CS Nov-Dec 2020

contact tracing
smartphones in mind: These users can print
out a personal QR code to be scanned by
restaurants and other places they visit.
KEEPING WATCH
Human Rights Watch is equally concerned
about proposals for the use of mobile
location data in the Covid-19 response,
because the data usually contains sensitive
and revealing insights about people's
identity, location, behaviour, associations
and activities. Indeed, mobile location data
programs to combat Covid-19 may not
be scientifically necessary and could lead
to human rights abuses, if they are not
equipped with effective safeguards to
protect privacy. The long history of
emergency actions, such as surveillance
measures put in place to counter terrorism,
shows that they often go too far, fail to
have their desired effect and, once approved,
often outlast their justification, according to
the international watchdog body.
Contact tracing’s goal is, of course, to
interrupt transmission by rapidly identifying
individuals who have been in close contact
of someone who is infected, defined by the
United States Centers for Disease Control
and Prevention (CDC) as within six feet of
someone for approximately 10 or more
minutes. The idea is to encourage such
individuals to isolate themselves from others,
and seek testing and treatment.
Because the coronavirus is primarily
transmitted through person-to-person
contact via respiratory droplets when an
infected person coughs, sneezes or talks,
mobile location data has been advocated in
many quarters as an essential method to
identify potentially exposed individuals.
Companies and governments are also
examining location data in aggregate form
to better understand general patterns of
people's movements and behaviours, and
how these have changed over time. Such
analysis aims to forecast how the virus might
be spreading and the effectiveness of public
health interventions, particularly social
distancing measures, and identify ways to
better allocate testing and medical resources.
RIGHTS & FREEDOMS
Even in times of emergency, when States
restrict human rights for public health
reasons, international human rights law says
that measures taken that limit people's rights
and freedoms must be lawful, necessary and
proportionate. States of emergency need to
be limited in duration and any curtailment
of rights needs to take into consideration
the disproportionate impact on specific
populations or marginalised groups.
These rules apply to efforts to track and
manage Covid-19 using mobile location
data. The collection and analysis of
such data could reveal users' identities,
movements, and associations in a manner
that interferes with the right to privacy.
Article 17 of the International Covenant on
Civil and Political Rights (ICCPR), which is
derived from Article 12 of the Universal
Declaration of Human Rights (UDHR),
establishes "the protection of the law"
against "arbitrary or unlawful interference"
with an individual's "privacy, family, home,
or correspondence." The United Nations
Human Rights Committee has found that
restrictions on the right to privacy must take
place only "in cases envisaged by the law."
Restrictions must also be "proportionate to
the end sought, and ... necessary in the
circumstances of any given case".
In the EU, eight major telcos agreed earlier
this year to share anonymised metadata with
the EC for modelling and predicting the
propagation of the coronavirus. An official
from the commission advised that the data
would be aggregated and anonymised, and
that the commission will delete it when the
pandemic is over. However, and worryingly,
the European Data Protection Supervisor
has previously warned about the possibility
of such measures becoming permanent.
24
computing security Nov/Dec 2020 @CSMagAndAwards www.computingsecurity.co.uk