- The privacy-first approach of the Google/Apple system hinders the usefulness of COVID-19 trackers.
- Trust in government is the biggest obstacle to effective tracking and tracing.
- Just installing the app on your phone may change your behavior for the better.
Getty Images / Charles McQuillan
COVID-19 tracking apps warn users when they’ve spent more than a few moments in the presence of an infected person. When you receive this warning, you yourself can get tested, and then anybody who came into contact with you can also be warned.
The idea of using technology to combat the pandemic spread fast. After all, almost everybody carries a smartphone with them whenever they leave the house. Back at the beginning of the pandemic, the main concern was privacy—what else might our governments do with all that data once they had gathered it? But the real problem, it turns out, is that COVID-19 tracking apps just aren’t that useful.
Privacy Vs. Efficacy
There are two kinds of coronavirus tracking app. One kind tracks your location and uses your phone’s Bluetooth capabilities to determine your proximity to other phone users. This data is sent to a central repository. From there, comparisons are made, and users can be warned about potential infection. The privacy problems here are obvious. What government wouldn’t be tempted by such a trove of information? Hidden within that data are potential clandestine liaisons, crimes in progress, and more.
“The population must be able to have confidence that its data is treated as confidentially as that in doctors’ [offices] and hospitals,” Howard Oakley, a software developer and writer who has studied contact-tracing apps, told Lifewire via email. “If they don’t, then they assume that their government is up to something.”
The second kind of contact-tracing app values privacy. No location or other personal data leaves your phone. Instead, phones exchange anonymous blips—aka keys—of data between themselves whenever they come close. Phones generate new keys regularly, so it’s impossible to track anyone’s movement over time.
If a user becomes infected, they self-report this to the app, then have the option to upload their own list of keys for the last 14 days. This is added to a primary list and regularly broadcasted to all users. Your own phone checks to see if it has ever encountered one of the keys on this primary list, and if so, it notifies you.
This second method is the one used by Google and Apple for their joint Exposure Notifications System (ENS). It protects privacy while also letting a government quickly allow apps to access it. In theory, it’s a fantastic method. But in practice, it isn’t working.
There are two major problems with COVID-19 contact-tracing apps right now. One is that not enough people are using them. The other is that they’re locking away a ton of valuable data.
Germany, a Successful Failure
“Tackling the problem of anonymous contacts is very important in modern infection prevention.”
Germany’s Corona-Warn app has been a relative success. As of June 28th, the app had been downloaded 16.4 million times, with a roughly equal split between iPhone and Android. That sounds good, but the population of Germany is 83 million, so only 20% of the population is using it.
Part of this is technical. The iPhone version only works on the iPhone 6s and newer, for example, and the iPhone app was only available to people with German App Store accounts at launch, so none of the foreigners living in Germany could use it.
“Tackling the problem of anonymous contacts is very important in modern infection prevention,” says Oakley. “But if adoption is poor, the whole thing just falls flat.”
The result is that only 792 users have reported testing positive for the virus. Or rather, 792 verification numbers have been issued. When a person tests positive for the virus, they can get a “TeleTAN,” a code that confirms they actually got a positive result. This prevents users from spoofing the app with false results.
According to a report by the BBC, there is no way to tell whether these TeleTAN’s were actually entered into the app. There is also no way to tell if anyone acted on any warning they received, or if any false positives or negatives were generated.
Usually, an app’s developers would use this kind of information to check whether the app was working properly, and to tweak the algorithms to improve it. But with the Apple/Google method, it’s not possible.
The Non-Private Option
Is it possible to build a tracing app that both respects privacy and also allows central processing of important data? Howard Oakley again:
“The crazy thing is that, if governments really wanted central servers to work, it wouldn’t be hard. All you need is a governance and privacy board which is completely transparent and led by someone from an organization like the EFF, with a trusted senior doctor for their clinical insight. There are plenty of servers containing medical data which are far more sensitive.
The fact that governments charge on ignoring this and the failure of public confidence can easily be interpreted as indicating that they do want access to the data, which is deeply sinister in the circumstances.”
Earlier in the pandemic, Germany and Italy shared anonymized cellphone tower location data with health authorities to help track outbreaks. In Israel, the government used its Shin Bet domestic spy agency to locate people who might have been infected, and sent them an SMS to warn them.
Centralized tracking doesn’t have to compromise privacy. In the Isle of Wight, a British island off the south coast of England, The UK tested its Test, Trace, Isolate program. Adoption was around 40% overall, or 70% of smartphone users, and location sharing was limited to partial zip codes. The scheme has been successful.
“We observed significant decreases in incidence and R on the Isle of Wight immediately after the launch,” writes the study’s lead researcher, Michelle Kendall.
One side effect of the tracing app was that people improved their distancing, and were more aware of potential dangers.
Will it Work?
Can cellphones be used as a weapon against the COVID-19 pandemic? Yes, but it will take some work. The technical part is straightforward. The problem will be convincing a suspicious public that their governments are acting in good faith. In the US and UK, where the government response has so far been verging on negligent, this will probably be impossible. In the US, individual states are cobbling together their own app strategies, when it’s obvious to everyone that the Federal government should be taking charge.
In the end, it’s the governments that have best handled the crisis so far that are most likely to be trusted. Even without high adoption rates, then, contact tracing apps could be a valuable part of a responsible government’s strategy to control the pandemic. But on their own, and in their current form, they’re not going to fix anything.