A Swiss soldier shows on a mobile device the contact tracking application created by the Swiss Federal Institute of Technology Lausanne (EPFL), using Bluetooth and a design called Decentralised Privacy-Preserving Proximity Tracing (DP-3T) at the Chamblon barracks, Switzerland, April 30, 2020.
Mobile phone apps may hold promise in the fight against a pandemic.
Using apps to accelerate contact tracing, in which authorities identify and test people who may have come into contact with a virus carrier, has emerged as a tool to stem new outbreaks of the novel coronavirus. It could help authorities test more potentially infected individuals than they would normally be able to based on patients recalling recent interactions from their own memories.
Authorities in more than 20 countries have sought access to contact-tracing technology from tech giants Apple and Alphabet Inc.’s Google, which released the initial version of its system last week. Apple and Google have barred authorities using their technology from collecting GPS location data or requiring users to enter personal data.
But some governments contend their app-based efforts would be more effective if they could track users’ locations to identify hot spots for virus transmission and notify them about possible exposure through calls or texts, rather than generic push notifications.
Tate Ryan-Mosely is part of a team at MIT Technology Review that compares apps from more than two dozen countries around the globe. Ryan-Mosely spoke with The World’s Marco Werman about how different apps balance data and privacy priorities.
Marco Werman: Give us a quick reminder, if you would, of the technology used. How can a smartphone actually help with contact tracing?
Tate Ryan-Mosely: Yeah, sure. So we’re seeing mobile apps using two main different types of technologies, but there are actually a handful of other less commonly used ones. The two most prevalent ones are GPS — so your location, on your phone — and then Bluetooth signals. So basically, if you have a phone with this Bluetooth app-enabled and somebody in the same room as you has a phone with Bluetooth enabled, those Bluetooth signals would actually speak to each other. And then each app logs the encounter with that other Bluetooth signal.
Related: South Korea’s coronavirus contact tracing puts LGBTQ community under surveillance
And is it generally more reliable than calling people up and essentially interviewing them and relying on their memory of who they’ve been in contact with?
We don’t know yet, is kind of the short answer there. I would say, the methods are very, very different. And it’s not necessarily clear whether digital contact tracing is actually meant to replace manual contact tracing. You know, we’re beginning to see that in some of these countries that are doing this well, they really do work hand in hand. So the digital contact tracing is enhancing what the manual contact tracers are doing. But there’s just no evidence to say that it’s more effective or less effective.
So your database compares the apps and you’re asking specific questions about the data they collect and who the data is shared with, how the data might be used or misused in the future. Can you give us an example of one country’s app that your team gives high marks to and why?
Yeah. So I would say Singapore’s app. It’s called TraceTogether. It was a very early app, so I think it was released around March 20th, which is, you know, quite a bit ahead of what we’re seeing now. And it was the first Bluetooth system that came online that was really privacy-preserving. And so basically all of the data is stored on individual phones. And the Ministry of Health only collects and gathers that data at the point that someone “A” is confirmed to have COVID-19 and then “B” consents to the scraping of that data. The data is anonymized. It’s encrypted. It doesn’t reveal the identity of that person or the other person that you’re meant to have come in contact with that might have been exposed. And it’s deleted automatically after 21 days. So that was kind of in some ways the gold standard. It’s a little bit different because it’s still considered in some ways a centralized data structure. So, because the Ministry of Health can grab that data, there are still some people who say that’s not ideal from a privacy perspective. But the way that we’re evaluating the app in our database, that was the first and kind of the first gold standard we saw come online.
Related: What the US can learn from West Africa to stop the coronavirus
So at least Singapore is kind of addressing the privacy issue with TraceTogether, their program. You bring up privacy and there have got to be a lot of tradeoffs between people’s privacy and being effective at tracking possible infections. What is an example of an app that does not meet your team standards?
I would say the most obvious one that’s getting a lot of press right now is Qatar. So Qatar’s app is — first of all, it’s mandatory. So they kind of had a go-live date, which was, I believe, on Thursday of last week, which was, you know, everybody needs to download this app or you will be fined or pressed with even criminal charges. And so that mandatory-ness, first of all, is kind of our very first privacy principle. They also collect unnecessary data for contact tracing. For example, the app actually requests permission to use the camera and access to the photos on the phone, which they say is “a system requirement,” which is just completely unnecessary when it comes to effective digital contact tracing.
That’s interesting. So EU countries have privacy built into their laws. How do European apps manage to meet privacy standards and, right now, still be rigorous about tracing the spread of disease?
Basically, what we’ve seen with the EU is a series of conversations about how privacy-preserving the apps need to be and how rigorous the privacy-preserving nature of these apps should be. And we’re seeing them get more and more rigorous. The UK started by saying: We will build our own app; it will be specific to the laws in our country; it will be held to the privacy-preserving laws that we have within our jurisdiction. And they went about trying to build it. And then when they realized that the Google and Apple system requirements on Android and Apple phones — they ran into system limitations in terms of their ability to build the apps the way that they would need to for them to be effective.
So what’s kind of happened is all of these countries that wanted to go out on their own are being kind of forced into the standard set forth by Google and Apple. And that’s been really, really fascinating to watch. The Google and Apple standards are understood to be more privacy- and data-preserving. But just the kind of soft power that they’re showing alone has been really, really interesting.
Related: Netherlands nursing home builds ‘glass cabin’ for safe visits
So what chance you see of the US putting out a national contact tracing app. Is that even being talked about or is it in development?
I think, in the US, we probably won’t see a national contact tracing app. I think what we will see is individual states bringing government-sponsored apps on board. My guess is that most of those apps will leverage this Google and Apple infrastructure.
This interview has been edited and condensed for clarity. Reuters contributed reporting.