Online contact tracing is changing business: from a means to counter the Coronavirus contagion to a tool of public order. Can we afford it? The analysis of Andrea Monti, Adjunct-Professor in charge of law and order and public safety at the University of Chieti-Pescara
Originally published in Italian by Formiche.net.
A series of tweets from the American network NBC News bounce the news that the authorities in Minnesota plan to use data from Coronavirus contact-tracing software in public order and security operations to contain the antiracist protests broken out over the death of George Floyd caused by a police officer.
This announcement re-ignites the controversy about the risks of abuse by the State, if it is allowed to have at its disposal vast amounts of data of all kinds on citizens and, in Italy, reinforces the position of those who praised the incredible technological complication that “to protect privacy” has delayed and castrated the development of Immuni, the contact tracing software that should warn us if we came into contact with someone who tested positive at Covid-19.
There are several reasons why Immuni and its counterparts make no sense (intrinsic unreliability of results, limited usefulness, dependence on operating systems and smartphone models). However, the reuse of data by the State for other purposes is not among them.
The Italian Personal Data Code, in fact, already provides that telcos and internet providers retain all telematic traffic data for 72 months and make it available to the judiciary. The civil and fiscal legislation requires that banking transactions and payments be stored for ten years, also subject to seizure by the judiciary, as well as hospital medical records. Policing hooligans, the concept of “deferred flagrancy” allows the video recording of the clashes, so that the subsequent analysis of the footages allows to identify and report the perpetrators.
Enormous archives of our communications, movements and activities which have been collected for other purposes can also be used by the judicial authorities. Adding to the list data coming from Immuni, therefore, would not change the situation much: a Public Prosecutor has, by definition, the power to access and seize anything (data included) that is necessary for the investigations.
The choice of the Minnesota authorities reveals, however, a less evident but no less critical prejudice in the dystopic rhetoric of those who are afraid of the State: that of invoking “privacy” as immunity and impunity for the commission of illicit acts.
Protesting is sacrosanct and is the founding right of a democracy. Vandalising, destroying and beating are, on the other hand, behaviours that damage public order and as such must be prevented before they happen, contained when they occur, punished when they have ceased.
It should not cause any scandal, therefore, if a public authority uses what it has at its disposal – including contact tracing data – to fulfil its institutional role. And it is incomprehensible why the “privacy” of those who commit illegal acts should be “protected” when it comes to contact tracing but quietly “violated” when it comes to using state trojans, the “computer captors” who infiltrate smartphones and take control.
Moreover, in the case of Minnesota, the use of contact-tracing data for police purposes is transparent and declared, so we are not even dealing with a case of clandestine use of these information.
In conclusion, therefore, we must realise that every time data are accumulated for any reason or any purpose, the State has the power and duty to access it for purposes of public order and the administration of justice. Thus, even if Immuni’s data only be available for a couple of weeks, nothing would prevent investigators from acquiring it.
And here, another paradox manifests itself: to “protect privacy” Immuni’s data are encrypted and, therefore, not immediately intelligible by those who had access to it, not even the Public Prosecutor. Consequently, if he wanted to use them, he would have to ask the State – that is, himself – to hand over the deciphering keys, risking being told that the keys are not there “for privacy reasons”.