Think back just 6-months ago and you could be forgiven for thinking the phrase ‘track and trace’ was something straight out of a Jason Bourne movie or Cold War spy novel. A form of covert surveillance operation undertaken by special agents to oust the bad guys. As we adjust to living in a world with Covid-19, ‘track and trace’ has taken on new relevance as we enter into a ‘new normal’, marked by the wearing of face masks, regular hand washing and social distancing measures. As some of us have ventured outside to go to the pub or restaurant for the first time in months, we will have no doubt been asked to give our name and contact details when making a reservation or on entering the premises. This is track and tracing in action (sometimes referred to as contact tracing). But what does it mean? How does technology play a part and what are some of the ethical and social implications we need to be mindful of?
What is Track and Trace?
By now we have all experienced the effects of a national lockdown and we look set to witness more localised lockdowns as both local and national government seek to respond to localised spikes in Covid-19 cases. The term ‘lockdown’ clearly indicates the very indiscriminate way in it is applied – exceptional and sweeping action taken to curtail freedom of movement and assembly. Relaxing restrictions will need to be far more discriminate with the aim of enabling people to move about and go about their business, at the same time as ensuring their safety and those around them.
Track and trace plays a key part in achieving this aim by allowing the selective isolation of confirmed cases and those thought to have be at risk of infecting others until their status is determined. An individual reports symptoms that are suggestive of COVID-19, which may then be confirmed by testing. This triggers a process of identifying and contacting those they might have infected through prior contact. The people who are contacted can then be advised to isolate themselves and take a test. If those people show symptoms or test positive the process can be repeated.
This kind of response has been proven to be successful in helping to track and restrict the spread of other infections such as HIV. Replace the criterion of “had sex with” or “shared needles with”, with “spent 15-minutes within 2-metres of ….” and you’ve pretty much got the same approach being applied. Yet there are clear differences and challenges to the Covid-19 virus compared with those of HIV. The act of sharing a needle with someone is a more easily distinguishable event in comparison to spending 15 mins within 2 metres of someone which can happen by chance on public transport, shopping or having a drink in the pub. Suddenly what was pretty much ‘low risk’, normal every-day life activity has become ‘high risk’ activity during a pandemic.
This process of tracking and tracing is also pretty labour intensive. Just think in terms of the necessary recording of information. There is the need for accurate and regular diary-keeping, gathering of information from strangers, setting up and running of call centres to provide support for reporting and accessing of advice and guidance. Factor in the scale and spread of the virus alongside this and it is understandable that the attention of governments and policy makers have been drawn to thinking about how digital technology and automated systems could be utilised to help speed up the process.
Prior to the pandemic, the emergence of biometric technologies designed to measure and track physical or behavioural human characteristics, so as to digitally identify a person and grant them access to systems, environments or data has been hotly debated. The events of 9/11 in the US and 7th July in the UK, have only intensified debates over the emergence of digital identities to aid privacy and use in surveillance measures. Novel and versatile forms of tech have continued to evolve particularly in the areas of face recognition technologies (FRT), assisting with one-to-one matching (face verification) and one-to-many matching (facial identification).
Now, faced with one of the most serious public health crises of our time, the pandemic has only served to bring these technologies and the related ethical and social implications to the fore once again. FRT could prove to be key to social distancing measures, including proposals for digital immunity or health certificates. It would seem not only are digital identities an emerging reality, but more specifically ‘Public Health Identities’ (PHI), digital identification systems for sharing public health relevant to public health concerns.
There are three inter-related forms of technology that have emerged and are being considered by different countries including the UK:
- Symptom tracking applications
- Digital contact tracing applications (or proximity apps)
- Digital immunity certificates or passports
These are apps, typically available to download onto a smart phone or tablet device, which enable the user to track their daily health and any potential COVID-19 symptoms. These kinds of apps raise very few risks and concerns, but in terms of data quality, coverage and accuracy have more limitations.
A contact tracing app is designed to let people know if they have been in close contact with someone who later reports positive for Covid-19. This kind of technology has been in existence for some time but is suddenly finding a new relevance and application in relation to the pandemic. New innovations are being developed whilst existing technology is being ‘re-tooled’ for a Covid-19 era.
This area therefore remains a work in progress, particularly in terms of assessing the efficacy of this kind of app. To begin with, such an intervention only works if there is a large take up and people are honest in their reporting. The story of the UK government’s attempts to bring in a track and trace app reflect the significant challenges which persist in this area. After much fanfare and hyperbole as to what it would deliver, a trial in the Isle of Wight revealed significant problems with the app’s functionality particularly in terms of reporting capability. Following significant levels of investment, claims have shifted from it being an ‘add-on’ to manual contact tracing to being the solution to stopping the spread of the virus. Lately, it appears it is part of the solution once more, with the Health Secretary commenting the app “puts the cherry on the cake, it isn’t the cake”.
An immunity certificate, sometimes referred to as immunity passport or license, is a form of document that could be given to an individual who has tested positive for COVID-19 antibodies, and who is now considered to be at limited risk of contracting the virus again, or who has received a vaccine in the event of one being eventually manufactured. Receipt of this kind of immunity certificate would link their identity with a test result, allowing the individual to share and prove their immune status with third parties such as restaurants, airports and employers, thereby assisting in the nation’s economic recovery.
There is broad agreement that short of a vaccine widespread testing is the only route through which the UK can exit the coronavirus crisis so digital immunity certificates could be a means by which to assist with this test and checking process.
A number of concerns have been raised over the effectiveness of immunity certificates. First, the accuracy of this form of testing. How certain can we be that a positive or negative test is true and accurate? Second, the time constraints of immunity. Currently it is widely disputed as to how long an individual remains immune to Covid-19. A recent study indicates that people who recover from Covid-19 (whose body produces a reasonable antibody response to the virus) may lose their immunity within a matter of months, causing the longevity of an immunity certificate to be questioned. Based on this uncertainty and lack of evidence proving long term antibody protection, the World Health Organization (WHO) has issued a warning to governments against issuing immunity passports. There are strong views that antibodies aren’t the be all and end all of immunity and that we remain a long way off knowing for sure what makes somebody immune to Covid-19 and in what ways immunity to the virus is conveyed. Yet introducing this kind of certification is considered to be a viable option needed to open up cross border travel between countries again. Two of the largest professional services firms, Ernest and Young and PwCare all reported to be trialling apps designed to manage return to work and travel.
There is clearly still much work to be done in developing this certification, not least in terms of more robust scientific means of testing immunity and how immunity will actually be certified and integrated into key aspects of everyday life such as work and schooling. There are concerns whether the introduction of digital immunity certificates would encourage people to intentionally catch the diseasein the hope of recovering from it, obtaining immune status and gaining a certificate in order to engage in work.
In response to these concerns and challenges, technology is being developed with a view to assisting with the return to normality once our understanding of immunity is better understood. A team of software engineers from global tech start-ups TransferWise and Bolt, have been working on developing digital immunity passports on a pro-bono basis. Co-founder of TransferWise, Taavet Hinrikus, is quick to point out that they won’t be launched publicly until scientific consensus has been reached on Covid-19 immunity.
Tech company Onfido, which specializes in developing identity technologies, has developed software that verifies people’s identities by matching a selfie with a government-issued ID card. Working in partnership with Sidehide, a German hotel booking app, the hope is to integrate Onfido software with the app so that guests can present a unique QR code to prove they hold an immunity certificate.
In the UK, the NHS app (not the contact-tracing one) has an option for individuals to use face recognition as a way of logging in to the app so they can order prescriptions, book appointments and find healthcare data. It requires users to submit a photo of themselves from an official document such as their passport or driving license. NHS Digital are keen to stress that this technology has only been provided in order to provide a secure login capability via mobile devices. And it must have some appeal since reports indicate that more than a million people have now registered with NHS login, with a peak of more than 60,000 new IDs verified during the first week of April 2020. The developers of the app acknowledge that this could also be used for Covid-19 "immunity passports".
Opinion appears to be divided amongst the science, technology and policy communities as to the merit of introducing digital immunity certificates. As pressure continues to mount on governments to balance the containment of the pandemic on the one hand and encouraging citizens to return to as normal a life as possible on the other, the debate over digital immunity certificates looks set to continue. What are some of the ethical and societal issues we all need to be giving careful thought as the prospect of public health identities look set to become a reality?
Privacy and mission creep
First, the loss of privacy and how our data is used and stored, along with the associated safety and security issues. This needs to be considered not only within the immediate context of the pandemic but also life beyond Covid. The term ‘mission creep’ started off as a military term used to describe the gradual or incremental expansion of an intervention, project or mission and it has quickly been taken up recently in discussions surrounding new and emerging technologies. A new technology might be quickly touted as helping to meet need x or usher in benefit y, but how easily and to what extent could its reach ‘creep’ into other areas of our lives?
In the areas of privacy and surveillance, the case of CCTV is often used as an example. With rising cases of car theft, CCTV was introduced to help combat incidences of this crime occurring. Now with reports indicating there is one CCTV camera for every 11 people in the UK, CCTV is used for many other things which were not originally anticipated. Chillingly, in 1989 CCTV originally installed to assist with traffic control in Tiananmen Square, China were turned on student protestors to help identify and secure their arrest by broadcasting their images on nationwide TV.
With the Covid-19 pandemic and generation of significant amounts of personal health data, there is the risk of this data being sold, hacked or used for other purposes. There is likely to be data we are happy to share and disclose during a pandemic to help inform and shape track and tracing measures and other public health initiatives, that we are not happy with disclosing for other purposes. For example, if you’re more active and attend a gym, during a pandemic this is useful information to share for tracking and public health purposes. Post-Covid-19, should this information be available for employers to view and access? Is it right your employer could begin to set expectations around what appropriate behaviour is in terms of achieving your 10,000 steps a day or going to the gym? Are these grounds upon which a decision should be whether to promote an employee?
To mitigate this kind of scenario arising, calls have been made to ensure clear and comprehensive primary legislation is introduced to regulate data processing in symptom tracking and digital contact tracing applications by imposing strict purpose, access and time limitations. Introducing what are known as sunset clauses is one such step which would help to dismantle any system of data tracking and surveillance once the pandemic has ceased.
According to the Ada Lovelace Institute’s live tracker database of Covid-19 digital contact tracing apps, Australia, Austria and Norway to name but three countries, report they have policies in place which prevent mission creep and ensure that the app does not outlive the effort against Covid-19. Whilst such steps are to be cautiously welcomed there remains a lot still to be decided in the long term, particularly in the face of the likely pressure and competition between different nations as they seek to lead the fight against Covid-19.
Introducing various social nudges or a mix of different legal requirements according to our health status may at first sound only logical and necessary during a time of pandemic. If not carefully considered though, such steps could easily help to generate or exacerbate existing inequalities or lead to stigma or discrimination, effectively ‘streaming’ society.
For instance, making it mandatory for citizens to download and use a particular app to help in track and tracking may seem like a good move as everyone has a smartphone … or do they? What happens if you can't afford a smartphone? Or simply do not want one? There are concerns that this could help trigger increased levels of inequality and discrimination amongst society simply because certain people choose not to or are unable to use a certain piece of technology. Disabled individuals or those with protected characteristics may particularly find it difficult to prove that they have Covid-19 immunity if they are unable to use certain technology.
In terms of employment, a greater focus on public health identities (PHI) could change and intensify tensions between employees and employers. With the shift to home working during lockdown and the likelihood that it will remain in some form going forward, there is a tendency to want to find ways of keeping tabs on productivity as well as manage public health concerns. New technologies could promise greater management insights which could benefit employee training, support, wellbeing and the companies’ profitability during the pandemic, but can also have implications on trust and morale.
The Chartered Institute of Personnel and Development carried out research recently on employees and workplace technology. The study found that:
- 45% of employees thought that monitoring was currently taking place in the workplace.
- 86% believe that work monitoring and surveillance will increase in the future.
- 73% think it would damage trust between workers and their employers.
PHI could give employers greater discretion to determine who can return to work and who cannot. We could arrive at a place where employers are either called to or feel empowered to make the decision whether or not to call an employee back to work on the basis of a digital certificate. Will employees comply or risk losing their job? If employee A has a certificate but employee B doesn’t, what happens to B?
The line between personal and professional lives also becomes blurred. Are employees expected to use an app on their personal phone or are their employers expected to provide a phone? If so, is the employees expected to carry two phones? What if you don’t carry your phone on your person all of the time? On a construction site or health environment this might not be permitted. A woman may have to wear a uniform or chooses to wear an outfit which does not readily have pockets in which to carry a phone. How can these issues be resolved?
India has taken steps to make its app mandatory for all people returning to work with some reports claiming that it is also necessary for those wishing to travel on public transport. Indian author, Arundhati Roy comments, “Pre-corona, if we were sleepwalking into the surveillance state, now we are panic-running into a super-surveillance state.”
The importance of trust
The Ada Lovelace Institute’s rapid evidence review recommends “Effective deployment of technology to support the transition from the crisis will be contingent on public trust and confidence”. Trust is the new touchstone for this season. The truth that trust takes years to build but seconds to lose ought to ring loudly in all of our ears, not least those designing and shaping policy responses. Are we trying to build public confidence in tackling Covid-19 or increasing the public’s resistance to invasions of privacy?
It would be too simple and naïve to set up this conversation as a case of privacy versus pandemic response. Generally speaking, it is believed that we the public will support emergency or extreme measures that require some curtailment of liberty or agency, or the increase of surveillance, if it is clearly justified for the common good and solidarity. But this does not mean rights and responsibilities to protect and uphold privacy can be railroaded in order to pursue the eradication of Covid-19 at all costs.
Reading the pages of the Bible, we realise that God places a high value on privacy because it is important to our relationships (for example: Proverbs 11:13; Proverbs 27:6; 1 Timothy 5:13; James 5:16). Healthy relationships can only be formed and able to flourish if we’re able to choose to open up with other people. If this becomes no longer a matter of choice, but something that is enforced then true, authentic relationships will die.
The New Testament says that God delegates certain powers to secular authorities so that we can live at peace, with law and order. That delegated power is with protection in mind but has limits to its reach. The insatiable desire to control things that only God can control has been part of us ever since the Fall. No human individual or agency must ever try to fill the role that only God is qualified to play. Once more during a time of pandemic we are faced with a familiar, time-less challenge, wrapped up in contemporary trappings.
As steps are taken around the world to respond responsibly to the pandemic, it would be foolish not to harness the benefits various technologies could hold in helping us to win the battle against Covid-19. However, in doing so we also need to not lose sight of the challenging ethical questions which these technologies present, alongside the unintended consequences they may well pose.
The blog above was written by Matt James, a consultant for CARE