Around the world countries have been deploying contact tracing apps as a technological tool to fight the spread of the COVID-19 virus—and they’ve had mixed results and privacy worries to show for it.
Contact tracing is an important measure used by local public health officials to keep tabs on the virus’ movement in a community. It helps curb the spread of the disease by alerting people that they may have been exposed to the coronavirus, helps them get tested, and lets them know if they should self-isolate or self-quarantine. It’s the reason you may get asked for your name and phone number whenever you go out to a restaurant and other public places. Contact tracing could be even more important when it comes to COVID-19, where asymptomatic people may be capable of spreading the disease.
But it can be a time-consuming, tedious and labor-intensive task. Health authorities deploy hundreds and even thousands of investigators to interview newly diagnosed patients to determine who they may have come into contact with; they then ask those people to provide contacts of their own and repeat the process. But a person infected with the coronavirus may not know or remember every person they interacted with during the critical contagious phase—making the contact tracer’s job more difficult when they have incomplete or wrong contact information.
For this reason, many jurisdictions have started relying on apps to automatically assist in the contact tracing work, hoping they can identify potentially infected individuals that other contact tracing methods might miss.
“It will not only help us do contact tracing but can also get people a sense of security and confidence,” said Governor Andrew Cuomo of New York when the state rolled out its app. “You know anxiety is very high, everybody is wondering, I was next to this person, I was next to this person, but this can actually give you some data and facts can help reduce anxiety and that is a good thing.”
Centralized vs. Decentralized
Contact tracing apps fall into two broad categories: centralized and decentralized. Both categories of apps use Bluetooth signals transmitted between two devices that have the app installed. If a person is diagnosed with COVID-19 by a health official—and, importantly, enters that information into their app—the app will transmit that information to apps on other devices nearby. Those apps will then notify their device owners that they may have been exposed to the virus, and what they should do about it: self-isolate, get tested, or other measures.
The difference between the two classes of apps is found in how they handle the data. Centralized apps make the data anonymous and upload the information to a remote server that matches the individual’s data with other app users to determine who could have been exposed. It then transmits an update back out to the apps—and those apps alert their users that they may have come into contact with someone who has the coronavirus.
Decentralized apps, in contrast, keep the information on the device—giving their users more control over their personal information. The apps communicate with each other directly rather than uploading data to a server and flag any potential exposure to COVID-19 to their users.
The centralized approach gives public health authorities greater insight into the behavior of the virus and monitors how well the app is working in efforts to curb an outbreak. The decentralized framework offers users more robust privacy measures and is better able to fend off hackers—or nosy government agencies—from getting access to a person’s social contacts.
Apple and Google Team Up to Fight the Coronavirus
Efforts to develop effective contact tracing apps got a big boost when Apple and Google—two of the most powerful and influential rivals in the tech world—announced that they were teaming up to develop a common platform that would work on iOS and Android devices alike: the Exposure Notifications architecture.
It’s not an app in and of itself, but is rather an application programming interface (API) that other apps can piggyback on—the same way a Google Maps widget would work. It is part of the operating system, which allows it to run in the background and drain less of a device’s battery.
The system assigns a random ID to the device it’s running on; that ID changes every 10 to 20 minutes so it can’t track the user’s location or personal information. The device exchanges its ID with other devices that are nearby for at least 15 minutes. If a user tests positive for the coronavirus, a public health official gives the user a code that lets the app anonymously add their ID to a list of other users who have tested positive. Other devices equipped with the app regularly download this list and check to see if they’ve come into contact with any of them. If a device finds a match, it alerts its user that they may have been exposed to COVID-19 and advises them what to do next—without revealing the location or identity of any of the other users on the list.
Jurisdictions using the API include Canada, Brazil, Ireland and South Africa, and the states of Virginia, New York, Michigan and Alabama.
Balancing Public Health Concerns with Individual Privacy
COVID-19 contact tracing apps also must maintain a fine balance between helping to support effective public health measures and respecting individual privacy. To make things more complicated, those boundaries vary by country and culture.
In India, the federal government and many businesses have made the Indian app mandatory for millions of its citizens. People in China must input their personal information, recent travel history and health status into an app, which then determines the person’s infection risk and assigns them a color code—green, yellow or red. Workers will stop anyone without a green code from entering transit facilities, offices and malls. South Korea hasn’t deployed a contact tracing app at all—but it uses other measures such as CCTV footage, credit card transactions and phone location data. These measures would be considered a serious invasion of privacy in the U.S. and Europe—and governments in these parts of the world have had to address these concerns in their app designs.
Many think that the Apple-Google platform strikes the right balance between public health and privacy. The tech giants have gone further with privacy protections as well. Users voluntarily turn the app on or off whenever they want, and users are not identified to either company or to each other. In addition, users aren’t identified to their public health authority—they must choose to do so themselves. Moreover, the companies require that governments which adopt the system must comply with Apple and Google’s security requirements. The companies will also deactivate the system in jurisdictions where the outbreak is brought under control.
Apps Need to Be Used More to Be Successful—But There Are Still Limitations
Researchers believe that at least 60 percent of a population needs to download the app for it to be effective in limiting an epidemic without other severe measures such as lockdowns in place. However, usage rates as low as 15 percent could help when other contact tracing measures are also in place. Ireland’s app is being actively used by 37 percent of the population—and that’s one of the best adoption rates in the world.
In addition to privacy concerns limiting their use, there is some difficulty in getting centralized and decentralized apps to work with each other. “The core reason is that centralized systems ask you to upload the people you have seen, and decentralized systems don’t need that data, so they don’t play well together,” said Dr. Michael Veale of the DP3T group, which has developed a system similar to the Apple-Google architecture.
And while limited downloads of the apps seem to be hampering their effectiveness, researchers believe that even with widespread use the apps can only do so much. “Even when we see cases in which apps have been downloaded a lot of times, and alerted a relatively high number of people, in terms of what that does for overall numbers and the resurgence of the virus, I think it’s important that we understand the limitations of these apps,” said Samuel Woodhams, a digital rights analyst. “Contact tracing apps are not going to be a silver bullet.”
Read more about how engineers are helping fight the coronavirus at How Machine Learning Is Helping in the Fight Against COVID-19.