A contact tracing app | Stephen Groves/AP Photo
NEW YORK — Hundreds of thousands of New Yorkers will be asked to disclose personal information this month as part of the city’s herculean Covid-19 tracing effort — but suspicions over how the government will use that information are threatening the city’s best chance to crawl out of its coronavirus lockdown.
Contact tracing requires handing over intimate personal data — including home addresses, names of friends and relations — to strangers, many of whom were only recently trained and hired to collect the information. The city expects to have 3,700 contact tracers mobilized this month, and as many as 10,000 when the effort reaches its capacity.
But in this majority-minority city, government distrust was already exacerbated due to the Trump administration’s hard-line stance against immigrants. After a week of chaotic protests against the police following the killing of George Floyd, suspicion between residents and government authorities has only grown, community leaders say. And elected officials, advocates and privacy experts argue the de Blasio administration’s unwillingness to specify how privacy will be protected will limit the tracing effort’s reach and potentially prolong the need for strict lockdown measures the city has had in place since March.
“People who were at these protests should be concerned that the government could use that data,” Public Advocate Jumaane Williams said in an interview. “I want to encourage [contact tracing], but it’s hard to when our executive leaders are not clarifying how that data will be used.”
The city has not provided a detailed plan on how it will keep data private and secure, especially among city agencies like the NYPD — a pressing concern for activists, privacy experts and some elected officials.
And the city’s Department of Health and Mental Hygiene — which for decades has conducted tracing efforts through HIV/AIDS, syphilis and Ebola crises — has been sidelined in the tracing effort after a feud within the de Blasio administration. Now manual contact tracing, which began on June 1, will be run by NYC Health + Hospitals, the city’s public hospital system, which has little-to-no experience conducting such a program.
“They are reinventing the wheel,” said Allie Bohm, policy counsel for New York Civil Liberties Union. “It’s not even that they haven’t explained how data are going to be protected. They haven’t thought through the privacy regime and what privacy protections we should have in place, and that’s scarier.”
Contact tracing relies on a city worker building trust with a Covid-19-positive person, who then details where they’ve been and with whom they’ve been in contact prior to the onset of symptoms, according to Johns Hopkins University. Tracers interview people by phone, email or text and log the answers into a system developed by Salesforce. The process takes about an hour, according to Health + Hospitals.
“Community members must have confidence that the information that they provide to contact tracers is truly confidential,” Bethsy Morales-Reid, senior director for health initiatives for the Hispanic Federation, said at a recent Council hearing. “When you ask a Covid-19-positive person who they have come in contact with, you’re asking them to give up their undocumented tía [aunt] who helps them raise their children or their elderly mother who lives with them and may not be listed in their lease agreement.”
Dr. Ted Long, who heads up the city’s test and trace program at Health + Hospitals, said the public hospitals had a proven track record with NYC Care — a program launched in 2019 aimed at providing health care to the uninsured and undocumented.
“We had a lot of similar questions about undocumented immigrants, how can we assure them that entering into this program would give them the protection that they deserve,” Long said at a technical briefing this week. “We will not be turning over any data. We have not in the past, and that is not what we’re going to be doing.”
Guillermo Chacón, founder of the Hispanic Health Network, said government leaders have to “ensure people that confidentiality and data protection is a must. … Contact tracing is a very intrusive program.”
Yet data breaches can also come through cyberattacks or independent actors within an agency, privacy experts said. The Sergeants Benevolent Association recently tweeted a screenshot of the mayor’s daughter Chiara de Blasio’s arrest record that contained personal information after she was arrested for participating in a protest. The SBA argued the screenshot was intended to critique de Blasio’s leadership.
The city has a mixed record with privacy in immigrant communities.
Muslim New Yorkers have not forgotten the massive surveillance operation perpetrated by the NYPD in the years following Sept. 11. The Associated Press revealed in 2011 that police spied on heavily Muslim neighborhoods, used informants and monitored residents who had not been accused of a crime or suspected of criminal activity.
“I don’t expect [the city] to get answers from the Arab and Muslim community because of the past surveillance that’s been done,” said Yafa Dias of the Arab American Association of New York. “They’ve felt so much hate and mistrust, and it still makes them anxious.”
An Arab community organizer, who asked for her name to be withheld over fears of jeopardizing her immigration status, added that immigrants, Arabs and Muslims are still “surveilled nonstop.”
“I have a sense of freedom, but I’m not really free,” she said. “I would probably opt out [of contact tracing].”
Orthodox Jewish groups, already mistrustful of secular authorities, are likely to resist attempts to trace their movements. A health care provider in the community said the de Blasio administration failed to work with local organizations during last year’s measles outbreak until it got out of control.
“I did already hear rumors in Yiddish that they shouldn’t answer the [contact tracing] calls,” said Yosef Hershkop, manager of Kāmin Health Crown Heights Urgent Care. “There’s no way they’re going to get any more cooperation from the Jewish community than the African American community or Arab community or Muslim community. Everyone is suspicious.”
He added, “People are going to be nervous that every little bit of information will be used against them.”
As part of de Blasio’s much-criticized mental health program, ThriveNYC, the city aimed to send an army of counselors into neighborhoods throughout the five boroughs to help tackle persistent mental health problems in the communities. The effort was hastily prepared and poorly executed, workers told POLITICO, warning it was unclear who in city government was able to view sensitive patient information.
With those concerns in mind, civil liberty watchdogs are clamoring for more answers on how the tracing effort will protect people.
“Even if there are strong confidentiality rules and privacy protections in place, I think it’s important to know how those are being communicated to the people the city is newly hiring to do this work,” said Zach Ahmad, policy counsel for the NYCLU.
Others argue existing regulations don’t address whether data can be shared across agencies or if it can be sold by a third party for non-Covid-19 tracking.
“Data is so seductive. Once you have these data sets, there’s so many reasons to use them,” said Jacqueline Seitz, a staff attorney at the Legal Action Center who advocates for privacy rights and anti-discrimination protections for those with HIV, AIDS, histories of substance use or criminal justice involvement.
“Our contact tracing solution allows cities/states to manually trace health and relationship contacts in a safe and private manner, by collecting data from individuals who are infected or potentially exposed and creating visual maps of contacts and locations to monitor potential interactions and outbreak,” said Joel Steinfeld, a spokesperson for Salesforce.
He declined to share more details on how the company will work with the city to collect data and referred questions to the de Blasio administration.
City Hall said data will not be shared with law enforcement but declined to elaborate further, saying, even though the effort is already underway, “many facets of the technological side are still developing.”
“We feel strongly about our responsibility to protect patient health data in all that we do,” city health department spokesperson Patrick Gallahue said. “Patient health information is also protected by various state and city laws, rules and regulations.”
Advocates are still pushing for more stringent laws to further protect data.
“We want clear, on-the-book laws to secure protection,” Chacón said.