U.S. map illustration for a story on how coronavirus researchers want to use phone tracking, but with strong privacy controls

In the global scramble to contain the coronavirus pandemic, health experts and governments are thirsty for more information about how the virus is hopping from person to person. Many countries are considering—or already implementing—extraordinary surveillance programs to track people's movements and who they come in contact with, even in passing.

These projects raise a thorny question with lasting impact: How much digital privacy is worth sacrificing in the name of fighting a fast-spreading disease?

Over the past two weeks, a White House task force and other government groups have reportedly been in discussions with technology companies including Facebook and Google over how the personal data they hold about Americans could be used to track people potentially exposed to the virus.

More on the Coronavirus

Palantir and Clearview AI, two companies reportedly talking to different levels of government about coronavirus projects, have previously helped law enforcement set up powerful surveillance systems, quietly using vast troves of data collected on ordinary Americans not suspected of any wrongdoing. 

These partnerships would normally draw sharp criticism from civil liberties watchdogs. But even some of the most strident advocates of individual privacy say the urgency of the moment trumps their usual concerns. “We need a massive surveillance program,” argues Maciej Cegłowski, a prominent privacy expert, in a recent widely circulated essay. However, others warn that previous expansions of surveillance by the government have proved nearly impossible to claw back once a crisis subsides.

As it turns out, a devil’s bargain that trades privacy for public safety may not be necessary. Speaking out this week, a group of scientists who study the spread of disease argue that the kind of data they need most doesn’t have to interfere with civil liberties. 

“Accessing data from apps and devices raises legitimate concerns about privacy,” says Satchit Balsari, an emergency doctor and technologist at Harvard. “But there is a large body of research that shows how these data can be used responsibly, while minimizing harm to individuals.”

Balsari is one of 19 doctors, epidemiologists, disease-modeling experts, and data-privacy scholars in a newly formed group—the COVID-19 Mobility Data Network—that aims to use aggregated, anonymous data from technology companies to guide officials as they make public health decisions in response to the pandemic. The researchers say they don't need the intrusive measures reportedly being discussed in Washington. 

The group wants to provide constantly updated answers to a key question: Are people listening to officials when they’re asked to stay home?

Why Scientists Want Consumer Data

In a letter published Monday in Science, a top academic journal, the researchers said they want to track how many people move every day between broadly defined locations—like from neighborhood to neighborhood, or county to county. That can show whether people are staying put, as they have been asked to as a part of social distancing policies meant to slow the spread of COVID-19.

The question is critical for a public health debate now taking place. Tension is brewing over when to lift restrictions on the movements of millions of Americans. The ringing consensus from public health experts is that it’s still far too early to go back to normal, but President Trump has said he wants to see social distancing policies loosened by Easter.

“This is urgent, because social distancing is the only intervention we have to stop this epidemic right now—there are no treatments and there is no vaccine,” says Harvard epidemiologist Caroline Buckee, who leads the group of researchers. “It’s essential to know whether it’s working, and how much.”

If scientists get daily doses of aggregated mobility data, they can see the effects of small policy changes, such as a specific school closure, or a ban on dining in restaurants or bars. Without this information, several disease-modeling experts tell CR, state and local governments are flying blind.

Experts say that mobility data will also be vital for gauging the impact when businesses do reopen. “Such analysis will contribute to our understanding of what the barriers to implementation are, how communities are differentially impacted, and what rollback strategy will be the safest, and harm the least number of people,” Balsari says.

More Data Sharing to Come

Aggregated mobility data lumps together information about many people but doesn't reveal the movements of individuals. 

These details can come from companies, including technology giants and data brokers that specialize in providing location data on individual consumers. These companies pass along summarized versions of the data they have already collected to disease researchers, but not before setting up strict restrictions about how that data can be used.

Scientists already employ aggregated location data. Among other things, they used it to track an international Ebola epidemic several years ago.

“We’ve been doing this for years,” says Andrew Schroeder, director of research and analysis at Direct Relief, a global health nonprofit. His organization has used aggregated movement data from Facebook since 2017.

Direct Relief didn’t have to change its data-sharing agreements with Facebook to begin studying the coronavirus, says Schroeder, who co-signed the Monday letter. “We didn’t ask for new information.” He emphasizes that the data-sharing contracts strictly limit the ways researchers can use sensitive location data. “It spells out very clear do's and don’ts around the purpose of this information,” Schroeder says.

However, scientists don't have easy access to all the data they want.

Researchers typically have one-on-one data-sharing agreements with various companies, so each researcher ends up with a small slice of information. Buckee, Schroeder, Balsari, and their colleagues want to pool and organize this data so that a much larger group of experts can get a more complete picture of people’s general movements.

So far, the Mobility Data Network has announced that it will receive data from Facebook, a marketing company called Cuebiq, and Camber Analytics, a location data firm.

The scientists say they want to become a “trusted intermediary” between private companies and public officials—sidestepping worries about giving the government direct access to information on Americans’ movements. Officials could ask for help in making critical policy decisions, but they wouldn’t be able to muck around in the data directly or reuse it for another purpose, like policing or immigration enforcement.

That’s in contrast to other countries that have set up intensive surveillance systems in response to the coronavirus, like China, South Korea, and Israel, where governments have been at the very center of the operation. Israel’s domestic intelligence agency, for example, deployed its own extensive surveillance apparatus to monitor where people move and notify them if they’ve crossed paths with someone who comes down with COVID-19.

What the Data Already Shows

Several ongoing projects show what can be gleaned from the detailed data that’s already been analyzed by private companies.

On New Year's Eve, a Canadian tech company called Blue Dot was among the first to warn about a potential disease outbreak starting in Wuhan, China—beating out the World Health Organization by more than a week. The company relies on publicly available information such as local news reports, flight ticket sales numbers, and climate data to forecast the spread of disease.

Last week, a location data broker called Unacast started using smartphone location data to grade every U.S. state and county based on how strictly its residents appear to be adhering to social distancing guidelines. Descartes Labs, a location data company, ran a similar analysis and found that the movement of residents in California fell by almost two-thirds after Governor Gavin Newsom implemented a statewide shelter-in-place ordinance.

Descartes Labs tells CR that it's discussing sharing location data with several state and local governments, but not with any federal agencies.

Any direct-to-government sharing is still extremely nascent. When CR asked the seven public health agencies in the San Francisco Bay Area that imposed a shelter-in-place order last week whether they are making use of mobile location data, the five that responded said they are not. The Centers for Disease Control and Prevention and the Federal Emergency Management Agency did not reply to requests for comment before this story was published.

Google tells CR that it is considering sharing aggregated, anonymous information about people’s movements with government officials but declined to provide more details. Facebook tells CR that it has not received a data request from the federal government, but it didn't provide information about state or local government contacts.

Avoiding Privacy Pitfalls

Privacy experts say they're much more comfortable with researchers using aggregated data rather than information about individuals, and they prefer to keep the data in the hands of researchers rather than the government.

After a major disaster, “there’s a quick knee-jerk reaction to do anything necessary or everything possible to remedy the problem, whatever it may be,” says Ashkan Soltani, a privacy researcher who has served in the Federal Trade Commission and the Obama administration.

But Americans should be wary of the government building a surveillance system that could later prove difficult to dismantle, Soltani and others say.

“Government and researchers have a compelling need for data given the public health crisis, but information gathering and sharing should still be carefully scoped to what's reasonably necessary and proportionate to achieve a particular aim,” says Justin Brookman, CR’s director for consumer privacy and technology policy.

“Our top priority is having clear red lines and boundaries in terms of what information is being used, who’s getting it, and when the expiration date will be,” says Matthew Guariglia of the Electronic Frontier Foundation, who co-wrote a guide to preserving privacy during a health crisis.

As governments and companies kick around ideas for new surveillance systems, academics are pushing to expand their research now, with the systems they already have in place.

“We really need to scale [research] fast, and we don’t really have a whole lot of time to get stuck in a bunch of debates about these things,” Direct Relief’s Schroeder tells CR. “Let’s just use the tools we’ve got to the best of our abilities to help guide decision-making.”