Harvard to Track Affiliates’ Wi-Fi Signals as Part of Contact Tracing Pilot

Harvard began piloting Tracefi — a Wi-Fi-based contact tracing system — this past Friday in preparation for freshmen and a select group of upperclassmen students’ return to campus later this month.

Tracefi uses the signals phones, laptops, and tablets constantly emit to Harvard’s Wi-Fi infrastructures to gather three pieces of information: a datetime stamp, the signal strength received by Harvard’s Wi-Fi infrastructure, and the MAC address of the mobile device. The system then stores the data for up to 28 days.

Harvard will use the Tracefi data to aid contract tracing efforts run by Harvard University Health Services and Harvard University Information Technology by providing information to human contact tracers about the specific whereabouts of infected individuals.

“We all want Harvard to return to lab research and on-campus activities safely, and we want our undergraduates to return to campus too,” Tracefi’s website reads.

“One of the safety precautions Harvard wants in place to achieve this vision is the ability to notify a person who was in a building that she came into contact with someone who later tested positive for COVID-19. Timely notification can help her seek prompt testing for herself and protect her family and others from exposure.”

The website explains that the data collected from the Wi-Fi information does not contain personally identifiable information, and that HUHS will only access relevant data if a patient tests positive for COVID-19. People can choose to opt-out of Tracefi by turning off Wi-Fi service on their device, the info page for the program notes.

The Tracefi pilot program in the Houses consists of town halls — meetings to gauge House affiliates’ interest in the program — and “fingerprinting” spaces, which involves determining the signal strength in different areas of a room to determine the optimal position for Tracefi devices

Government professor Latanya A. Sweeney, the director of the Harvard Data Privacy Lab and the co-lead of the Faculty of Arts and Sciences’ Testing and Tracing committee, said she believes Tracefi will fortify typical contact tracing methods. Sweeney also serves as a Currier House faculty dean, a role in which she oversees a residential community of hundreds of undergraduates.

“I started the Tracefi program with the same attitude I have today: can we make this work in a way that makes this community safe? That’s my only goal,” Sweeney explained. “Part of the reason Harvard brought some students back was the belief that we could do effective contact tracing, but contact tracing alone does not give us enough protection to stop outbreaks from happening that turn places like Currier into a cruise ship.”

Still, as the pilot program begins, some Harvard affiliates and privacy experts questioned whether Tracefi’s collection methods are too invasive, and whether the Wi-Fi data could be repurposed for other uses.

Tim Hwang, a research fellow at the Center for Security and Emerging Technology at Georgetown University, also found fault with the program. He said he views Wi-Fi-based contact tracing programs as imperfect due to issues with accuracy and security.

“Wi-Fi-tracing uses radio signals to determine whether or not two people are proximate to one another. This is actually a sort of very inexact science,” Hwang said. “Radio signals bounce off obstructions that can be easily distorted by buildings and other things.”

“The second issue is that it has been known in the computer security space for some time that Wi-Fi hotspots are notoriously vulnerable to cybersecurity problems,” he added.

Hwang also said he worries the mass collection of data can lead to “pressure to use that data for purposes other than what it was collected for.”

“There has to be very strong sort of rules and placing sort of bureaucratic incentives in place to make sure that it isn't sort of appropriated for some other purpose,” he said.

Despite security concerns, Asaf Lubin, a faculty associate at Harvard’s Berkman Klein Center for Internet and Society, said he believes Tracefi is “better compared to some other university contact tracing programs.”

“It’s not compelling you to download an app. It’s relying on information that the University already possesses,” Lubin said. “They’re not automating the decision making process, but relying on interviews to make decisions, thereby giving students the clear opportunity to challenge the findings. That’s important.”

Lubin also explained that while tracing a MAC address to its true owner is a “privacy intrusive element” of the program, the University could justify it due to the “legitimate public health reasons.”

In response to criticisms raised about the Tracefi system, Sweeney said she believes the program adequately protects the privacy of Harvard affiliates.

“The data gets locked down, and I don’t think it gets better than this with locking down the data while also having transparency and accountability,” Sweeney said. “The contact tracer is the only one seeing the data and the data relevant to that particular case. The goal is to empower the contact tracer and no one else.”

—Staff writer Sydnie M. Cobb can be reached at sydnie.cobb@thecrimson.com. Follow her on Twitter @cobbsydnie.