Mass surveillance in the age of COVID-19

Abstract

Epidemiological surveillance programs such as digital contact tracing have been touted as a silver bullet that will free the American public from the strictures of social distancing, enabling a return to school, work, and socializing. This Article assesses whether and under what circumstances the United States ought to embrace such programs. Part I analyzes the constitutionality of programs like digital contact tracing, arguing that the Fourth Amendment’s protection against unreasonable searches and seizures may well regulate the use of location data for epidemiological purposes, but that the legislative and executive branches have significant latitude to develop these programs within the broad constraints of the ``special needs'' doctrine elaborated by the courts in parallel circumstances. Part II cautions that the absence of a firm warrant requirement for digital contact tracing should not serve as a green light for unregulated and mass digital location tracking. In light of substantial risks to privacy, policy makers must ask hard questions about efficacy and the comparative advantages of location tracking versus more traditional means of controlling epidemic contagions, take seriously threats to privacy, tailor programs parsimoniously, establish clear metrics for determining success, and set clear plans for decommissioning surveillance programs.

INTRODUCTION

In China, the government has required residents to download a smartphone app that tracks their movements and assigns them a color (red, yellow, or green) corresponding to their asserted public health risk. These color codes regulate access to “subways, malls, and other public spaces.”¹ The methodology by which an individual is color-coded is opaque, however, and the app “also appears to share information with the police, setting a template for new forms of automated social control that could persist long after the epidemic subsides.”² In South Korea, the government reportedly pushes cell phone alerts about infected individuals, sending detailed information including “credit-card history, with a minute-to-minute record of their comings and goings from various local businesses.”³ That level of detail has led to infected individuals, being identified and suffering harassment. Israel has hastily repurposed mass location data secretly collected for counterterrorism purposes to track potentially infected individuals wherever they go.⁴ Meanwhile, in the United States, North and South Dakota have already issued an app for their residents, which gathers location data using cell towers, GPS, and Wi-Fi and stores those data on a centralized, private server.⁵ In all, according to one live-tracking site, at least 53 contact tracing apps have already appeared across at least 29 countries.⁶

In the United States, the Supreme Court has held that individuals have the right to expect that “the whole of their physical movements” will remain private.⁷ Location data from smartphones and cell phones “provide[] an intimate window into a person’s life, revealing not only his particular movements, but through them his familial, political, professional, religious, and sexual associations.”⁸ Yet the explosive growth of COVID-19⁹ in this country and the drastic social distancing measures that have crippled American life and the economy have triggered increasing interest in harnessing the power of digital location data to track, predict, and control the pandemic.

The U.S. government is already tapping bulk cell phone location data for public health surveillance purposes in the fight against COVID-19. These efforts include tracking the “presence and movement of people in certain areas of geographic interest.”¹⁰ Under new legislation, Congress appropriated “not less than $500,000,000” for “public health data surveillance and analytics infrastructure modernization.”¹¹

Private enterprise has been quick to cooperate. Google analyzed location data from its app users’ devices to generate “COVID-19 Community Mobility Reports” for every county in the United States. These reports “chart movement trends over time by geography, across different categories of places such as retail and recreation, groceries and pharmacies, parks, transit stations, workplaces, and residential.”¹² Another much-watched visualization analyzed cell phone location data to show how the spring break population in south Florida dispersed across America. Each dot along a Florida beach during spring break marked a unique cell phone, which was followed for weeks thereafter. Spreading like delicate tendrils, this visualization of individuals’ movements illustrated “how massive the potential impact just one single beach gathering can have in spreading this virus across our nation.”¹³ These analyses by Google and others enable the government and others to discern how well the public has complied with social distancing at the individual, county, state, and national level.

The use of cell phone location data for contact tracing in a more targeted, individualized way has also garnered significant interest. Contact tracing is a traditional public health tool. The World Health Organization defines contact tracing as a monitoring process in which an infected individual identifies all other individuals with whom they may have been in contact. Those contacts are then informed, monitored, and sometimes instructed to self-isolate or quarantine.¹⁴ Contact tracing, coupled with effective isolation of relevant contacts, can “prevent further transmission of [a] virus.”¹⁵ Traditionally, contact tracing has relied on skilled workers, who interview infected individuals to learn about their activities and the people they encountered after becoming ill, and then monitor those contacts for illness. According to a recent report from the Johns Hopkins Center for Health Security, more than 100,000 contact tracers may be needed nationally to grapple with the COVID-19 pandemic.¹⁶ Massachusetts alone “plans to hire and train roughly 1,000 people to do contact tracing.”¹⁷

Other jurisdictions have trained their sights on cell phone data as a new, potentially more powerful, efficient, and accurate tool for contact tracing. With China, South Korea, Singapore, Israel, and others as examples, data brokers and app developers are working to bring digital contact tracing to European and American markets.¹⁸ Their pitch is enticing. In a forthcoming paper in Science, researchers at Oxford argue that COVID-19 spreads too quickly and asymptomatically to be controllable through traditional contact tracing methods.¹⁹ To alleviate the need for long-term mass social distancing, the authors of that study argue that communities will need to deploy “instant digital contact tracing.”²⁰

Despite the public health benefits touted by proponents, it is not clear that digital contact tracing can achieve its lavish claims, nor is it evident that it can do so without imposing disproportionate privacy harms. Current technological limitations, as well as limitations in COVID-19 testing and support for quarantining identified contacts, undermine the efficacy of digital contact tracing efforts that its proponents seemingly take for granted.²¹ As for privacy, digital contact tracing efforts abroad already raise significant cause for concern. These mass surveillance programs sweep up revealing location data indiscriminately. Although they are defended on grounds of emergency and the urgent need to contend with the present health crisis, experiences in those countries already reveal the potential for abuse. Moreover, our own history amply demonstrates that surveillance powers claimed on emergency grounds frequently remain after the emergency has passed, often morphing into tools of social control targeted against disfavored individuals and groups.²²

This article assesses whether and under what circumstances the United States ought to embrace the use of epidemiological surveillance programs, including the use of cell phone location data for contact tracing purposes. Part I analyzes the constitutionality of programs like digital contact tracing, arguing that the Fourth Amendment’s protection against unreasonable searches and seizures may well regulate the use of location data for epidemiological purposes, but that the legislative and executive branches have significant latitude to develop these programs within the broad constraints of the “special needs” doctrine elaborated by the courts in parallel circumstances. Part II cautions that the absence of a firm warrant requirement for digital contact tracing should not serve as a green light for unregulated digital location tracking, whether in the form of individual or aggregate surveillance, and by means of location or proximity tracking.²³ In light of substantial risks to privacy that a digital contact tracing program might entail, this article argues for a thoughtful, constitutionally sufficient, legislative scheme that does not indulge the hubris of emergency, assert claims of broad, unchecked power, or follow the siren’s song of technovelty. Policymakers must instead ask hard questions about efficacy and the comparative advantages of location tracking versus more traditional means of controlling epidemic contagions, take seriously threats to privacy, tailor programs parsimoniously, establish clear metrics for determining success, and set plans for decommissioning surveillance programs. Should the political branches fail to perform on these duties, then the courts, as guardians of the Fourth Amendment’s sacred trust, must act.

I. FOURTH AMENDMENT FRAMEWORKS

In the U.S. context, questions about protecting privacy against threats of government surveillance implicate the Fourth Amendment, which guarantees that “The right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures shall not be violated . . . .”²⁴ Would an epidemiological surveillance program that uses cellphone location data to conduct individual contact tracing or to document and predict infection patterns using aggregate data be subject to Fourth Amendment regulation? If so, what form should those regulations take? Answering these questions requires addressing two Fourth Amendment thresholds: whether the program entails state action and whether the conduct at issue constitutes a “search” or a “seizure.”

The Fourth Amendment applies only to governments and their agents. It does not regulate the conduct of private persons or entities. Based on the surveillance programs deployed in other countries and those imagined domestically, data aggregation for contact tracing has been and will be conducted by private entities, principally cellphone service providers and technology companies with access to location data through apps installed on users’ devices. This does not necessarily exhaust the Fourth Amendment inquiry, however. Under established doctrine, a private party may be subject to Fourth Amendment regulation to the extent it is acting as an agent of the state.

“Whether a private party should be deemed an agent or instrument of the Government for Fourth Amendment purposes necessarily turns on the degree of the Government’s participation in the private party’s activities, a question that can only be resolved in light of all the circumstances.”²⁵ Among the factors relevant to this inquiry are whether a government agent directed, requested, or incentivized the search, whether the private actor believed at the time that she was acting under the direction or authority of a government agent, and whether a government agent had advance notice of the search and believed that the fruits of that search would accrue to the government.

There are good reasons to believe that the cellular service providers and technology companies aggregating data for contact tracing and similar surveillance programs would be acting as state agents for purposes of the Fourth Amendment. Most of these entities are already routinely targets for government demands for user data—sometimes on the order of tens of thousands of requests each year. They may therefore already be acting as state agents when they collect and aggregate location data.²⁶ That case is even stronger in the narrower circumstance of epidemiological surveillance. These programs require ongoing access to historical data for baseline analysis, recent aggregate data to model population flows and contact patterns, targeted data to trace individual persons, and real-time data to monitor the activities of persons and groups. In short, these programs will entail close, ongoing public-private partnerships, which will have the effect of converting AT&T, Google, and other data collectors and aggregators into government agents for purposes of the Fourth Amendment.²⁷

To the extent doubts about the state agency requirement persist, they are probably mooted by the Supreme Court’s recent decision in Carpenter v United States.²⁸ There, the Court held that the Fourth Amendment governs law enforcement access to historical cell site location data gathered and stored by cellphone service providers (cellphone location data, whether in the form of cell site location or GPS tracking, appears to be a centerpiece of tracing and proximity surveillance proposals because these devices are so often with their users²⁹). As the Carpenter Court noted, service providers collect and aggregate these data for their own business purposes.³⁰ Nevertheless, the Court held that law enforcement must secure a warrant before accessing that data in the context of a criminal investigation.³¹ The Court was decidedly mealy mouthed about what constituted the “search” in Carpenter, who did it, and when,³² but the circumstances contemplated by epidemiological surveillance programs are sufficiently analogous to conclude that the state agency requirement would not be an impediment to applying the Fourth Amendment, even if the precise reasons why might remain a mystery.

But does epidemiological surveillance constitute a “seizure” or a “search”? The Fourth Amendment regulates conduct that threatens the security of the people against “unreasonable searches and seizures.” Conventionally, this means that the Fourth Amendment applies only to conduct that constitutes either a “seizure” or a “search.”

“Seizures” entail material interference with property or liberty. Depending on the technology used, epidemiological surveillance programs plausibly could constitute seizures of “effects.” For example, if the government required citizens to install specific applications on their cellular phones or other electronic devices, then that interference might well amount to a seizure of effects. So, too, if government agents surreptitiously hacked devices to install tracking software.³³ In addition, if a surveillance program was aimed at using personal devices to limit users’ liberty by, say, using geofencing or other proximity tracking to enforce a physical quarantine, then that would constitute seizure of persons.³⁴

“Searches” encompass either physical intrusions into constitutionally protected areas (persons, houses, papers, or effects) for the purpose of gathering information³⁵ or intrusions upon subjectively manifested expectations of privacy that society is prepared to recognize as reasonable.³⁶ Depending on the nature of the program, epidemiological surveillance may qualify as a search under one or both of these definitions. For example, if government agents actively search data on cellular phones or other devices in order to gather location information or to access photographs and other evidence of social contacts, then their conduct might fairly be described as physically intruding upon a constitutionally protected “effect” for the purpose of gathering information.³⁷ Alternatively, if government agents access location information gathered and aggregated by third parties, such as cellular service providers or technology companies, documenting persons’ movements (or lack thereof!) over a period of time, then that would probably qualify as an intrusion upon reasonable expectations of privacy,³⁸ particularly if it revealed that they were at home.³⁹

Complications exist, to be sure. For example, what if the Centers for Disease Control (CDC) uses anonymized location data that are aggregated by a cellphone service provider or technology company and made available to researchers or business entities? Is the CDC subject to Fourth Amendment regulation if it has done nothing more than what a private party could do? In one respect, the answer is easy: “Yes, of course!” As described above, the state agency requirement highlights the fact that government agents are subject to Fourth Amendment restraints that do not bind private actors. In another respect, however, the answer is less clear. The Supreme Court has long allowed government agents to access through lawful means information voluntarily shared with third parties. For example, law enforcement can access information about a suspect’s financial transactions through the suspect’s bank or credit card servicer without worrying about the Fourth Amendment because this conduct does not intrude upon reasonable expectations of privacy.⁴⁰ In a similar vein, government agents are free to observe anyone’s public movements⁴¹ or to access areas open to the public⁴² without subjecting themselves to Fourth Amendment constraints. Would either or both of these lines of cases—colloquially, the third-party and public observation doctrines—exempt epidemiological surveillance programs from Fourth Amendment scrutiny? Probably not.

In Carpenter, the Court held that neither the third-party nor the public observation doctrine could relieve law enforcement⁴³ from the burden of securing a warrant before accessing cell site location data that are routinely gathered and aggregated by cellphone service providers for their own business purposes.⁴⁴ The crux of the Court’s reasoning was that location tracking reveals a host of intimate details about private associations and activities.⁴⁵ The Court also worried that granting law enforcement unfettered access to this kind of data would facilitate programs of broad and indiscriminate search, threatening the right of the people to be secure against threats of arbitrary state power, and conjuring the specters of general warrants and writs of assistance that haunted the minds of the founding generation.⁴⁶

Epidemiological surveillance programs robust enough to conduct individual contact tracing or to document disease progression using aggregate data will trigger these same concerns. This suggests that they, too, would be subject to some form of Fourth Amendment restraint. The fact that some of the data used might be anonymized does not change the calculus. First, as has been amply demonstrated, it is very easy to deanonymize location data.⁴⁷ That is likely to be particularly true in a world where people have been ordered to stay at home because location data will be robustly associated with individual residences. Second, the fact that data are anonymized may salve some of the individual privacy concerns, but it does little to resolve concerns about “arbitrary power”⁴⁸ and “permeating . . . surveillance,”⁴⁹ which threaten the Fourth Amendment right “of the people to be secure . . . against unreasonable searches and seizures.”⁵⁰

Accordingly, it is likely that epidemiological surveillance programs proposed amid the current pandemic would be subject to Fourth Amendment regulation. This does not mean that agencies like the CDC would be forbidden from using these tools or that they would be required to seek and secure a warrant based on probable cause. The Fourth Amendment allows for considerable flexibility in terms of the form of regulation it requires,⁵¹ particularly where searches are conducted to advance public policies (“special needs”) separate from criminal law enforcement.⁵²

The epidemiological surveillance programs discussed in recent months, be they individual tracking, location monitoring, or the use of aggregate data, are likely to fall under the special needs doctrine because their purpose is to address public health challenges rather than to effect the goals of traditional law enforcement. The Court has endorsed public health as a legitimate ground for special needs searches on a number of occasions⁵³ where the programs are sufficiently likely to succeed in serving a legitimate public interest⁵⁴ and stayed true to their public health goals.⁵⁵ The centerpiece of the special needs doctrine is the balancing of compelling government interests served by searches against the privacy interests of those subject to potential search. In the present context, there is no doubt that there are significant public health interests at stake. Proper interventions could well save thousands, if not hundreds of thousands, of lives while minimizing social, cultural, and economic harm.⁵⁶ These weighty public interests cannot sign a constitutional blank check, however. The Fourth Amendment still requires some form of constitutionally sufficient prospective constraint on searches and the discretionary authority of agents to conduct searches.

Special needs searches generally do not require a warrant.⁵⁷ In these noncriminal contexts, the Court has endorsed a variety of regulatory approaches that serve legitimate public policy interests while still guaranteeing the right of the people to be secure from threats of unreasonable searches and seizures. Executive agencies and legislatures play a key role in this context. Courts tend to grant the political branches broad latitude to develop and deploy administrative and programmatic structures regulating the use of searches that serve goals such as public health as long as they are narrowly tailored, likely to succeed, strike a reasonable balance between privacy interests and public policy goals, and limit the discretion of government agents conducting searches.⁵⁸ The next part details a framework that policymakers can apply to meet these constitutional demands when deploying and using epidemiological surveillance tools such as contact tracing.

II. LEGISLATING DIGITAL CONTACT TRACING IN THE SHADOW OF THE FOURTH AMENDMENT

The COVID-19 pandemic poses an emergency for public health. Faced with such emergencies, executive agents are wont to assert broad discretionary powers. As the Canadian Freeholder observed in 1779, they are

fond of doctrines of reason of state, and state necessity, and the impossibility of providing for great emergencies and extraordinary cases, without a discretionary power in the crown to proceed sometimes by uncommon methods not agreeable to the known forms of law.⁵⁹

The Fourth Amendment guards against these threats, “curb[ing] the exercise of discretionary authority” to search and seize.⁶⁰ To deploy and use epidemiological surveillance tools will therefore require more than executive fiat. What the Fourth Amendment demands is a clear and deliberative process, weighing the genuine benefits and costs of programs likely to engage in invasive and potentially mass surveillance. This process—which should involve both legislative and agency actors—must identify prospective remedial measures sufficient to safeguard the right of people to be secure against unreasonable searches and seizures while reasonably accommodating legitimate public health goals.

In other work, one of us has elaborated a constitutionally informed framework policymakers can apply when designing data surveillance programs.⁶¹ This framework challenges the political branches to engage critical questions about need, efficacy, parsimony, and discretion before deploying these kinds of surveillance tools. It also provides a guide for courts to evaluate the constitutional sufficiency of the regulatory structures erected around these kinds of surveillance programs.⁶² Below, we explain how that framework might guide the development and deployment of public health surveillance programs like digital contact tracing, location monitoring, and data aggregation and analysis.

Predeployment review. Before a digital public health surveillance program is deployed, proponents must publicly and transparently identify the goals of the program and establish a reasonable, scientifically grounded fit between those goals, the methods to be used, and the data to be gathered.⁶³ In particular, proponents must clearly articulate why digital methods outperform traditional alternatives in order to justify additional intrusions on privacy.

Contact tracing is a well-established component of ordinary public health measures. Historically, contact tracing has utilized skilled workers to conduct interviews, contact potentially infected individuals, and counsel and diagnose those individuals throughout a monitoring or quarantine period. But there is emerging evidence that digital contact tracing may have substantial benefits over traditional methods of interview and direct contact, given the unique attributes of COVID-19. Recent modelling data comparing traditional and digital contact tracing methods have indicated that COVID-19 spreads too quickly and often asymptomatically to be controllable through traditional contact tracing methods.⁶⁴ According to some researchers, “instant digital contact tracing” will be necessary to transition out of mass social distancing.⁶⁵

Digital contact tracing cannot hope to achieve its promised benefits, however, without necessary precursors and responses. For instance, although the United States has expanded COVID-19 testing, its per capita level of testing still lags many countries, including several at the forefront of digital contact tracing.⁶⁶ Effective identification of infected individuals is a pre-requisite to effective contact tracing efforts. Absent testing capacity and procedures robust enough to give confidence that infected individuals are likely be identified rapidly, collecting and storing mass location data are likely to impose significant privacy harms without corresponding public health benefits.⁶⁷

Previous infectious disease mitigation efforts reinforce the need to prioritize traditional processes before resorting to technologically enhanced surveillance. In 2014, a West African outbreak of Ebola eventually made its way to the United States.⁶⁸ The first case of U.S. Ebola was Thomas Eric Duncan, who had contact with an Ebola patient in Liberia 4 days before traveling to the United States. Although Duncan should have been screened before departing Liberia, that screening did not occur. Moreover, when Duncan presented with symptoms at a Texas emergency room, “somehow doctors were unaware that he had recently traveled from one of the West Africa countries where Ebola [was] spreading rapidly. He was sent home, highly infectious.”⁶⁹ Duncan eventually succumbed to Ebola, but not before infecting two of his caregivers. As one commentator concluded, “Ebola is a tragic reminder of the power of the process.”⁷⁰ Efforts to use aggregate digital data in other public health surveillance efforts have reached similar conclusions.⁷¹

Reliable processes to identify infected individuals must be followed by efficient procedures to inform and monitor any contacts who may have been exposed. In the case of COVID-19, current proposals for digital contact tracing largely appear to take for granted that identified contacts will immediately and reliably self-isolate for the 2-week incubation period of a possible COVID-19 infection. The Oxford research team that advocates “instant digital contact tracing” plainly states that it modelled the impact of “tracing the contacts of symptomatic cases and quarantining them.”⁷² Their model defines its success rate as “the fraction of all contacts traced, assuming perfectly successful quarantine upon tracing, or the degree to which infectiousness of contacts is reduced assuming all of them are traced.”⁷³ That is a generous assumption with no demonstrated grounding in reality.

Our recent experience with social distancing suggests that many people will continue to congregate, whether by choice or necessity, despite prompts to maintain social distance. Pictures abound of crowded subways, public markets, houses of worship, beaches, and parks across the country.⁷⁴ Workers without paid sick leave—let alone paid leave for possible, but unconfirmed, infection—may simply be unable to afford to self-isolate when prompted by public health orders, even if they are otherwise inclined to obey. From a purely practical perspective, then, models grounded in assumptions about compliance with self-isolation instructions offer little in terms of evidence that digital tracing methods will be superior enough to traditional methods to justify the radical costs to privacy attendant to mass surveillance.

Moreover, digital contact tracing may cast so wide and impersonal a net that it will be less effective than traditional means in generating compliance. Depending on the precision of the location data, prompts to self-isolate may become overbroad and routine, which will further reduce compliance. Social distancing recommendations emphasize 6 feet of distance between people to minimize infection. This suggests that ideal contact tracing would limit its scope to individuals who were within 6 feet of an infected person. But cell tower and GPS data typically have margins of error of more than 6 feet. GPS data, which is more precise than cell tower location data, is usually accurate only to within 16 feet, with even poorer performance in crowded urban areas.⁷⁵ Bluetooth tracking may be more precise, but it is also overinclusive, likely registering contacts between devices despite the presence of walls, car doors, or even whole floors in a building.⁷⁶

At least for now, these tools are likely to direct into isolation many people who were never actually at risk. Over time, overbroad notifications will fail to prompt appropriate self-isolation even among individuals who are genuinely at risk—the epidemiological equivalent of crying “wolf!” Other difficulties may arise as well, from false or malicious designations of an individual as infected when they are not, to insufficient participation in voluntary programs. Traditional contact tracing, though perhaps a bit slower, may still prove to be more precise, accurate, robust, reliable, and visceral, and therefore may be more effective in generating actual compliance.

In sum, digital contact tracing is unlikely at present to yield its promised benefits due to low testing rates, low compliance rates, and technological limitations. Before requesting or requiring individuals to sacrifice their locational and associational privacy, policymakers must ensure that the screening, testing, and isolating of affected individuals can be done at comparable scale. Similarly, before aggregate location data are gathered or analyzed, policymakers should ensure that there is sound evidence of efficacy and accuracy of such tools, beyond what traditional public health surveillance methods can generate. Absent such assurances, Americans would be surrendering substantial privacy without concrete gains in public health, safety, or liberty.⁷⁷

Even if an epidemiological surveillance program can establish efficacy, that does not end the Fourth Amendment inquiry. Given the substantial privacy interests at stake, legislators and app developers must take care at all stages of design, deployment, and use to mitigate against privacy harms, beginning with data gathering. Indeed, these later stages—and the need to continue to probe issues of efficacy—will take on increased importance if app developers or policymakers charge ahead before pre-deployment review is completed.⁷⁸

Data gathering and aggregation. Epidemiological surveillance programs such as digital contact tracing should gather the minimum amount and types of data reasonably necessary to facilitate their public health goals. Although GPS data are seemingly ubiquitous, it casts too wide a net and thus exposes a larger population’s location data in response to every query. Bluetooth data, by contrast, may be able to register proximity between devices more precisely, alongside or instead of logging location directly.⁷⁹ Utilizing proximity data rather than location data could minimize the intrusiveness of the data gathered because these data would reveal that two devices were in proximity but not where. Limiting the timeframe covered by location or proximity data would minimize the scope of information revealed about a person’s movements, habits, and intimate associations.⁸⁰

Policymakers should also mandate information siloing to the extent possible. Information silos “establish or maintain separation between databases, thereby setting limits on the breadth and generality achieved by aggregation.”⁸¹ Where possible, data should be stored locally on a device or with the entity that initially gathered it. This limits the government’s ability to make secondary uses of sensitive data. Congress used this approach in the 2015 USA Freedom Act, which amended the National Security Agency’s telephony metadata program so that metadata would remain with telephone companies until queried, rather than being turned over to the National Security Agency in bulk.⁸²

Similarly, keeping digital location trails out of government hands would help mitigate the privacy threats of contact tracing programs. Thus far, digital contact tracing efforts have relied on centralized administration by governments, putting mass location data in government hands. This includes an app for digital contact tracing that the European Union will soon roll out, beginning in Germany.⁸³ But there may be alternatives that decentralize data storage, limiting threats of mass surveillance. For instance, a team at University College London designed a framework that “focuses on decentralization and . . . stops any personal data leaving a device.”⁸⁴ If accurate and effective, a decentralized approach would help mitigate privacy harms while preserving important public health goals.

Data storage. The privacy harms of digital location tracking are exacerbated the longer tracking lasts and the longer data remain available to government agents.⁸⁵ The Supreme Court has recognized that the time-machine nature of digital location tracking is inconsistent with “a central aim of the Framers … to place obstacles in the way of a too permeating police surveillance.”⁸⁶ Strict durational limits on data collection, storage, and destruction are vital to minimize threats to privacy posed by epidemiological surveillance programs.

For example, current public health practice recommends a 2-week quarantine or active monitoring period for individuals potentially infected with the COVID-19 virus.⁸⁷ A similar durational limit would be appropriate for location data utilized for digital contact tracing. Only contacts within that 14-day period are likely to be at risk of infection, with more temporally distant contacts having interacted with the infected person before they were infected or contagious. It therefore seems that location data should be collected and retained only for 2 weeks at a time, after which it should be destroyed. Insofar as there may be good reasons to extend this window, the point remains that it is important to set limits on how much data are retained and for how long.

Data access, analysis, and use. Access to the data gathered, aggregated, and stored as part of an epidemiological surveillance program—and authority to query that data—should be strictly limited to those whose access is essential for the program to function. These data should not be available to people, groups, or algorithms for purposes unrelated to digital contact tracing and certainly should not be open source. The reason is straightforward: Mission creep imperils the success and constitutional soundness of such a program as does the risk of abuse.

For instance, mass digital location data would surely aid the Department of Justice in investigating and prosecuting crimes or the Department of Homeland Security in tracking and arresting undocumented immigrants in the United States. But these uses would plainly diverge from the purposes undergirding this digital location data program. So, too, would a functionary’s use of the data to trace a former spouse’s movement and associations. Just as data should be siloed to prevent its misuse, access and authority to query these data should be zealously guarded, privileging public health efforts and excluding law enforcement or other efforts. Absent such segmentation, the Supreme Court’s recent epistle on digital location privacy in Carpenter would be meaningless.

Similarly, even within the public health arena, the use of this mass surveillance data must be strictly limited to its intended purpose. For instance, while digital location data might be accessible to public health officials engaged in contact tracing efforts, it would be inappropriate for those data to be accessible to government officials charged with enforcing general social distancing orders.⁸⁸ This constitutes a separate purpose requiring independent justification. Moreover, if decentralization of data is possible, then direct access by any government entity might well be unnecessary and therefore inappropriate.

The program must end. A well-designed and well-justified epidemiological surveillance program designed to combat COVID-19 must be coupled with strict sunset provisions. The War on Terror, launched in the wake of the 9/11 attacks, is instructive in the way that demands for emergency authority can act as one-way ratchets, effecting permanent expansions of surveillance powers, and how crises can metastasize, developing into perpetual claims of emergency. It is telling that, in the midst of the current crisis, Congress once again granted a reprieve to the National Security Agency’s troubled Section 215 program, which originated the bulk collection of telephonic metadata.⁸⁹ Once a tool like contact tracing is operational, it will be tempting for public health officials to utilize this tool to combat other infectious diseases. Seasonal influenza, after all, sickens millions and kills thousands each year.⁹⁰ The ability to more easily track and trace the flu would surely aid public health efforts. Yet this, too, would constitute unjustified mission creep.

Recursive review. Finally, audit procedures should be required to ensure accountability after the fact. Audit trails or other documentation should enable review of who gains access to sensitive location data, on what authority, and for what queries. In addition, program managers should conduct regular reviews to determine whether the promises of a program match its reality.

Conclusion

Epidemiological surveillance programs such as digital contact tracing have been touted as a silver bullet that will free the American public from the strictures of social distancing, enabling a return to school, work, and socializing. But these tools also tread on established expectations of privacy while presenting real threats of persistent mass surveillance. In sorting through these promises and challenges, the Fourth Amendment will have a critical role to play. Like all provisions of in the Bill of Rights, it imposes limits on what the political branches can do, no matter how popular or seemingly necessary in “providing for great emergencies and extraordinary cases.”⁹¹ In particular, the Fourth Amendment will require that epidemiological surveillance programs demonstrate sufficient potential to serve compelling public health goals.

There are good reasons to be skeptical. Unless and until more mundane aspects of contact tracing are operating efficiently—including availability of testing and practical support for appropriate self-isolation by contacts—there is little reason to think that there is enough promise to justify the dramatic expansions in government power and significant costs to personal privacy.

Even if there is good reason to believe in the public health promise of these programs, the Fourth Amendment requires more than blind faith in the judgment of government officials. The Fourth Amendment is genetically skeptical of granting broad, unfettered discretion for state agents to conduct searches and seizures.⁹² To meet Fourth Amendment demands, epidemiological surveillance programs, whether directed at digital contact tracing, location monitoring, or data aggregation and analysis, must be the products of rigorous deliberative processes, weighing the genuine benefits and costs. Robust prospective remedial measures should be put in place to secure privacy and liberty, including limitations on data gathering, aggregation, storage, access, analysis, and use. In addition, programs should be subject to constant review and sunset provisions. Only by adopting these kinds of procedural and substantive safeguards can we hope to achieve legitimate public health goals as we face COVID-19 while also protecting our sacred constitutional trust.