In brief
Phone-based tracing can support human contact tracers, but cannot replace them or adequate testing. In May 2020, Apple and Google favoured decentralised matching to protect privacy, while some governments pursued centralised systems to collect more data and improve their understanding of transmission.
Two technology giants, Apple (Apple) and Google, made a rare joint announcement last month that they would develop mobile apps to trace contacts of people with COVID-19. The aim was to detect and stop transmission early, lift social restrictions and restore economic activity as soon as possible. Although many countries supported their approach, an even more unusual response came from countries that felt the companies were protecting privacy too strictly at the expense of collecting important data for fighting the pandemic. How can mobile phones help track the spread of the virus? Should privacy remain entirely non-negotiable in the fight against the pandemic?
Apple founder Jobs（Steve Jobs) threatened to wage “thermonuclear war” when he discovered that Google was developing a smartphone platform to compete with iOS. Now, amid the global COVID-19 pandemic, the two technology giants have set aside more than a decade of “personal animosity”. In early April, they announced that they were jointly developing a system to track the spread of the coronavirus.
The companies said in a joint statement: “Everyone at Apple and Google believes that this is a critical moment when we most need to work together, so that we can address the world’s most urgent problems.”
Tracing every person and place visited by someone diagnosed with an infectious disease is an important means of controlling an outbreak. According to guidance from the World Health Organization (WHO), infected people should draw up a list of contacts, and efforts should be made to “identify every contact listed and inform them of their exposure”. At a press conference late last month, New York Governor Andrew Cuomo estimated that the state would need at least 30 tracers per 100,000 people. It would therefore hire up to 17,000 contact tracers, creating what he described as an “army of tracers”.
Supporting the “army of tracers”
However, researchers at the University of Oxford argued that manual contact tracing was “too slow” and difficult to scale sufficiently during a pandemic: “The virus spreads too quickly to be controlled through manual contact tracing, but it could be controlled if the process were faster, more effective and conducted on a larger scale… A delay of just half a day in contact tracing after symptoms appear can make an enormous difference, determining whether an epidemic is brought under control or resurges.” Countries around the world are looking to mobile tracing apps to identify people who have been in contact with patients more quickly and on a larger scale. As John Brownstein, an epidemiologist and chief innovation officer at Boston Children’s Hospital in the United States, noted: “Generally speaking, traditional contact tracing has involved a great deal of manual work. We need to expand our public health teams, and this new technology can relieve much of that burden.”
Apple and Google’s proposed tracing method works as follows: phones running the same or compatible apps transmit and receive cryptographic “keys” over Bluetooth. When two phones remain within a certain distance for a certain period—for example, within two metres for 10 minutes—they exchange keys. Although Bluetooth cannot directly measure distance, signal strength can be used to estimate proximity: a stronger signal indicates closer contact. If someone is diagnosed with COVID-19 and agrees to report their condition through the app, their anonymous user code is uploaded to the system’s central database. Other users’ apps automatically check against the database at regular intervals to establish whether they have been in contact with an infected person. Users then receive notifications so they can self-isolate or get tested as soon as possible.
Technology giants have faced extensive criticism and penalties in recent years for failing to protect privacy adequately, so Apple and Google are being particularly cautious this time. Under their approach, personal contact records remain on users’ phones, while the central database holds only the anonymous identities of those diagnosed with the disease. Apple and Google will first release an application programming interface (API) this month, enabling tracing apps developed by national public health agencies to work across Android and iOS devices. Over the following months, the companies will then integrate the tracing function directly into their respective mobile operating systems, allowing users to receive notifications without needing an app.
The companies say they do not intend to build tracing apps themselves or collect any data through them. For privacy reasons, they will not grant access to location data before developers request permission. They also promise that tracing apps will not operate indefinitely, and that support will end once the pandemic is under control. Google and Apple even changed their terminology: initially calling the applications “contact tracing” apps, they later renamed them “exposure notification” apps, shifting the emphasis from large-scale surveillance to alerts for individuals.
Apple and Google have also imposed restrictions on the use of their API to make tracing apps more efficient while offering stronger privacy protection. For example, only government health authorities may create apps; users must consent before using an app or sharing test results with public health authorities; and data may not be used for targeted advertising or law enforcement. Because matching takes place on each person’s phone rather than in a central system, Apple and Google’s approach is also known as decentralised tracing.
This tracing method has its own limitations. Jason Bay, product lead for Singapore’s TraceTogether contact tracing app, cautioned that automated tracing cannot fully replace manual tracing. Apps cannot automatically capture many crucial details, such as whether an encounter took place in a well-ventilated setting or involved singing with a group of people. Human tracers can also focus on people living in poverty or older people without smartphones—groups more affected by COVID-19. Nor can tracing alone combat the pandemic: without enough testing tools, it is ineffective. In Iceland, which has the world’s highest voluntary adoption rate for a tracing app at 38%, Gestur Pálmason, the inspector overseeing tracing, believes that rapid testing and isolation early on were the main reasons for the country’s success against the pandemic.
The effectiveness of Bluetooth tracing has also been questioned on technical grounds. Farzad Mostashari, former national coordinator for health information technology at the US Department of Health and Human Services, told technology publication The Verge that apps could produce many false-positive contact detections: “If I am in an open space, our Bluetooth signals might connect even if you are more than six feet away. They might also connect through apartment walls or between different floors of a building, triggering a close-contact alert.” Even placing a phone upright rather than flat in a pocket can significantly change the strength of the Bluetooth signal it receives.
Ross Anderson, professor of security engineering at the University of Cambridge in the UK, agreed and added: “The problem is that Bluetooth was not designed for radio ranging… It depends on how you hold the device, whether you are wearing gloves, whether it is raining, and so on. In other words, you will receive many false alerts.” Beyond being irritating, he warned that this could create a “boy who cried wolf” effect, causing some users gradually to ignore genuine alerts. App designers also face a difficult question: how close must two people be, and for how long, for an encounter to count as close contact capable of transmitting the disease? A definition that is too broad generates excessive false alerts, while one that is too restrictive may miss contacts.
The debate over decentralised and centralised tracing
Swarun Kumar, head of a new technology laboratory at Carnegie Mellon University in the United States, said Bluetooth’s accuracy problems could be addressed by collecting and analysing more data alongside it: “Phones have other sensors. For example, an ambient light sensor can tell you whether a phone is in a pocket or wallet, indicating that its signal may be obstructed. A compass and gyroscope can tell you the phone’s orientation.”
Some experts also argue that collecting phone location data is more useful than Bluetooth. Ramesh Raskar, an associate professor at the MIT Media Lab in the United States, said that “location and contextual information are very important for contact tracing”. With Bluetooth, “you only receive a notification, without knowing what happened. Did the encounter take place while you were wearing a mask in a grocery store, or at a social gathering or café?”
Location data assembled from the Global Positioning System (GPS), mobile networks and Wi-Fi signals can show where someone was and when. Location tracking may not tell you precisely how close you came to an infected person, but it can at least establish where you were and how many other people encountered that person at the same time. Raskar and researchers at the University of Washington are separately developing projects centred on location data, uploading only infected people’s anonymous movement histories to track the spread of the outbreak.
However, Apple and Google’s API restrictions prevent governments from using it to build their own centralised tracing apps or apps that collect geographical location data. The French government had intended to launch StopCovid, a mobile tracing app “tied” to the healthcare system, in June this year. France’s digital affairs minister, Cédric O, unsuccessfully asked the technology companies to relax their privacy safeguards. In a television interview early this month, he criticised Apple: “Apple could have helped us make it work better. A company whose financial position has never been stronger has failed to help governments respond to the crisis. We will remember that.”
A small number of countries and regions, including the UK, France, Norway, Singapore and the US state of North Dakota, have therefore chosen to develop their own centralised mobile tracing apps instead of adopting Apple and Google’s approach. The advantage is that health authorities can freely collect user data beyond Bluetooth information. For example, the UK National Health Service (NHS) app asks users to enter the first part of their postcode when they first open it. India’s app says that, alongside Bluetooth and location data, it collects names, telephone numbers, gender and even smoking status, but does not make the information public. More importantly, when a user reports a confirmed diagnosis, these contact records and personal data are uploaded together to the system’s central database, which centrally identifies and notifies contacts.
The chief executive of NHSX, the NHS’s digital division, Matthew Gould, explained that information collected about contact events—including when they occurred, signal strength and duration, together with the postcodes being collected—could help authorities understand the spread of COVID-19. For example, they hoped to use the data to identify the most dangerous types of contact, patterns in interactions that transmit the virus, or the time between someone encountering an infected person and reporting symptoms. Gould said postcodes might reveal contact-related transmission in a particular area, helping hospitals and the healthcare system prepare early for a new wave of infections.
University of Oxford epidemiologist and NHSX adviser Christophe Fraser added that collecting these data through a centralised system could further improve the app and make notifications to potential contacts more accurate: “One advantage is that, as scientific evidence accumulates, the system is easier to audit and corresponding adjustments can be made more quickly. The main aim is to notify people at the highest risk of infection, rather than those at lower risk. A centralised system may make that easier.”
The choice of model has consequently divided countries into two camps. The mainstream approach is Apple and Google’s decentralised tracing, which offers stronger privacy protection and has won support from countries including Italy, Switzerland, Ireland, Finland, Austria and Estonia. Countries in the other camp insist on centralised tracing. Norway’s tracing app Smittestopp, launched in the middle of last month, collects both Bluetooth and location data.
Some countries, however, have begun to reconsider or have already switched sides. As of the middle of last month, Germany still supported a centralised tracing standard called Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT), but switched to developing a decentralised app after Apple refused to cooperate. Australia and Colombia, which initially adopted centralised tracing, are also about to change course. The UK is testing a centralised tracing app developed by the NHS on the Isle of Wight in southern England, but has recently kept another option open by also hiring Swiss consultancy Zühlke Engineering to explore adopting Apple and Google’s approach. Gould told the UK Parliament that the decision not to use the two technology giants’ system was reversible: “If another approach can achieve our objectives more effectively, we will change… I want to assure you that we will not keep following a path simply because we have already started down it.”
Original article URL: https://bit.ly/2ATTdUL