Lessons from 9/11 can help build better contact tracing app

Our public health authorities have made clear that to keep COVID-19 infection levels down, we must strengthen our ability to identify, test, and isolate individuals who have been exposed to the virus. Contact tracing apps — which use mobile technology to track a person’s proximity to someone who has tested positive for the coronavirus — could help us achieve these goals. The challenge is to develop tools that deliver real results without sacrificing civil liberties and personal privacy.

Most contact tracing tools to date leave something to be desired. Some countries have adopted methods that collect far more personal information (such as location data and video footage) than U.S. citizens historically have been willing to accept. Other tools, such as those being promoted by Apple and Google, are voluntary and less intrusive, but may not provide sufficient public health data to be useful. 

Hard choices need to be made, but we have been here before. A similar tension between public safety and democratic principles arose after 9/11 when the U.S. harnessed new technologies to strengthen counterterrorism intelligence collection. Lessons from that era can help us emerge from unsustainable “stay-at-home” orders without sacrificing our core values. 

First, we know from the 9/11 experience that the public will tolerate some loss of privacy in the name of safety. But several counterterrorism programs foundered when the public decided the privacy sacrifices were not worth the security gains. 

Tools that collect as little data as possible promise to avoid this overreach. But apps that rely on voluntary participation and anonymized proximity data also will likely fail the cost-benefit test. Too many infected people will not be identified, and public health officials may waste valuable resources chasing down “contacts” who are at low risk of being infected. 

Instead, health officials should explain to the public what data they realistically need to conduct effective contact tracing given our levels of infection and the resources available. Strong privacy protections can then be built around public health priorities, rather than the other way around. This will allow the public to better appreciate the health benefits that come with the privacy sacrifices we will all need to make.  

Second, the 9/11 era taught us that surveillance methods are more likely to be widely accepted if they are transparent and have democratic legitimacy. Americans were outraged when they learned that the executive branch had instituted certain surveillance programs without public debate. These programs gained more acceptance after Congress created a robust oversight structure and set clear rules for how information could be collected and used.

People will be more willing to adopt contact tracing tools if they know how their data will be used and protected. Congress should take the lead now in setting enforceable national standards for privacy and cybersecurity. State legislatures and regulators can build on those standards and tailor them to local priorities and the technologies employed. Setting an end date for the use of contact tracing data, as Congress did for parts of the Patriot Act, would also promote public confidence.

Third, we know from the counterterrorism experience that effective oversight builds public trust. Since 9/11, rigorous reviews by agency inspectors general have helped agencies make important corrections to surveillance programs. The work of the federal Privacy and Civil Liberties Oversight Board, created by Congress on the recommendation of the 9/11 Commission, has also helped improve and legitimate counterterrorism programs.  

Congress should authorize a federal panel to provide guidance to states and scrutinize the efficacy and application of any surveillance tools. States and local authorities can take similar steps by appointing privacy advocates, health professionals, technologists, and community leaders to oversee new contact tracing technologies. A key priority would be to protect against “mission creep” by ensuring data are used only to stop the spread of COVID-19, not for other governmental or commercial purposes.

Finally, no matter how good the technology, we will still need large numbers of public health employees to do the painstaking work of sifting through data, interviewing infected individuals, and communicating with past contacts. Just as we had to rely on an array of tools and committed professionals to combat the terrorism threat, we will not simply “tech” our way out of the current crisis.

David Schanzer and David Hoffman are professors at Duke University’s Sanford School of Public Policy and Shane Stansbury is a professor at Duke Law School.