To beat coronavirus, we’ll have to give up our privacy

We’ve got some bad news for you: the coronavirus isn’t going anywhere anytime soon.

While a lot of people are hoping that this will blow over in a month or two, new research [pdf] by the Imperial College COVID-19 Response Team shows that we might have to deal with the effects of the pandemic – school closures, social distancing, closed borders, overrun hospitals, lost income –- for at least another year. 

The authors make it clear that this kind of suppression will probably have to continue for about 18 more months until the vaccine is widely available, or else the spread of the disease “will quickly rebound if interventions are relaxed.”

Yup, that’s right: 18 more months of this. In fact, even worse than this, since you can bet that whatever our situation is at this very moment, next week will most likely be worse.

These are tough pills to swallow. But it doesn’t mean we can’t do anything about it. 

In fact, while the pandemic may have started in Asia – specifically, Wuhan in China – most Asian countries are handling the coronavirus exceedingly well. 

For example, China, Taiwan and Hong Kong are each adding only 10-30 new cases per day. Compare that with the situation currently unfolding in Europe:

• Italy: 6,000 new daily cases 
• Spain: 6,000 new daily cases
• Germany: 3,000 new daily cases

There are many factors that contribute to the Asian handling of this crisis, including a quick readiness, lots of daily testing, and most importantly – the accurate tracking of sick and potentially sick people throughout the city and country. 

But in order to achieve that, these populations had to give up something that Westerners hold dear – their right to privacy.

The Singapore case

While Singapore was one of the first countries (okay, city-states) to be hit by the virus in early January, to date there have only been about 700 confirmed cases. One major factor for this success is how quickly Singapore is able to uncover the way patients first got infected and how many people they may have infected.

Rather than taking days or weeks, Singapore is able to do all that in just two hours. But the cost of that is an almost complete lack of privacy for the infected individuals.

On covid19 SG, you can track all cases of infected individuals and see an eye-opening amount of detail for these cases. It’s a remarkably useful site, where you can even analyze the clusters of people and places where coronavirus infections have led to breakouts:

Click on any of those individuals, and you’ll see something similar to this:

While there is no name listed, you get the patient’s age, coronavirus-related medical history, work location, occupation, and even residential address.

In other cases, you’ll get citizenship data (if they’re not Singaporean) and travel dates and locations.

Again, this is remarkably useful. Imagine being able to know if you’ve been in the same place at the same time as this confirmed case. Then, you can go to a nearby hospital if you interacted with the patient and get yourself checked out.

That’s great.

But there’s a large Western part of my brain that’s looking at this and becoming extremely uncomfortable. If I were Case 141, any of my neighbors or colleagues, would know that that person...is me. And since it’s out there for anyone to see, who knows what some malicious actors can do with my personal, private, sensitive data?

In many Asian countries, people have a different approach to privacy. For example, one businesswoman that helps Western companies enter the Chinese market, says that she often has problems translating the word “privacy” into Chinese. “In China, people identify with a group, and privacy is a non-existent concept.”

On the other hand, we have countries like the United States where privacy is a basic right that covers all areas, including healthcare. Take HIPAA for example -- a privacy law that gives patients the ultimate choice in who gets to see their medical data, and when. This sense of privacy is so deeply ingrained in the country’s DNA that US citizens are willing to accept less security in the face of terrorism in order to maintain privacy and civil liberties.

But in reality, those were different times. Now, there’s only a pre-pandemic society, and a post-pandemic society.

If we want to survive long enough (physically, economically, and even politically) to see a post-pandemic society, we’ll probably have to adopt the Asian sacrifice of privacy in order to maintain social order and assured survival.

How to give up your privacy, safely

When we’re talking about private data, we mean your real-time GPS location, demographics, your work and residential addresses, phone number, personal and professional contacts, and maybe more.

There are some important risks to consider when giving up this privacy, including:

• Unauthorized usage – the authorities may access our personal data even in situations unrelated to coronavirus mitigation
• Unsecure systems – infrastructure that houses and processes an entire nations’ worth of private data would have to be very secure (imagine a WannaCry-type ransomware on that data)
• Unethical usage – to increase their funding, governments may feel tempted to sell some of this data (however “anonymously”) to private companies so that they can sell us better ads

A promising privacy-oriented tool

While Singapore has now agreed to open-source its contact-tracing app and make it freely available to developers around the world, better solutions might be right around the corner. A team of researchers from Harvard, MIT, Facebook and Uber have already come up with a way to accomplish Singaporean transparency while maintaining Western privacy.

Private Kit: Safe Paths is a free, open-source app that allows people to see if they might have interacted with someone infected with the virus. The patient would have a choice to share that information anonymously with other users who can then understand if they were exposed to the virus based on time and place. The patient can also choose to share their location data with health officials. 

It’s very similar to Singapore’s model, except that no names, addresses, workplaces or any personal information is shared without the patient’s consent. Even more, the location information is encrypted and shared within the app network, so it does not rely on a central authority to store and process the data.

This is very promising, but of course there are some drawbacks:

• Size: In order for it to work, the app would have to be used by a large number of people in order to be effective. This might require government intervention if the spread becomes severe enough, which itself can require further compromises of user privacy or choice
• Reliability: people have to be certain that the information they’re getting is dependable. As it is, the can be abused by simple tricksters who want to cause panic, whereas the Singaporean model relies on data given to hospitals and other authorities
• False sense of security: even if there’s a good adoption rate, the information won’t be complete. People may get a false sense of security about a certain location if there aren’t any reported cases within that area. They’ll avoid the known hotspots, and congregate in the unrecognized hotspots

But even with all these disadvantages, it’s important to remember that it’s still early on in the coronavirus fight, and we’re likely to see a lot of great solutions that provide adequate levels of privacy. In time, as more people understand and accept the depth of this crisis, they’ll be more willing to change their behavior, including using apps like these without abuse, and letting go of any dreams of pre-pandemic privacy.

Thinking beyond the coronavirus crisis, in time we’ll likely accept that a temporary suspension in privacy is necessary to stop future pandemics for which no vaccines exist.

And considering the speed at which the world is changing in this current crisis, that time may be right around the corner.