The U.S. is in the throes of a pandemic caused by the SARS-CoV-2 virus, COVID-19. Realizing that long-term lockdowns are not sustainable, governments are seeking alternative methods of controlling the pandemic. “Testing and tracing” has been touted as a way to reopen economies with the pandemic still raging. While testing has its own set of privacy challenges, the methods discussed to accomplish contact tracing are rife with problems.

In simple terms, contact tracing involves determining who has had contact with an infected individual and notifying them of potential exposure to the virus. However, with the scale of this pandemic, traditional methods of manual contact tracing will likely prove unworkable. Estimates are that manual contact tracing would require at least 100,000 contact tracers and would cost billions. Given these problems, governments are turning to smartphone app-based contact tracing as an alternative.

To be effective, any contact-tracing application will have to be able to tell who was at the same location as an infected person at the same time. That means that information regarding the location of devices running the contact tracing app will have to be stored somewhere, and that information will have to go back for some period of time, perhaps months. If someone contracts COVID-19 and visits their local Starbucks, health officials will need to query that database to determine who was at that same Starbucks on that particular day at that particular time. In other words, whether it is on a centralized database or on the device of each individual user, vast amounts of data regarding one’s exact location will have to be stored for long periods of time. 

Recognizing the privacy pitfalls of a centralized location information database, Apple and Google have partnered to utilize Bluetooth technology in contact tracing. Under the Apple-Google model, devices that are within a certain proximity of one another for a certain period of time exchange unique identifiers and store them for future reference. If one of the owners of those identifiers later becomes infected, that information becomes available to users whose devices have been in close proximity. However, despite its decentralized nature, the Bluetooth model still necessarily involves the storage of mass amounts of location data for an extended period of time.

Whichever model is used, the participation of a large percentage of the population is necessary for contact tracing to be effective. A recent study by Oxford University found that 60% of a population would need to use the tool for it to work effectively. While a mandatory participation regime solves the problem of sufficient participation, in the U.S., it creates constitutional problems that are likely insurmountable. If a voluntary regime is used, privacy concerns must be sufficiently allayed to attain public buy-in. 

Function creep is a well-known phenomenon in the privacy arena. Information collected for one purpose tends to be used for ever-expanding and undisclosed purposes. It is a particularly serious concern with respect to the information collected by contact tracing apps. And while the risks of misuse by private companies and nefarious actors have been well discussed, the history of a different type of seemingly unrelated personal information demonstrates a little-discussed risk of function creep with respect to contact tracing apps.

In 2017, law enforcement in California used a database of genetic information called GEDMatch — which was designed to allow individuals to share the results of genetic tests obtained from companies such as 23andMe or AncestryDNA for the purposes of locating relatives and assisting in genealogy research — to identify the Golden State Killer, a serial rapist and murderer who terrorized Northern California in the 1970s and '80s. The identification of Joseph James DeAngelo as the perpetrator of these crimes was hailed as a model of good police work. However, GEDMatch faced backlash from customers for allowing what amounted to a massive warrantless search for a purpose never disclosed to customers before they voluntarily provided their genetic information. 

The Golden State Killer instigation illustrates the irresistible nature to law enforcement of massive databases like GEDMatch and, perhaps, the location information that will have to be created to trace COVID-19 exposures. Faced, for example, with a murder or rape that occurred at a particular location, will law enforcement be able to resist the temptation that this huge collection of location information will present? The lessons of GEDMatch suggest that the answer is no.

The first instinct of privacy professionals is to specify the uses to which information will be put in their terms of use. However, again, GEDMatch demonstrates this is unlikely to sufficiently allay the concerns of privacy-conscious individuals. After the uproar regarding law enforcement access, GEDMatch changed its policies, requiring user opt-in for sharing of genetic information with law enforcement. Faced with a vastly smaller database of genetic profiles, police turned to search warrants in order to access the coveted information. In 2019, a Florida judge issued a search warrant for the entire GEDMatch database, not just the pool of data of individuals who opted in to law enforcement access. And as recently as February 2020, Ancestry.com revealed that it had been served with a search warrant issued by a Pennsylvania court seeking access to its entire database of some 16 million genetic profiles, despite promises that it would not permit any law enforcement access. It requires no stretch of the imagination to worry that similar search warrants will be sought for contact tracing databases.

That privacy-conscious individuals would be concerned about these possibilities with respect to contact tracing databases is not mere speculation. After GEDMatch changed its policies to only give police access to genetic profiles of individuals who consented, less than 15% of genetic profile owners opted in. As studies suggest that upward of 60% participation is needed for contact tracing to be effective, more than mere policies will be needed to obtain the necessary public buy-in.

Given the short time frames governments have to work with, how can these privacy concerns be satisfied? Based on law enforcement’s demonstrated willingness to use the court process to compel access to similar databases, it is likely that legislation is the only sure way to guarantee users that their location and contact information will not be subject to similar function creep. Legislatures in states that use contact tracing apps would do well to consider passing legislation that would do the following:

1. Prohibit law enforcement from accessing or using location/contact information created from contact tracing.
2. Prohibit the issuance of search warrants or subpoenas seeking access to that information. 
3. Provide that any information derived from unauthorized use of contact tracing data would be inadmissible in any civil or criminal proceeding.

Function creep is not a new concept in the privacy world. It is precisely the history of "collect for one purpose and use for a vastly different purpose" that has created such distrust between data collectors and members of the public when it comes to personal information. If governments really want the kind of public buy-in that would make contact tracing work, they will likely need to consider swiftly enacting legislation that will minimize that risk.

Photo by magnezis magnestic on Unsplash