The on-going COVID-19 pandemic has brought surveillance and privacy concerns to the forefront, given that contact tracing has been seen as a very effective tool to prevent the spread of infectious disease and that public authorities and government officials hope to use it to contain the spread of COVID-19. On the other hand, the rejection of contact tracing tools has also been widely reported, partly due to privacy concerns. We conducted an online survey to identify participants’ privacy concerns and their risk perceptions during the on-going COVID-19 pandemic. Our results contradict media claims that people are more willing to share their private information in a public health crisis. We identified a significant difference depending on the information recipient, the type of device, the intended purpose, and thus concretize the claims rather than suggesting a fundamental difference. We note that participants’ privacy preferences are largely impacted by their perceived autonomy and the perceived severity of consequences related to privacy risks. Contrarily, even during an on-going COVID-19 pandemic, health risk perceptions had limited influence on participants’ privacy preference, given only the perceived newness of the risk could weakly increase their comfort level. Finally, our results show that participants’ computer expertise has a positive influence on their privacy preference while their knowledge to security make them less comfortable with sharing.

Enrollment apps for COVID-19 vaccinations are meant to be privacy-enhancing, but poor design puts privacy at risk. We report on a qualitative exploration of the experiences of older adults attempting to register for vaccination. We engaged in a think-aloud protocol with six participants over age 65 over Zoom as they used the New York state vaccination portal. Authentication requirements were: Medicare ID, DOB, address, and phone (optional). For this cohort, Social Security numbers were the default Medicare ID. We found that a privacy-enhanced authentication option exists, but efforts to use privacy-preserving enrollment were confounded by security-enhancing timeouts. Choosing to use the time-consuming privacy-preserving authentication increased the risk that available vaccines were taken. As a result, older adults reliant on volunteers to enroll revealed sensitive information and risked identity theft. A design that was meant to be privacy-enhancing by offering multiple avenues for authentication and ensuring logout via timeouts created a system where the more secure option was not effectively available due to a competing security mechanism. This was exacerbated by a counter counting down the number of vaccine sites available, similar to a well-known stress condition used to create cognitive load in laboratory experiments. All six participants used privacy-sensitive information to enroll; provided adequate information for identity theft; and all six encountered stop points. The countdown of available vaccination sites, the time required for insurance validation as an alternative to Medicare ID, and logging off after inactivity to prevent session theft each are good practices; but fail together.

No abstract

No abstract