Here come COVID-19 tracing apps -- and privacy tradeoffs

As governments around the world consider how to monitor new coronavirus outbreaks while reopening their societies, many are starting to bet on smartphone apps to help stanch the pandemic.

But their decisions on which technologies to use and how far those allow authorities to peer into private lives are highlighting some uncomfortable tradeoffs between protecting privacy and public health.

There are conflicting interests, said Tina White, a Stanford University researcher who first introduced a privacy-protecting approach in February.

Governments and public health (agencies) want to be able to track people to minimize the spread of COVID-19, but people are less likely to download a voluntary app if it is intrusive, she said.

 

Containing infectious disease outbreaks boils down to a simple mantra: test, trace and isolate. Today, that means identifying people who test positive for the novel coronavirus, tracking down others they might have infected, and preventing further spread by quarantining everyone who might be contagious.

That second step requires an army of healthcare workers to question coronavirus carriers about recent contacts so those people can be tested and potentially isolated.

Smartphone apps potentially speed up that process by collecting data about your movements and alerting you if you've spent time near a confirmed coronavirus carrier.

The more detailed that data, the more it could help regional governments identify and contain emerging disease hot spots. But data collected by governments can also be abused by governments or their private-sector partners.

Some countries and local governments are issuing voluntary government-designed apps that make information directly available to public health authorities.

In Australia, more than 3 million people have downloaded such an app touted by the prime minister, who compared it to the ease of applying sunscreen and said more app downloads would bring about a more liberated economy and society."

Utah is the first U.S. state to embrace a similar approach, one developed by a social media startup previously focused on helping young people hang out with nearby friends.

Both these apps record a digital trail of the strangers an individual encountered. Utah's goes even further, using a device's location to help track which restaurants or stores a user has visited.

The app is a tool to help jog the memory of the person who is positive so we can more readily identify where they've been, who they've been in contact with, if they choose to allow that, said Angela Dunn, Utah's state epidemiologist.

A competing approach under development by tech giants Apple and Google limits the information collected and anonymizes what it pulls in so that such personalized tracking isn't possible.

Apple and Google have pushed for public health agencies to adopt their privacy-oriented model, offering an app-building interface they say will work smoothly on billions of phones when the software rolls out sometime in May.

Germany and a growing number of European countries have aligned with that approach, while others, such as France and the UK, have argued for more government access to app data.

Most coronavirus-tracking apps rely on Bluetooth, a decades-old short-range wireless technology, to locate other phones nearby that are running the same app.

The Bluetooth apps keep a temporary record of the signals they encounter. If one person using the app is later confirmed to have COVID-19, public health authorities can use that stored data to identify and notify other people who may have been exposed.

Apple and Google say that apps built to their specifications will work across most iPhones and Android devices, eliminating compatibility problems. They have also forbidden governments to make their apps compulsory and are building in privacy protections to keep stored data out of government and corporate hands and ease concerns about surveillance.

For instance, these apps rely on encrypted peer to peer signals sent from phone to phone; these aren't stored in government databases and are designed to conceal individual identities and connections. Public-health officials aren't even in the loop; these apps would notify users directly of their possible exposure and urge them to get tested.

In the U.S., developers are pitching their apps directly to state and local governments. In Utah, the social media company Twenty sold state officials on an approach combining Bluetooth with satellite-based GPS signals. That would let trained health workers help connect the dots and discover previously hidden clusters of infection.

It's unlikely that automated alerts are going to be enough, said Jared Allgood, Twenty's chief strategy officer and a Utah resident, citing estimates that the peer-to-peer models would need most people participating to be effective.

In Singapore, for instance, a large migrant worker population lives in cramped dorms, makes about $15 a day, and powers the city's previously booming construction industry but smartphone usage in this group is low. When the Southeast Asian city-state launched its tracing app in March, total confirmed COVID-19 cases were well under 1,000.

Then in early April, a rash of new infections in worker dormitories pushed that number to more than 18,000, triggering new lockdown policies.