Published: March 18, 2020
In coping with an emerging crisis, the need for accurate and actionable information is paramount for effective response – but there has never before been a scenario like the current COVID-19 pandemic. Responders are looking to new technologies including IoT and AI to help tackle this outbreak, but their deployment may have a far-reaching impact on our privacy. How can these technologies contribute to response, both globally and locally – and what privacy concerns could they raise, both now and in the months to follow?
The 451 Take
The evolution of IoT and AI has grown to the point where these technologies can now be called on to make a real contribution to responding to a crisis manifesting both globally and locally. Globally, modern analytics can learn about the factors of spread that can help analysts identify where actions need to be taken. Locally, they can gather data, deliver visibility and empower action to identify and manage specific outbreaks and response scenarios. Here we explore examples of technologies brought to bear on such a situation and the implications for privacy they may introduce, both in the current crisis and beyond.
Critical Event Management
There are, however, many tools available to tame this complexity for more rapid and effective response and to minimize impact on responders. These generally address four stages of response management. In the first, they gather data from various sources to help assess the context and severity of a critical event, calling upon analytical tools to digest and correlate data to help response teams understand what is happening now and what could or will happen later. A second stage locates assets, employees or vital equipment. In a third stage, these systems offer emergency responders and organizations the tools to act by informing people of actions to take, mass-scale notifications for people in affected areas and tools for collaboration between response teams. The final stage enables responders and others concerned to review and evaluate the critical event so that future response can be improved.
Incident response management platforms are often homegrown among responsible agencies and organizations, but technology providers exist to support efforts. Among these are BeSafe, BlueForce, Crisis360, D4H Incident Management, Everbridge, Haystax, IBM Incident Response and Emergency Management, and NC4's Emergency Operations Center. Some of these technologies consolidate functionality for all four stages into a single system. Everbridge, for example, began with a focus on multi-modal text messaging after the tragic events of 9/11 and expanded into a platform used in 2012 to notify 10 million people after hurricane Sandy, and in 2013 by the city of Boston after the Boston Marathon bombings.
IoT in Critical Event Management
In smart buildings and smart cities, sensors can provide details about temperature, toxic gases and other hazardous conditions. Smart streetlights can analyze traffic congestion and plan evacuation routes through AI analytics. Body cameras can relay live intelligence from public safety workers to the Incident Command Center (ICS), while crisis teams can use IoT wearables to warn and guide civilians.
In the current global COVID-19 outbreak, the People's Republic of China is showing that rigorous measures seemingly slow the spread the outbreak, but at what cost to personal autonomy and privacy? China is turning to IoT and other emerging technologies to enforce its measures, such as drone surveillance of infected areas, monitoring quarantined zones and have equipped their police force with augmented reality helmets to assess the body temperature of civilians. Facial recognition technology that can discern the identity of individuals despite use of medical masks has also reportedly been deployed. The country has been color-coding their citizens with red, orange and green digital badges on their smart phones to indicate their risk status. All these measures are in support of limiting the spread of the virus, but they can also have enormous impact on personal privacy, and it remains to be seen how authorities keen to apply these techniques to address an emerging crisis will handle the implications for governing and protecting the highly sensitive data they are leveraging.
As the novel coronavirus spreads across the globe, we see new use cases emerging. With the number of new cases spiking in Europe, hospitals are beginning to see a shortage of supplies – a shortage to which the 'maker-space' community is responding. The Open Source Covid-19 Medical Supplies Requirements (OSCMS) group has accordingly started to collect requirements and designs for 3-D-printed medical masks and other supplies.
AI in Critical Event Management
The Chinese search engine Baidu has made its Linearfold algorithm available to researchers and medical teams to fight the outbreak to assist in the analysis of the virus, while across the world researchers are turning to AI technology to predict its spread.
Public Safety vs. Privacy in a post-COVID-19 World
Some providers offer an option for people to opt in on location tracking or set requirements for end-user approval. Role-based access controls can help assure that only relevant personnel will be able to see who has accessed facilities. Geofencing capabilities can be included without needing to know the exact location of employees. The creation of notification zones may be as simple as drawing a polygon in the user interface. Personnel can then receive an alert when entering the zone, without the organization needing to know exactly where the individual is.
The COVID-19 spread has sparked debate in the Netherlands over whether or not the names of patients should be made public so people can see if they have been in close contact with a patient and can then self-isolate. Although privacy laws have special conditions for processing special personally identifiable information (PII) in case of medical emergencies, the European General Data Protection Regulation (GDPR) specifically allows for processing of special protected categories of personal data when processing is necessary for reasons of substantial public interest (Article 9(2)(g)).
On March 16, the European Data Protection Board (EDPB) issued a new guidance on the use of personal data in context of the COVID-19 pandemic, stating that data protection rules (such as GDPR) do not hinder measures taken in the fight against the coronavirus. However, they underline that, even in these exceptional times, the data controller must ensure the protection of the personal data of the data subjects.
Perhaps COVID-19 is simply indicative of the world to come, and how personal data can be leveraged and potentially abused in emergency response situations. To get a handle on metrics and data useful for managing response, governments around the world are rushing to leverage personal data to analyze, contain and mitigate the spread in absence of cheap, rapid and reliable diagnostic tools. Current efforts at mitigation are having major disruptive effects on the global economy. For a disease with even higher contagion rates and higher mortality than COVID-19, one can only imagine the ways that personal data might be effectively used to exclude individuals from participation in society, whether or not biological or medical testing confirms risk. For technology providers seeking to improve response, stewardship of sensitive data and transparency of processes moving forward will be paramount to establishing trust and confidence in the many ways they can help.
Johan Vermij is an analyst for the Internet of Things practice at 451 Research. He covers the smart energy vertical, including renewables, oil & gas. Prior to joining 451 Research, he has worked as an IoT practitioner, managing innovation projects across multiple sectors including aerospace, government and finance.
Paige is a Senior Analyst for the Data, AI and Analytics channel at 451 Research, covering data management, including data integration, data governance, data quality and master data management. She has experience covering a broad range of information management technologies spanning database functionality and self-service analytics to regulatory policy and compliance.
Scott Crawford is Research Vice President for the Information Security Channel at 451 Research, where he leads coverage of emerging trends, innovation and disruption in the information security market. Scott is also a member of 451 Research’s Center of Excellence for Quantum Technologies.