A Patriot Act Moment for Science

By Tayyaba Jiwani

As the world fights a historic pandemic, science has taken global center stage. Many governments made tough decisions following scientific advice, such as enforcing lockdowns and closing national borders, that ground the economy to a halt. In large part, the public has trusted these decisions and the science they were based on. But the pandemic has also sparked some disturbing trends in science. These include a proliferation of rushed and questionable research, enthusiastic commercialization of science, and—more ominously—a new surveillance paradigm, centered on biology and supposedly justified by the demands of the pandemic.

In many ways, the crisis today represents a Patriot Act moment for science. That legislation, enacted after the 9/11 attacks on the United States, arose in an atmosphere of fear that vested trust in government to take action to protect lives. But that fear was also exploited to deploy unprecedented, and otherwise unacceptable, tools to expand state control in the name of public safety and national security. The Patriot Act gave government agencies carte blanche to surveil and criminalize people based on little more than suspicion, and to set aside safeguards of privacy, legal process, and standards of evidence in the name of the greater good.

Importantly, the excesses of the Patriot Act would not have been possible without technologies that radically expanded the boundaries of state and corporate power around the world. The COVID-19 pandemic is creating a similar situation for biomedical sciences, endangering the position of public trust that science has gained.

Congress passed the USA PATRIOT Act with little deliberation, weeks after the 9/11 attacks. The law sought to expand the powers of law enforcement to prevent terrorist acts, allowing US security and intelligence agencies unprecedented powers to secretly collect personal information on any US resident without justification or a judicial warrant. These and other provisions overrode most legal and constitutional barriers protecting privacy and civil liberties, and longstanding checks and balances preventing abuse of state power.

It was not until the whistleblowing revelations of Edward Snowden in 2013 that the extent of the powers enabled by the Patriot Act came to light. A contractor for the National Security Agency, Snowden leaked reams of NSA documents that revealed that government and intelligence agencies were systematically collecting bulk information on people’s communications—details on phone calls, internet browsing, emails, and online chats. The companies involved not only handed over private customer data, but some even allowed their infrastructure to be directly used for surveillance. For instance, Snowden’s documents revealed that NSA had intimately integrated its equipment into AT&T’s network in New York City, and NSA analysts had direct access to the servers of major tech companies.

Ultimately, the value of rampant surveillance for counterterrorism ended up being highly questionable. A 2014 report by a privacy oversight board found no instance of the phone surveillance program proving instrumental for a counterterrorism investigation or uncovering a terrorist plot.

Yet the provisions of the Patriot Act did not come out of nowhere. Intelligence agencies had been lobbying for such powers, but had faced opposition from Congress and advocacy groups. The fearful atmosphere following 9/11 presented the opportunity to roll out these initiatives with public consent. Big Tech was able to leverage the relaxation of democratic controls to support powerful interests in state and military agencies. It promoted digital data as a hot new commodity by touting its power to identify and predict human behavior—and made huge financial gains in the process.

A New Surveillance Agenda

The disorientation and shock of the COVID-19 pandemic has similarly created space for highly contentious and unacceptable agendas—the growth of advanced surveillance centered on people’s bodies and the erosion of confidentiality for biometric and health data. Digital-rights organizations have sounded alarm at the extraordinary expansion of government surveillance and data collection, which threatens to become permanent in the post-COVID world.

As one example of what’s happening, most countries are performing contact tracing by monitoring people’s movements through smartphones—in the most egregious cases, without people’s consent or knowledge. Israel was among the first to use existing surveillance infrastructure to monitor smartphone locations of COVID-19 patients. In India, the government pressured people to download an app it built for location tracking and mandated its use by government employees.

The disorientation and shock of the COVID-19 pandemic has created space for highly contentious and unacceptable agendas.

Some countries have taken a more cautious approach, giving greater consideration to privacy concerns. Canada, Germany, and Italy developed tracing apps that people can opt into. The apps use a secure interface (developed by Apple and Google in a rare joint effort) to log anonymized contact tracing information locally on phones that directly communicate with each other to notify users if someone in their vicinity is found to be infected. Interestingly, the tech giants foiled a similar app built in the United Kingdom that would store information not locally but on a central database.

These contact-tracing measures, even if billed as temporary, set a significant precedent for normalizing mass surveillance and integrating digital and biological surveillance tools into daily life. The potential for misuse is massive. Digital privacy-monitoring websites such as Top10VPN have recorded many governments violating privacy and civil liberties, in such forms as the absence of privacy stipulations or time-limited data storage and insufficient protection from unauthorized access, inappropriate exposure, and misuse of data.

Similar concerns surround efforts to expand the collection of biometric and health data in response to COVID-19. In Britain, the Guardian newspaper reported in April that the artificial intelligence start-up Faculty was collaborating with the US data giant Palantir to process confidential UK patient information. Their goal was to build a centralized database, claiming it would help target the delivery of health and relief services. But the sensitive nature and scope of data collected on patients (down to conversations with the National Health Service’s helpline) was described by a government source as “unprecedented” and showing “insufficient regard for privacy, ethics, or data protection.” According to the Guardian, two companies also offered phone location information for the database, which would combine location and health data in a single system.

Palantir is also providing coronavirus tracking services to the US Centers for Disease Control and Prevention, claiming it uses anonymized hospital data to model COVID-19 spread and to anticipate needs. Yet the company has a history of misusing data, notoriously providing “data harvesting” services to help US Immigration and Customs Enforcement track down migrants—a service Palantir has reportedly been pitching to European health agencies combined with its COVID tracking software.

These contact-tracing measures, even if billed as temporary, set a significant precedent for normalizing mass surveillance and integrating digital and biological surveillance tools into daily life.

As with the Patriot Act, tech companies are exploiting the temporary weakening of regulations under COVID-19 to expand new market opportunities. The global biometrics market is projected to quadruple in revenue in the next four years as health services are increasingly digitized. Companies are eager to obtain access to previously restricted patient information and integrate their technologies into new digital systems being erected rapidly by governments and hospitals.

Another disturbing facet of biosurveillance in the COVID-19 era is the expansion of facial recognition technologies. Clearview AI, a US company that was sued for training its facial-recognition software on personal images scraped from social media, has offered its technology to track COVID-infected individuals by “leveraging” existing cameras in gyms and retailers. Another company, Athena Security, has developed AI-powered thermal cameras to screen people in public for a fever by measuring eye temperature. Athena’s early marketing plainly showed the motivations often guiding these technologies, claiming that its COVID screening system augments “our gun detection system which connects directly to your current security camera system to deliver fast, accurate threat detection.” This framework views people with suspicion and presumption of guilt—equating COVID patients with lethal weapons—and glorifies secret and extralegal force. It is a punitive approach towards disease monitoring, one intended not so much to support the sick as to instill fear and exploit our vulnerability to a virus in order to expand surveillance networks.

The Perils of Genetic Data Collection

Perhaps the most troubling concerns surrounding the new biological surveillance paradigm relate to the use of genetic data. People’s differing vulnerability to COVID-19 may result from variations in their DNA. The consumer genetics company 23andMe is offering 10,000 free genetic tests to COVID-19 patients to identify potential genetic sequences shared by those with severe symptoms. Identifying credible genetic associations could in theory lead to calls for widespread population genetic testing to predict each individual’s risk for the disease.

Such testing might even be justified from a public health and economic standpoint, since predicting the severity of a patient’s infection could help redirect resources toward those with greater need. But collecting and banking genetic data for entire populations is fraught with ethical challenges.

It is a punitive approach towards disease monitoring, one intended not so much to support the sick as to instill fear and exploit our vulnerability to a virus in order to expand surveillance networks.

Genetic data represents another confluence of the interests of governments and companies. For government and law enforcement agencies, access to people’s unique genetic information promises an unprecedented and far more personalized level of control. It is not just the ability to identify every individual in the country, but also their near and distant relatives, demographic backgrounds, disease risks, genetic vulnerabilities, and even potentially psychological and behavioural traits. For the private sector, the soaring value of genetic data is generating lucrative opportunities in next-generation genetic therapies, diagnostic tools, and data-driven technologies. In the absence of watertight safeguards for data governance, privacy, civil liberties, transparency, and—crucially—democratic engagement with the public, mass genetic data collection is a Pandora’s box better left unopened.

Proponents of the emerging surveillance technologies may argue that ordinary rights and privileges must be set aside in view of the extraordinary crisis upon us. But this argument sets up a binary choice between saving lives and protecting rights, presenting the former as a collective need versus the latter as an individual concern. This framing fails in the context of biological data, where people’s democratic rights protect their sovereignty over their bodies, and hence their lives.

Biosurveillance is especially threatening when it involves people in marginalized communities whose rights are routinely violated in interactions with the government—and particularly with law enforcement. It was these populations who bore the brunt of the Patriot Act, with, for example, Muslims having to endure widespread surveillance and suspicion and communities of color being overwhelmingly targeted in warrantless searches for drug investigations.

Now, activists in India are sharply criticizing the government’s contact-tracing app for poor privacy protections and lack of transparency. They fear the expansion of a biosurveillance regime under Narendra Modi’s government, which has links to politics of violent religious nationalism and a history of targeting dissidents and minority communities. In Zhengzhou, China, the government installed facial-recognition gates in underground stations to track people’s travel histories, expanding the state’s vast surveillance infrastructure that has victimized the Uighur Muslim community among others. In the United States and Canada, surveillance technologies would likely spark similar fears among Black and Indigenous communities of enabling state violence and domination, which acquire a sharper edge given their historical oppression through medical experimentation and abuse. Such fears may not be unfounded, as numerous police departments in the United States are investing heavily in facial recognition technology, especially since the Black Lives Matter protests. The Canadian government neglected to enact laws to prevent anyone from forcing people to use the contact-tracing app or disclosing their data.

A Way Forward

In the wake of 9/11, policies previously considered unthinkable suddenly became normalized. Twenty years ago those changes were considered temporary, but people adjusted to the new normal of constantly being watched. Once legal protections were relaxed and ethical concerns overridden, lucrative markets were unlocked, which now drive a significant portion of the economy and cannot be easily dismantled. Patriot Act laws, despite instances of noncompliance and breaches of privacy and civil liberties, have largely been retained. Congress renewed the internet-tracking program in 2018.

Biosurveillance is especially threatening when it involves people in marginalized communities whose rights are routinely violated in interactions with the government—and particularly with law enforcement.

Today, the COVID-19 pandemic is unlocking a new and more insidious surveillance paradigm, located more intimately in people’s bodies and biology. Breaching medical, and especially genetic, confidentiality has arguably more dangerous consequences than leaking digital communications.

What can be done? Scientists and scientific institutions have the greatest authority to demand robust safeguards governing the COVID-19 response. As scientists and health workers collaborate with governments on testing, tracing, and data collection, organizations such as the American Association for the Advancement of Science and global health leaders such as the World Health Organization must advocate for informed ethical and democratic frameworks to guide this work.

Global health organizations must challenge governments committing biosurveillance abuse, on the grounds that their actions promote fear and incentivize evasion and noncompliance, thus undermining the world’s ability to contain the virus. Contact-tracing apps must be audited periodically for privacy or data violations, and evaluated for efficacy in tracking disease spread. Hospitals and public health institutions that engage companies to build virtual care and data collection platforms must ensure robust measures for data governance and ethical use to protect patients and prevent unintended harm.

Organizations for digital rights and civil liberties also have a vital role. The Electronic Frontier Foundation has developed valuable guidelines for protecting civil liberties during the COVID-19 public health crisis. They include collecting data that are proportionate to need—such as not maintaining 10-year travel histories when the disease has a two-week incubation period—and making data use transparent and subject to expiration once the emergency abates. The American Civil Liberties Union is investigating the US government’s COVID-19 response, especially in terms of waiving privacy guarantees and forming partnerships with tech companies to share patient data in a nationwide system.

Finally, scholars in science and technology studies should engage scientists and scientific organizations to develop interdisciplinary links and coordinate efforts to advise governments on scientifically informed and sociologically responsible use of technology. Such multidisciplinary roundtables are especially important in developing nuanced frameworks governing population-scale genetic data, to harness its power without compromising on public safety.

For scientists, this is a pivotal moment to define the role we seek in society. Will we use the public trust we have gained to affirm our commitment to democracy and the universal public good? Or will we enable our work to be co-opted for private gain or authoritarian control?