Without a Trace

COPYRIGHT 2020 Debra Littlejohn Shinder

Corona Smartphone App Tracing - Free image on Pixabay

Many of us breathed a sigh of relief as state and local governments finally began to lift the orders of mass house arrest under which we had been living for two months — but that feeling was short lived, as they revealed that they had another heinous control tactic up their sleeves: contact tracing.

If you think things are back to normal now that you’ve finally been allowed to return to work, get a haircut, and eat in a restaurant, think again. Most Americans are now under surveillance to an extent they’ve never been before, and your liberty can be snatched away again in the blink of an eye if you happen to be in the wrong place at the wrong time.

What is contact tracing, anyway?

Most people outside of healthcare had never heard of contact tracing three months ago. Now states are pouring massive amounts of (mostly federal) money into contracts with private companies that will build massive armies of “tracers” (it even sounds like something out of a sci-fi/dystopian future novel) to act as so-called “disease detectives.” Their mission: to hunt down anyone who has been infected with or has possibly been exposed to the SARS-CoV-2 virus and advise them to “voluntarily” quarantine.

Spartan army - Wikipedia

Sounds innocuous enough, right? Oh, did we forget to mention that if you should choose not to quarantine yourself voluntarily, then it magically becomes mandatory, with criminal penalties and even in some cases, the state removing you from your home to a “quarantine camp” and/or taking your children away to “protect” them from you (despite the fact that the virus very rarely has any serious effects at all on those under 18).

Now, contact tracing advocates will dismiss any concerns you might have about this with the assurance that “this is nothing new — public health agencies have been contact tracing for decades.” That’s true. They did it with AIDS, and it was useful in controlling the spread of HIV. They also did it with the small U.S. outbreak of Ebola in 2014.

What’s happening now, however, is very, very different.

AIDS is transmitted via bodily fluids. Tracking with whom someone had had sex or shared a needle is orders of magnitude easier than tracking everyone a person came within six feet of over the course of their daily lives. Those people were then advised not to have unprotected sex. They weren’t locked in their homes until a cure was found. In the case of Ebola, the number of cases was extremely small, making it effective to find and quarantine those who had been in contact with those few people.

To compare the proposed COVID contact tracing programs with those for AIDS and Ebola is like saying “speeding has always been against the law; that’s nothing new” when you’re proposing to expand that law to now send all speeders to jail and also jail anyone who was a passenger in a car that was caught speeding, or who parked next to the offending car in a parking lot.

For an up-close and personal look at how this is going to work from someone who took the class to become a tracer, check out Contact Tracing: Scarier than You Thought on YouTube.

COVID contact tracing: a horse of a different color

Yes, contact tracing can be a valid epidemic control strategy, but as shown in the video linked above, contact tracing for COVID-19 is a whole other animal. The efficacy of contact tracing depends largely on the nature of the disease and the extent to which it has already spread. It can be effective early on in an epidemic when there are no more than a few hundred cases. It becomes unmanageable and ineffective when a large percentage of the population has already been exposed — as is the case here, evidenced by studies showing a high prevalence of asymptomatic cases in random sampling.

I see those in favor of tracing saying “well, if I have the virus, I want to find out so I can be treated.” If that were the end-all of contact tracing, it might make sense. But quarantining those who have virus is only a small part of it. The entire point of contact tracing is to find out with whom those testing positive have been in contact and quarantine them — and the people with whom they have been in contact since their exposure. And then you’d need to also hunt down the people that those people contacted.

Is it beginning to sound a whole lot like a multi-level marketing (MLM) strategy, also not-so-affectionately known as a pyramid scheme? That’s because it is — and as with MLM, within a few “levels,” you exhaust the supply of people; now the majority of the population is in quarantine. Welcome back to lockdown.

Quarantine | A word cloud featuring "Quarantine". This image… | Flickr

But that’s not all. If you simply had to serve your two-week sentence and then you could go about your business freely, it wouldn’t be quite so bad from a practical standpoint (although it’s still pretty awful from a liberty and constitutional rights perspective). But here’s the kicker: as soon as you get out of quarantine, happy to have developed no symptoms and tested negative, if you go back out there and come within six feet of another COVID positive, back into quarantine you go again.

This, my friends, is not sustainable. And governors all over the country are implementing these programs without even getting the authorization of their own legislative bodies. It’s not a partisan thing, either. It’s not just the Democrats or just the Republicans who are pushing this thing. As this article warns, your governors, red or blue, are coming after you with their tracer armies. Read it and be afraid. Be very afraid.

The key factor here is whether participating in contact tracing systems will be voluntary or mandatory. We’re being assured, by those advocating for it, that it will be the former. But we’re also told that it won’t work unless there’s an 80% participation rate. What if enough people don’t volunteer? We all know that “voluntary” government programs have a way of becoming mandatory – the personal income tax is supposedly “voluntary,” too — until you don’t pay.

NOTE/UPDATE: While it’s true that governors in both red and blue states are embracing the idea of contact tracing, there’s no denying that one party is pushing it harder than the other, especially at the federal level. H.R. 6666 (seriously, that’s the number), with the scary title “COVID-19 Testing Reaching, And Contacting Everyone (TRACE) Act,” is sponsored by 65 members of the House of Representatives — all of them Democrats. The lone Republican co-sponsor withdrew his support May 15th.

There’s an app for that

Now you may be wondering: exactly how do they track down everyone with whom you’ve come in contact: the friends with whom you had dinner last week, the guy who brushed up against you in the grocery store a few days ago, the lady who sat at the station next to yours at the hair salon this morning?

That’s another way in which contact tracing for COVID differs from past implementations. Traditionally, it was done manually, through interviews with patients. They were asked to provide names and contact info for those they might have exposed. Conducting such interviews — including going to people’s homes — will be the job duty of the members of the tracer armies.

In some jurisdictions, state and/or local governments are requiring restaurants, hair salons, and other businesses to keep a log of their customers’ visits, including contact information, to be turned over to public health officials if they ask. They’re making it a condition for the businesses to reopen. So even if you pay cash, you still have to reveal your identity and personal information.

But here’s the big difference: Today, in addition to those “manual” methods, we have technology rushing to the rescue (or perhaps more accurately, is being rushed into use as a weapon against us). Most people now carry cell phones everywhere they go. A majority of those are smart phones that include all sorts of location sensors: GPS, wi-fi, Bluetooth, NFC — all of which can be used to pinpoint where you are and where you’ve been.

Apple and Google, which together own almost 100% of the smart phone operating system market share worldwide, have partnered to build support for these apps into their OS application programming interfaces (APIs). This capability is being rolled out now to smart phones on all carrier networks. Unlike many/most system updates, you can’t easily avoid it; even those who have automatic updates turned off are getting it installed on their iOS and Android devices. On Android, you’ll find it in Settings | Google Settings if it’s been installed.

Don’t panic if you see this on your phone. These OS updates, at the moment, don’t mean you’re being tracked for contact tracing purposes. For that to happen, you have to also have a tracing app installed. Individual states are developing their own contact tracing apps to take advantage of this. Some of those apps are more invasive than others.

The Apple/Google system is actually designed to be less invasive than some others that are being developed by companies using their own frameworks. The APIs on the iPhone and ‘droids are supposed to work like this: a person who has tested positive and has the app enters that information in his/her app. If you have the app, when your phone detects that it’s in proximity of that person (which it does using Bluetooth), it notifies you. You then have the choice to get tested. The information is not (at this time) sent to the state or any centralized database. You can read more about this “privacy-preserving contact tracing.”

I keep saying “at the moment” or “at this time” because of course these APIs and apps could be updated at any time for “added functionality” — which could include using other location services (GPS, wi-fi) and/or “calling home” to upload the info they collect to the tech company’s or state’s servers.

One of the (many) potential problems with all of this is that proximity detection isn’t precise. Bluetooth’s range varies based on many factors but can generally extend to 100 meters (over 300 feet) for BT v4. This means your phone can “detect” another phone that’s much farther away than the 6 foot “social distance,” so you could be tagged as having “contact” with someone who was all the way on the other side of the grocery store from you.

As mentioned, some states are already creating their own apps that go farther and collect more data. Companies are also making contact tracing apps specifically for businesses to use with their personnel and many of these collect much more information. Some of these also enforce social distancing rules by detecting if you (and your phone) are within six feet of any other person and alerting you (and reporting it to your company’s department that is monitoring such things). Smart phone GPS is now accurate to around 16 feet, but indoors, especially depending on the building material, accuracy can be degraded. Atmospheric conditions, satellite geometry, and even radio interference can also affect accuracy.

The main takeaway here: Just because the app says you were in contact with a COVID positive person doesn’t mean you really were close enough for viral transmission to occur; it just means you were close enough for signal transmission to happen. However, you may still end up quarantined — depending on how your particular app works.

Something else to bear in mind is that just because you don’t install an app, that doesn’t mean you’re safe from having your technology used against you. Tracers could also check your phone’s GPS history, check your posts on social media that mention where you are at various times, use your car’s data event recorder (if you have a newer model), even use facial recognition technology to find your face on the multitude of cameras installed in businesses and public buildings if they’re really determined.

Currently you have the choice to install a contact tracing app or not. If “too few” people do so, what are the chances the next step is to push the apps onto your devices whether you want them or not? What about those of us who conveniently leave our phones at home when we go out, or keep them in a Faraday bag so they can’t send or receive signals? Will it become illegal to be out and about without a phone? Will we be required to show the app to enter businesses and public buildings (some have already started giving discounts if you show the app)?

Or will the government simply issue tracking wristbands that we’ll all have to wear when we leave the house? Singapore is already in the process of doing so, and many of its residents are not happy about the invasion of their privacy.

This is a test. This is only a test.

Your app’s location service isn’t the only thing that might not be accurate. Let’s back up for a moment. The way this whole contact tracing chain gets started is when someone tests positive for the virus. But do these tests have a high degree of accuracy? It turns out maybe not. Here in Texas, state officials are investigating a high rate of false positives at several nursing homes. A large number of patients and employees tested positive, but a second round of testing at a different lab came back with all negative results.

File:Blood test.jpg - Wikimedia Commons

How many more inaccurate test results are causing myriads of people to be quarantined unnecessarily? Since the common cold can be caused by a different strain of coronavirus, tests can come back positive because a person has simply had a cold. As if it weren’t bad enough to be put under house arrest because you were in the same store as someone with the virus and might or might not have been close enough to him/her to catch it, now you can have your liberty restrained when the original person didn’t even have the disease in the first place, but merely had a cold.

If testing is the foundation of contact tracing and the testing can’t be counted on to be accurate, doesn’t that feel a lot like being convicted in court based on evidence that may or may not be faulty? Of course, since this is a public health matter instead of a criminal matter, the protections guaranteed under the criminal justice system technically don’t apply — but the impact on your life, which is loss of your freedom, is very similar.

Who loves contact tracing?

Many epidemiologists, of course, find contact tracing very appealing because it feeds their hunger for statistical data about the disease, although others will admit that it’s unlikely to be effective in stopping the spread of COVID-19. This is understandable; they’re looking at it from the perspective of making their jobs easier.

What’s more puzzling is how state governors on both sides of the political aisle are suddenly head-over-heels in love with it. One wonders whether that’s because they think it makes it look as if they’re “going something” to address the epidemic, whether they’re power-hungry potentates who want constant surveillance of their citizens beyond disease control, or whether it’s simply a “money matter” — getting all those federal dollars for the state and/or getting under-the-table payments from the contact tracing companies for awarding them the contracts.

And make no mistake about it: we’re talking about a lot of money here. Contact tracing is suddenly big business. In fact, COVID-19 has created a billion-dollar industry that sprang up over the course of just a couple of months. To the average thinking person, the continued hysteria over the virus now that we know the fatality rate is little more than that of a bad flu season doesn’t make any sense — but when you follow the money, suddenly it does.

Many people are going to become very wealthy, from producers of PPE (including cloth masks that provide almost no “PP”) to vaccine manufacturers to “safety consultants” who charge big bucks to advise companies on new policies to virus testing facilities to contact tracing companies. That’s without counting the unexpected boom for suddenly-in-demand products such as webcams and green screens for work-from-homers, Amazon and the rest of the e-commerce industry now that more people are buying online and staying out of stores, and of course sellers of hand sanitizer, wipes, alcohol (both kinds) and inexplicably, toilet paper.

Who hates contact tracing?

Despite its obvious appeal to data collectors, would-be dictators, those making money off it, and those for whom it soothes their paranoid fear that every human being they see on the street is going to give them a “deadly” virus, there are many who are not fans of this new and “improved” brand of contact tracing.

The anti-contact tracing sentiment is especially strong here in the Lone Star State. The Texans and Americans Against Contact Tracing group on Facebook is one of several and has attracted over 13,000 members in a couple of short weeks of existence. Publications on both sides of the political aisle have raised privacy and liberty concerns regarding tracing, and a group of Texas state legislators, led by Republican state senator Bob Hall, have stepped up to speak out against contact tracing in our state. The Texas Freedom Caucus has called for an immediate end to the $295 million contract that Governor Greg Abbott recently awarded to contact tracing company MTX.

There is never a right time or right way to do the wrong thing. In the COVID-19 scenario, contact tracing is technically wrong, financially wrong, and morally wrong.

Texas State Senator Bob Hall

As more and more new information comes out about the misinformation that government agencies have disseminated throughout the COVID crisis – and even those most inclined to blindly follow the leaders are having a hard time reconciling the constantly changing conflicting “facts” that entities such as WHO and the CDC put out – trust in government is at an all-time low.

Add to that the mass protests aimed at the police, one of the most visible branches of government, and there are a whole lot of folks out there who aren’t inclined to put their lives and freedom in the hands of a government-contracted company dedicated to tracking their every move in hopes of finding a reason to lock them up in their homes again.

The polls show widely varying results when Americans are asked about contact tracing: on May 12, an Axios-Ipsos poll showed respondents to be overall opposed to using a contact-tracing app, with 48% saying they wouldn’t use it if established by the CDC and 68% saying they wouldn’t if it were established by the federal government (apparently they don’t realize the CDC is a federal government agency …).

Interestingly, another poll taken by the same organization just one week later, on May 19, indicated that most Americans are on board with tracing if it doesn’t involve revealing their cell phone location data. However, the very different wording makes it hard to compare the two polls.

Bottom line is that a whopping 84% of those responding said they would self-quarantine for 14 days if they were notified that they had come into contact with someone who tests positive for COVID, but only 56% said they would give tracing officials access to their phone’s data if they themselves tested positive. It seems close to half the population does not trust tracking apps. Maybe that’s because we’ve all used computers and mobile devices and seen just how badly a program can mess things up.

Even many of those who support enhanced contact tracing acknowledge that it is intrusive. Some will even go so far as to admit that it can be a violation of constitutional rights. Unfortunately, although many folks assume it’s a HIPAA privacy violation, that statute contains an exception for public health. However, in late April some Republican senators announced that they were planning to introduce a COVID-19 Consumer Data Protection Act that would give people the right to opt-out of tracing apps’ data collection.

This image has an empty alt attribute; its file name is image-2.png

It’s a little disheartening that privacy advocates such as the EFF (Electronic Frontier Foundation) have generally focused their concerns more on whether the apps are open to hacking than the intrusiveness of the concept itself, although the organization did publish an article back in March pointing out that governments haven’t shown that location surveillance would actually help to contain the virus and goes on to say:

Moreover, fear of surveillance chills and deters free speech and association. And all too often, surveillance disparately burdens people of color. What’s more, whatever personal data is collected by government can be misused by its employees, stolen by criminals and foreign governments, and unpredictably redirected by agency leaders to harmful new uses.

MARCH 23, 2020

Likewise, the American Civil Liberties Union (ACLU), rather than taking a strong stand against the expansion of contact tracing, issued a white paper recommending “governance principles” for adopting tracing programs. The good news is that those principles include that “any use of a contact tracing app or technology is voluntary, including by prohibiting private and public entities from making the use of a contact tracing technology a condition of employment, housing, or access to critical services like grocery stores.”

The cost/benefits analysis

Even if we put privacy and constitutional rights aside (which, of course, we should never do), we need to ask another very important question: Is the cost of contact tracing worth the benefits? According to an article in the MIT Technology Review:

A team in any given region would have to detect at least half of new symptomatic cases, and reach at least half the people they were in close contact with and encourage them to stay away from others, in order to reduce the transmission rate by 10% or more.

James Temple, “Why contact tracing may be a mess in America

Now Congress is being urged to fund a contact tracing workforce of nearly 200,000 people at a cost of $12 billion. Remember that we’re talking here not about a disease like Ebola, with a 30-50 percent fatality rate. Not like smallpox, with a fatality rate up 30% and life-long scarring of up to 80%. The CDC has, as of this writing, provided a “best estimate” of the fatality rate for COVID-19 as 0.4% — or two-fifths of one percent — and possibly as low as 0.2%.

Although every death is tragic and I have deep sympathy for those who have lost loved ones to COVID-19, the facts show that a very large percentage of those deaths are among the most vulnerable population – the elderly and those with serious underlying medical conditions; in other words, the same people who make up most of the annual flu deaths each year. In fact, the World Health Organization reported in 2017 that 250,000 to 650 000 people die of respiratory diseases linked to seasonal flu each year.

We’ve never deployed an “army” of contact tracers to track down everyone exposed to the flu. Why not? Because it’s so common, with so many infections that are so widespread that it would be ineffective, and because despite the large number of deaths, the fatality rate is so low that the cost wouldn’t be worth it.

And let’s remember that there are additional costs of implementing this new version of contact tracing (since it relies on digital technology, let’s call it contact tracing 2.0) that aren’t monetary. Turning the public health system into an army of “enforcers” will seriously undermine the public trust in its medical system.

Many people are already afraid to go to the doctor for their routine visits because they’ve heard that everyone is being tested for COVID and they don’t want to risk quarantine — not just for themselves but their families and friends. Some are even hesitant to go to the ER despite serious symptoms of heart attack or stroke for the same reason.

There are horror stories out there about elderly people who went to the doctor for a minor issue, were required to be tested for COVID, and then were forced into the hospital even though they showed no symptoms (that couldn’t have anything to do with the fact that Medicare pays hospitals more for patients diagnosed as COVID-19, could it?). Tales like this have some people terrified of seeking any medical care for anything.

Another intangible cost: Contact tracing, like social distancing and masks, will alienate people from one another. Now the hysteria over the disease itself and the paranoia about certain death if you get too close to someone outside your household are dying down in light of the much lower fatality rate than was previously thought. But just as we thought we could go back to enjoying human company again, we’ve been fed a new fear: if we socialize with someone and then they get exposed, boom! We’re on the contact tracers’ radar. And if we get exposed, we’ve done the same thing to them.

The past three months have been surreal – something out of a bizarre novel. Overnight the comfortable world in which we lived was turned upside down and our lives were put on hold indefinitely. Jobs and businesses were destroyed, relationships ruined, and our emotions ran the gamut from fear for our lives to anger over the lies to worry about the loss of autonomy and control over our own bodies and medical decisions.

But we got through it (well, most of us did — some decided they couldn’t handle living in a COVID-era world and took their own lives; suicide rates shot up sharply during the pandemic). The good news started to emerge, including the lowered fatality rate, the information that surface transmission was unlikely and that asymptomatic transmission was rare. Life was beginning to return to some semblance of normal — but then along comes the specter of contact tracing to make us feel as if we’re caught in a Minority Report world where instead of having to be afraid of being punished for a crime you haven’t committed yet (and might never commit), you have to worry about being put under house arrest for a virus you don’t have yet – and might never have.


For decades, contact tracing has been a useful tool in the public health arsenal to fight communicable diseases. It was critical in the eradication of smallpox, and was used to help track HIV/AIDS, tuberculosis, SARS, and other infectious diseases. Contact tracing as it was practiced in those cases is a legitimate and important process that can help limit transmission of serous illnesses.

However, contact tracing as it’s being ramped up in response to COVID-19 is like nothing we’ve seen before in the public health arena, and raises serious ethical and legal issues. Private contractors will be privy to confidential medical information of millions of people. Tracers will be given authority, at least in some states, to forcibly quarantine people who may not have been exposed at all, or who were in contact with people who are thought to be carriers because of false positive tests.

Those who refuse to “voluntarily” quarantine or who refuse to divulge the personal information of people with whom they’ve been in contact may be subjected to civil or even criminal penalties and may be forcibly removed from their homes or have their children taken from them. Millions or billions of taxpayer dollars will be wasted, creating a national debt that will fall on the shoulders of Americans for generations to come.

Is it worth it, for this disease? Apparently most of our elected leaders think it is. I wonder if they’ll feel the same if this turns out to be the hill they die on in their next election. No doubt they’re watching the polls, but polls can be deceiving (ask John Kerry and Hillary Clinton). I have a feeling a lot of those citizens who are currently saying they’re okay with contact tracing will change their opinions when it’s them or their loved ones who find themselves caught up in its web and discover that the freedoms they once enjoyed are gone without a trace.

About debshinder

Technology analyst and author, specializing in enterprise security. Author of or contributor to over 25 books, including "Scene of the Cybercrime." Fourteen-year Microsoft MVP, married to Microsoft FTE Tom Shinder, and proud mom of two wonderful grown-up human children and three amazing Japanese Chin pups. In my spare time, I love to travel - especially on cruise ships - and write about my grand adventures.
This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s