Contact-tracing apps have been a disaster, but could they still save us?

The coronavirus hasn’t gone anywhere. Even as countries scramble to reopen, case numbers continue to rise, and despite a lot of talk about building systems to curtail a second wave, many governments have struggled to put those systems in place.

One of the most popular tools for dealing with an outbreak is contact tracing — the process of tracking new cases of a virus and reaching out to everyone that patient has been in contact with, creating a web of connections to trace the spread. Governments and tech companies have both pushed contact-tracing apps as a modern method of containing the virus, tapping into the fact that so many people own smartphones. Despite the hype, many of the contact-tracing apps launched worldwide have been ineffective or outright disastrous, and if states want to get people on board, they’ll need to learn from their mistakes.

A big idea and some big failures

Billions of people own smartphones, invisibly tethering them to everyone else, and so, the thinking goes, public health agencies could use those connections to make contact tracing easy. Apple and Google viewed the idea so favorably, the two tech giants joined forces to develop a contact tracing API for the world to use.

The results have been embarrassing. France’s StopCovid app acquired 1.9 million users over three weeks. Only 68 users declared they tested positive, and only 14 notifications were sent out over that time period.

The United Kingdom also opted to build its own app without the Google/Apple toolkit; after months of development and meager results, the government announced it would ditch its plan and work on a new app using the Google/Apple approach.

North Dakota was one of the first states in the U.S. to deploy a contact tracing app, but its achievement soured when the app was discovered to violate its own privacy policy by sharing user data with third parties.

Miscommunication and sloppy rollouts

Why has contact tracing gone so poorly in so many places, despite Google and Apple throwing their weight behind it?

“I just think there was a lot of misunderstanding about how the technology worked,” says Sarah Kreps, a professor of government and law at Cornell University in New York, whose work covers the intersection of technology, policy, and national security.

“Most of these new apps are using the Bluetooth technology — so these Bluetooth “handshakes” — that transmit when you’ve been in close proximity to someone who has tested positive,” Kreps explains, “and obviously that person who tested positive has to have uploaded that information into their phone. And then it notifies people who were proximate.”

Not all of the apps use Bluetooth, however.

“Some use GPS location data,” Kreps says, and the “differences matter because they introduce very different privacy considerations.”

A Bluetooth system would only track which devices your device has been near, but GPS tracking reveals your movements, and for many people, that’s too much.

Kreps points to North Dakota’s GPS app debacle, which she describes as a “technological and privacy trainwreck.”

In addition to whether apps use Bluetooth or GPS, there’s also the issue of how they store data. Countries such as the U.K. (in its first attempt) and France have pursued centralized approaches to managing data.

“What that means is that data is going over to public health authorities,” Kreps says. “And the advantage of that is that they have more information at their fingertips to be able to then track down people who’ve been in contact.”

The disadvantage is that the public might not trust a centralized system, and the more people who refuse to sign up, the less effective the system will be.

https://twitter.com/ElaineDMoore/status/1253951039658758145

Contact-tracing apps require individual citizens to trust not just government agencies but Big Tech, and so they’ve crashed against the “techlash moment that we find ourselves in” says Kreps. “There is a lot of skepticism about technology companies and their ability to keep our information secure.”

The last few years have seen data breach after data breach, scandal after scandal. Post-Cambridge Analytica and Equifax, how can the public trust Big Tech?

Tech companies promise privacy, but states don’t seem to believe it

Apple and Google seem to have recognized the need for privacy. Their system uses Bluetooth rather than location tracking, and promises not to “share your identity with other users, Apple, or Google.”

It’s a decentralized data storage approach, one that Kreps commends as being very good when it comes to privacy.

“Unfortunately, a lot of states just did not say they would adopt this Apple Google API,” she says.

By mid-June, only three states in the U.S. (Alabama, Arkansas, and North Dakota in its second attempt at an app) had committed to using the Apple/Google API, according to a report by Business Insider. The rest were either noncommittal or flat-out declined to use it.

We reached out to Google and Apple for their stances on the matter. Neither replied to our requests.

“California, which initially had jumped on this … now just hasn’t,” Kreps adds.

In April, Gavin Newsom’s office had spoken with Apple about its technology and was “making it a part of the state’s planning for easing out of its statewide stay-at-home order,” according to NBC. California ultimately did not pursue an app, instead launching a program called California Connected, in which “Public health workers across the state … will call, text and email individuals who test positive for COVID-19 and people they may have unknowingly exposed to the virus.” The program is bolstered by a Salesforce data management platform.

We reached out to the California Department of Public Health to see why the state hasn’t pursued an app. A spokesperson for the department told us “Contact tracing is an essential public health function that has been used by public health departments for decades … It involves notifying people who have been in close contact with an infected person to prevent the disease from spreading to others. Most of that work can be done by phone, text, email, and chat.”

Earlier this week, White House health adviser Dr. Anthony Fauci told CNBC that contact tracing is “not going well,” and New York City provides a dire case study. Only 35% of residents who tested positive for the coronavirus gave information about their contacts to tracers, according to a report by The New York Times.

“I am not persuaded that the traditional methods are sufficient,” Kreps says. “Given the magnitude of the current problem, I don’t see any reason why states would not be using multiple tools to address this public health problem. If California doesn’t want to develop the app themselves, they can work with groups like Covid Watch who will.”

Kreps emphasizes that “traditional methods require considerable infrastructure and resources, not to mention time in a public health crisis where every additional exposure is a potential life lost. An app could be up and running now and wouldn’t in and of itself solve the public health crisis but provide a quick and effective measure.”

Despite the failures, states may still turn to apps

As coronavirus cases rear up again and states debate another round of lockdowns, public health agencies, “groping for solutions” as Kreps puts it, may have no choice but to get over their qualms with Google and Apple. Once they do, they’ll still have to go about actually developing an app, and then getting people to install it.

Even Iceland’s contact tracing app, which has the highest adoption rate in the world, has only been installed by 38% of the country’s population. While that may not seem great, however, Kreps argues that any adoption is better than none.

“Every notification is potentially a life saved.”