Why We Should Worry About Big Tech’s COVID Tracking Plans

Google and Apple’s invasive tools cannot replace human contact tracers and will continue to harm civil liberties long after the virus subsides.

By Jeff Hauser, Sarah Miller, and Daniel E. Stevens

Apple and Google are forging ahead with their COVID-19 contact tracing tools, and many are welcoming them as a key factor in efforts to emerge from our national lockdown. But the companies’ past behavior — and their business models — raises the prospect that their new technology could lead to an unprecedented level of surveillance long after the current crisis has passed.

It may not be worth the trade-off.

There are growing concerns that the system devised by the tech giants won’t be particularly helpful for slowing the virus’ advance. It will allow, but not require, a person who has tested positive to alert anyone with whom they’ve been in recent contact. What a person getting such an alert would do next is an open question. Without a human contact tracer involved, the system may end up being of little use.

On the other side of the ledger, the new tools pose serious risks to civil liberties that will likely be felt long after the virus subsides. It is unclear if users will truly be able to opt out of having their data collected. It’s also unclear what data, if any, will be stored on Apple and Google servers and associated with user accounts. We don’t know what will happen to the data once the crisis passes, or whether users’ privacy settings will revert to the way they were. The tech platforms are asking us to simply trust them.

Our organizations have been investigating the problems caused by powerful tech companies, and we see good reason to be skeptical. Apple and Google have already been forced to pay huge fines for failing to follow consumer protection laws, and polls show Americans have little confidence things will be different this time.

At its core, Google is an advertising company with an insatiable appetite for user information, which it relies on to target ads. Understanding users’ social networks is especially valuable.

Apple makes most of its money by selling expensive gadgets, and it has criticized companies like Google that sell access to personal information. But Apple has proven quite content to steer its users’ data to Google when it’s in its own interest.

Google paid Apple a staggering $12 billion in 2019 to make it the default search engine in Apple’s Safari browser. That gives Google access to the personal information of the Apple users it doesn’t control through its ownership of the Android operating system.

What’s to stop the two tech giants from brokering a similar deal for access to information about someone’s physical contacts — and continuing to share that proximity data long after the coronavirus crisis is over?

The companies say users will have to “opt-in” to the system. But Google has a history of coercively extracting consent from users, and of continuing to track users even when they have attempted to opt-out of its data collection.

Users who opt in for this ostensibly worthwhile reason will likely have to alter their permissions on what kind of data the tech companies can collect. If history is a guide, as long as the companies are reaping a data bonanza, they won’t be in a hurry to restore those settings.

Google and Apple have stressed that public health organizations will build the apps that use their new tracing tools — suggesting that those entities can be trusted to protect user privacy. But third-party apps that use its services are covered by Google’s own privacy policy, giving it wide berth to mine users’ data.

Finally, Apple and Google say their new system is safe because smartphones will trade anonymized tracing keys. But there is abundant research showing that anonymized data can be de-anonymized and attached to individual users.

The danger is that, having built this system, Apple and Google will find it hard to say no if governments say their contact-tracers, and not just users, must get the alerts. France has already asked the companies to loosen privacy restrictions for its contact tracing app, causing one early proponent of the system to have a change of heart.

Apple has repeatedly caved to the demands of authoritarian regimes, particularly China, where it manufactures and sells many of its devices. Last year, as anti-government protests raged in Hong Kong, the company took down an app that helped protesters evade law enforcement and removed the Quartz app from its Chinese store after the news outlet’s tough coverage of the demonstrations.

Even in this time of need, we must ensure that we don’t usher in a new era of surveillance that cannot easily be reversed.

Jeff Hauser is the founder and director of the Revolving Door Project.

Sarah Miller is the Executive Director of the American Economic Liberties Project.

Daniel E. Stevens is the Executive Director of Campaign for Accountability.