Cyber risks involved with digital contact tracing

Health officials are recommending time-honoured techniques to help reduce the spread of the novel coronavirus. Today’s technology can make these methods more effective than they’ve ever been, a researcher argued recently, but that means people would have to sacrifice one of their most valuable possessions — privacy.

A recent KPMG survey found that 92% of Canadians believe balancing privacy and public safety is a priority if new-age technology were to be used in the fight against the novel coronavirus. They fear their data could fall into the hands of nefarious actors and put their civil liberties at risk.

“The principle tools being used for managing COVID-19 are truly ancient,” said Robert Muir-Wood, chief research officer at risk modelling and insights firm RMS. The four main tools are quarantine, confinement, social distancing and protective sequestration.

Robert Muir-Wood of RMS speaks during RMS Exceedance 2020, which was held virtually.

“All of these methods date back hundreds of years, and all of them are being actively used in the management of the COVID-19 pandemic,” he explained during a keynote presentation of RMS’s conference Exceedance 2020, which was moved to a virtual event due to the pandemic. “And yet, technology has transformed how we live and work during social distancing.”

Think of the technology available today that wasn’t around 20 years ago, Muir-Wood said. From video conferencing to entertainment, and the ability to purchase anything online, technology has made it easier to social distance than ever before.

Technology can also help to reduce infection rates below a threshold level of hospital admissions, he said. Three balls must be juggled to make this happen:

• Re-establishing comprehensive contact tracing, testing, quarantine and containment to isolate a high proportion of potential sources of infection.
• Predicting sources of human contact and transmission associated with each economic sector (such as primary education, for example, or manufacturing) before that sector re-opens.
• Get smarter at measuring the real-time COVID-19 transmission rates, instead of waiting three weeks to see how many are seeking hospitalization.

The easiest way to accomplish these goals? Track people through credit card and smartphone data.

Muir-Wood brought up the example of an Austrian app called “Stop Corona” that allows users to keep a digital diary of the people with whom they’ve come in contact. But people have to ask for others’ consent.

“Charge card data is being used for locating people and their interactions in Hong Kong and China. Smartphone data is also being harvested in Europe and the U.S.,” Muir said, before referring to a Google/Apple initiative.

Digital instruments can become epidemic monitoring tools, Muir-Wood said. “The initial idea is only to study aggregate, and therefore anonymous, data. However, such data can become much more powerful if also linked with instant contact tracing.”

“The initial idea is only to study aggregate, and therefore, anonymize data. However, such data can become much more powerful if also linked with instant contact tracing.”

Which brings up the concerns about privacy. “Large-scale, voluntary uptake [of these digital methods of contact tracing] will be key. Is there going to be a privacy backlash?” Muir-Wood asked.

Collecting personal data is a touchy subject because of the risks of hacking. Housing private data creates many risks, such as cyberattacks, thus opening the door to cyber insurance claims. Canadians are generally skeptical of private data collection, the KPMG study reported.

Any such collection should be voluntary, said 55% of KPMG survey respondents. About two-thirds said they would not download an app that conducted contact tracing, even as New Brunswick, Manitoba, Newfoundland and Labrador and Saskatchewan are said to be looking at creating apps to track users’ whereabouts. Alberta already launched such an app. However, 62% of respondents told KPMG they would sacrifice privacy for public health.

So, how do you calm the fears of the populace and reduce the risk of exposure? “This deep surveillance needs to be time-limited,” Muir-Wood said. “Can people be convinced [that] adopting their national app and sharing data will be saving lives and frontline medical personnel?”

Feature image by iStock.com/LeoPatrizi