CORONAVRIUS TRACKING PLAN HAS SECURITY RISKS

Contact tracing, along with widespread testing and effective quarantine measures, is seen as critical to slow the spread of the coronavirus.  The ambitious Covid-19 contact tracing plan that is being developed by Apple and Alphabet Inc.'s Google has great potential.  However, it will undoubtably create a tempting target for cybercriminals looking for sensitive health data to find out who’s been infected.

Apple and Google plan to set up their tracing system in phases. The first step is to create an application programming interface for public health authorities’ apps to allow anonymous virus information sharing between iPhones and Android devices.  The system taps into Bluetooth technology so Apple and Android devices can anonymously communicate with each other.  Two people coming into close contact would have their phones share anonymous identifiers with each other to log that encounter.  

If one of the people gets a positive Covid-19 diagnosis, he or she would enter the results into a public health agency application.  With consent, a log of other mobile devices the person came in close contact with would be stored on a server for 14 days. The other person’s phone would then check the server periodically to see if they have been in close contact with someone with Covid-19 and send an alert about how to self-isolate.  Apple and Google also plan to build contact tracing capability directly into their phone operating systems to help users detect when they are physically near someone who has tested positive.

While this tracking technology seems promising, the companies have acknowledged that there are security risks in a system potentially involving the personal data of millions of people. As a result, they’re building in a range of security measures including anonymous identifiers and encryption keys.  Notwithstanding these efforts, cybercriminals might be able to tie the anonymized private data back to specific individuals, including information one could collect while the individual is in possession of his or her phone  

Common law claims are the biggest risk to public health authorities after a data breach.  In this regard, authorities can face lawsuits that allege that their negligence led to a data breach.  Companies whose data is breached could also face lawsuits under state consumer protection laws for not having reasonable security.  Overall, public health authorities and companies involved with this technology need to ensure that these security risks are properly evaluated and addressed before it is implemented throughout the country.