The month of May is bringing an ease to coronavirus pandemic “stay at home” measures in many parts of the world. Though stay-at-home orders appear to have been broadly successful in most places, nearly a month-and-a-half of a global economy on life support has necessitated some level of risk of a second wave of the virus. Local governments are attempting to control this risk by keeping various social distancing requirements in place as a limited amount of businesses and public services open their doors. Various technology proposals are also on the table, including anonymized digital identity tracking and the use of health certifications to determine who can safely return to work.
During the regular Covid-19 pandemic briefings, NIAID director Dr. Anthony Fauci has mentioned that the United States government is considering the use of some sort of “immunity cards” to identify Americans who have tested positive for antibodies. However, as with many of the ideas floated at these briefings, more concrete details have yet to emerge.
Researchers at MIT have taken initiative in this area. A new white paper from the university’s Connection Science program proposes a roadmap for an immunity testing system, one that would also anonymize personal data and protect user privacy. Though the proposal is tempting given the desperate circumstances, serious questions about actual ability to protect privacy and real expected efficacy remain.
The MIT health certification proposal
The white paper proceeds from the assumption that unemployment will soon crest 30% in the U.S., and that waves of the virus will continue for as long as two years until a vaccine is developed. Certain economic sectors will be unable to function normally during that time, causing widespread financial devastation.
The remedy, as the paper proposes, is a stable of known “safe workers” with documented antibodies to the virus. The paper cites various countries in Asia that have undertaken a similar effort, but notes that these have tended to use various levels of authoritarian measures that would not be legal or accepted throughout much of the rest of the democratic world.
MIT’s answer is to anonymize digital identity data and keep it local. The paper proposes that only entities with a need to know in each individual’s locality, such as local patient care facilities or the city government, be able to store and access this data.
The end result would be something like the ServSafe certification already required of many food workers in the United States, but in a digital form that is encrypted and verifiable through mobile devices.
The first and most important element in this plan is the availability of widespread, effective and inexpensive Covid-19 testing, something that much of the United States is still lacking. The proposal suggests blood testing for greater accuracy, and when a vaccine is developed one could become certified after being inoculated.
The paper’s author, Alex Pentland, is part of a team at MIT already working on a contact tracing project called Private Kit. This is a Bluetooth-based system that would use an app to anonymously track paths of contact, similar to efforts underway throughout the EU and the TraceTogether initiative already underway in Singapore.
Is digital identity tracking too problematic to overcome?
A month ago, coronavirus fears were centered around the ability of hospital systems to absorb the potential patient load. With most areas having been able to handle the crisis at lower capacities than expected, concern is increasingly shifting to economic damage and potential long-term knock-on effects. One very real concern is the potential misuse of any digital identity data, whether by governments or by threat actors that gain illicit access to stored health information.
A health certification is a potential answer to balance the competing interests of continuing to manage viral transmission while also enabling economic activity to resume. However, it is a proposition that is fraught with potential problems. At the moment, the MIT researchers are light on answers to those issues.
The paper suggests economic incentives as a measure to drum up public support for a health certification program. Instead of enforcement and punishment, individuals and businesses would be encouraged to participate with things like tax breaks and bonuses for front-of-house workers who have regular customer contact. However, in absence of any kind of federal guidance on the digital identity issue it would be up to localities to make their own rules — there is really nothing to stop them from adopting an enforcement-based approach instead.
While this system attempts to account for government misuse, it does not address how digital identity data might be abused by private entities. Once these health certifications are in use for verifying identity, will private property owners start requiring them to allow anyone access to their facilities? Will there be other forms of discrimination against those who do not hold a certification?
The wrong conditions could create perverse incentives for individuals to attempt to intentionally contract the virus, if they feel that they cannot work or access vital services without the ability to display a certification. And if the security of the digital identity program is not airtight, the generation or forgery of fake health certifications could undermine the entire effort.
As the widespread lockdown protests demonstrate, many are wary of any government measure that might curtail civil liberties. The use of a health certification could be seen as too close to being a digital “mark of the beast,” particularly if it is used to deny access to services or employment.
There is also a simple technical barrier to any digital identity tracking program, and one that researchers who live in something of a tech bubble may not be aware of; many people simply do not have a smartphone or do not know how to operate one. Recent Pew research indicates that while 96% of Americans own mobile phones, only 81% have smartphones capable of running apps. That leaves about 40 million American adults without ability to participate, with a particular skew toward one of the most vulnerable groups: those age 65 and older. The lower-income workers who overwhelmingly man the service industry jobs with high levels of public contact are also about 20% less likely to own a smartphone than their wealthier counterparts who are more likely to be able to work from home.
Finally, the core premise of the entire digital certificate effort is still somewhat in doubt: epidemiologists are still not entirely sure how much immunity is conferred, and for how long. Secure, anonymous digital identity tracking and health certification programs have a great deal of potential. They also face strong natural barriers to successful implementation. As the contact tracing efforts in other countries have shown, mass voluntary adoption is critical in absence of authoritarian measures of forced acceptance. The MIT proposal is certainly something worth thinking about, but it remains to be seen if it can come up with a concrete answer to this dilemma. There has been no word of government adoption as of yet but the team is working with the United Nations and the Club de Madrid, a consortium of former democratic presidents and prime ministers.