Author - Abhishek Gupta, Founder of Montreal AI Ethics Institute and Machine Learning Engineer at Microsoft

Extraordinary circumstances require extraordinary measures - as we battle the ongoing COVID-19 pandemic, governments, industry and citizens around the world have kicked efforts into high gear to find creative and effective ways to curb the spread of the disease. Different from other recent pandemics, COVID-19 can remain asymptomatic for a few days while being highly contagious [1]. This warrants for techniques that can help to swiftly identify people who might be carriers and then test and quarantine them with medical assistance to best manage symptoms. A variety of technological and AI-enabled solutions are being proposed and piloted with varying degrees of success. What's being discussed less is how this might alter what precedents get set and how the technology landscape will change once the pandemic has subsided.

Contact tracing is a technique [2] whereby, usually an application is deployed on some sort of location-tracking device, often a smartphone, to monitor for, and collect timestamped location data on the movements of a person and store that data in association with others who might have come in contact with that person. If such a person is tested positive for an infectious disease, then others who might have been in close contact can be notified via a variety of techniques so that they can get themselves tested as well and thus help to minimize the spread of the disease by catching potential cases proactively.

Although this method can be highly effective, it comes with a slew of ethical and privacy concerns. Location data, even when anonymized, using a few points can lead to re-identification of the individual concerned [3]. Especially in the case of someone's health status as a carrier of an infectious disease, it can lead to severe harassment and ostracization by people who find out about it. This not only affects the individuals concerned but also others that are close to them, such as their family, friends and colleagues that are known to be in frequent interaction with the individual. This also has a larger impact outside of related individuals to potential businesses that the person might have visited which can be discerned from the location data, further imposing economic hardship, especially on small businesses that don't have the liquidity to weather the recession and slowdown in spending by consumers.

AI systems are being fast tracked for approval where they might be able to provide better intelligence in detection, tracing and any other measures that can help to curb the spread [4]. The benefits from such expediency are no doubt important, particularly when every single day matters in slowing down the spread of the infection. But, it leaves open the door for less than rigorous analysis of the systems that once deployed can continue to reinforce biases and patterns that could divert away crucial health resources from those who need it the most. One can easily imagine a scenario, where with the shortage of ventilators [5], healthcare professionals will have to make tough choices based on limited information. In such scenarios, it's not far off to say that relying on an AI system that could claim to optimize for allocation of ventilators and other medical equipment towards those that it deems to have the highest chance of survival can emerge as a tool which eases the burden on overwhelmed staff. Choosing to value some lives over others by a machine is placing too much faith in opaque systems, especially when they lack transparency and explainability on how they arrived at their decisions. Relegation of our morals and ethics to non-human agents is a terrible outcome, even in the times of crises.

Cybersecurity attacks have gained momentum with the start of the pandemic [6] and are creating additional burden on teams that are already scrambling to meet the needs of people relying on them for critical services. For health agencies and other organizations that are implementing contact tracing, they hold highly sensitive data about individuals and breaches would cause even greater deals of stress for individuals that are having to deal with the economic and social fallout from the pandemic. Beefing up cybersecurity implementations and pushing for defense in depth and other best practices [7] is going to be crucial in ensuring the safety and privacy of people's data. The success of contact tracing solutions will in part rely on the trust that can be evoked from the public when it comes to their data. Utilizing open source methods and detailing the cybersecurity practices being used will be a reassuring step that will increase uptake by the public.

Finally, we must pay attention to the creeping deployment of surveillance infrastructure under the guise of fighting the pandemic. Particular attention needs to be focused on powers being granted to the government, the technological solutions being deployed and the legal and social precedents being set. We don't want to emerge from the pandemic crisis with a privacy and ethical crisis on our hands. The solutions being deployed to combat COVID-19 need to be purpose- and time-limited to hold our rights and freedoms in place.

The Montreal AI Ethics Institute is working with researchers in AI, law, privacy and cybersecurity to create a framework to balance ethics and privacy concerns of such systems with the potential benefits that they might bring in terms of public health outcomes. The team will be releasing the work shortly and details will be released in MAIEI’s weekly AI ethics newsletter here - https://aiethics.substack.com. Please feel free to reach out to the team if you're interested in helping with these efforts.

References:

[1] https://www.cdc.gov/coronavirus/2019-ncov/symptoms-testing/index.html

[2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3428220/

[3] https://www.schneier.com/blog/archives/2013/03/identifying_peo_5.html

[4] https://ec.europa.eu/digital-single-market/en/news/join-ai-robotics-vs-covid-19-initiative-european-ai-alliance

[5] https://www.nejm.org/doi/full/10.1056/NEJMp2006141

[6] https://www.who.int/about/communications/cyber-security

[7] https://www.nist.gov/cyberframework