Policing the Pandemic
Although there were those who foretold the risks of a pandemic, it is fair to say most of the world was caught unprepared. All of the sudden there was a scramble—for protective clothing, for tests, for antivirals and a vaccine. Even under the best of circumstances, the measures necessary to combat a worldwide rapid-spreading disease of this sort would have been challenging. Caught flat-footed, it has been a disaster.
As the world searched for ways to combat the spread of COVID-19, a puzzle presented itself. The key to counter-spreading is surveillance and enforcement: the traditional tools of the state. But entrusting the state with the vast surveillance and enforcement authority necessary to control the pandemic gives rise to threats of its own. Perhaps a more effective and less threatening alternative was to leave enforcement in private hands, and particularly to rely on emerging technology, to help stop the spread. Although it was not always stated explicitly, watching what happened in the United States, the private option seemed preferred in many states.
Stateless solutions to the pandemic, we argue here, were and are a pipe dream. Emerging technology has its value, to be sure. And committed private parties can accomplish much. But in dealing with a public health emergency, government is essential to solve coordination problems, to monitor what is happening, and to enforce with the lawful machinery of the state what needs enforcement.
Still, we agree: government surveillance and enforcement does pose a threat. For that reason, the how of government action is as important as the what. To ensure the tools to fight the pandemic are used wisely—and effectively—government power should be granted by democratic means, preferably legislative ones. And it must be constrained properly. Part I briefly sets the stage—we all know too well, unfortunately, the circumstances that have brought us here. Part II identifies the competing costs and benefits of public and private approaches. Part III explains the necessity of state power, but also stresses what the state must commit to doing, and do, to gain the trust of the public, be effective in fighting the virus, and ensure the lawfulness of state action.
I. The Necessities of Surveillance and Enforcement
As we write, the coronavirus pandemic has killed well over 200,000 people in the United States, and more than a million globally, with no clear end in sight. Public health officials have developed strategies for dealing with pandemics generally, and specifically to combat COVID-19. These range from mass testing programs to increasing mask wearing, from expanding hospital capacity to instituting social distancing.
Fundamentally, any comprehensive strategy requires some level of surveillance to monitor and trace the spread of the disease, as well as to ensure people are complying with the rules designed to prevent its spread. The baseline of public health surveillance is contact tracing, traditionally carried out by workers who get in touch with people who have tested positive to identify and notify any prior contacts who may have been exposed. Contact tracing has been used for hundreds of years, most often in contemporary public health efforts to deal with sexually transmitted diseases. Many states employed contact tracers as a key response to COVID-19—by June, a National Public Radio survey found that state health departments had over 37,000 contact tracers on staff. But even that number was insufficient in most states, and contact tracing alone cannot stop the pandemic without simultaneous efforts to test people, isolate those who have been exposed, and encourage compliance with public health guidelines.
Given the challenges of monitoring this rapidly spreading disease, and the slowness of some governments to act, initial responses to the coronavirus relied heavily on the potential benefits of technologies to substitute for and supplement traditional contact tracing. Key among these was the idea of a contact tracing app to supplement or even replace human contact tracers. The idea was to use Bluetooth on smartphones to keep a running tab of people whose phones have been in close proximity so that when one tests positive, anyone who has been in contact can be alerted. There are broadly two models for such an app: a centralized model, in which contacts, positive tests, and potentially GPS location data are available to a government health department, and a decentralized model, in which phones themselves store anonymized contact data so individuals can be notified without information going to the government. The centralized model gives public health officials more information to track outbreaks and potentially monitor compliance, and has been used in some countries, such as South Korea, Taiwan, and France. But it has received heavy criticism from privacy advocates, and centralized apps struggle to be effective without the support of technology companies, causing many countries that originally planned to use centralized apps to reverse course. Google and Apple worked together to create an integrated platform that could be used only for decentralized apps with anonymized data, which increasingly is being relied upon around the world. This trade-off between models implicates many of the same concerns as the trade-offs between public and private systems more generally, as discussed in Part II. As with much of the coronavirus response, the United States has landed on an ad hoc system, in which five states launched GPS apps and eleven states released apps on the Google/Apple platform, all with low rates of use.
Along with new apps, the early pandemic response included many efforts to repurpose surveillance technologies already in use by policing agencies to assist public health efforts. Prior to COVID-19, policing agencies throughout the country increasingly had been buying and using more and more advanced surveillance technologies, from license plate readers to facial recognition systems. When the pandemic hit, policing agencies were drastically better-equipped than public health agencies, many of which still rely on paper records and fax machines. Law enforcement technologies employed to address the pandemic ran the gamut from fever-detecting drones and drones that spot social distancing violations, to police-agency partnerships with facial-recognition and camera-analysis companies that claimed to be able to identify social-distancing violations as well.
Getting the virus under control also required some level of enforcement, be it with regard to social distancing, mask wearing, or isolation on exposure. Here, the tendency naturally was to turn to the police—though a number of countries also prioritized incentivizing compliance by paying salaries of workers who need to isolate or quarantine. This is not new to the coronavirus pandemic: Police routinely are used to ensure compliance with public health-related laws, like seatbelt requirements and drunk-driving bans. Police also have been authorized under some state laws to enforce quarantines of individuals who pose a threat of spreading disease. With regard to the coronavirus, social-distancing violations, lack of mask wearing when required, and failure to quarantine all have been met with citations, fines, and even arrests.
As the pandemic response evolved, private enforcement played an outsize role as well. Private store owners, for example, have denied entry to individuals without masks. Many airports and other businesses are conducting temperature checks on everyone who enters. Some companies have set up cameras to monitor and flag violations of social distancing. The U.S. generally has adopted what Professor Jonathan Zittrain has termed the “Company Town Model” of contact tracing, in which employers and universities set up their own test, trace, and isolate systems. Schools and offices mandated testing at various intervals and required isolation of anyone who tests positive. Universities adopted their own symptom- and contact-tracking apps—some voluntary and some mandatory for students to use—and other employers are doing the same.
But despite these measures, the novel coronavirus continues to spread, and the race for a vaccine goes on.
II. The Benefits and Costs of Public and Private
From the start, there has been an ongoing debate about which approach is best when it comes to surveillance and enforcement: the use of public agencies (most notably the police) or privatization. There are real concerns about both methods, which pose serious risks of disproportionate enforcement and generate very real data-privacy concerns. Competing benefits and costs need to be assessed in clear-eyed fashion—the immediate need to control a deadly virus is immense, and measures taken must be pursued effectively, but the harms caused in the course of tackling the pandemic also must be mitigated to the greatest degree possible. So which is best, public or private?
A. Public Control of Surveillance and Enforcement Has Real Downsides
In addressing a pandemic like the one we face, government has the advantage of capacity: it can coordinate a response, track its success, and bring the legitimate power of the state to bear upon those who refuse to follow the rules. Successful enforcement requires cooperation of all levels of government. But under the circumstances we face, the need for guidance and direction from the top—the federal government—seems obvious.
Still, putting surveillance and enforcement into public hands poses very real risks. Stringent state power of the sort necessary in a pandemic quickly breeds resentment and noncompliance. Witness the powerful anti-mask movement, and armed individuals flouting state orders to socially distance or to shut down businesses.
Although the state quite obviously needs to collect vast amounts of data to respond capably to a public health crisis, there are real hesitations about putting yet more data into the hands of the government. Instituting surveillance for a limited purpose rarely has stayed limited, particularly when the information collected would be useful to other agencies and entities. In the public-health context itself, Professor Wendy Mariner noted well before the coronavirus pandemic that “the aim of those who collect medical information has shifted from preventing the spread of contagious diseases to the more general purposes of research, budget analysis, and policy planning. This shift poses a challenge to the principles of liberty and privacy that underpin one’s individual autonomy to decide whether to participate in research or to accept medical care.” The British government recently disclosed that coronavirus test data of people in England will be shared with police to support enforcement of self-isolation, leading to concerns over further use of the data and the potential that such sharing will discourage testing at all. Data collected for this pandemic will be valuable in myriad ways, but its use beyond the specific pandemic implicates privacy concerns that have not escaped notice.
Enforcement, too, creates real harm, the risk of which increases dramatically during a pandemic. For some people, any interaction with police can be traumatic in and of itself, and there always is an additional risk of an encounter escalating. The very public examples of violent and sometimes deadly responses by police officers—particularly to unarmed Black people—make this danger very stark. Public attention to this problem long preceded the pandemic, but took on new urgency after the police killings of George Floyd, Breonna Taylor, and many others. Early examples of social-distancing and mask enforcement included a number of extremely violent responses by police officers against people failing to comply, including a video of an NYPD officer punching a man who was first approached for being “in violation of social distancing orders” and kneeling on his head, less than a month before the death of George Floyd. In addition, during a pandemic, police enforcement of things like social distancing and mask regulations involve physical interactions that can spread the virus to the public and police. Custodial arrests create even more risk; prisons and jails have been hit especially hard by the virus. Even fines can be devastating, especially during a time of widespread unemployment.
There is ample evidence that both the pandemic and pandemic-related enforcement is falling most heavily on people of color. As of October 13, one in 920 Black people and one in 1,110 Indigenous people in the United States have died of COVID-19—double the death rate for white people. The racial disparity is due to many factors, including a higher likelihood of people of color performing jobs as essential workers, more preexisting health conditions often exacerbated by environmental factors, and long-documented structural inequities and biases in the provision of medical care. Many also have noted the enforcement disparity, as it was apparent from early days that police were standing by watching widespread violation of the rules and unsafe conduct by white and well-to-do people while aggressively enforcing in minority communities.
The current political context makes these concerns all the more salient. Public reporting has disclosed that the federal government and local police have used a number of different methods, from social media analysis to airplane surveillance, to monitor and gather information on anti-police protesters. Contact tracing inherently collects information about where people were and with whom they interacted, raising the concern that such information could be used to identify protesters or members of targeted groups easily.
B. Private Control over Pandemic Surveillance and Enforcement Also Poses Threats
In the face of a colossal failure of government in many places, pandemic response has fallen into private hands. The federal government has dropped the ball in remarkable fashion, tossing the pandemic onto the shoulders of state and local governments. But many of these governments too have failed, leaving much of the work to private actors. Some of this is well-organized: some employers and universities are instituting their own guidelines, including their own symptom monitoring systems and even their own contact tracing. Much is haphazard, as businesses try to enforce distancing and mask guidelines.
Private data collection involves different considerations than government collection, but it also creates serious risks. Although the Fourth Amendment and data privacy laws provide only limited protection against government data collection, there is even less in the way of legal safeguards for privately gathered data. Many efforts relying on private gathering of data ostensibly require user consent as one of the terms of service, creating a bit of a free-for-all. In order to go to work or to school, people are being asked to consent to the collection of data about their movements throughout the day, the people they come into contact with, and their health—including temperature and symptoms over time. The proliferation of private symptom tracking, contact tracing, and more puts this wealth of personal data into the hands of private companies with a wide range of security protocols, from the effective to the ineffective. Private companies also are able to provide data they obtain to the government if they so choose, and the government can recreate a private search without implicating the Fourth Amendment. Although some companies are more privacy-protective, reliance on corporate branding and mission statements to protect vital privacy interests is insufficient.
As with public data, there is a risk of mission creep in the use of privately collected data. It is even more likely in this context, as data is extremely valuable to the companies and organizations doing the collecting, as well as to third parties to whom they might sell it. We know advertisers buy and use extensive amounts of data about people’s behavior, but health data also is valuable to insurers, employers, and others in ways that could lead to potential discrimination on the basis of health status. And while private companies cannot directly carry out arrests, employers and universities have shown a willingness to use new surveillance systems for internal discipline. Even before the pandemic, there was increasing concern about the use of AI social media monitoring, facial recognition cameras, and other surveillance technologies by schools—the new pandemic response has broadened the scope and accelerated the implementation of monitoring. Corporate or organizational decision-making on data collection and use suffers from real transparency problems, and there are few if any requirements to disclose what data is being stored or for how long. One anticipates many fights on the use of such data after the current crisis is over.
Technologies themselves can be built and used in discriminatory ways. Technological contact tracing relies on Bluetooth-enabled phones, rather than workers making calls, but low-income communities are less likely to have the smartphones needed to participate in private contact tracing. And people in low-income communities also are more likely to live in apartment buildings or close quarters, work in essential jobs, and take public transportation—all things that could spark false positives (for instance, when people are within six feet but separated by a wall or behind a plexiglass divider) or so many alerts that contact tracing notifications become useless. This can exacerbate disparities by forcing low-income workers to quarantine, often without pay, even though the notifications do not necessarily show actual exposure. And it can amplify the reluctance of people generally to use contact-tracing apps, undercutting the entire value of such programs.
The dangers of private enforcement have been on display since the commencement of the pandemic. Putting mask enforcement in particular onto individual store owners and employees has led to confrontation and the potential for violence. These contentious incidents have become sufficiently ubiquitous that the Center for Disease Control released guidance for retail, service, and other customer-facing employees to “Limit Workplace Violence Associated with COVID-19.” Leaving mask enforcement to store owners also might exacerbate racial profiling, particularly of the sort faced by Black shoppers. Private enforcement of testing mandates or requirements to use contact tracing apps have less risk of violence, but the concerns about monetary harms during a pandemic apply to employees being fired as much as to people being fined.
The main problem with a system of private enforcement, though, is that it is ineffective. The private sector does not have the same level of overall command and control that the government does. Even with wide use, contact tracing apps are ineffective without a comprehensive national testing program and interoperability between different systems. Contact tracing within a workplace or school leaves out anyone else with whom employees or students may have met in other circumstances. Compliance can be required as a condition of employment (or to be a customer). But if someone refuses and is fired or banned from a store, they easily can continue to spread the virus in other places. Unless the requirements are close to uniform, they are not effective on a public health level. Leaving enforcement of mask mandates and social distancing in the hands of store employees can lead to confrontation and risk to all concerned. And private actors have much less authority to require or incentivize isolation and quarantine when needed, a key part of the process needed to contain the spread of the disease.
Ineffective pandemic response can be actively damaging, because it wastes time and resources, and focuses efforts on the wrong issues. Early efforts to mobilize cutting-edge technologies may have made it harder to focus on the more fundamental but less flashy need to upgrade the computer (and sometimes fax) systems in the public health department offices around the country. Making surveillance and enforcement decisions on the fly—as private actors and governments did at the beginning of the pandemic—makes the public into guinea pigs for the latest proposal. There is a real risk of mistakes that cannot be undone, such as increasing the spread of COVID-19, or releasing or misusing large amounts of private health data.
Simply put, the response to the novel coronavirus in the United States has been ineffectual, and we are all the worse for it.
III. The Necessity of Democratic Governance
The only effective way to deal with a pandemic like COVID-19 is through government action, but the very real trade-offs inherent in surveillance and enforcement need to be made publicly, with clear democratic authorization and strict controls. Trust in government is at an apparent low, but trust is crucial to success, making transparency, public buy-in, and government self-control all the more essential. Yet, most of these have been sorely lacking. Indeed, the pandemic has magnified many of the problems already afflicting the country, particularly regarding policing.
Government response to public health threats like this pandemic often needs to be fast and creative, and so the law gives ample authority to executive officials, which some of them have utilized. Governors in some states have mobilized the machinery of government to do the best they are able to achieve public safety. And despite a couple of highly publicized exceptions, courts have been understandably reluctant to intervene. While several state courts have examined the timing and scope of legislative delegation of emergency authority to the executive branch, courts typically do not like to second-guess the specific content of emergency orders: “Courts have no authority to ask whether a ‘particular method [is]—perhaps, or possibly—not the best.’ Instead, courts may ask only whether the state has acted in an ‘arbitrary, unreasonable manner.’”1
Ad hoc executive action, however, has given rise to vigorous opposition, even to the point of taking up arms. At the least, there is widespread flouting of seemingly reasonable measures like requiring the wearing of masks. In Michigan, for example, protesters angry with stay-at-home orders entered the state capitol unmasked and heavily armed. (The seeming propriety of action such as this has been fostered by a few court decisions holding executives have gone too far.)
In retrospect—and it is still not too late—democratic authorization according to the ordinary processes of law would be preferable. Ideally this would involve legislative action. Legislative debate, even if contentious, would forge consensus that could not so easily be ignored by courts and dissenters. Indeed, an airing of some of the arguments against what seem to be necessary even if inconvenient measures might reveal the opposition for what it is: irrational and unlikely to keep us safe. Less ideal, but still better, would be executive agencies exercising power in some fashion that allows public input, even if not full-blown notice-and-comment rulemaking. COVID-19 is not a short-lived event, there has been ample opportunity to use the regularity of government process; it just has not happened.
Democratic authorization also would allow individual states and cities to be more responsive to their particular communities’ needs, especially in the wake of mass protests against police action. Increasing enforcement, even to deal with a pandemic, without inviting community input is likely to increase tensions around policing. Enacting appropriate laws provides a focal point for coordination in the fight against the disease.
In the absence of consensual lawmaking, enforcement runs the risk of being threatening and ineffectual both. During a pandemic, compliance is requisite. Government would be in a far better position if the rules were public, clear, and adopted by democratically accountable representative bodies. Enforcement options for police should be spelled out in law. The law should favor warnings and education over citations and arrests but should make clear the circumstances under which citations and arrests will be made. If there are particular situations where the intervention of police is causing more harm than good, then decisions about those interventions should be made publicly with broad input, rather than through the ad hoc decisions by individual officers or by police departments more generally. Regulations should direct the police on how to do their jobs safely—for themselves and the public. The response by many policing agencies during protests against policing itself has shown little regard for the pandemic; too frequently, even as protestors wear masks, many police do not. The state must spell out in clear rules what it expects of the public, and of itself.
Any use of surveillance technology and data collection similarly needs to be fully transparent, and cabined with appropriate safeguards. Even before the pandemic, government use of policing technologies has come under fire precisely because there is not the requisite transparency or regulation. Unfortunately, during the pandemic, when states and localities were creating strategies that rely on surveillance—whether through partnerships with companies promising to do facial recognition-based social distancing enforcement or simply by creating lists of addresses in the area where people have tested positive—they typically did not put guardrails around the collection, storage, and use of that data. Legislative bodies and executive agencies should be partnering with experts to answer public questions about whether the technologies and methods are effective from a scientific and public health perspective. It should be clear who is collecting data, how that data is stored, how long it is to be kept, and who can access it. All these protocols should be accessible publicly. There should be audits and consequences for breaching data privacy.
None of this is rocket science. Although all of us hope for scientific and technological breakthroughs that will save us and allow life to return to a semblance of normalcy, in the meantime we are left to save ourselves. But by failing to utilize the ordinary means of democratic governance, we have failed ourselves. The response has been ineffectual, overly draconian in some places, and impressively inconsistent in others; it has fomented public opposition to a startling degree; and it has left all of us at risk.
It is not too late to do for government to do what one would expect as part of the rule of law: enact laws to specify what must, should, and will be done—laws that both grant authority, and cabin it in appropriate ways.
- 1In re Abbott, 956 F.3d 696, 716 (5th Cir. 2020) (citing Jacobson, 197 U.S. at 35, 25 S. Ct. 358).