Technology considerations for COVID-19 — Protecting health and ensuring privacy

COVID-19 has impacted almost every aspect of our lives. Thus, it’s not surprising that the pandemic has brought forth significant considerations in regards to trust, privacy and inclusion for identity technology that can help with contact tracing of the disease. Identity technology might even be deployed to provide immunity information about individuals. Developing secure solutions that help protect individuals and the community, while safeguarding privacy and ensuring fair distribution, is a complex task that needs careful consideration.

Tools for tracing COVID-19

Solutions that can improve tracking of the disease are valuable community health tools. The process of contact tracing — identifying individuals who have been in contact with an infected person and further tracing who else that individual has been in contact with— is well established and proven to be effective in slowing disease transmission. Contact tracing helps public officials monitor cases and patterns, and also helps locate individuals to notify them about recommended testing.

However, in this era of large urban populations and numerous anonymous interactions, it’s often hard to know who was in contact with an infected person. Enter the ubiquitous mobile device. Contact tracing can use capabilities available on most modern mobile phones to help automate the process of determining who has been within contact range over a 14-day period. If a person becomes ill with COVID-19, depending on the specifics of the app and permission settings, potential carriers can be warned or the contact list can be shared with health officials.

One initiative, supported by both Google and Apple, uses a private proximity contact detection API and the transmission of anonymous ID tokens using Bluetooth. The system requires opt-in, both at initiation and to send the record to health authorities, does not use location data, and does not disclose identities of tracked individuals; it simply indicates to the mobile user if they have been around an infected individual.

These privacy measures are important elements of any contact tracing app. Since this system is opt-in, as are most contact tracing apps, it requires people to be comfortable enough with the technology to get the distribution necessary to make the system effective. As stated by Jennifer Granick, ACLU’s surveillance and cybersecurity counsel, “these systems also can’t be effective if people don’t trust them … to their credit, Apple and Google have announced an approach that appears to mitigate the worst privacy and centralization risks.”

To date, the rate of adoption of various contact tracing apps has not been stellar. For example, in Singapore, where citizens generally have a high level of trust in government, only about 25 percent of citizens have downloaded the tracing app. While this number of downloads does help tracing, it’s estimated that it will take about 80 percent of all smartphones to use a tracing system (and follow the recommendations) to fully control an outbreak. One study in the U.S. suggests that only 41 percent of the population would use a contact tracing app.

As with other aspects of educating the public about COVID-19, it seems that explaining the value and privacy protections for an effective contact tracing program is required. Clearly communicating the message and creating a consolidated approach will provide the best chance for a tracing app to supplement the traditional manual approach.

Immunity passports — verifying COVID-19 immunity

While most governments are currently focused on controlling the spread of COVID-19, future phases will involve opening up society in an effective manner. The economic, social and psychological costs of shutting down much of society have taken a toll, and most people look forward to getting back to a new normal in a way that allows for safety.

By many expert accounts, the most effective way to ensure that you don’t catch or spread COVID-19 is to have immunity either through a vaccine or through antibodies (although it hasn’t been proven that antibodies confer immunity, nor how long that immunity would last). Those who have immunity would theoretically be safe to travel, attend large-scale events and otherwise participate in society without risk to themselves or others.

How will we know who can travel without risking the population at the destination, or who can attend an event without risking themselves or becoming a COVID-19 carrier? It’s natural that organizations would want to know people’s immunity status to better protect their customers and workers. But how can organizations quickly and accurately determine immunity status?

Enter the concept of an immunity passport, an identity verification check that provides evidence that the person is immune to COVID-19. Just as an age verification verifies that an individual is old enough in that jurisdiction to participate in an age-restricted activity, an immunity verification verifies that the individual has been deemed incapable of spreading COVID-19.

A trusted immunity identity

One key consideration will be trust; how can the validity of an immunity be ascribed to a specific individual? As an immunity status will be highly sought after, the impetus for fraud will be significant, so highly secure measures need to be in place prior to any rollout. Moreover, any such system would require a similarly suitable identity verification function on a global scale.

Beyond that, how is the immunity status determined and managed? Currently, there is no such process, and there needs to be an entirely new system of management, safeguards and communication protocols established. In any specific jurisdiction, who will own this process and how will they work with all the other stakeholders? Multiply that complexity to deal with cross-border situations, where multiple organizations including airlines, border controls and destinations all need to sync up standards, protocols and operational systems, and the enormity of the problem is incredible.

Of course, all this information sharing needs strict privacy and security measures in place as well. After all, personal health information is one of the most protected types of information, and how this information is collected, shared, stored and deleted will be a regulatory and logistical challenge.

Any solution requires deep planning and thought as individuals could be denied service, jobs, access to facilities and more based on their immunity status. Governments and health officials would have to examine serious ethical questions before any operational factors are considered; is such a system even legal, let alone socially acceptable? Elizabeth M. Renieris, a Fellow at Berkman Klein Center for Internet & Society at Harvard, states immunity passports “would pose an unjustified interference with, and serious threat to, our fundamental human rights and civil liberties, in violation of the principles of legality, necessity, and proportionality.”

Are existing identity infrastructures able to properly handle this new challenge quickly and efficiently? Questions around improper documentation, lack of official registrars and outdated technology already surround many identity systems around the world; it’s estimated one billion people don’t have an official proof of identity. Creating robust and secure identity programs usually takes years to properly determine and operationalize, so adding a brand-new complex requirement at record speed will put extraordinary demands on even the best managed programs.

While currently there is no immunity passport system in place, there are various proposals and prototypes being examined. With the unprecedented speed and the wide-spread impact of COVID-19, the desire to deploy measures that can mitigate the health and economic impact is substantial.

These are trying times, and we all want solutions that protect health and allow “normal” economic and social activity to return. However, society needs to keep our primary values, such as equality and privacy, at the forefront. Damaging our fundamental principles in the face of danger will not improve our long-term future.

Trulioo holds the principles of trust, privacy and inclusion at the core of our mission. Whatever new identity protocol emerges out of this crisis requires deep consideration of those principles to ensure that going forward we’ll be stronger, safer and better served by our identity systems.