EXCLUSIVE: Contact Tracing and the Constitutional Right to Privacy

Will citizens trade their privacy for the convenience of automated contact tracing?

We made our escape from the COVID-19 lockdown in New York City, sneaking out at the crack of dawn.

Hoping to evade detection, we wore our face masks, sat low in the seats, and kept looking straight ahead to avoid eye contact. No speeding. Loaded with a bag of Ess-a-Bagels, we were heading north to Newport, Rhode Island, founded in 1639, incorporated in 1784, five years before George Washington took office. Newport is a center of American sailing and the U.S. Naval War College. It is steeped in crusty New England tradition – and lobsters, lobsters, lobsters!

Near the back doors of restaurants, sharpening their knives, the greedy chefs were waiting. Like us, the lobsters also were making an escape. I could see them running up and down the streets of Newport, snapping their giant claws at any tourist standing in the way.

Even though it was the middle of summer, the height of the tourist season, this normally vibrant New England village was quiet. Anthony’s Seafood wasn’t serving its signature clam chowder and whole-belly fried clams. Benjamins0 Raw Bar, our corn-on-the-cob and steamed lobster haunt, was closed until the weekend.

After looking around, we ended up at the historic Black Pearl, a seaside restaurant founded in 1967 by Barclay Harding Warburton the Third, founder of the American Sail Training Association.

As we were about to take our seats, the maitre d asked for our names and cell phone numbers.

“We need this for contact tracing purposes.”

It seemed obtrusive. Why was the restaurant compiling personal identifying information? Was someone actually going to make use of the personal data being collected?

Contact Tracing
Contract tracing is a public health tool used to identify persons who have come into contact with an infected person. It is used primarily for tuberculosis, sexually transmitted diseases such as HIV, and the series of novel infections (SARS-CoV, SARS-CoV-2, and COVID-19).

The success in eliminating smallpox – an incredible feat of the international community, coordinating public health efforts around the world – was due in great part to contact tracing. This horrible disease caused fever, sores in the mouth, and then rashes that turned into puss-filled pimples all over the skin. These turned to scabs that then fell off, leaving disfiguring scars. In the 20th century, the smallpox virus took the lives of 300 million people. In 1967, there were 15 million cases per year. In 1980, there were none. Contact tracing is an essential tool.

By the way, if you are wondering what the “big” pox was comparison to the “small” pox, well, the “great” pox was syphilis.

Contact tracing is laden with specialized terminology. An index case is the first individual in a chain who is reported as having the disease. In the current legacy contact tracing process, researchers conduct interviews seeking to track down and identify every person that has been near the index case. These persons are then isolated or otherwise treated for the infection. Of course, they also are interviewed to identify further possible infections.

Sometimes, it is not possible to identify specific persons exposed to the index case. For example, they might be passengers on a commercial flight or at a group event. In those instances, everyone involved is contacted, and then if appropriate, provided with treatment.

Of course, there are many different forms (“modes”) of contact that might pass a disease from the index case to others: sexual transmission, blood transfusion, needle sharing, or breathing air, such as with pulmonary tuberculosis. The techniques of contact tracing are slightly different for each mode.

Become a Contact Tracer
Looking for a career? You or someone you know may be interested in the field of public health. The Johns Hopkins Bloomberg School of Public Health has just launched a free course (through Coursera) intended to “train an army” of contact tracers. As of today, already there are 256,590 students enrolled. Coursera is one of the world’s leading Massive Online Open Course (MOOC) providers.

By some estimates, the United States will need a minimum of 300,000 contact tracers for COVID-19. The cost will be much larger than the $11 billion in testing funds allocated by Congress to states in March.

Automation of Contact Tracing
Can information technology displace these contact tracers even before they are hired? There is some indication that this might happen. For example, the Citizen app has added contract tracing features to its public safety capabilities.

The tech giants also are involved. Google and Apple have developed a way to conduct contact tracing using the Bluetooth signals in cell phones. (See Apple & Google, Contact Tracing: Bluetooth Specification, April 2020) The system is capable of “alerting participants of possible exposure to someone with whom they have recently been in contact, and who has subsequently been positively diagnosed as having the virus.” (emphasis added)

The term “have recently” means there must be a mechanism for recording where a person has been (or at least, the whereabouts of their mobile phone). This information is collected and stored while presumably maintaining privacy. The data retention standard in many systems calls for a limit of 30 days.

Other technologies such as QDX(™) HealthID is a smartphone app that keeps track of test results and allows healthcare providers to ensure the authenticity of test kits. For any organization that plans on implementing a regular system of COVID testing and screening, this will become a “must have” app to hand out to its employees.

A recent MIT Review article profiled 29 contact tracing apps being rolled out. The list was compiled by the MIT Covid Tracing Tracker Project. The data (as of May 5) indicates that the Apple/Google approach is being used in Austria, Estonia, Germany, Ireland, Italy, Malaysia, and Switzerland. The apps for Australia, Bahrain, the Czech Republic, Finland, France, India, Mexico, Macedonia, Norway, Poland, Singapore, Turkey, the United Arab Emirates, and the UK are using some other form of Bluetooth. In Bulgaria, China, Cyprus, Ghana, Iceland, Iran, and Israel, only location information is used, mostly through GPS signals.

From an information technology systems integration point of view, having the emergence of so many different apps for contact tracing will present challenges in the future, particularly as it becomes necessary to coordinate across international borders. This has happened before.  When the telephone was invented, it took a while for the International Telecommunication Union (ITU) to obtain agreements on standardization that would enable inter-connection of the world’s telephone systems.

The same challenge will occur with automation of contact tracing. We can predict that eventually, there will be calls for an international standard of interoperability that will work everywhere. This would make possible the tracking of the spread of a pandemic through international travel. But we are not there yet.

Models of Epidemics
In addition to helping individuals obtain proactive treatment and avoid spreading a disease further, contact tracing helps public health officials make basic measurements characterizing the disease. These measures become crucial inputs into formulas that are used to forecast the spread of a disease and determine the level of threat it represents.

Using mathematical models, we find a number of ways to anticipate what will happen in a pandemic. The most basic approach is the SIR model, originally published in 1927. It depends on a number of important measures, including R_0, which is a figure representing how infectious the disease is (“basic reproduction number”): S is the proportion of people susceptible to the disease; β is the initial rate for infection; γ is the rate of recovery; and I(t) is the number of people not yet infected (at a specific point in time). The SEIR model adds a separate calculation for how many people have been exposed (E) to the disease, but remain in an incubation period.

So contact tracing is crucial to numerating the variables needed to evaluate a disease. For example, the “basic reproduction number” is fundamental, and can only be known by making an assessment of how many persons the index case has come into contact with, and downstream, how many of those persons have become infected.

Only when these numbers are calibrated to their derivatives can scientists extrapolate how the disease will spread and tear through the fabric of a society. Outputs of these models are the “curves” everyone is working to “flatten.”

Constitutional Issues
The meal at The Black Pearl was wonderful. But the contact tracing continued to bother me. It became clear that all food establishments were collecting the information. And the data was not going to stay at the restaurants. Piles of isolated paper logs from hundreds of sources would be useless. They were being transferred to a central location, and probably being entered into an electronic database. City data would need to be integrated with state data, and state data with national data (perhaps, national data with international data).

If the past is any guide to the future, then we know that once information is collected by the government, even on a “temporary” basis, in practice, it never goes away. Ten or even 25 years from now, it will be possible for someone to access a record of our lunch at The Black Pearl. They will not know how good the lobster was, but they will know we were there. Is there a privacy issue here?

The Constitutional Right to Privacy
Currently, there is much angst regarding privacy. In the United States, privacy is a Constitutional issue. The Bill of Rights is made up of the first 10 amendments to the U.S. Constitution. The Fourth Amendment protects citizens against unreasonable search and seizures. Its inspiration is actually the misbehavior of Hessian mercenaries who had the habit of raiding the countryside in search of pigs and cattle for their dinner during the American Revolution. These amendments apply directly to actions of the federal government. They are applied to state actions through the Due Process clause of the Fourteenth Amendment.

Privacy rules govern how law enforcement is allowed to access your personal information. In practical terms, prior to violating your privacy, law enforcement usually is required to obtain authorization from a magistrate, and theoretically, this is only upon the existence of probable cause. (Practice may occasionally be different from theory.)

It is entirely possible that the massive amount of contact tracing information being collected likely will receive minimal privacy protection. Sometimes, persons who have come into contact with the index case are not given their identity. Certainly, permission will be required to access the information, at least for outsiders. But in the short term, the data will be open for use to any healthcare professional involved in the study of the COVID-19 pandemic – merely a tissue-paper facade of protection. 

But what might happen when the contact tracing data is used for non-health purposes? Like all information that traces the whereabouts of citizens, it soon will become yet another tool for law enforcement representatives who might wish to know where you have been and with whom. For example, in a criminal investigation, it might be possible to data-mine archived contact tracing information to uncover conspiracies. If you ate out at a restaurant, but a criminal or terrorist sat at another table, then you might fall under suspicion. Indeed, you were in the same place at the same time.

“How do we know you did not exchange information with (the suspect)?”

Contact tracing data also could be used for “personalized” advertising of medical services.

“Use this coupon for 20 percent off on your COVID-19 testing kit.”

What would happen if you were denied a job, not because you were ill, but because at some time in your past, you simply had been exposed to a disease, or had been “seen” (“co-located”) with a terrorist or criminal? This is not so unrealistic. A large number of applicants to jobs are rejected because of what they have posted on social media. 

Because of experiences involving abuse of personal data during World War II, Europe has the world’s strongest privacy regime. Already it is developing a number of protocols that might help users being contact traced hold on to their privacy. See, for example, the Pan-European Privacy-Preserving Proximity Tracing System (PEPP-PT). In Berlin, work at the Fraunhofer Heinrich Hertz Institute for telecoms (HHI) is focusing on making such an automated system consistent with the strict privacy rules in Europe.

In the United States, privacy standards are weaker. It is reasonable to expect that over time, these fears and concerns over handling of contract tracing data will subside. We have seen this before. When turnpike providers released sensors on automobiles to automatically pay the toll, some expressed concern that “the state is tracking you every time you cross the bridge.” Eventually, ease of use overshadowed these worries. The same has happened with social media, as it has aggressively engaged in tracking citizens, but without the constraints placed on government and law enforcement. Citizens tend to trade privacy for convenience.

And what about raising an “army” of contact tracers? Will the United States actually hire 300,000 people and put them on the public sector payroll? Who knows? If the COVID crisis recedes quickly enough, the sense of urgency will pass, and public health organizations across the country will continue their normal life living in an under-funded wasteland. If there is a second or third wave of the virus, then the funding will come through, and perhaps an automated approach may be implemented.

In the meantime, I’m going to try and find that lobster dinner.