Where’s the line between surveillance and research?
By: Cmu S Block Center For Technology
Tags: Privacy, Health, Artificial Intelligence, Policy, Technology

Where’s the line between surveillance and research?

Why this semantic argument could have strong implications for privacy rights after COVID-19.

In March, a location data analytics firm called Unacast released a “Social Distancing Scoreboard” that assigned grades to states based on how well their residents were observing social distancing guidelines. Unacast calculated these grades based on GPS data from the gaming, shopping and utility apps that sell their data to Unacast for location-based advertising, which users would have consented to when they agreed to let that app track their location.

Something that’s really compelling, and perhaps a little troubling, about Unacast’s work is that as a society, we’re not always sure what to call it. While a lot of news outlets have been calling this project a tool or a scoreboard or even a report card, some are referring to Uncast’s scoreboard as a study or research.

But is this research?

The COVID-19 pandemic has resulted in the temporary relaxation of certain regulations related to how personal data is shared, and that has opened up new opportunities for healthcare entities, large tech companies and governments to fight the virus. But it has also raised some important questions about what all of this is going to look like going forward. Because if it is research, it comes with certain rights, protections and regulations. And if it isn’t, then figuring out what exactly work like this is and how we’re going to regulate it is going to be essential for not only improving public health, but for protecting people’s privacy.

According to David Jones, a psychiatrist and historian at Harvard University whose work looks at the history of medicine and medical ethics, attempting to categorize this kind of data collection and analysis is a fairly prevalent issue in the scientific research community today.

“One of the big questions that comes up now with big data and the analysis of them is what counts as research or not research. If it’s something that’s not really research, how, how do you then think about this question of protecting the subjects since they’re not really research subjects?” considers Jones. “There are some people who argue that research is the wrong way to think about that because the subjects weren’t being asked to do anything.”

This may be where some of the tension in how we describe Unacast’s work might be coming from. Because it does look a lot like research: there’s data, there’s a fun interactive map, there’s distinctive findings. But like Professor Jones said, we intuitively consider research on humans to be something with clearly defined research subjects who do something. Still, while contributions to efforts like Unacast’s scoreboard are largely passive, the risks you can encounter through your status as a participant might necessitate the same precautions that traditional research usually has.

“I think there’s a lot of activity taking place in this country that looks like research. It might not be research,” says Jones. “But it still might justify ensuring that adequate provisions are in place.”

The United States and many other countries have begun collaborating with large tech companies on the development of an infrastructure to share everything from patient data to geolocation data, and this has a lot of promise for helping epidemiologists and public health officials learn more about COVID-19 and curb its spread. For example, Google’s analysis of its search data — specifically, the massive uptick in Google searches for the phrase “I can’t smell” in states with a high prevalence of COVID-19 — helped epidemiologists and health officials learn more about the disease’s symptoms and determine new outbreak epicenters. However, this does raise the question of what happens after the pandemic.

“I think there’s a lot of activity taking place in this country that looks like research. It might not be research. But it still might justify ensuring that adequate provisions are in place.”

In a recent article in the Financial Times titled “The world after coronavirus,” author and historian Yuval Noah Harari considered that the COVID-19 epidemic might “mark an important watershed in the history of surveillance.” Because while there’s an argument that this is all just a temporary measure, as Harari says, “temporary measures have a nasty habit of outlasting emergencies, especially as there is always a new emergency lurking on the horizon.”

While it’s understandable to feel frightened about the potential for abuse, it’s important to remember that we aren’t going into this completely unprepared.

“It’s not like we have zero experience with these risks,” says Tom Mitchell, a professor in the School of Computer Science at Carnegie Mellon University. “We have plenty of experience with different organizations, including universities, working with very sensitive data. We have experience with hospitals themselves, who do work with their own data and have in regulations that require that people who have access to that data take a courses offered by the NIH on how to protect the privacy of that data.”

Currently, Americans’ health information is protected under the Health Insurance Portability and Accountability Act, or HIPAA, which gives individuals agency over their own health information and protects patients’ privacy. In addition to HIPAA, human subjects are protected by IRBs — or Institutional Review Boards— which are panels of at least five experts of varying backgrounds charged with determining whether or not proposed research could pose any harm to human subjects.

“One thing we do want to do is make sure that organizations who have new access to new kinds of data adopt many of the methods that are already in use in research centers and hospitals that are routinely using sensitive data.”

“It’s not the Wild West in universities,” notes Henry Kautz, the Division Director for Information & Intelligent Systems at the National Science Foundation and a professor of computer science at the University of Rochester. “And when companies collaborate directly with medical centers, those medical researchers are also all subject to IRBs, even if the research is funded by a collaboration with a big company.”

Currently, the IRB process asks applicants to explain what their research aims to accomplish, how researchers intend to obtain informed consent from their research subjects, and what could be the potential risks to the health and wellbeing of subjects participating in the study. Additionally — and perhaps most significantly — the IRB asks researchers to specifically outline how, where and how long they intend to keep subjects’ data in order to ensure that their information would be anonymized, confidential and secure.

“One thing we do want to do is make sure that organizations who have new access to new kinds of data adopt many of the methods that are already in use in research centers and hospitals that are routinely using sensitive data,” says Mitchell.

It is hard to say with complete certainty what our lives are going to look like after this, but it is important to remember that technology in and of itself is not good or bad. It depends on how the technology is implemented and regulated. Right now is a serious time for thinking about certain crucial decisions, but according to the Block Center’s Executive Director Scott Andes, this is not the only time we have to make these decisions.

“Oftentimes we fall into sort of the slippery slope sort of paradigm with these types of conversations about, you know, well, what’s next? And I think there’s a place for those conversations,” says Andes. “But I also think that we should recognize that that’s part of what the legislative and public sector processes are meant to address. We never get one shot on goal. It is never the case that we say we are going to relax a certain regulation or create a certain regulation, and you never get another chance to have a conversation about it.”

Want to learn more?