Will Privacy Survive COVID-19?

As entire populations, nations, and markets are brought to their knees by the accelerating chaos of COVID-19, the disease caused by the novel coronavirus, one thing is clear: when the world eventually recovers – whether that is within months or far longer – it will be a fundamentally different place. Many of the shifts are still unknown, but the seeds for some changes have already been sown.

One issue that warrants close attention is the deployment of new and enhanced surveillance. The close monitoring of movements is fundamental to slowing the spread of the virus – which is to say, the close monitoring of humans who are now or may become its hosts. Countries around the world have implemented a variety of techniques to this end, with varying degrees of success. In the disorder that accompanies "state of emergency" declarations, new mechanisms of social control are being introduced at an accelerating pace, bypassing checks and balances that might prevent them from being approved under less chaotic circumstances.

China has mobilized the full force of its AI-based surveillance dragnet to limit the spread of the virus, two months after new daily cases peaked. In nearby Taiwan, Singapore, and Hong Kong, early contact tracing and other tracking measures – as well as lessons learned from the SARS outbreak – enabled its containment internally, though a second wave of cases brought in from overseas travelers has been rising. Some governments are characterizing the virus as an "enemy" or "terror threat" to trigger intensive counterterrorism surveillance in their fight against it.

In Western Europe, the United Kingdom and the United States – where constitutional protections of individual privacy and other civil liberties may act as a guard against intrusive monitoring – surveillance has not yet been integral to virus responses by state actors. It is these states that are, at the time of publication, among the nations struggling most to hamper the virus's spread. How privacy fares in these places is still an open question. In the UK, emergency legislation was passed with serious consequences for civil liberties and, across the Atlantic, similar emergency powers have been proposed by the U.S. government.

In the following feature, The Privacy Issue investigates the monitoring mechanisms that four governments – two democratic, two authoritarian – have launched in response to coronavirus. We analyze what these cases collectively reveal about emerging trends, which may become the "new normal" standard for surveillance around the globe and survive long after the crisis has subsided.

China: Upgrading the Dragnet

Soon after China first informed the World Health Organization that a novel coronavirus had broken out in Wuhan, Hubei Provence – on December 31, 2019 – President Xi Jinping launched what came to be known as a "people’s war" on the virus. The full force of the government’s powerful, high-tech surveillance apparatus was unleashed in an attempt to contain the virus. This response was combined with an unprecedented lockdown of Wuhan, followed by other cities around the country, and censorship of any mentions of the disease or criticism of the government response on social media.

In the early days of the outbreak, the government’s strategy focused on a host of advanced AI technologies, including real-time facial recognition cameras, cellular location tracking technologies, and software utilizing natural language processing to identify and communicate with people suspected of carrying the disease as they traveled.

Al Jazeera reports that there are an estimated 250 million surveillance cameras across China, and their capabilities are quickly advancing. Every underground station in the city of Zhengzhou now has facial recognition gates. Combined with infrared temperature scanners, these technologies have been used to track down "super spreaders" – people considered threats to public safety by concealing their travel history or violating home quarantine orders. “The situation now is a bit like wartime; the government needs to take some emergency action, some [of which] may inevitably infringe on citizens’ privacy,” Beijing-based lawyer Yuan Chenghui told the South China Morning Post. Those infringements have indeed occurred, manifesting in sustained harrassment. Recent travelers to Wuhan had personal details – including photos and phone numbers – leaked on social media, triggering insults and even death threats.

Public shaming – from police officers, the government, and fellow citizens – has also taken more unconventional forms, such as drones equipped with cameras and loudspeakers. These drones follow citizens and publicly denounce them for failing to wear masks, a practice that some provinces have made compulsory in public spaces. A video posted on Twitter by the state-supported newspaper Global Times shows citizens in different parts of the country being chased by drones that speak directly to them, telling them to put on a mask or go inside.

Beyond existing surveillance technologies, new tracking systems have been instrumental to the Communist Party’s efforts to monitor the coronavirus’s spread. Together with tech giants Alibaba and Tencent, the government has introduced "Health Code" QR systems. In the version run by Alibaba-owned Alipay, individuals fill out an online form with their ID number, travel history, and any symptoms they may have before being assigned a color-based QR code that indicates their health status. All-clear green allows for unrestricted travel, medium-risk yellow compels people to stay inside for seven days, and high-risk red necessitates a 14-day quarantine including regular updates via a chat app. The systems have been rolled out sporadically, first at travel checkpoints, but have also been adopted by supermarkets and apartment buildings.

In the special administrative region of Hong Kong, where pro-democracy protests were sustained for nearly a year before the outbreak of COVID-19, location tracking is also becoming a fact of daily life. Victor Lam, Hong Kong’s Chief Information Officer, announced that the region would monitor people under quarantine via new enforcement technology. Hong Kong residents who are put under quarantine must wear a wristband that not only tracks their location but also tries to encourage social distancing, all tied to a mobile app released by the government.

This combination of intensive tracking measures by China, which has pushed privacy aside in the name of disease control, is being touted as a crucial element that has enabled China to slow down spread of the disease. As Arthur Reingold, an infectious disease expert at the University of California, told the Wall Street Journal, “China has proven that maybe if you are draconian enough, if you put enough resources into it, you can actually retard transmissions.”

Though the efficacy of these measures may not be in doubt, a severe loss of privacy and autonomy has been the cost. Experts on the subject emphasize that Xi Jinping’s powerful tech dragnet shows no signs of relenting. Maya Wang, senior researcher on China at Human Rights Watch, suggests the coronavirus could “serve as a catalyst and a boost for China’s development in mass surveillance systems,” CNBC reported. Another expert on China, Nigel Inkster, senior advisor at the International Institute for Strategic Studies, agrees: “Once the dust has settled, reviews will be conducted and adjustments made. I don’t think [China] will need more capabilities than they already have, but they will want to fine-tune them and work towards greater systems integration.”

South Korea: Building a Panopticon

Unlike China, the democratic republic of South Korea – which was reporting 909 new cases a day at its peak on February 29, 2020 – chose not to place its cities on lockdown, and instead launched what has been touted as a highly-sophisticated and meticulously-organized testing program, involving over 5200 tests per million residents. For comparison, the United States has so far initiated around 125 tests per million residents at the time of publication. People confirmed infected – and anyone who has come within a two-meter radius of them, or been in the same room as a "confirmed carrier" while that carrier coughed, are placed under a compulsory two-week self-quarantine. As of early March, that applied to over 30,000 people.

To enforce these specific rules – which are part of Seoul’s so-called "maximum" action virus containment plan – the government has developed a "self-quarantine safety protection" smartphone app to keep tabs on quarantined citizens. Using GPS to track their location in real time, the app allows officials and case officers – who are assigned to each person under quarantine – to keep tabs on their exact whereabouts. An automatic alert is sent both to the patient and the case worker if any out-of-the-ordinary movements indicate the breaking of rules.

The location of South Koreans diagnosed with coronavirus isn’t limited to patients and their case workers, however. The Washington Post reported that the government has been keeping a public "virus patient travel log" which shares the movements of people diagnosed with the virus before they became infected, along with their sex and age – though names are removed. The location data is collected via a powerful combination of technological tracking mechanisms, including “GPS phone tracking, credit card records, surveillance video and old-fashioned personal interviews with patients.” While names are removed, personal identities are not difficult for friends and family to determine from the information at hand.

This can lead to invasive consequences for the individuals involved, given that bars and love hotels are on the list of locations that are pinpointed in city-wide text messages, along with the time and date of a visit – “Magic Coin Karaoke in Jayang-dong at midnight on Feb. 20,” for example, or “Imperial Foot Massage at 13:46 on Feb. 24.” The potential harms of this shared information are particularly pertinent to already-vulnerable communities such as LGBTQ+ people, who may already face stigmatization, shame, and threats to their personal safety.

South Korea’s public travel log brings the public safety/privacy trade-off into sharp focus. While many citizens are currently prioritizing public safety, voluntarily sharing information on others with the authorities, some are beginning to take the implications for their privacy seriously. The Washington Post reported that a coronavirus patient in Busan whose movements had been shared on the public travel log submitted a privacy complaint to the country’s National Human Rights Commission. The Commission supported the complainant, stating that the public location tracking log was "beyond necessity."

The current practices in South Korea, which combine and share specific private information in public, is unprecedented in the country's history, as Mr. Goh, an official at the Korea Centers for Disease Control Prevention, told the BBC. He added, “After the spread of the virus ends, there has to be society’s assessment whether or not this was effective and appropriate.” When the immediacy of the threat to public health subsides, it is likely that general public sentiment will fall on the side of "no". 

Iran: Dubious Protection and Data Collection

As the country hardest-hit by the coronavirus in the Middle East, with a steep daily rise in new coronavirus-related deaths that includes a large number of government officials, Iran has come under fire for its handling of the outbreak. The government’s initial denial eventually morphed into a slow and inconsistent reaction, including patient number suppression and disinformation about the virus in an attempt to, as the New York Times puts it, "save face".

To limit the spread of the virus, an official state Android app, "AC19", has been released. The app purports to "detect infection" within moments by asking users to answer a set of multiple choice questions. A message from the Ministry of Health tells citizens: “Dear compatriots, before going to the hospital or health center, install and use this software to determine if you or your loved ones have been infected with the coronavirus.”

Beyond AC19's stated purpose, however, the app serves as an effective data collection mechanism. Coded with the same location tracking software that is commonly used in motion-detecting fitness apps, it collects users’ real-time locations, as well as their names, phone numbers, addresses, and birthdates. According to VICE News, though the app prompts people for permission to share their exact location data with the government, this notice of consent is far from sufficient – it is automatically shown in English, and for users who have an older operating system, no prompt is displayed at all. As MJ Azari Jahromi, Iran’s ICT Minister, shared in a tweet, over 3.5 million Iranian citizens have given the government their personal details, including their precise movements at any given moment.

Under President Hassan Rouhani, Iran has a history of mass data collection and population monitoring via apps, especially in times of turmoil. During the November 2018 uprising, the same company that built AC19 created two alternatives to the end-to-end-encrypted (E2EE) chat app, Telegram, which were allegedly vulnerable to monitoring by the Iranian intelligence agency.

The data collection enabled by AC19  appears to be the next iteration of the state’s ongoing mass monitoring of its citizens – and fundamental to the regime’s struggle to for power. As Shahin Gobadi, spokesperson for the National Council of Resistance of Iran, told VICE, “The regime’s survival is intertwined with suppression, surveillance, espionage, and intruding in the most personal affairs of the Iranian people. It does not spare any opportunity to intensify its efforts, even at the time of such a major crisis such as coronavirus.”

Israel: War on Terror Meets Pandemic

Tracking technology has also been adopted by Israeli prime minister Benjamin Netanyahu, though to a far greater extent – and, unlike the Iranian regime, the Netanyahu administration has been transparent about its plans to implement a temporary "cyber surveillance" program. At the time of publication, the proposal still requires an official sign-off from the Knesset subcommittee, but has already gained the approval of the attorney general, bypassing the need for a court order or regular parliamentary procedure.

If approved by the Knesset, the radical measure will enable the national security service, Shin Bet, to monitor the smartphones of people diagnosed with – or suspected of having – COVID-19. This data will be used to contact people who crossed paths with those affected in the 14 days before the confirmation of their cases. There are, the government assures, limits: any information gathered can only be used for the specific purpose of fighting the disease, and the program will only last for 30 days after it has been authorized. “We are waging a war that obligates using special means, and therefore I sought the approval of the Justice Ministry,” Netanyahu announced in mid-March, acknowledging the resulting invasion of privacy, but stating it was justified. “This gives us a very effective tool.” Effective because, as analysts told The Washington Post, “the question in monitoring a coronavirus patient and a terrorist is largely the same: Who are their contacts?”

Criticism of what has been called a disproportionately-intrusive measure has poured in, both from around the country and international human rights watchdogs. Much of it centers on the fact that Netanyahu called upon the secret service, as opposed to a more accountable agency such as the police or the Ministry of Health, to carry out his order.

The near-limitless scope of Shin Bet’s counterterrorism powers means that every Israeli can be surveilled at any given moment. Unlike other Israeli government agencies, the security service has direct access to cellular data – and is not subject to public accountability or transparency requirements, meaning precisely what data is collected and how it is used may never be revealed, let alone reviewed. As attorney Avner Pinchuk of the Association for Civil Rights of Israel told the Times of Israel, enacting the cyber surveillance program to track potential coronavirus carriers “does not justify the severe infringement of the right to privacy. The danger of COVID-19 is not only the virus itself, but the fear that as part of the efforts to overcome the danger, we will also lose our basic values as a free and democratic society.”

Privacy, Post-Coronavirus

When the dust settles, what do these case studies – highlighting four different approaches to mass surveillance, enacted by two democratic and two authoritarian governments, each with their own specific set of circumstances and challenges – reveal about the future of privacy? There is no doubt that an unprecedented pandemic calls for unprecedented measures – taken swiftly and resolutely, but also in a rational manner that is consistent with human rights and civil liberties.

Many citizens around the world recognize the need for enhanced monitoring and data sharing, and are proactively communicating information like past movements, location data, and contacts with their governments. The understanding, however, is that this sharing is for a specific and extreme purpose. Do the ends justify the means? The surveillance strategies of the four countries profiled here appear to be of varying success – but the myriad other factors involved in the crisis response, such as quarantine regulations, healthcare systems, virus testing, media reporting, and government transparency are not easily extrapolated from one another.

In the United States, the United Kingdom and Western European countries like Germany, Italy, and Spain, the virus is spreading at exponential speed, yet no such measures as live location tracking via apps or cellular data have been implemented at the time of publication. However, there are reports that the United States has held talks with Google and Facebook about the potential of using such tactics, such as cell phone and GPS data, to monitor the virus’s spread. Given the high value placed on civil liberties by the population, the rights enshrined in the U.S. Constitution, and the increased awareness that followed the Snowden revelations, time will reveal how enhanced tracking measures will be balanced with privacy concerns, as well as the public's response.

However strong civil liberties may seem to be within a society, however open and democratic a country is, once a government has gained enhanced powers to collect and process information on its citizens – with or without due process – there are few incentives to roll back the clock. Forms of surveillance which would have been regarded as draconian before an emergency, such as tracking citizen whereabouts in real time, often become the accepted norm. This contributes to "surveillance creep", widening the scope and power of the state's mandate.

There is a high likelihood that the new and upgraded technologies implemented during the panic to slow COVID-19 will remain when the pandemic has abated, continuing to accelerate the pervasiveness and intensity of surveillance around the globe. What remains to be seen is the extent that they raise the bar.