Contact Tracing, Technology, and the Law

Shortly after the seriousness of the pandemic became apparent, the UW School of Law announced a newly created addition to the course catalog entitled "Law in the Time of Covid-19". I jumped at the chance to add it to my course load for the Spring quarter, thinking surely the litany of issues we'll cover will be an enticingly complicated tangle of law, tech, and social issues, among other things. I was not disappointed … it was informative and illuminating. My final paper for the course was a topic of my choosing: contact tracing. As I set out to do some digging, a colleague in Microsoft Research asked me a question I couldn't answer: Can someone be legally compelled to respond to a contact tracing request? Or is it voluntary? So, off I went to find the answer and write the paper. Given the relevance of these topics to much of what we see discussed here on LinkedIn, I am sharing it here as an article, lightly edited for this medium and late-breaking policy changes from Governor Inslee. I hope you find it informative.

INTRODUCTION

The arrival of a long-predicted global pandemic has spurred various efforts around the world to track the propagation pattern of the disease in an effort to slow its spread, thus buying time for the healthcare system to accommodate patients in need of care while research scientists work toward development of drug interventions. In geographies like Asia, experiences with past epidemics have led to advances in contact tracing, a practice that predates vaccines, and was first used in 18th-century England to identify persons who may have been exposed to smallpox. Contact tracers are still equal parts clever detective, empathetic social worker, and committed public health official, but their efforts can now employ digital technology and smartphone apps. Here in the United States, Covid-19 is the catalyst for multiple threads of public debate, including government powers (both federal and state), preservation of personal liberties, technology & data privacy, and the persistent racial, ethnic, and socioeconomic divisions in society. This article will explore several of these threads in varying degrees of depth in an effort to shed light on how state and federal laws empower officials to take enforceable action to slow and contain outbreaks. Specifically, this article will explore the conditions under which public participation in contact tracing can be mandated by the state to achieve the end goal of public health and safety. We will also consider the application of modern contact tracing approaches currently being used in other geographies and contexts by delving into the promise and limitations of digital technology, and the degree to which these well-intentioned approaches can have the unintended consequence of furthering existing inequalities in society.

CASE STUDY: SINGAPORE AND SARS

When SARS took hold in Asia in 2003, it was followed by over two years of struggle across the region to slow the spread of the disease and ultimately contain it. While other countries dealt with multiple waves of outbreak, Singapore, despite having Asia’s third-highest infection rate, managed to contain SARS in just over three months, using contact tracing as the primary tool. The government’s efforts involved placing 8,000 people under home quarantine (including extensive video monitoring), subjecting 4,300 people to telephone surveillance, and issuing electronic wrist tags for quarantine violators. None of this would have been possible, however, without general public surveillance practices that were and remain an accepted part of Singaporean society. Telecommunications firm SingTel has been widely criticized for its role in the government’s mass surveillance of citizens, but this arrangement “appears to generate little controversy among Singaporeans, where state surveillance in the form of CCTV, monitoring of social media, and ‘lateral surveillance’ by peers appear to be an established norm.” In the end, public health and safety goals were achieved, and “Not only did the population comply with the extreme measures, many observers see the government’s handling of SARS as having increased national pride and allegiance to the state.”

With Covid-19, Singapore is taking a similar approach, this time enabled digitally by asking citizens to download an app developed for the pandemic, but government officials have said that three-quarters of the population would have to do so in order for it to be effective, and that they are nowhere close to achieving that goal. Singapore’s past contact tracing experience combined with its enlistment of law enforcement and surveillance infrastructure are assumed. What’s not clear is whether or not an opt-in smartphone app will improve its results.

As Covid-19 spreads across North America, the lessons of Singapore’s successful approach to SARS in 2003 and early learnings from Covid-19 loom large. Those lessons, however, exist in a local cultural context. As we have seen, US efforts to replicate that success depend heavily on America's unique legal, cultural, and social dynamics.

CONTACT TRACING IN THE USA

As Covid-19 spreads beyond any achievable notion of near-term containment, contact tracing proposals and plans abound. Manual contact tracing is a laborious process, with New York City recently announcing a plan to hire as many as 17,000 contact tracers, and a study by Johns Hopkins Center for Health Security estimated that 100,000 new contact tracers are needed nationwide. The process might be hastened through the use of smartphone Bluetooth and GPS-enabled proximity detection, in which mobile device users are notified when they’ve been close to someone who has received a positive Covid-19 test result. Many of these “exposure notification” solutions purport to preserve privacy through avoidance of acquiring personally identifiable information (PII) and location data. Regardless, these smartphone applications are opt-in, which is a default condition of driving adoption and use in a democratic society like the US, in which Americans are fiercely protective of personal liberties, freedoms, and rights, and generally averse to being forced into providing personal data to a government institution for any reason, even public health. It begs a set of questions: in a public health emergency, what are the government’s powers to mandate public participation in contact tracing schemes, either manual or digital? Is a global pandemic an appropriate context to allow citizens the option of not participating in a proven intervention? Does contact tracing have to be done digitally? Are these apps even a good idea?

Let’s first discuss manual contact tracing, independent of digital tools. Contact tracing is an exercise in trade-offs between the benefit of public health and the potential for privacy harms. It’s worth noting that the benefit collectively applies to society, while the harm is distinctly individual. The goal of contact tracing is (among other things) to direct quarantines and isolation based on risk of exposure, with actions enforceable via a mosaic of statutes in all 50 states, many of which became law in the wake of previous infectious disease outbreaks of the last century. The challenge lies in the inconsistency of having “50 different states and 50 different approaches”. More importantly, even though states have clear quarantine and isolation authority, health officials and law enforcement need to know who to quarantine and isolate based on infection potential in the absence of broad testing availability. In other words, the states can exercise power to mandate public participation in contact tracing.

For example, in Washington State, Governor Inslee recently released a set of newly-created restaurant/tavern reopening requirements to force dining establishments to “create a daily log of all customers and maintain that daily log for 30 days, including telephone/email contact information, and time in.” Under normal circumstances, government access to personal data about one’s exact location at a particular time requires a lawful order from a judge or magistrate, but these requirements were supported by the Governor’s “general obligation to keep a safe and healthy facility in accordance with state and federal law” and were enforceable under regulations administered by the Department of Labor & Industry’s Division of Occupational Safety and Health. Regardless, privacy advocates subsequently voiced strong concerns about the potential for harms, resulting in a relaxation of the guidelines to make them voluntary, adding that “businesses should not condition service on a customer’s unwillingness” to provide personal information.

As an aside, the public already voluntarily provides this information to restaurants via non-cash payments, or making reservations, either by phone, the restaurant’s website, or third-party booking services like OpenTable or Yelp Reservations, but the real issue resides in (1) the disclosure of time, location, and health data to the government, and (2) the subsequent phone, email, or text outreach from a contact tracer on behalf of the Department of Health. In a state of emergency, the state’s powers are broad if a requirement seeks to protect a governmental interest (in this case, public health and safety). It’s not clear that notice and consent play a role, given the absence of comprehensive privacy legislation at the federal level or in the vast majority of states. In any case, local governments can indeed compel the public’s participation in contact tracing activities by making documented efforts to contact exposed persons and recommending that they voluntarily self-quarantine. In Washington State, the contact tracer is accountable to the Local Health Officer (LHO) who is empowered to “control and prevent the spread of any dangerous, contagious or infectious diseases that may occur within his or her jurisdiction”. If through contact tracing the LHO finds it necessary to isolate or quarantine a person or group, they have three options to initiate the action: (1) request voluntary quarantine; (2) order an involuntary isolation or quarantine; (3) obtain a court order from a judge for involuntary isolation or quarantine. In the event of non-compliance, the LHO can order an emergency detention “for a period not to exceed ten days”. To detain an individual beyond ten days, the LHO can “petition the superior court for an order authorizing the continued isolation or quarantine of a person or group … for a period up to thirty days.”

Americans often describe accounts of health officials abroad forcibly detaining citizens for quarantine and isolation as “draconian” and “authoritarian”, but similar enforcement powers exist in the US today during a state of emergency. Contact tracing exists to identify people or groups in need of quarantine and isolation, and an order to do so from a local health official is a lawful one in which non-compliance is subject to enforcement. Whether the general public realizes it or not, this is the law of the land, certainly here in Washington State and likely elsewhere in the US. Given the rising tensions across the US relating to lockdowns and stay-at-home orders, using force to detain citizens who refuse to comply with quarantine requests would certainly escalate the situation and is therefore unlikely, but it would be entirely within the bounds of the law.

GOING DIGITAL

Digital contact tracing, or exposure notification, augments manual efforts by providing an automated means of notifying people of exposures to others confirmed to have Covid-19. These smartphone apps are in use all over the world, and have recently been introduced in some states in the US. There are multiple challenges with the apps themselves, their implementation, and the data they collect, giving rise to concerns about privacy intrusions, lack of inclusiveness of certain groups of people, occurrence of false positives and/or false negatives, false senses of security, disinformation, and scams. These concerns exist against a backdrop of limited adoption, which effectively hobbles this effort before it has a chance to deliver benefits. Epidemiologists estimate that digital contact tracing apps require use by 60% of a population in order to be effective, but in North Dakota, a repurposed meeting app deployed for contact tracing had been downloaded by only 3% of the state’s population as of the end of April. Utah was another early-adopter of smartphone technology, having released an app in late April that had only been downloaded by only 2% of the state’s population as of mid-May. According to a poll by the Washington Post and University of Maryland, “more than half of all Americans either do not own smartphones or would not use apps backed by Google and Apple to trace who has been exposed to the new coronavirus.” Similar patterns exist outside the US. In Singapore, fewer than 20% of its population has installed its TraceTogether app since its release in late March. In India, the government’s Aarogya Setu app has seen only 75 million downloads by the country’s 1.4 billion people.

Beyond the voluntary adoption challenges, local government contact tracing efforts in the US that begin and end at state borders represent a fundamentally flawed approach to public health, as Covid-19 travels across state lines along with infected people. This local, fragmented approach of 50 smartphone apps in 50 states is ill-suited to a society in which people travel across state lines for everything from work to essential shopping to caring for relatives. Many states do have domestic travel restrictions in place, and according to FindLaw, “The federal government's authority to order quarantines and travel bans is mainly derived from the commerce clause of the U.S Constitution. Additionally, section 264 of the Public Health Service Act grants the feds authority ‘to take measures to prevent the entry and spread of communicable diseases … between states.’” Regardless, local travel restrictions, which are part of state police powers, are not uniform across the US, and essential workers (who are more likely to be exposed to Covid-19) are generally exempt.

Digital contact tracing approaches suffer from headwinds that are part legal and part cultural. But ultimately, the lack of a national, federally-directed effort renders the expected benefit of these fragmented efforts and the apps they employ marginal at best, and decidedly local. While discussion and debate continue in the midst of this incomprehensible human tragedy, both would be incomplete without attention paid to the implications of these approaches on vulnerable people and those from marginalized communities.

SOCIOTECHINCAL CONCERNS

Early in the pandemic, Covid-19 was described by pundits, the general public, and even New York Governor Andrew Cuomo as “the great equalizer.” It’s not. Not only has Covid-19 exposed divisions and inequalities in society, the use of technology in the form of digital contact tracing apps will likely amplify those divisions. Independent of the apps themselves, we now have enough empirical data on cases and fatalities to know who among us (beyond people with pre-existing health issues) are most likely to be affected by Covid-19: minorities, low-income people, and the elderly.

The New York Times maintains a running tally of case counts around the world, and a US analysis of outbreak hotspots and clusters shows a clear trend of prisons and meat processing facilities, the occupants/employees of which both skew sharply toward minorities, as well as nursing facilities, which are obviously home to the elderly. The introduction of technology-enabled contact tracing, which depends on voluntary adoption, further exposes these inequalities and the distrust that certain groups of people in society harbor towards the government. Treatment of African-Americans by the criminal justice system is well-documented, but the Black community’s historical distrust of the healthcare system is equally fraught, most infamously personified by the Tuskegee Experiment. As the LA Times recently reported, “Now that the nation is in the grips of a pandemic, public health officials must confront a legacy of distrust — handed down from generation to generation — of medical research, healthcare workers and government mandates.” Given this legacy, it stands to reason that the likelihood that African-Americans will download contact tracing apps in any significant numbers is exceedingly small.

Low-income communities are also unlikely to rush to adopt contact tracing apps. Even though in 2019 US smartphone ownership surpassed 70% among people earning less than $30,000 per year, distrust of the government and the healthcare system remain constant companions for these Americans. As Virginia Eubanks writes, “There is a long history of social services and the police collaborating to criminalize the poor in the United States.” She goes on to call out the historical pattern of testing digital decision-making tools in “low rights environments” where legal and political accountability tend to be less reliable. Given what we now know about the socioeconomic distribution of illness and death from Covid-19, the people most in need of support from our best efforts to slow and contain the disease will likely not benefit from these efforts due to a long-held, entrenched distrust of institutions. These inequalities also play out in other countries as well. Singapore has recently discovered a blind spot in its contact tracing efforts: migrant workers, who build and maintain most of Singapore's modern infrastructure. Dorms that house these workers have emerged as the source of cluster outbreaks, leading to a second wave of infections there, giving the country the largest recorded outbreak in Southeast Asia. Societal inequality is not a phenomenon unique to any one country, and great care is required to ensure that well-intentioned technology deployments don’t amplify and compound these divisions. Digital contact tracing apps have never been used before (at least not in the US) and are thus unproven. The societal risks stemming from inequality and lack of inclusiveness that pre-date Covid-19 put these apps on a path to fall far short of their expected benefit and worse yet, amplify harm.

CONCLUSION

Police power exercised by the states provides the regulatory and enforcement capacity to affect the rights of individuals “when those rights conflict with the promotion and maintenance of the health, safety, morals, and general welfare of the public.” This stands in stark contrast to impassioned claims of unconstitutional oppression, seen daily in news media, by Americans who are frustrated and tired of lockdowns, quarantines, isolation, and for millions, an abrupt halt to employment and income. It’s understandable, in many cases heartbreaking, and an intractably difficult public policy problem. Nonetheless, public health interventions such as participation in manual contact tracing can be mandated and enforced by the state. Digital contact tracing, however, has not tested this doctrine, and such a test is unlikely here or in any democracy. The passage from voluntary restaurant info and manual tracing to required app downloads and digital tracing represents a personal privacy rubicon that elected officials would be hard-pressed to successfully defend, even in the midst of the health emergency we face with Covid-19. The lack of universal access to smartphone technology alone creates an inequality that would certainly be met with a legal challenge. Perhaps as we emerge from this experience, we’ll do so with a more enlightened view on what our elected officials are actually empowered to do, and the implications of those powers on our personal privacy against in the midst of increasingly capable technology and existing inequalities in society.