As countries around the world look for ways to track coronavirus infections using people’s personal smartphones, measures President Trump says the U.S. is also considering, privacy experts and technologists warn that the U.S. government faces an uphill battle to put such surveillance into practice.
During a Monday press conference, President Trump described the potential of using GPS data to enforce social distancing guidelines as extreme, a measure his former Food and Drug Administration Commissioner Scott Gottlieb suggested in his roadmap to recovery after coronavirus. “So what happens? A siren goes off if you get too close to somebody? That’s pretty severe,” Trump said, while noting that “we’re taking a look.”
But unlike a number of other countries, surveillance and national security law experts say, the U.S. intelligence community doesn’t currently have the authority or capability to tap into massive amounts of individualized American geolocation data. Technology and ad sales companies, who do have access to that kind of data, need to navigate their own complicated path in choosing to make some of its customers’ information available or not.
“The government would ordinarily need a warrant to acquire non-anonymized location data from cellphone service providers,” explained Elizabeth Goitein, co-director of the Liberty and National Security Program at the Brennan Center for Justice and an expert on executive authority and surveillance law.
A former FBI official said that even for the bureau, which handles domestic intelligence, getting access to real-time geolocation information would require a high standard of evidence. “Anything real time like that would be the equivalent of a criminal wiretap,” the official said. “Anything that collects content has a significant administrative burden.” While location data wasn’t always considered invasive personal content, a recent Supreme Court decision determined otherwise.
Additionally, the president’s executive authority, while wide reaching on issues of national security and foreign affairs, typically does not extend to matters of public health — though it could depend on creative legal interpretations. “Any President can do a lot with the combination of [executive orders] and emergency powers,” wrote Patrick Eddington, a research fellow in homeland security and civil liberties at the Cato Institute and a former congressional staffer and CIA analyst.
Al Gidari, the consulting director of privacy at Stanford’s Center for Internet and Society and a former top private attorney representing companies like Google, told Yahoo News that “neither the Stored Communications Act nor the Communications Act permit the government to compel disclosure or location information in response to a public health emergency.”
He noted that the government can request the data from providers in response to an emergency “but nothing obligates the provider to make the disclosure.” Instead, providers can turn over aggregated data, if they choose. “While there are real privacy concerns, so far at least in the U.S., it has been managed well,” he wrote.
Consequently, changing those standards would likely require a change in the law — a tough lift for a Congress that is focused on resuscitating a plummeting economy without getting members sick themselves. Debates over whether virtual voting is possible have already created challenges for ongoing business for lawmakers.
One congressional source said “there would be serious privacy concerns” about collecting or accessing geolocation information the way some other countries have, from both the government side and the side of the tech companies, both of whom have the potential to abuse the access to information.
“I don’t see this being something under consideration,” said the source.
A second congressional source agreed that getting individual phone records was possible, but that it would likely require a warrant and wouldn’t scale to the entire country. However, it’s unclear how accessing even individual records would be that useful at this point, they continued. “What use is tracking individuals if you aren’t testing?” the person asked, pointing to the delay in testing for COVID-19.
A former White House official said he believed that people in the U.S. would have a difficult time being tracked like they were in South Korea and China, even in a scenario where the stakes are clear: thousands of lives lost. However, he said that the distrust in federal surveillance might enable the private sector and state and local authorities to step in. “They’re going to have a better chance.”
Cellphone tracking data resides within tech companies, social media firms, telecoms and ad sales organizations, because consumers are often more willing to give up private data in exchange for goods and services. Some companies around the world have offered to anonymize that data and provide it to the government to help track the disease’s spread, an offer some researchers have suggested would be helpful in slowing the disease’s exponential growth.
That exchange is already happening between certain companies and the U.S. government, according to the Wall Street Journal. When asked whether there would be any legal barriers to accepting that data, the Justice Department referred Yahoo News to the White House, which declined to comment further.
However, there are privacy concerns even with anonymized geolocation data, which can be used to follow an individual’s path between home, work, the doctor’s office and other private locations. Many applications have access to your location by default, and it’s difficult to opt out or know which companies are purchasing that information.
Those concerns might be eliminated if people opt into temporary tracking applications sponsored by the government or health organizations, voluntarily forsaking some privacy to protect themselves, their families and others. The U.K. reportedly plans on releasing an opt-in app for contact tracing when lockdown restrictions lift and people reenter society.
It’s possible data could be a public service that helps people understand the consequences of their actions. Big data company Tectonix and location data company X-Mode’s recent map of individuals’ spring break travel in recent weeks revealed just how many people traveled and came into contact with each other in recent weeks, potentially spreading coronavirus.
“Misinformation is the enemy of order, and the bedfellow of panic; keeping ourselves properly informed is more important now than ever,” wrote the companies in a blog post. “In times like these, we here at X-Mode hope that our precise location data can be counted on to provide a clear picture of what’s really happening in the world.”
Yet the big tech companies that have the most location data, such as Google, Apple, and AT&T, may be hesitant to share the kind of data the U.S. government wants — partially because of eroded trust, especially following the Snowden revelations that depicted telecom and internet companies as complicit in global surveillance. “Sharing user data with government outside of legal process is a red flag for privacy groups, so companies would be more likely to share anonymized data with academic public health researchers instead,” said one person who works in the tech sector but asked not to be named. “They don’t want to remind the public they have that data.”
However, regardless of participation by the tech sector, it’s unclear whether technology can really be as useful as some people think in preventing the spread of coronavirus.
Susan Landau, a computer security professor at Tufts University, explored the efficacy of geolocation surveillance in contact tracing for the legal blog Lawfare. “Determining whether surveillance will help combat the virus requires understanding how the coronavirus spreads and how cellphone tracking works,” she wrote.
Geolocation data pulled from cellphones isn’t nearly exact enough for contact tracing, she said. The government would likely need to merge cellphone data with other location tracking information, such as use of Wi-Fi, and information about visits to medical offices or pharmacies and stores.
And none of that is effective without widespread testing to know who is positive and needs to be traced.
“It is crucial to be honest about what problems the technology can solve,” Landau wrote.
Click here for the latest coronavirus news and updates. According to experts, people over 60 and those who are immunocompromised continue to be the most at risk. If you have questions, please reference the CDC and WHO’s resource guides.