How Coronavirus Is Eroding Privacy

Technology to track and monitor individuals aims to slow pandemic,
but raises concerns about government overreach

In South Korea, investigators scan smartphone data to find within 10 minutes people who might have caught the coronavirus from someone they met. Israel has tapped its Shin Bet intelligence unit, usually focused on terrorism, to track down potential coronavirus patients through telecom data. One U.K. police force uses drones to monitor public areas, shaming residents who go out for a stroll.

The Covid-19 pandemic is ushering in a new era of digital surveillance and rewiring the world’s sensibilities about data privacy.

Governments are imposing new digital surveillance tools to track and monitor individuals. Many citizens have welcomed tracking technology intended to bolster defenses against the novel coronavirus. Yet some privacy advocates are wary, concerned that governments might not be inclined to unwind such practices after the health emergency has passed.

Authorities in Asia, where the virus first emerged, have led the way. Many governments didn’t seek permission from individuals before tracking their cellphones to identify suspected coronavirus patients. South Korea, China and Taiwan, after initial outbreaks, chalked up early successes in flattening infection curves to their use of tracking programs.

In Europe and the U.S., where privacy laws and expectations are more stringent, governments and companies are taking different approaches. European nations monitor citizen movement by tapping telecommunications data that they say conceals individuals’ identities.

American officials are drawing cellphone location data from mobile advertising firms to track the presence of crowds—but not individuals. Apple Inc. and Alphabet Inc.’s Google recently announced plans to launch a voluntary app that health officials can use to reverse-engineer sickened patients’ recent whereabouts—provided they agree to provide such information.

The first global pandemic in an age of ubiquitous smartphones has meant governments now have surveillance capabilities unimaginable during prior outbreaks. Data flowing from the world’s 5.2 billion smartphones can help identify who, where and how people get infected—and lasso in those who might.

The extent of tracking hinges on a series of tough choices: Make it voluntary or mandatory? Collect personal or anonymized data? Disclose information publicly or privately?

In Western Australia, lawmakers approved a bill last month to install surveillance gadgets in people’s homes to monitor those placed under quarantine. Authorities in Hong Kong and India are using geofencing that draws virtual fences around quarantine zones. They monitor digital signals from smartphone or wristbands to deter rule breakers and nab offenders, who can be sent to jail. Japan’s most popular messaging app beams health-status questions to its users on behalf of the government.

Authorities in Moscow said last month they used facial-recognition technology to catch a Chinese woman who broke quarantine and was walking the streets illegally. The police in Derbyshire, England, used drones to spot residents venturing out to a scenic overlook. Kansas recently said it used third-party GPS tracking data to monitor whether people were abiding calls to stay at home.

A little more than half of Americans now back anonymized government smartphone tracking, according to a Harris Poll survey of about 2,000 people conducted between March 28 and 30. In another Harris survey last year, Americans indicated data privacy was the biggest issue facing companies.

The perceived invasiveness of such technologies varies, but the tentpoles are shifting, said Joseph Cannataci, the United Nations’ special rapporteur on privacy rights. “Things are going too fast, and not enough scrutiny is being applied,” said Mr. Cannataci, whose next report to the U.N. General Assembly in October will address coronavirus surveillance and privacy.

Security professionals say the coronavirus crisis could become a watershed moment similar to the Sept. 11, 2001, terrorist attacks, which ushered in new government surveillance powers around the world in the name of protecting public safety. Jim Harper, an original member of the U.S. Department of Homeland Security’s Data Privacy and Integrity Advisory Committee, said that once such surveillance powers are in place, they rarely recede and can be repurposed as a political tool.

Surveillance efforts this time around have a new ally: public-health experts. They say some form of digital tracking will be necessary in the months ahead, even as people return to more normal lives after city lockdowns relax. Billions will live with a continuing coronavirus threat as the world waits for a vaccine.

Until then, technologies can allow officials to quickly identify carriers and stamp out new outbreaks before they spread, said Dale Fisher, an infectious-disease expert who investigated China’s coronavirus outbreak with a World Health Organization team in February.

The biggest privacy debate has centered on the involuntary use of smartphones and other digital data to conduct contact tracing, a process of identifying everyone with whom infected patients had recent interactions. Such tracing typically relies on in-person interviews with the patient. After singling out at-risk individuals, authorities then test and quarantine them, preventing the further spread of disease.

The most aggressive pandemic surveillance so far has been in China. Authorities there used mobile-phone numbers and location data to trace the identities of thousands of residents who had left Wuhan, the earliest center of the outbreak, for other cities over the Chinese Lunar New Year holiday. The information was then passed to local officials and neighborhood minders, who asked the targeted individuals to quarantine themselves for two weeks—even though many had yet to show any symptoms. Chinese authorities also used travel records and security cameras to identify people who had been in contact with the country’s coronavirus patients on trains, airplanes and street corners. Those residents also were put in forced isolation.

South Korea, a liberal democracy and one of the wealthiest Asian nations, built its coronavirus approach on public disclosures and technology. At its outbreak’s peak in late February, it reported more than 900 cases in a single day. This week, the daily average is around 30—without resorting to lockdowns.

A sweeping infectious-disease law passed after South Korea botched its response to a different coronavirus five years ago—MERS, or Middle East respiratory syndrome—authorized officials to produce dossiers of confirmed patients using cellphone data, credit-card transactions and security footage. Authorities are using such information to identify people who have come into contact with coronavirus patients, then encourage them to get tested or stay home.

Suh Chae-wan of the Minbyun Lawyers for a Democratic Society, which focuses on human rights and democracy, said the government has accessed information on far more people than those with the virus. Even though officials are required to notify individuals when their personal information is being used for investigation, only confirmed patients themselves appear to have been notified so far, he said.

South Korea’s Centers for Disease Control and Prevention declined to say how many individuals’ data had been accessed. It does so, a spokesman said, only when a person violates self-quarantine or if necessary for contact-tracing purposes.

South Korean government websites publish detailed reports about confirmed coronavirus cases. The reports include patients’ ages, work and home addresses and personal details such as the restaurants they frequent and trips to family get-togethers and even to get massages. One aim was to show people where not to go.

Although the dossiers don’t provide names, they sometimes provide enough clues for individuals to be identified. That has led to patients being targeted online with unfounded accusations and hate speech, according to a recent letter signed by more than a dozen South Korean advocacy groups, including the Minbyun lawyers organization.

On March 4, the country’s infectious-disease law was expanded. It granted not just health officials, but local government heads, the power to request information. The government said it can identify and locate at-risk patients in 10 minutes or less by automating access to personal information.

One South Korean coronavirus patient detailed on her blog how quickly neighbors figured out her identity. Her apartment building name had been shared, and fellow residents started asking others what floor her family lived on and their room number.

“It gave me shivers,” wrote the blogger, who didn’t respond to interview requests. “I was afraid of how people would view me and my children, and worried people would come to our house. That was scarier than contracting the virus.”

In Israel, Prime Minister Benjamin Netanyahu mobilized the Shin Bet, the nation’s domestic intelligence unit, to collaborate with the country’s health ministry to halt coronavirus spread. The Shin Bet gained access to a telecom database previously used only to fight terrorism and espionage. That meant citizens who had come into contact with coronavirus carriers would be sent a text message telling them to quarantine themselves for two weeks. Those who knowingly violate self-quarantine face fines.

Officials at Israel’s health ministry have praised the Shin Bet program, calling it crucial to stopping the spread of the virus. Some 500 people identified by the Shin Bet eventually tested positive, the agency said on March 26.

The Israeli Medical Association questioned why such intrusive monitoring was necessary with most of the public already largely confined to their homes by government order. In a letter to the Knesset, Israel’s parliament, the association said the lack of input from epidemiologists and public-health specialists raises the likelihood of errors. It recommended testing and other preventive measures instead.

Within days, Israel’s Supreme Court ordered the Knesset to set up a supervisory committee to oversee the tracking.

Tel Aviv gynecologist Itamar Zilberman got himself tested for the coronavirus after coming down with a fever and cough in mid-March. He initially tested positive, but a repeat check declared him free of the virus.

Israel health authorities input his data incorrectly because of a typing error, Dr. Zilberman said. The Shin Bet immediately began using cellphone location data to track down the people Dr. Zilberman had been in contact with. His colleagues and family received text messages from the government requiring them to stay home for 14 days, even though Dr. Zilberman faced no such restrictions.

Israeli health authorities didn’t respond to emails seeking comment.

As Israel prepares to reopen, the country’s defense minister wants to introduce a digital health-rating system that ranks all citizens on a 1-to-10 scale. Those with high risk would have higher scores. The real-time rating could nudge up, for instance, if government tracking reveals a person had recently visited an infected area. Anyone graded at 9.5 or above would have to be tested. The proposed system awaits signoff from the attorney general and prime minister.

In Germany, home to some of the world’s most stringent privacy laws, Health Minister Jens Spahn, a conservative, defended a bill he proposed last month borrowing some mobile-phone tactics from South Korea to “very quickly investigate infection chains.”

The proposal would have allowed officials to use cellphone data to track the movements of people who tested positive. The measure was quickly criticized by privacy advocates and rival political parties, and the bill was put on ice.

Lawmakers are learning that voluntary contact-tracing apps that claim to preserve users’ privacy, such as the one proposed by Apple and Google, aren’t effective without high levels of participation.

Only about one-fifth of Singapore’s 5.6 million residents have downloaded the government’s “TraceTogether” app, even after health officials implored citizens to partake. The tally must rise by millions more to be effective, the government said.

—Dasl Yoon in Seoul, Dov Lieber in Tel Aviv, Bojan Pancevski in Berlin and Rachel Yeo in Singapore contributed to this article.

Article originally published on wsj.com