EFF: University App Mandates Are The Wrong Call

University App Mandates Are The Wrong Call

As students, parents, and schools prepare the new school year, universities are considering ways to make returning to campus safer. Some are considering and even mandating that students install COVID-related technology on their personal devices, but this is the wrong call. Exposure notification apps, quarantine enforcement programs, and similar new technologies are untested and unproven, and mandating them risks exacerbating existing inequalities in access to technology and education. Schools must remove any such mandates from student agreements or commitments, and further should pledge not to mandate installation of any technology.

Even worse, many schools—including Indiana University, UMass Amherst, and University of New Hampshire—are requiring students to make a general blanket commitment to installing an  unspecified tracking app of the university’s choosing in the future. This gives students no opportunity to assess or engage with the privacy practices or other characteristics of this technology. This is important because not all COVID exposure notification and contact tracing apps, for example, are the same. For instance, Utah's Healthy Together app until recently collected not only Bluetooth proximity data but also GPS location data, an unnecessary privacy intrusion that was later rolled back. Google and Apple’s framework for exposure notification based on Bluetooth is more privacy-protective than a GPS-based solution, but the decision to install it or any other app must still be in the hands of the individuals affected.

Further, in many cases, students face disciplinary proceedings and sanctions if they violate these student agreements. That’s why tracking app mandates, particularly by government entities like public universities, have the potential to chill constitutionally protected speech. Students may be afraid to exercise their rights to speak about university policies if they know the university has the potential to sanction them for it.

The speculative discussion of COVID-related technology and schools has obscured a key fact: contact tracing is a long-established medical technique that was effective long before the advent of computers in our pockets. It involves interviews with a trained person to review a diagnosee's recent travels and interactions. It is still effective, and it is still necessary. Exposure notification apps are new, and there is not yet strong evidence of their efficacy. They certainly do not offer a silver-bullet solution.

App mandates also rely on various assumptions: that every person has their own smartphone, that the phone is an up-to-date Android or iOS device, and that it is always charged and close to their body. These assumptions exacerbate the digital divide, and relying excessively on apps over human contact tracing widens the already stark wealth and racial divides in who is most impacted by COVID-19. With app mandates in place, the same students who do not have reliable home broadband connections and study space for remote instruction would likely be unable to meet the smartphone app requirements to attend classes in person.

Universities should strike any app mandates from their existing student commitments, and should pledge to not include them in future student commitments. If and when a university identifies a specific technology it would like students to use, it is the university’s responsibility to present it to students and demonstrate that it is effective and respects their privacy: by sharing privacy policies, by explaining how and by whom student data will be used and shared, by making commitments regarding how the institution will protect students privacy, and by offering avenues for feedback before and during decision-making. Anything short of that abuses the university's power over its students and erodes their rights. It is not too late for schools to commit to a better path.