phone isn't fully precise. So not only can't it reveal if, for example, you were in the same aisle in the supermarket as the ill person, but sometimes it will make errors about whether you made it into the store, as opposed to just sitting on a bench outside. What’s more, many people won't have the location information available because GPS drains the battery, so they’ll shut it off when they're not using it. Their phones don't have the location information—and neither do the providers, at least not at the granularity to determine coronavirus exposure.

GPS is not the only way that cellphones can collect location information. Various other ways exist, including through the WiFi network to which a phone is connected. But while two individuals using the same WiFi network are likely to be close together inside a building, the WiFi data would typically not be able to determine whether they were in that important six-foot proximity range.

Other devices can also get within that range, including Bluetooth beacons. These are used within stores, seeking to determine precisely what people are—and aren't—buying; they track peoples' locations indoors within inches. But like WiFi, they're not ubiquitous, so their ability to track exposure will be limited.

If the apps lead to the government’s dogging people’s whereabouts at work, school, in the supermarket and at church, will people still be willing to download the tracking apps that get them get discounts when they're passing the beer aisle? China follows this kind of surveillance model, but such a surveillance-state solution is highly unlikely to be acceptable in the United States. Yet anything less is unlikely to pinpoint individuals exposed to the virus.

South Korea took a different route. In precisely tracking coronavirus exposure, the country used additional digital records, including documentation of medical and pharmacy visits, history of credit card transactions, and CCTV videos, to determine where potentially exposed people had been—then followed up with interviews not just of infected people but also of their acquaintances, to determine where they had traveled.

Validating such records is labor intensive. And for the United States, it may not be the best use of resources at this time. There's an even more critical reason that the Korean solution won't work for the U.S.: South Korea was able to test exposed people. The U.S. can't do this. Currently the country has a critical shortage of test kits; patients who are not sufficiently ill as to be hospitalized are not being tested. The shortage of test kits is sufficiently acute that in New York City, the current epicenter of the pandemic, the rule is, "unless you are hospitalized and a diagnosis will impact your care, you will not be tested." With this in mind, moving to the South Korean model of tracking potentially exposed individuals won't change the advice from federal and state governments that everyone should engage in social distancing—but employing such tracking would divert government resources and thus be counterproductive.

Currently, phone tracking in the United States is not efficacious. It cannot be unless all people are required to carry such location-tracking devices at all times; have location tracking on; and other forms of information tracking, including much wider use of CCTV cameras, Bluetooth beacons, and the like, are also in use. There are societies like this. But so far, even in the current crisis, no one is seriously contemplating the U.S. heading in that direction.

When one has a hammer—in this case, cellphone location tracking—it is tempting to see nails everywhere. But it is crucial to be honest about what problems the technology can solve. Could technology be built technology that could determine whether someone has been within that six- foot sphere surrounding an exposed person? Potentially, but that technology doesn’t exist now, and there would be huge privacy and civil liberties issues to resolve in building and deploying any such tool. It behooves technologists to be honest about what current technology can and can't do—and not to push miracle drugs when they don't exist.

Similarly, it does not make sense to "try everything" just in case a technique—that is, tracking people's cellphone locations—might turn up some new exposed cases of the virus. If the numbers of false positives (people wrongly identified as exposed) and false negatives (people exposed who are not identified by the system) are significant, the wrong people will be sent to health centers and people who should be isolated will not be told to do so. Using data with high error rates can easily lead to distrust in government recommendations; yet trusting the government’s recommendation of social distancing is the single most important step that all Americans can be taking now. And social distancing has the advantage that it can be implemented without cellphone tracking.

This doesn’t mean that phone location has no value during this pandemic. The type of aggregate location information that internet companies use, say, to determine traffic jams (by looking at slowing of cellphones on a route) can also work to optimize public transportation networks, understand how people move after an earthquake (and therefore where to provide aid)—or to track city dwellers decamping for the countryside to ride out a pandemic. That last use might prove valuable, for example, by serving to alert health care systems in rural areas of an influx of potential patients traveling from an area with many cases of the virus—thus enabling an early start to hospital preparations.

Aggregated information, which does not carry the same privacy and civil liberties risks as does data about individuals, may be useful in tackling COVID-19. In such extraordinary times as these, as technologists and government officials develop programs for protecting the public, it is critical that the privacy and civil liberty implications of such programs remain fully front of mind. But efficacy should always be the first issue to raise in the deployment of any technology, especially one that involves potentially serious risk to privacy and civil liberties. If a proposed "solution" is not efficacious, there is no reason to consider the program.

Under this model, the Israeli cellphone tracking may not achieve significant improvement in public health and safety. Unlike the South Korean effort, which involves monitoring the symptoms of those in close contact with an infected person, the Israeli effort doesn’t seem to involve such measures. The much more important action that Israel took—for which surveillance wasn’t necessary—was to limit leaving home to essential purposes (buying food, seeking medical treatment, and the like). That latter action will help flatten the curve and thus save lives; it is the crucial step to be taking.

Surveillance need not be ruled out as a means by which to address the coronavirus pandemic. But implementing surveillance without the other measures that make it an effective public health response will not do much. Efficacy first and foremost is the right measure; that principle must be held front and center as the world handles this pandemic. Otherwise, we endanger our health, our safety and our liberty.