Surveillance printer go BRRRRRR

In 2001, Argentina was in the middle of a gigantic recession because of its hard currency peg to the US dollar and extensive foreign borrowing.

Back then the president was Fernando de la Rúa, a sleepy-looking lawyer who took office in late 1999 after being the first Buenos Aires' Mayor elected by popular vote.

De la Rúa is now famous for stepping down of his presidency and fleeing the Pink House – our third-world version of the White House – on a helicopter.

But he left another legacy with us – the Impuesto al Cheque (translation: Check's Tax).

On March 24 of 2001 and in response to the profound economic crisis, De la Rúa sanctioned Law 25.413. Among other things, it created an "emergency" tax called the Impuesto al Cheque – a 0.6% tax on every bank transaction done by individuals or companies.

Like every law passed during an emergency period, 25.413 had a consumer –friendly name – 'The Competitiviness Law' – and an expiration date: December 31, 2002.

Almost 20 years later, the Impuesto al Cheque is still going strong and is now responsible for 10% of Argentina's tax income.

Governments have a history of passing troublesome regulations as a justified response to emergency. Those regulation are never dismantled and become the new normal.  

I call this smuggling regulations.

Like 2001 Argentina with the Impuesto al Cheque, Europe is trying to smuggle draconian surveillance as an exceptional response to COVID-19, using the North-East Asian model as justification.

I strongly believe is misguided and today's piece is about that. But first, let's dive into North-East Asia.

Exploring the North-East Asian COVID-19 model

We've all seen headlines like this one – How Taiwan and Singapore managed to contain COVID-19, while letting normal life go on.

There's this idea floating around (heck, I tweeted about it) that draconian privacy-infringing measures are the main reason why North-East Asian countries were able to control the COVID-19. Even though data played some role in stopping the outbreak, it was far from the only one.

Let's look at Taiwan and its  3-pronged approach:

The first containment measure was (1) a tight control of international travel. Taiwan started screening passengers from Wuhan as early as December. Beginning 26 January 2020, people from Hubei province of China were banned from entering into Taiwan, and from 6 February, all people from China were banned.

On 31 January, and leveraging the SARS experience, the government first issued a ban on all exports of medical masks according to Art. 11 of the Foreign Trade Act and its delegated Regulations Governing Export of Commodities.

This was followed by the other two measures: (2) strictly isolating people who have or might have COVID-19 and (3) zealously pursuing those who had contact with the infected.

For instance, Taiwan merged citizens’ recent international travel history with their digital health-insurance files and let doctors and pharmacists access it all.

To achieved that, Taiwan merged health and travel databases and made that information widely available to help identify cases.

Granted – a possible why Taiwan and other Asian countries were able to react so swiftly to the pandemic is a terrible deja vu.

Also, some measures would be hard to implement in the West at the same speed that were implemented in Asia.

For instance, the Taiwanese government ordered to requisition all medical masks produced in domestic factories on the basis of Art. 54 of the CDC Act and its Regulations Governing the Requisition of Materials Property for the Control of Communicable Diseases.

But whatever it might be, the fact is that entire playbooks have been written about the North-East Asian model – reducing its success to a single reason is either lazy, or serving a hidden purpose.

Surveillance as a means to legibility

At this point, you might be wondering why.

In his seminal work Seeing Like a State, James C. Scotter explains an idea he stumbled upon while researching efforts by nation states to sedentarize nomads:

The more I examined these efforts at sedentarization, the more I came to see them as a state’s attempt to make a society legible, to arrange the population in ways that simplified the classic state functions of taxation, conscription, and prevention of rebellion.  Having begun to think in these terms, I began to see legibility as a central problem in statecraft. The pre-modern state was, in many crucial respects, particularly blind; it knew precious little about its subjects, their wealth, their landholdings and yields, their location, their very identity. It lacked anything like a detailed “map” of its terrain and its people.

Governments have traditionally attempted to make their states more legible at the expense of their own population and often to disastrous consequences.

A fantastic example is the collectivization in Soviet Russia.

The collectivization of Russian agriculture was an extreme but diagnostic case of authoritarian high-modernist planning. It represented an unprecedented transformation of agrarian life and production, and it imposed by all the brute force at the state's disposal. The ... The human costs of that war are still in dispute, but they were undeniably grievous.

These attempts at making states more legible weren't limited to communist Russia.

The United Kingdom has a history of failed "surveillance smuggling" attempts. Here's Wired back in 2014.

The UK has a long history of surveillance – and it continues to be unlawful. In the latest damning judgement of British security operations the European Court of Human Rights (ECHR) has ruled the government unlawfully obtained data from communications companies and didn't put in place safeguards around how it did it.

In Hungary – who belongs to the EU since 2003 – president Viktor Orbán is having some fun with COVID-19 and using emergency powers to effectively suspend democracy.

"Mr. Orban, the prime minister of Hungary who has steadily accumulated ever greater powers, was quick to see that the draconian measures being imposed all across Europe were a perfect cover to reach for truly dictatorial powers. Legislation passed by the Hungarian Parliament, controlled by his Fidesz party, effectively allows him to rule by decree, cancel elections and punish spreaders of “false” information. Indefinitely."

Not-so-obvious countries like Israel are taking measures as well.

"In Israel, the government last week approved sweeping new emergency surveillance powers that allow authorities to enforce quarantine orders and warn people about potentially infectious encounters."

This is happening right now, as I write this, and is happening everywhere.  

"Now, drones are deployed in Brussels, the heart of Europe's institutional capital, to enforce social-distancing rules, and stay-at-home orders are being broadcast through the streets of German cities."

But let's go back to the United Kingdom.

The United Kingdom, phone data and Palantir

In response to COVID-19, the U.K. is dusting off it's old skills and trying to take it a step further.

The ICO, the U.K.'s privacy watchdog, approved the use of phone operators to handle over location data and the NHS asked Palantir (in partnership with Microsoft and Google) to integrate, clean and analyze multiple data sources and build dashboards around it for decision-making.

Here's straight from the NHS website:

In this time of crisis, we need the private sector to play its part to tackle these unprecedented challenges. We have therefore enlisted the help of some of the most cutting edge and experienced firms from across Britain’s technology sector.

The UK is effectively stating that reducing the privacy of the U.K. population is justifiable, given the serious threat to public health posed by the coronavirus

We know this data is more far-reaching than usual because they volunteered to destroy it once the project is over.

"All NHS data in the store will remain under NHS England and NHS Improvement’s control. Once the public health emergency situation has ended, data will either be destroyed or returned in line with the law and the strict contractual agreements that are in place between the NHS and partners."

What's the big deal?

Collecting large-scale anonymized location data is a step in the wrong direction and a very dangerous slippery slope because, as a start, anonymous data isn't fully anonymous since an individual's identity can easily be deduced from just a handful of mobile phone location data points.

"The challenge with this data is that we don't believe it can be anonymized," said Yves-Alexandre de Montjoye, head of the computational privacy group at Imperial College London, whose research found that almost all people could be personally identified from just four pieces of anonymized mobile phone data. "It comes down to what is reasonable and proportionate."

And I can tell you that I'm not the only one with this concern.

While the Commission said it would anonymise data and aggregate it to protect privacy, the European Data Protection Supervisor — the EU’s privacy watchdog — warned that safeguards should be well in place, and that caution should be exercised so these exceptional measures don’t become permanent.

So...

Overshooting and undershooting in times of crisis

In times like these, where the stakes are extremely high, the balance is extremely thin and the feedback loops extremely long, it can be hard to get it just right.

It's like a taking a shower in an old hotel room.

The water temperature takes a minute to respond to your faucet twists so you spend the next 15 minutes chasing a decent temperature, constantly overshooting and undershooting between dangerously hot and outrageously cold.

What I can do is point you to historical examples and tell you that there are ways to hedge against overshooting, particularly when it's not 100% sure it worked.

Singapore is not completely out of the woods, and as of Monday most workplaces will close, schools will move to full home-based learning from next week and social gatherings will be prohibited.

Most workplaces, except for essential services and key economic sectors, will close starting on Tuesday, while the city-state will move to full home-based learning in its schools from Wednesday, Prime Minister Lee Hsien Loong said in an address to the nation Friday afternoon. The government will also unveil additional stimulus measures to boost the economy early next week.... Singapore’s tougher moves signal its current approach -- relying on contact tracing, strict containment measures such as shutting bars, and quarantine -- is no longer tenable. While more than 160 countries have already shut schools, the city-state was one of a handful that did not do so, citing early research that children are not as affected as adults.

That's a narrative violation if I ever seen one.

Decentralized data use as a hedge

On Wednesday, a group of European privacy experts published a white-paper proposing a decentralized system for Bluetooth-based COVID-19 contacts tracing called Decentralized Privacy-Preserving Proximity Tracing (DP-PPT).

Here's TechCrunch:

The key element is that the design entails local processing of contacts tracing and risk on the user’s device, based on devices generating and sharing ephemeral Bluetooth identifiers (referred to as EphIDs in the paper).

A backend server is used to push data out to devices — i.e. when an infected person is diagnosed with COVID-19 a health authority would sanction the upload from the person’s device of a compact representation of EphIDs over the infectious period which would be sent to other devices so they could locally compute whether there is a risk and notify the user accordingly.

Under this design there’s no requirement for pseudonymized IDs to be centralized, where the pooled data would pose a privacy risk. Which in turn should make it easier to persuade EU citizens to trust the system — and voluntarily download contacts tracing app using this protocol — given it’s architected to resist being repurposed for individual-level state surveillance.

Experts from at least seven research institutions across Europe argue that the decentralized nature of DP-PPT makes it harder for governments and malicious actor to abuse and misuse of people’s data than a centralized approach that would allow states to reconstruct a social graph from the data and used it for non-COVID purposes.

It's not the perfect solution – the biggest criticism being that in a decentralized service you would broadcast the anonymous IDs of infected people to everybody making it impossible for some countries’ to approve it – but it is the perfect start.

But one thing is sure. The world is in flux, and we need to adapt. But smuggling  is not acceptable under any circumstances.

"Even the best policy is only a solution to the developmental challenges of a particular moment in time. As the economic environment unfolds, good policies that remain unchanged eventually turn into bad ones" - Joe Studwell