How many times have you failed to get a new digital device working properly the first time? While toddlers can (amazingly) master iPhones in minutes, some tech gadgets require many troubleshooting attempts to activate. And even then, they might fizzle.
Last weekend, the State of Utah learned that simple tech lesson in a very public way while attempting to implement an executive order from Gov. Gary Herbert to require every adult crossing the Utah border to submit an electronic State of Utah Travel Self-Declaration Form with details about their contact information and health status.
When entering Utah at one of nine virtual border checkpoints positioned across major roads and highways, motorists were supposed to receive a text message directing them to complete a survey form with their name, address, phone number, email, and any potential symptoms or exposure to COVID-19.
According to the FAQ compiled by the state about this wireless alert system, the personal and health data collected by this survey was transferred securely from the Utah Department of Transportation (UDOT) to the Utah Department of Health (UDOH) in the event that health investigators needed to follow-up with any respondents about self-quarantining.
At least, that was how the system was supposed to work.
Instead, even after tweaking the wireless signals to reduce the geographic area of these virtual checkpoints, people sitting at their kitchen tables in Vernal were receiving text messages to fill out the entry form, as were residents of St. George out for a walk around their neighborhood. One resident of Myton, Utah—located 60 miles from the Colorado border—told the Deseret News she received 80 text messages from the system in one morning. Simply put, Utah’s Wireless Emergency Alert (WEA) system, also called a “geofence,” had a lot of holes. In addition, alert system couldn’t distinguish between motorists entering or leaving the state, so many people received the alert while driving from Utah to Nevada or Idaho.
After launching the entry alert system on the afternoon of Friday, April 10, the Utah Department of Emergency Management cancelled the project the following Monday after several attempts to narrow the wireless zones failed to stop the wayward text messages going to people located miles from the state border. “We knew that this was going to be kind of an experiment and we were trying to do something innovative,” Joe Dougherty, public information officer for the Utah Division of Emergency Management, told the Deseret News.
Still, Dougherty explained that about 35% of the people who received a text message completed the entry form. He said the state received about 10,000 responses during the 72 hours the system was operational.
To the ACLU of Utah, that’s 10,000 people who provided their personal and health information—including their date of birth, cell phone number, and status as a state resident or visitor—to government agencies without much thought or explanation about how it could be used.
Plus, although UDOT executive director Carlos Braceras said his agency “Do[es] not see this as an effort to penalize people,” he added that if travelers entering the state did not comply with the order to fill out the entry form, “we could then take subsequent steps if we need to going forward.”
To the ACLU of Utah and others, Bracera’s comments sounded like a threat to use the data collected by this surveillance system to track people down and force their compliance. Because the state could determine how many motorists responded to text messages (the 35% figure mentioned by Dougherty), they could judge if enough travelers were complying. Plus, while the initial wireless alerts did not identify individual cell phone numbers, anyone who responded to the survey would have their mobile number and any other personal identifying information they included in their response collected by the state. Given Utah’s troubled history with the secret sharing of personal data with outside law enforcement agencies, as well as data breaches of sensitive information held by the Department of Health, many people in Utah’s immigrant community correctly feared implementation of this new surveillance system.
What’s most troubling to us, however, is that Utah’s experiment with a virtual border checkpoints was cancelled not because of concerns about state overreach that infringed privacy, but because of hundreds of complaints from Utah residents whose smartphones got jammed with surveillance spam. The problem wasn’t that Utahns were concerned about the government wanting to know personal details about thousands of people entering the state, but that too many of the wrong people got asked these questions.
And while the FAQ prepared by the state to explain the wireless alerts did identify and answer several privacy-related questions, both this document and some comments by state and local leaders resorted to hyperbole to justify the rapid implementation of the system. Why did Utah need to record the personal details and health history of everyone entering the state? According to the FAQ, “These are extraordinary times, and Utah is taking extraordinary measures like using this technology (which we have never used in an instance like this before). There may be some kinks here and there, but it’s absolutely essential to help us stop the spread of the coronavirus, COVID-19.”
Extraordinary times.
Extraordinary measures.
Absolutely essential.
Those phrases jammed into a single, excitable paragraph are certain clues that this effort shifted the crucial balance between state authority and personal privacy too far towards the state. Besides being unworkable, the implementation of this wireless alert system was an unnecessary infringement on personal privacy. Because we realize that recognizing that this balance becomes harder for elected officials during times of crisis, the ACLU of Utah issued this statement about the state’s initial response to the pandemic in late March:
"The ACLU of Utah will continue to engage in important discussions about the balance of prudent and effective public health protections with the preservation of our inalienable civil liberties. It is encouraging that in promoting social distancing measures, Utah officials are currently stressing education and persuasion over threats of criminal penalties. We will continue to monitor this rapidly developing situation as it unfolds with an eye to protecting all of our rights.”
After a serious review, we do not believe the state’s experiment with wireless alerts at border crossings was either prudent or effective. And we do not want to see it re-implemented in the future. While concern over travelers spreading the coronavirus was a significant concern during early stages of the COVID-19 pandemic, most experts agree that threat is significantly reduced now that 97% of the U.S. population is under orders to stay at home or shelter in place.
Plus, are non-residents actually the biggest threat to Utah’s virus mitigation policies? What evidence is there that the most dangerous vector for increased contagion are travelers entering Utah from Nevada (96 cases per 100,000 people) or Arizona (51 cases per 100,000 people), instead of Utah residents driving from Summit County (728 cases per 100,000 people) or Wasatch County (303 cases per 100,000 people) to Salt Lake County (99 cases per 100,000 people)? If we need to have virtual checkpoints at the state border, shouldn’t we have one at Kimball Junction too?
Finally, if the state’s primary focus is educating everyone about Utah’s current shelter in place and self-quarantine orders—and getting people to pay attention and change their behavior—perhaps the wireless text alert could have included text and links about the importance of these recommendations instead of the threat of an invasive survey. We view that merging of technology and education as a more balanced approach that we could support.
