So far, at least, those hopes have been dashed. If Silicon Valley planned to save states the trouble of starting a tracing system from scratch, that hasn't worked out. Just three states — Alabama, North Dakota and South Carolina — have committed to using the Google-Apple API. Many more have said they’ll build their own.
The lack of interoperability — different apps that can share information — means it will be tougher to trace the coronavirus as it spreads across state lines. Officials in 17 states told Business Insider that they don’t intend to create apps or use smartphones to perform contact tracing at all. The Dakotas and Utah are the only states that have released apps so far. (North Dakota has already paired with South Dakota to roll out a separate contact tracing app that doesn’t use the Google-Apple API.)
Contact tracing apps have the potential to solve a lot of the problems associated with manual tracing. Hunting down and informing the contacts of a single infected individual can take several days, which is why some cities and states are hiring contact tracers by the thousands. When an app works well, it doesn’t present the same problems as relying on individuals to remember all the people they’ve come into contact with recently, or even to know the names of those who were near them in public.
But no matter what app a state might use, getting millions of individuals to download it will be a tough sell. An Oxford University study suggested that it would take a 60 percent adoption rate for contact tracing apps to be effective. No country has come close to achieving that level of penetration.
When Iceland announced last month that 38 percent of its population had downloaded its version, it represented a record high. Singapore, which is highly advanced when it comes to tech adoption, saw only a 20 percent uptake. Polls suggest that many Americans, if not most, will be wary about downloading and using such apps. A new study found that people who think they have been exposed to the coronavirus — even if they haven’t — are much less likely to download a contact tracing app.
There are serious privacy concerns involved in having health information intersect with government agencies. Those may be particularly acute at the moment. By definition, during a season of protest, distrust of the government runs high. Protesters are now being warned by organizers to turn off their cellphone data, or leave their phones home entirely. Alarm bells went off in Minnesota after Public Safety Commissioner John Harrington directly compared efforts to look into the affiliations of protesters to contact tracing.
“People who were at these protests should be concerned that the government could use that data,” New York City Public Advocate Jumaane Williams told Politico. “I want to encourage (contact tracing) but it’s hard when our executive leaders are not clarifying how that data will be used.”
Even when health officials can gather names of individuals an infected person has come in contact with, those individuals have to respond to their outreach. “Contact tracing is really an art,” says Greg Nojeim, senior counsel at the Center for Democracy and Technology (CDT). “It’s the art of building enough trust with a person who has a disease, so that person will reveal contacts so those contacts can be notified.”
Human contact tracers have already run into the problem of people refusing to answer calls from unknown numbers. There’s reason to be skeptical. Whenever there’s a mass outreach effort, unfortunately scammers will piggyback on it.
Health departments make every effort to ensure confidentiality. For contact tracing apps to be widely used, such assurances have to be built in. “If an app is catastrophic to privacy, it’s not going to be used,” Nojeim says. “Even if it’s mandated, people will find a way around it.”
Market Power and Privacy
Google and Apple sought to assuage privacy concerns when they designed their API. It can only be used by government health departments or their contractors, which can’t store data themselves. The API requires agencies to disable their apps when the pandemic ends.The system relies on anonymized Bluetooth data, which is changed repeatedly. If two people using the app are near each other, their phones collect an anonymous identification from each other in what is sometimes called a “handshake.”
If one of the users is later diagnosed with COVID-19, that user can then decide — voluntarily — whether to notify the people he or she came into contact with. Notifications include no information about who potentially exposed them or where any exposure may have occurred. It’s basically a flag warning them that getting tested might be a good idea.
It’s a decentralized approach. Rather than data being collected by and stored at a health agency, all the information stays on individuals’ phones. “At this time, Google and Apple happen to be supporting the most privacy-friendly version of contact tracing,” Frederike Kaltheuner, a tech policy fellow at the Mozilla Foundation, said during a CDT webinar. “They’re trying to prevent government from developing more invasive apps.”
European countries including Germany, Italy, Ireland, Austria and Poland, among others, have either released apps based on the Google-Apple API or intend to do so. Other nations, however, including France and the United Kingdom, decided to develop their own. In part because it intends to store data for years, the U.K. is now being sued for failing to meet privacy standards under GDPR — the General Data Protection Regulation, the European Union’s privacy regulation.
France, meanwhile, has been unsuccessful in its attempt to convince Apple to allow its app to capture Bluetooth location data when it’s not running. Apple says that exception would open the floodgates for commercial uses. “This is a reminder the Google and Apple have an extraordinary market power when it comes to mobile phones,” Kaltheuner says. “It’s remarkable Google and Apple can dictate to European countries how they can use their apps.”
Rather than apps, Asian countries such as China, South Korea and Taiwan are relying on GPS and telecom data to assist manual contact tracing and enforce quarantines. Last week, South Korea began using QR codes, requiring people to log when they enter some public spaces. “So far, from what we’ve seen in Asia, the data suggests that contact tracing apps have really not been what they’d promised to be, but they do play a role,” says Dev Lewis, a fellow at Digital Asia Hub, an Internet think tank in Hong Kong.
Other Things to Worry About
There are other challenges involved with developing an effective contact tracing app. For one thing, Bluetooth signals are imprecise. People might be near each other but their phones might not sync up if there are too many layers of clothing or other physical separation between them. There are bound to be false negatives and false positives.Also, not everyone has a smartphone. Apps have to be designed in ways that can be used on older phones. Lewis notes that Singapore went into lockdown mode after an outbreak among migrant workers in dorms who didn’t have the app.
Former British Prime Minister Tony Blair recently suggested people would need to have “digital IDs” that would record their “disease status” in order to facilitate opening up businesses and international travel. Kaltheuner emphasizes that app use should be strictly voluntary. Employers, landlords and other parties shouldn’t be able to force people to download apps.
Under the Google-Apple API, it’s up to individual users to send out alerts about infections. But people with the app shouldn’t be able to use that power in vindictive ways, scaring their contacts with false announcements. Google and Apple are planning to work around this potential problem by requiring a code from a health authority to send out notices.
For all the hurdles and drawbacks, contact tracing apps are well worth using, says Albert Gidari, consulting director of privacy at the Stanford Center for Internet and Society. They may not solve every problem, but they can vastly speed up the process of tracking and tracing. If not enough people have smartphones or don’t want to download apps, that’s an argument for more resources and education, he suggests.
“Whatever the theoretical problem, the benefit is obvious: Bluetooth contact tracing saves lives,” Gidari says.
In this instance, Google and Apple embraced privacy and data protection as central design principles. But no government yet seems to have squared the circle involved in protecting privacy and decentralizing data, while also achieving enough adoption so that digital contact tracing actually works to limit spread of the disease.
“We all know an app is not going to solve the pandemic,” Kaultheuner says.
