Five Privacy Measures to Justify Wi-Fi Contact Tracing

UPDATED: Sept. 14, 2020 at 4:32 p.m.

As part of its efforts to control COVID-19 on campus, Harvard piloted a Wi-Fi-based contact tracing system that collects datetime stamps, signal strength, and MAC addresses of mobile electronic device users. TraceFi would supplement Harvard University Health Services’ manual contact tracing efforts by linking infected individuals to those who have been in their vicinity, though it has not been implemented since the pilot.

Digital contact tracing is a useful public health approach that has already been implemented by several governments to track infection routes and increase detection rates. In countries that have contained the virus, digital contact tracing has shown to be an effective measure, especially because testing alone can return a high chance of false negative results and inherently miss asymptomatic carriers who fail to get tested.

TraceFi, therefore, would be an important addition to Harvard's community safety measures. Still, the right to privacy is an important ethical and legal consideration, and it must not be neglected in the name of effectiveness and safety. In today’s age, when digital tools expand the risk of misuse and oversharing, and the mission creep of invasive digital surveillance regimes is prevalent, it’s easy to be skeptical about the feasibility of legitimate privacy protections. However, the thought that Harvard may subsequently expand the scope and remit of location tracking is a clear call for caution. Our locational data provides a full, intimate picture of our daily lives and deserves to be protected accordingly.

As a result, we expect Harvard to do its utmost in protecting rights and mitigating privacy violations. A choice to opt-out by switching off Wi-Fi is only a hollow and farcical excuse for justifying invasive data collection. Opting out would simply not be an option, not least in our digitized learning environment and particularly for students who do not have an independent cellular data plan because of various reasons. The University should therefore treat Wi-Fi tracing as a de facto requirement for on-campus students and provide robust protections to minimize its invasiveness. The only defense for collecting locational data is that the data is collected, stored, and used appropriately and in a clearly defined manner.

First, this means that the trove of sensitive health and locational information should be used only for COVID-19 contact tracing purposes. It is justified as a public health measure only. Other purposes, such as punitive ones, are not permissible.

Second, locational data should be assessed on a need-to-know basis only by those involved in contact tracing. Invasions of privacy must be justified by public health necessity.

Third, the current scheme must have a fixed and announced end date that can only be extended if necessary to combat the current public health crisis. The possibility that Harvard refuses to relinquish its newfound power is dangerous, especially considering the sensitive information that our location can betray.

Additionally, clear and open communication is imperative. Harvard has regrettably implemented TraceFi without prior consultation or notifications, and students were not given this information when planning for the fall and preparing for life on campus. Moving forward, any changes to the system must be transparently communicated.

Finally, oversight on data usage and procedures for data breaches is required. Students deserve to know whether and how their location is being used, and we believe that Harvard should consider a third-party or student body oversight mechanism to reinforce trust in its collection, storage, and usage of data. In the case that any breach or misuse happens, Harvard must take complete responsibility.

In recent memory, Harvard has, not once, but twice mishandled the privacy of its community members. On the second occasion, the former Dean of the College even violated Faculty of Arts and Sciences policy and misled faculty members on the scope of the searches. The reenactment of previous privacy scandals would be deplorable. We therefore demand that the University, if it moves forward with TraceFi, adopt the above measures and protect the privacy of its students. Anything less will weaken existing privacy protections, engender distrust and suspicion, and ultimately hamper important contact-tracing efforts.

This staff editorial solely represents the majority view of The Crimson Editorial Board. It is the product of discussions at regular Editorial Board meetings. In order to ensure the impartiality of our journalism, Crimson editors who choose to opine and vote at these meetings are not involved in the reporting of articles on similar topics.

Clarification: A previous version of this article stated that Harvard has implemented a Wi-Fi-based contact tracing system, TraceFi, to supplement Harvard University Health Services’ manual contact tracing efforts. In fact, Harvard used TraceFi in a pilot program that ran from July 9 to Sept. 9 and there are no plans to expand the service beyond the pilot. This article has been updated accordingly.