Bruce Schneier on COVID-19 Contact Tracing, Surveillance Capitalism, and Data Governance Challenges

Bruce Schneier, a renowned security expert, critically assesses the efficacy of digital contact tracing apps for COVID-19, arguing they are "effectively useless" due to inherent design flaws, high error rates (false positives and negatives), and low public adoption. He posits that these apps represent "tech solutionism" that risks squandering public trust without providing substantial defense against the pandemic. Schneier emphasizes that effective contact tracing, as seen in South Korea or the Boston area, is primarily manual, human-based, and relies heavily on trust and interviews, rather than automated digital systems. He highlights the critical importance of ubiquitous, fast, and accurate testing as the foundational requirement for any successful pandemic response, rendering most app-based solutions largely irrelevant or too late.

Schneier distinguishes between three main technological approaches to the pandemic: contact tracing apps, valuable aggregate statistics (e.g., fever maps, mobility data), and the concept of immunity passports. He proposes a seven-point framework for evaluating any such system: efficacy, proportionality, consent, data minimization, security, transparency, unbiasedness, and temporariness. He notes that while the technical challenges of building privacy-preserving apps (like the Apple/Google API) are solvable, the broader issues stem from the political economy of surveillance capitalism, where data collection is the internet's default business model. He argues that adding one more tracking app to a phone already laden with surveillance is a minor increment to an already pervasive problem.

Practically, Schneier suggests that if an app were to be used, its severe limitations must be clearly communicated, and it should only serve as a minor component within a comprehensive, human-centric manual tracing system. He stresses that the real hurdles are not technological but societal: fostering trust, ensuring widespread testing, and achieving collective action. For data governance more broadly, he advocates for deliberate, national conversations to balance the collective value of data (e.g., medical research, traffic management) against individual privacy risks. He illustrates how different data types require distinct trade-off models—anonymous and temporary for traffic, but named and permanent for medical research—and that these decisions should not be left to corporations driven by short-term profitability.

The podcast underscores how the COVID-19 crisis exposes and exacerbates existing societal inequities, particularly within healthcare systems and the digital divide. Schneier asserts that the pandemic merely brings pre-existing surveillance issues to the forefront, as "surveillance is the business model of the internet." He calls for a more proactive and deliberate approach to data privacy and regulation, citing Europe as a potential "regulatory superpower" in contrast to the US. The discussion also touches on the ethical dilemmas posed by "immunity passports," which could create a two-tier society of the "safe and the unclean," and the significant challenge of rolling back surveillance measures once a crisis subsides.

I maintain that contract racing apps are effectively useless and the fact that we're considering them is really just tech solutionism and doesn't reflect any actual defense against the pandemic.

The most important thing we have in this pandemic is trust and squandering that trust an app that doesn't work now after three days there'll be Twitter posts this thing didn't work.

Surveillance is the business model of the internet; there's no change here. Adding a one app to the 50 on your phone that track you is kind of so OTT.

We're in a global health crisis, it makes sense to make extreme trade-offs, the things we wouldn't do in normal time we might do today.

How do I balance this value to me as a member of the group through the value to me individual and there's no one answer to this, it's very domain-specific.

The problem is that this hasn't been handled at the bevel that it needs to be handled given that we are where we are.

The key is ubiquitous fast cheap accurate testing without that none of this matters.

It does sound kind of icky but you could imagine us saying you know yes we want to be able to reopen these businesses but the only way we can do it... is with it with an immunity passport.

I don't know that yet more I mean this has been happening for the past 10 years nothing is new this date has been collected this data is being used against you as faded to being handed over to government well before Kovach I don't see any change.

I'm looking more towards Europe right now they they seem to be a regulatory superpower on the planet and are doing something a little bit try to increase privacy.