Balancing Public Health, Privacy and Security: A Guide to Contact Tracing

As we continue to control the spread of COVID-19, governments are looking into the risks and rewards of contact tracing apps. Simply put, contact tracing apps, using Bluetooth technology, detect devices that are in close proximity and exchange unique identifiers with those devices. The app matches these devices against a database of those who are symptomatic—all based on self-reporting. If there is a match, the app notifies the device owner that he or she may have been in contact with someone who has the virus. Sounds easy, right? 

In a utopian world, this would be great. However, we are living in a time that is far from utopia—a time when merely wearing a mask may be a sign of weakness. In reality, it is unlikely that people will elect to give up bits of their privacy. So how can we make this a reality?

There are many considerations outside of the simple, “How do we convince society it’s worthwhile to opt-in?” rhetoric. What about the app itself: Is it effective when running in the background and what does it have access to? And what about the developers: What are they monetizing, if anything? Convincing people that their privacy and security will not be impacted is not an easy task. 

Much like the post-9/11 climate led to the implementation of the  USA PATRIOT Act, the need for information and contact tracing to reduce the spread of the virus may overcome privacy considerations. As with the excessive use or over-reach of the surveillance of American citizens under the Patriot Act, court actions after the fact do little to correct the loss of trust and hold accountable those responsible. So, what’s the right way to employ contact tracing apps that don’t sacrifice privacy and security? 

At the end of the day, here are the main considerations that policymakers need to take into account: 

• Models for security and privacy protections should be included in these apps based on existing privacy laws such as the European Union's General Data Protection Regulation, Health Insurance Portability and Accountability Act and California Consumer Privacy Act. Legislative and policy protections should be enforced as well.  
• The contact tracing data should have a specific expiry policy, after which it is automatically deleted. 
• The data should be encrypted and not made available to government agencies or agents without court order.  
• The opt-in requirement must be reciprocal—both the device owner and the owner of the device in proximity to the subject—and both must agree and opt-in. 
• The app itself and the hardware APIs should be tightly constrained to only collect and share the minimum data necessary, and not to correlate or access any other apps or data on the user’s device.  
• There must be transparency about the app and the developers as to how they are funded, their motivation for producing and maintaining the app, and the disposition of the data, the results, and the users who agree to participate. 

Balancing public health, privacy, and security is no easy feat. However, it is critical that governments structure their policies to address all three—especially in a time as vulnerable as a global pandemic.

Bill Harrod is the Federal CTO at MobileIron.