What a Privacy Expert Thinks About Harvard’s Wi-Fi Contact Tracing System
The Crimson asked Beatriz Arcila to discuss the benefits and drawbacks of a Wi-Fi contact tracing system Harvard began piloting this month, including issues related to accuracy and privacy.
Courtesy of the Faculty of Arts and Sciences
By Sydnie M. Cobb, Crimson Staff Writer
Beatriz Arcila is a doctoral student at Harvard Law School and a former fellow at Harvard’s Berkman Klein Center for Internet and Society. As a fellow, she studied the governance of data collected by digital platforms in cities.
The Crimson asked her to discuss the benefits and drawbacks of a Wi-Fi contact tracing system Harvard began piloting this month, including issues related to accuracy and privacy. The system — called Tracefi — uses the signals phones, laptops, and tablets constantly emit to Harvard’s Wi-Fi infrastructures to gather three pieces of information: a datetime stamp, the signal strength received by Harvard’s Wi-Fi infrastructure, and the MAC address of the mobile device. It then stores the data for up to 28 days.
This interview has been edited for brevity and clarity.
-----
The Harvard Crimson: Upon first looking at Harvard’s contact tracing diagram, what initial thoughts did you have about the plan?
Beatriz Arcila: I have two thoughts. The first one is that if you look at it carefully, Harvard isn't asking for any information it doesn't have already. So the way it works is they have all our devices’ IDs, which is something I think you give to Harvard anyway to do like the secure ID signup. And then you need to download some form of publication to enter Harvard’s Wi-Fi network. That is a common practice: Wi-Fi providers will have some form of record of which devices are connected to their networks. They have two parts of information that are required to identify the device: they have the device ID and then they know who that device belongs to. That's something that they know already. What they’re going to do is tap in to that information. So they have to do some form of contact tracing. So my first thought is they’re not collecting new information. They might be using it in a different way they hadn't before systemically. I don't know if there's a history of hardware using WiFi data for anything else before, but maybe there is. But it's not new information. So I think the privacy questions here have limits. Maybe when we download whatever is used to access Harvard's network, there might be a privacy policy there, and that will be something interesting to look into.
THC: Did you see any possible concerns for the contact tracing possibly infringing upon students’ privacy? Or do you think that the plan does protect students’ privacy adequately?
BA: Harvard has this information already. It might be unprecedented that it is being used like this. And some of the things I think students should be asking for are the safeguards on how that information might be used. We all agree that COVID is serious. We all agree that we want to be safe on campus. But you, for example, want to limit how that information can be used. It should only be accessible for COVID purposes. It shouldn't be disclosed to third parties. Harvard should not be able to use it for anything else. I don't know what else it could be used for. But maybe there is something that it could be used for that we don't feel comfortable. In a city context, I would say, we don't want that information to be used for criminal law purposes. At Harvard, you don't want contact tracing results to be used for disciplinary purposes that aren't related. But the other thing that I think is interesting and I will raise is that, if I understand correctly, Harvard is going to be testing people every three days.
So the question is, what is the effectiveness of doing contact tracing? Well, you already have universal testing, right? One of the main purposes of contact tracing is to be able to locate people who might be infected and who might have passed on COVID to someone else. We have universal testing that is going to happen every three days, and we assume those results are gonna come somewhat quickly. What is the purpose of doing contact tracing on top of it? You will have the results of the people I’ve been in touch with anyway in three days. So with the concerns to privacy, even if it looks new, the use of this data might be less justified.
THC: Given those concerns, do you think there's a better way that Harvard could have gone about contact tracing? Or do you think that this is the most effective way?
BA: I think it raises questions about general surveillance power Harvard already has, even if it hasn't acted upon it before. From a technical perspective, it makes sense. The thing that I find interesting is that I don't know if contact tracing to this degree is important if you're going to have universal testing. That's like a double intrusion upon students. Right? You have to get a test every Thursday. And then on top of it, your phone is being tracked. In the context of universal testing, I don't know if it's effective. I don't know if it's needed.
THC: Other than privacy concerns, did you have any other reactions to the system?
BA: I think something that you might look into a little is what is the accuracy of Wi-Fi location data? One of the big discussions about contact tracing apps a few months back was the accuracy of the technology used to do the contact tracing. So for example, GPS data has an inaccuracy rate that is somewhat significant for these purposes, maybe 20 feet, that's a lot. For example, it will ignore all other measures like masks or a wall. So even if you have a wall between you and the person next door, like in a dorm room, the device will decide that you were together if it's a Bluetooth type of technology. Similar issues might come up with Wi-Fi. I think in the context of universal testing might be simply unusable. If everyone is wearing masks and universal mask usage decreases the amount of spread, if like if you had like a 99 percent effectiveness, then what is the point of this sort of contact tracing? So I think I think from a privacy and technical point of view, it's well designed, it's fine. These are privacy concerns that we should have had as students before now, but we maybe just hadn't realized. But given the other measures, this just might be ineffective.
This Week’s Top Stories
Over 20 Percent of Harvard Undergrads Do Not Intend to Enroll in Fall 2020
By JAMES S. BIKALES AND KEVIN R. CHEN
Left Out of Fall Planning, Harvard Parents Send Demand Letters to Administration
By JULIET E. ISSELBACHER AND AMANDA Y. SU
Lowell Faculty Deans Announce Group to Explore House Name Change