Dissent: Wi-Fi Contact Tracing Is An Unacceptable Violation of Privacy

UPDATED: Sept. 14, 2020 at 4:28 p.m.

Within the past few weeks, a select number of our peers have returned to campus to begin their fall semester. To curtail a potential on-campus outbreak of COVID-19, Harvard piloted TraceFi: a Wi-Fi-based contact tracing system that would track these undergraduates’ locations. TraceFi uses the signal of personal electronic devices emitted to Harvard’s Wi-Fi to register “a datetime stamp” that’s linked to the MAC address, storing information about students' exact location on campus.

Our colleagues on the Editorial Board have argued that while such data must be collected cautiously and responsibly, ultimately the benefits of such a system outweigh the encroachment upon student privacy. We are sympathetic to proposals with a clear public health objective and to creative ideas to safely give people on campus greater freedom of movement. However, we could not abide by this decision. TraceFi's promise of better contact tracing is not worth the privacy cost or the implications it has for the future of Harvard students. We call on Harvard to not reimplement TraceFi to preserve students’ right to privacy.

We do not believe that TraceFi would hold up its commitments to anonymity or efficacy. TraceFi collects the datetime stamp of our devices, linking them to their MAC address (the "unique code assigned" to our phones). We worry that hackers could quite easily link these data points and use them to take advantage of our community members. Similarly, we’re unconvinced by the claim that it will be uniquely effective in combating COVID-19, particularly given the University’s already rigorous testing regime.

The University touting that TraceFi has an "opt-out feature" for anyone who "does not want to be noticed at all" is similarly deceptive. Turning one's WiFi off while taking online classes is simply unsustainable, especially for low-income students.

The implications of such a surveillance system can't be understated. Many already view privacy as a lost cause — those who point to how Facebook, Google, and others store massive amounts of our data. The comparison is inadequate: These corporations don't have the same direct control over our daily lives that Harvard does.

But even if one embraces the comparison, it serves only to validate a staunch opposition to the proposed system, particularly when it comes to security. If anything, the Cambridge Analytica scandal and Google's attempts to conceal significant security breaches ought to increase our skepticism. The fact that too much of our private information is already out of our hands is a poor excuse to further erode our remaining privacy. Such a stance is defeatist. Harvard should help its students fight for better control over their data, not put it further at risk.

But even without these concerns — even if our information were fully anonymous (it really isn't) and completely secure (unlikely) — there's still a good case to be made against the mass surveillance of our community. No matter who gets access to the data, or how rigorous the data security protocol, a public admission that the University is recording location information will have a chilling effect on community life and activities. Harvard Law School Professor Charles Fried makes the best case for privacy in his essay on the subject. Fried argues that privacy guarantees our ability to trust and be trusted, to build relations by controlling knowledge about ourselves. This ability to define ourselves — to choose what information exists in the public realm and what doesn’t, to move around campus without the concern of how those movements might be construed or misconstrued — is a crucial part of our basic dignity.

While COVID-19 contact tracing may sound like a worthy cause, we need to decide where to draw the line. Is it appropriate to forfeit privacy for the sake of policing final club activity? What about illegal drug use or underage drinking? What else might one day warrant tracking and perhaps, in the University’s eyes, punishment? Our Editorial Board colleagues might warn against such overreach, but a warning is hardly enough.

Harvard will always have an incentive to gather and use more data. Once we open the door to this invasion of privacy, there will always be new justifications to proceed with data collection. Implementing TraceFi beyond its pilot could set a harrowing precedent, one without proper transparency and without plausible means of opting out. Such authoritative abuses of power do not bode well for the future. Digital contact tracing is simply not worth the risk of creating and normalizing such a powerful surveillance framework.

We are stumbling willingly into a dystopian future. We do not support the University — a body which holds considerable power over the lives and futures of its affiliates — tracking our every movement. We all have a right to privacy; we must defend it.

Guillermo S. Hava ’23, a Crimson Editorial comp director, lives in Winthrop House. Romy Dolgin ’21, a Crimson editorial editor, is a Linguistics concentrator in Lowell House.

Clarification: A previous version of this article stated that Harvard has implemented a Wi-Fi-based contact tracing system, TraceFi, to supplement Harvard University Health Services’ manual contact tracing efforts. In fact, Harvard used TraceFi in a pilot program that ran from July 9 to Sept. 9 and there are no plans to expand the service beyond the pilot. This article has been updated accordingly.