COVID-19 has unrecognizably changed our lives and uncomfortably invaded our privacy. Yet, some privacy advocates criticize governments for amateurishly deploying software to surveil people in the name of public health.
Governments around the world attempted to harness technology to track and curb the spread of the coronavirus. But the appetite for private data was unhealthy, experts argue, and some call it safety theatre when citizens are asked to make compromises for the sake of public safety.
There’s a silver lining, too, however. “Without question, people are more aware of privacy issues,” Brian Philbrook, lead privacy counsel at OneTrust, said during the panel discussion about how COVID-19 changed data privacy, organized by the National Cyber Security Alliance.
Tracing apps, designed to help track and stop the novel coronavirus, have been at the center of a heated debate. Recently, it came to light that the personal information of a large number of people who participated in the Netherlands’ coronavirus track-and-trace program has been leaked. Even though companies such as Google brag about helping combat the pandemic while protecting people’s privacy, the truth is, some governments used the health crisis to cement their power and limit human rights.
“We see something like surveillance technologies that are used in the intent of public safety but, truthfully, they erode privacy for certain communities and individuals, and have the worst impact on their physical safety,” Melanie Ensign, founder & CEO at Discernible, said during the discussion.
According to her, when we talk about consumer privacy, consumer safety, we are not talking about a monolithic group of people.
“A lot of companies struggle with trying to balance how to do the most for the most people without leaving behind those who are most vulnerable,” she said.
At her previous position at Uber, she spent a lot of time researching the efficacy of security cameras. And they, she argued, are most helpful for investigations after the crime has already been committed. But they are not safety cameras, she argues. The more accurate term would be surveillance cameras. It would only be fair if various institutions that deploy them would be honest with consumers about ‘what the actual benefits are from a safety perspective in exchange for those privacy concessions’.
Melanie thinks that a lot of governments have learned that software development is something that they have underinvested in, and they do not know how to build it.
“So many of these tracing apps that were developed by governments are all such an abysmal failure,” she said.
That’s why, when the need for any type of government software application requiring more privacy trade-offs arises next time, we should see more involvement from technical experts.
“We saw some apps that didn’t function properly or were full of privacy and security vulnerabilities. People didn’t trust it, and we are not going to be able to increase trust. People are really tired of paper promises, privacy policies, and similar documents. I think that we are going to see more investment in technical integrity and development from these government agencies the next time they try to take something up of this magnitude,” Melanie said.
The second problem that Melanie emphasized is what she calls ‘security theater’. According to her, if you are asking a person to compromise his/her privacy to increase public safety, you need to tell that person what exactly you are going to use that data for and how it is going to improve the safety of that person’s family and friends.
“We have seen a shameful lack of that both from the private side and from the government side, explaining to consumers how their data and how the balance with privacy does actually lead to safety benefit. There’s still a very unhealthy appetite for data from these institutions without clear cases or purposes for how the data is going to be used and the safeguards that are going to exist around it,” she said.
According to Melanie, there are a lot of technologies put up to track people either online or in the physical world, but they don’t necessarily provide more safety for them. Some industries, she said, provide safety theater rather than actually being honest about whether people are truly safer because of those privacy-invasive technologies.
‘A dangerous way of thinking’
Christopher Harrell, chief technology officer at Yubico, also shares the view that the pandemic and declarations of emergencies helped some governments obtain additional powers. There is an ongoing debate whether the information that is being collected about people is necessary, is the protection of data adequate, is the information used for the purpose it was collected. Human rights activists are closely monitoring the trade-offs induced by COVID-19.
He, too, thinks that some of the technical work has been done last minute, and therefore technology lags behind policy when it comes to ensuring citizens’ safety and health.
“On the technology side of things, I think that we are behind the policy side of things. It makes it very hard because people will say things with the best intentions, they will say that they are trying to protect people and make sure that people stay healthy and safe, but it is very hard to ensure that happens. I hope that technology can catch up,” he said.
Unfortunately, many people are still holding to the “I have nothing to hide” misconception, which Christopher calls a dangerous way of thinking.
“People who are otherwise healthy and were not thinking a lot about how things might impact them are now kind of forced to think about it. Now, they have the context that they didn’t have before. They have context about that someone is going to look into who they are associating with or their health information. It is something new to them. We haven’t been forced into that situation before,” he said.
People are forced to think about their privacy, and it is a good outcome – they are becoming more aware of their privacy and rights.
Some countries, Christopher said, promised to use personal data only for COVID-19 contact tracing but have abused it. Hopefully, in the future, there will be some solutions that, at least, will make these abuses detectable by the people who gave out that data in the first place.
“Without question, people are more aware of privacy issues,” said Brian Philbrook. “If you just look at your organization, if you talk to the privacy officer there, they have most likely seen the pretty significant uptick in the amount of data subject requests for deletion, requests for access, opt-outs, and all of those different things. I think that people are starting to ask the right questions, but there is still a long way to go and more to learn.”
Recently, he read an article about the privacy officer whose child’s school sent her a request to record a class for operational purposes. It was a broad consent form that was sent to all the parents.
“She understood that obviously there were some privacy implications there, and it was her duty as a citizen and as a parent to push back a little and get some answers. So she started the conversation with the school and talked about what potential issues were, and after a lengthy discussion, the school ended up making pretty significant policy changes to how they are going to conduct the recordings. It is uncharted territory for teachers, and they haven’t considered privacy implications,” he said.
Lindsey Schultz, global privacy counsel at VISA, also believes that people are a lot more aware of what’s going on in this field. The questions that they have about privacy are getting much more sophisticated than before the pandemic.
Privacy vs health
In April, CyberNews decided to ask people in the US how they feel about the potential of giving up their privacy during the government’s response to the coronavirus pandemic.
The results have shown that roughly two-thirds of Americans are worried that the tracking measures used to contain the spread of the virus could lead to greater government surveillance.
In addition, the vast majority of survey respondents (~79%) were either somewhat worried or very worried that intrusive tracking measures enacted by the government would continue long after the COVID-19 pandemic has been defeated, with only ~9% not being worried at all.