The Legality of Artificial Intelligence Contact Tracing to Stop Coronavirus in the U.S.

Artificial intelligence (AI) surveillance systems based on cell phone ‘close contacts’ are the proven best way to trace and prevent the transmission of coronavirus.  This short commentary considers the legality of implementing AI tracing systems in the United States legal and social contexts during a public health emergency.  First, AI-driven close contact tracing via cellular phones is described, before turning to U.S. law and policy regarding pandemics and cell-phone surveillance paying particular attention to Fourth Amendment jurisprudence.  Finding AI-driven surveillance is constitutional and not ‘unreasonable’ if proper safeguards were implemented, this piece observes that what is legal and necessary may not be socially or politically palatable. Instead, voluntary participation in personalized AI-driven contact tracing can and should be incentivized as condition to receiving federal benefits (e.g. stimulus money) or prioritized testing and care.

Introduction

            Severe acute respiratory syndrome coronavirus 2 or ‘COVID-19’ propagates primarily through droplets from a coughs or sneezes.^[1]  Chances of spread increase with ‘close contact’ (“being within 6 feet of [an infected person] for a prolonged period of time … or having direct contact with infectious secretions.”)^[2]   Symptoms include fever, cough, and dyspnea (difficulty breathing).  It is deadly, albeit for a small fraction of sufferers (the mortality rate is between 1% and 3.4%).^[3]   It spreads extremely rapidly.  Initial human cases were clustered around a live animal market in Wuhan, China in late 2019.^[4]  The first recorded patient, a market worker, developed symptoms on December 1, 2019.^[5]  Within five day, his wife, who had no market exposure, was hospitalized for pneumonia.   On December 31, 2019, Chinese officials reported a cluster of  44 patients.^[6]  Three weeks later, it increased to 278 cases in China and spread to Thailand and South Korea.^[7]  By the end of August, the pandemic had infected over 25 million people in 175 countries killing at least 827,000 of them. ^[8]

            Asymptomatic transmission makes coronavirus challenging to detect and stop.^[9]  A person can spread SARS-Cov2 even when they don’t know that they have it.  Experts estimate 10-50% of the transmissions are asymptomatic.^[10]  Since the virus can be spread to others just four days after infection and prior to the onset of overt symptoms,^[11] “extreme measures” are necessary to control the spread.^[12]  Even with new vaccines, virologists predicting multiple resurgences over the next year.^[13]  U.S. CDC experts expect the pandemic “will last 18 months or longer.”^[14]  The U.S. must adopt a legal framework for thwarting the spread of COVID and future pandemics.

            Contact tracing requires laboriously scouring of troves of data to identify close contacts, but AI can help.  Oxford researchers first suggested “instantaneous digital contact tracing” utilizing AI to “tap[] into cellphone location data to track the spread of infection and warn people who may have been exposed.”^[15]  This approach has been validated by Columbia University health experts, who confirmed digital tracking is far more effective than traditional methods.^[16]  Programs in Singapore and South Korea, in which mobile phones in close proximity exchanging encrypted Bluetooth signals are stored locally within the user’s phone for 21 days and notified if the other phone’s user tests positive for COVID, has effectively identified people carrying the virus up to fourteen days before the onset of symptom.^[17]  In 40% of Singapore’s cases, the first indication a person had the virus was the “health ministry telling them they needed to be tested.”^[18]  These cases illustrate how powerful contact tracing information can be in identifying and warning those who might be have been exposed allowing them to be tested and quarantine before the onset of symptoms.  Former U.S. Homeland Security Assistant Secretary Stewart Baker, identified phone location tracking as key “to slowing the pandemic,” but lamented “privacy and civil liberties advocates hate the idea.”[19]

I. Legal Authority for Contact Tracing During Pandemics

            United States’ jurisprudence has long recognized the appropriateness of governments taking necessary steps to safeguard public health during emergencies.^[20]   In Kansas v. Hendricks, the U.S. Supreme Court opined “we have never held that the Constitution prevents a State from civilly detaining those for whom no treatment is available, but who nevertheless pose a danger to others.  A state could hardly be seen as furthering a “punitive” purpose by involuntarily confining person afflicted with an untreatable, highly contagious disease.”^[21]  Similarly, other compulsive public health measures have been upheld, such as mandatory vaccination,^[22] quarantine,^[23] curfews,^[24] and evacuation orders.^[25]  Courts strongly defer to governments regarding the scope, durations, and methodologies officials use to make  public health decisions.^[26]  Congress has explicitly granted the government authority to develop plans to control epidemics and to “take such actions as may be necessary to implement,” including detaining infected persons “for such time and manner as may be reasonably necessary.”^[27]  Consequentially, there is clear legal authority to implement AI-contact tracing, which is far less burdensome than detention. 

II. Analysis of Privacy/Reasonableness Jurisprudence & Contact Tracing

            The Fourth Amendment in the U.S. Constitution’s Bill of Rights protects people from “unreasonable searches and seizures.”^[28]  U.S. jurisprudence has taken a negative view of using surveillance on U.S. citizens without a warrant based on probable cause of a crime.^[29]  The U.S. Supreme Court ruled against the government using cell phone location data to track people without a warrant in Carpenter.  The Court held that the government’s warrantless accessing of a person’s historical cell phone location metadata constitutes a Fourth Amendment search violating “legitimate expectation[s] of privacy in the record of his physical movements.”^[30]  Chief Justice John Roberts’ majority opinion noted this “sweeping mode of surveillance” is “near perfect … as if it had attached an ankle monitor to the phone’s user,” it is “tireless and absolute,” “detailed, encyclopedic, and effortlessly compiled” “provid[ing] an all-encompassing record of the holder’s whereabouts.”^[31]  The majority said a warrant was required.  The decision built on precedence in the law enforcement domain, primarily United States v. Jones, a case where police had attached a GPS track logger  to a vehicle to track its movement.  There, the Court unanimously agreed the action violated the Fourth Amendment as a search, but split 5-4 on the reasoning.  The majority opinion penned by Justice Antonin Scalia focused on the physical trespass, but admitted “it may be that achieving the same result through electronic means… is an unconstitutional invasion of privacy, but the present case does not require us to answer that question” noting “reasonable expectation of privacy in… their physical movements.”^[32]  However, Justices Sotomayor and Alito separately concurred focusing on the “reasonableness” of the intrusion into privacy.  Justice Sotomayor likewise cautioned tracking movement would reveal highly private details.^[33]  This caselaw derives from a reasonable expectation of privacy and illustrates a generalized jurisprudential trend against government surveillance using cell phones.  

A. Reasonable in Exigent Circumstances including Public Health and Safety

            Yet, in a public health crisis, the reasonable expectations of privacy must be substantially reduced for several reasons: first, public safety necessitates a reasonable exception even when dealing with constitutional rights; second, an AI system could be narrowly tailored to safeguard privacy; and finally, compared to the alternative of restrictive quarantine orders, such monitoring appears far less disruptive and burdensome to citizens. 

            Exigent circumstances have long provided an exception to rights of privacy.  The oft cited example of firefighters breaking into a burning home to save inhabitants and property without a warrant illustrates that immediate safety needs represent reasonable intrusions into what would otherwise be private domains.  Public health and safety general administrative inspections are not necessarily subject to warrant requirements.  In Martinez-Fuerte, Justice Powell noted generally that administrative warrants not tied to particular persons or objects, can be issued for non-criminal administrative inspections of homes and commercial establishments for health and safety checks.^[34]  In 1967, the Supreme Court held the Fourth Amendment continues to apply in non-criminal inspections, but found that administrative health inspections require warrants only if the subjects object.^[35]  More recent caselaw suggests that a statutory framework for health and safety inspections provides sufficient notice to reduce the expectation of privacy, at least in the business context.  In Donovan v. Dewey, the Supreme Court permitted a regulatory framework that called for quarterly mine safety inspections noting the government has “greater latitude” to conduct warrantless inspections of commercial properties than of homes, because of “the expectation of privacy that the owner of commercial property enjoys… differs significantly from the sanctity accorded an individual’s home, and [is] adequately protected by regulatory schemes authorizing warrant-less inspections.”^[36]  This suggests courts will afford great deference to Congress in determining when a warrantless framework would be necessary for safety.^[37]  The Court noted it would be “absurd” to allow “hazardous industries” to escape regulation.^[38]  Also indicative of the different standard for public safety, the Supreme Court upheld sobriety checkpoints noting the “substantial government interest” in keeping drunk drivers from endangering the public.^[39]  Likewise, the Supreme Court found Fifth Amendment constitutionally required Miranda warnings can give way to public safety concerns.^[40]  The trial judge in the case noted “Miranda [rights were]  never intended to enable a criminal defendant to thwart official attempts to protect the general public against an imminent, immediate and grave risk of serious physical harm reasonably perceived.”^[41]  Similarly in Mobley, the Fourth Circuit found that public safety concerns outweigh a suspects invocation of their right to speak with an attorney before being questioned.^[42]  These cases apply when officers have an objectively reasonable belief that public safety is at risk. 

            In the context of foreign intelligence surveillance for national security without a warrant when dealing with Fourth Amendment issues, broad surveillance of even U.S. persons maybe permissible if significant government interests are implicated and safeguards, including anonymization, control (no sharing for other purposes), and data deletion.”^[43]  The Foreign Intelligence Surveillance Court of Review has looked to the “totality of circumstances” to balance “individual privacy interests” against “particularly intense” government interests, finding that “ if [privacy]  protections are insufficient to alleviate the risks of government error and abuse, the scales will tilt towards unconstitutionality.”^[44]  The court observed “there is a high degree of probability that requiring a warrant would hinder the government’s ability to collect time-sensitive information and, thus, would impede the vital national security interests that are at stake.”^[45]  Later when the National Security Agency (NSA) collected the “full contents” of 250 million Internet communication of which 2,000 to 10,000 were wholly in the United States, the Foreign Intelligence Surveillance Court found “given the current state of NSA’s technical capability, [the system was] reasonably designed to minimize the acquisition of … information concerning unconsenting United States persons.”^[46]  Thus, even substantial warrantless surveillance might be deemed reasonable given significant government interests; however, it should be noted the Court found the NSA was wrong to retain this excessively collected information and to disseminate it. These cases illustrate that reasonableness must be weighed against the government’s interest; but the government must attempt to narrowly tailor warrantless surveillance and take steps to cleanse data. 

            In the COVID-19 context, as Stewart Baker observed “no one values the privacy of their location history more highly than they value the lives of their loved ones.”[47]  The government has a clear and substantial interest in protecting the public from coronavirus, which would warrant an exception to the Fourth Amendment.  Safeguarding can be implemented, such as anonymizing data, unless there was a specific health need to identify close contacts, erasing data after the time period of potential spread (21 days), and only tracking the close contacts via Bluetooth contacts within 6 feet (rather than using cell sites to continuously monitor movements).  Personal data could be stored in secure servers that are automatically cleared after 21 days.  People that disagreed with AI-determination of close contact could be given a right to human review of the decision.  A technical oversight board could be appointed to review and ensure storage and retention practices are being followed.

IV. More Carrot, Less Stick: Incentivized Participation

            While the government could lawfully institute nonconsensual AI contact tracing surveillance, such a move may spark public consternation and political backlash.  Indeed, the government has partnered with Google and Facebook to collect “anonymized and aggregated” data and not share “any individual’s location, movement, or contacts.”   This suggests corporate and governmental fear that individually tracing users may be unpalatable, even if legal.  But individual tracing is necessary.  Instead policymakers should promote voluntary corporate-led efforts that tout the benefits of opting-in to provide a ‘personal early warning system’ or a government-led ‘carrot on a stick’ approach conditioning public coronavirus benefits on participation in AI contact tracing to prevent the spread.  The corporate leaders, whether it be Google, Facebook, or cell-phone providers would be incentivized to make the system as user friendly as possible to encourage use.  This could cause them to put limits on the commercial use of the data.  Alternatively, in the government-led system, if citizens wanted ‘bailout money’ or perhaps prioritized coronavirus testing they would have to agree to AI contact tracing.  The Supreme Court previously upheld a statute forcing recipients of child welfare payments to admit social workers to inspect the health and sanitation of the premises in order to continue receiving financial benefits.^[48]  The Court said a ‘home visit’ did not constitute a Fourth Amendment search, but rather validation of conditions for benefits.  Similarly, the government can force those employed in public safety jobs, such as military and railroad employees, to consent to drug testing through urinalysis due to the diminished expectation of privacy relative to personal gain from employment, notice, and public interest.^[49]  Consequentially, policymakers could condition receipt of government aid, such as $1,200 per adult in the $2.2 trillion Coronavirus Aid, Relief, and Economic Security (CARES) Act^[50] or subsequent benefits, to participate in AI contact tracing.  Congress could legislate for personal data protection in these schemes too, for example requiring personal data to only be used for health warnings (and not commercial purposes), limiting retention of the tracked movements, and appointing oversight/inspection mechanisms to ensure compliance.

Conclusion

            In the long battle against coronavirus, contact tracing is necessary to prevent transmission, even more so if populations do not remain in lockdown.  The U.S. should embrace AI-driven cell phone tracking to identify close contacts and effectuate quarantines before greater spreading can occur.  Within the U.S. legal framework, the Fourth Amendment applies, but government implementation of AI-contact tracing for epidemiological surveillance would likely be deemed reasonable, especially if initiated by Congress with safeguards, like anonymization (until Bluetooth close contact is found), minimization, and automatic deletion after the extent of potential incubation.  In implementation, steps should also be taken to use AI-contact tracing only for virus prevention, rather than imposing criminal sanctions.  The public should also be mindful that AI-contact tracing will not be perfect.[51]  Alternatively, the U.S. government could make AI contact tracing voluntary, but encourage it by conditioning significant public aid benefits on participation.  To stop the spread, protect the public, and get life ‘back to normal’ policy makers must embrace AI-aided contact tracing within the U.S. legal framework.