Digital technology is assuming a central role in efforts to contain the spread of the Covid-19 pandemic. Recent weeks have seen hundreds of initiatives mushrooming worldwide, ranging from relatively innocuous collection of health data through survey apps and providing information to suspected victims, which nevertheless require strict controls against abuse, to more active measures such as enforcing quarantines and contact tracing.
Efforts to use digital technology to trace people who may have been in contact with those carrying the virus in order to ask them to take appropriate measures — and thereby track the spread of the epidemic — are generating the most debate currently. These are seen as critical to the lifting of lockdowns. Smartphones seem particularly suited to this task, but many concerns have been raised about the potential for privacy abuses and the actual effectiveness of these tools, particularly in developing countries. A common concern is whether technology is becoming a substitute for public health resources.
Globally, the main trend has been to develop apps that use the Bluetooth radio signal that typically connects handsets to headphones, fitness trackers, and other peripherals. Using this protocol, apps can tell whether two phones have been close enough for long enough to trigger a potential contagion. If someone is infected, the app will alert other app users at risk.
The use of Bluetooth for tracking epidemics was pioneered by researchers at Cambridge University in the 2011 Fluphone project, and has been formally endorsed by the European Commission as more precise than other geolocation technologies such as GPS to determine proximity. It is important to understand that the apps are not interested in where you may have caught the virus, just who was nearby.
Singapore’s health authorities launched the first Bluetooth contact tracing app on March 18. TraceTogether immediately became an often-quoted example of a democratic and privacy friendly approach to using technology for battling the virus, in contrast to China’s draconian approach. The app was voluntary, relied on consent for data sharing, and the data could only be used by the health ministry. The protocol was launched as an open source effort to encourage other countries to follow suit and aid interoperability.
A large network of European academics and research centres launched the ‘Pan-European Privacy-Preserving Proximity Tracing’ (PEPP-PT) project. This network is an umbrella for many projects and protocols to support country-specific applications, but there are some fundamental differences in how its members approach the issue.
Experts who look at the use of technology in humanitarian disasters have warned that technology may exacerbate existing disparities in access to help, as those with access to smartphones are prioritised.
A major debate has emerged over the use of central national databases to collect the identifiers of potentially infected people and the potential for abuse. The Decentralised Privacy-Preserving Proximity Tracing (DP-3T) project has attracted huge support from well-respected cryptography researchers and independent technology experts to urgently build a state of the art open protocol. In this system, the backend central server run by the implementing government health agencies does not have information about the identities or social graph of app users, so this information cannot be accessed by law enforcement or other agencies.
This approach of using Bluetooth and decentralisation was given a major boost when Apple and Google jointly announced that they were partnering to build a functionality that closely follows earlier versions of the DP-3T protocol into their operating systems for smartphones.
Why Are People Worried?
So what’s not to like about an approach which centres privacy, decentralisation, and open public protocols, and has the support from major tech firms? Unfortunately, the situation is more complicated.
Questions have been raised about the privacy credentials of many government apps, including TraceTogether, which at least in an earlier version, appeared to give government agencies access to data, contradicting their stated policy. The DP-3T decentralised project is meant to deal with some of these problems, but a look at its Github issues page shows the many potential pitfalls and questions that even the best designed approaches raise.
In addition to the apps themselves, there are issues with the implementation. Some UK academics have drafted legal protections and safeguards — currently being discussed at the Council of Europe — that would ensure that nobody would be penalised for not carrying their phone and that any compulsory use of these apps is strictly limited. The European Union has published guidance on these apps that warns against using them for mass surveillance or forcing them upon people through the threat of negative consequences.
More broadly, there are issues with the role of tech companies. Most smartphones in the world run software controlled by either Apple or Google. While their initiative to create a decentralised privacy-friendly Bluetooth facility for app developers has been widely praised, there are also criticisms that such access could be abused for many purposes. It is also unclear whether these new mechanisms will be temporary and restricted to fighting the epidemic.
These debates confirm the immense power that these tech behemoths hold over society and the economy, and how these technological solutions are creating new dependencies that will entrench dominant positions. Some governments are now seeing their own more centralised app designs being shunned by Google and Apple, with technical impacts that will lower the adoption of such apps. For example, without access to those Bluetooth facilities from Apple, government apps will need to be kept open at all times, posing huge security risks and draining phone batteries.
Will These Apps Work?
Before anything else, the first question to ask is whether these apps work at all. There are some compelling arguments. The World Health Organization (WHO) recommend contact tracing to interrupt transmission and understand the spread of the disease. Researchers , however, have developed models that appear to show that traditional contact tracing methods are unable to keep up with the volume and speed of this pandemic. And while a Bluetooth mobile app may be the solution, many questions remain.
It is unclear how many people would need to use the app for it to be effective. The UK government is targeting 80 percent of smartphone users for its app but such high levels of penetration might be unrealistic. In Singapore, for instance, only 13 percent of the population has installed TraceTogether.
Questions have also been raised on whether mobile app contact tracing is comparable to the real thing, which involves officials carrying out interviews and potentially trawling through records. To be sure, there is limited privacy in such circumstances. Doctors in many countries are obliged by law to report any confirmed cases, including personal details, for purposes other than contacting people, such as public policy planning. Anonymous apps don’t provide such important data. But there are also practical problems with deciding who can trigger an alert, whether a test is necessary or not, and how to avoid the malicious use of any anonymous self-reporting mechanism overloading the system with false positives.
Assuming that the tools work and are not abused, there is still the issue of what people should do once they are alerted. Must they self-quarantine, get a test or simply monitor their symptoms? How do we know that they have taken action? Will any fluctuations caused by technical errors simply saturate health systems?
Contact Tracing for the Majority of the World
These issues may become more acute in the global South. For example, In India the government has launched the Aarogya Setu contact-tracing app, which has been criticised for potentially enabling any government agency to use the data collected for other purposes and a general lack of technical transparency.
Estimates of smartphone penetration in India vary but are generally under 30 percent compared with around 90 percent in Singapore. This puts into perspective the challenge of using apps for mass contact tracing. Given the low adoption rate of smartphones in India, it might even skew testing in favour of smartphone owners, and ignore the possibility of community spread amongst a significantly larger population that cannot access mobile internet. In addition, the lack of privacy legislation has been raised repeatedly in relation to technology to fight the coronavirus. The absence of protections has real world consequences. There are concerns that discrimination against people infected – harassment, public shaming, and in some cases, eviction – could “drive the disease underground” and deter people from reporting their illnesses.
Again, assuming that the app works despite the above concerns, what then? In the absence of welfare support, how can people self-isolate if they risk destitution or starvation? The disastrous displacement triggered by the current lockdown in India shows the difficulties involved in transplanting policies to different contexts.
The disastrous displacement triggered by the current lockdown in India shows the difficulties involved in transplanting policies to different contexts.
Should We Ditch Mobile Contact Tracing?
The case for the use of mobile contact-tracing apps is not settled and is very thin in parts. This approach may make sense in mathematical models and some specific contexts but may be hard to implement in most parts of the world and may well entrench the power of large tech companies for limited gains.
One answer to this gloomy analysis would be: why not try anyway? This is true, and for now, we certainly will need to wait and see if these tools work or not, but we also need to make sure that we don’t make things worse.
Experts who look at the use of technology in humanitarian disasters have warned that technology may exacerbate existing disparities in access to help, as those with access to smartphones are prioritised. More problematically, the apps should not detract from developing public health responses and capabilities, including access to testing, treatment and vaccines once these appear. Given the global inequalities in access to health, this should be the real priority.
This is part of our ongoing series on the coronavirus and its impact.
