With the coronavirus pandemic perhaps showing signs of letting up in some countries throughout Europe and beyond, you might have heard a good deal of conversation around contact tracing. Particularly, in the context of reducing lockdown and stay at home measures as countries look toward life after COVID-19. But what is contact tracing? How does it work? What's that thing Apple and Google are doing? Should I be concerned about my privacy? For answers to all these questions and more, check out our deep dive into the world of contact tracing.
Tracing contact
In essence, contact tracing does exactly what it says on the tin, it traces contact. It's used the world over to chart and manage the spread of infectious diseases (including sexually transmitted ones) by establishing who an infected person has had contact with. This, in turn, allows people who've potentially been exposed to a disease or virus to be notified, adjusting their behavior accordingly so as to reduce and slow down the spread of disease. Right now, of course, that disease is COVID-19.
The big headlines in recent weeks, and the reason for our interest in contact tracing, is that governments and tech firms the world over are trying to automate the process using technology. That's because traditional contact tracing involves public health workers manually interviewing a patient and contacting anyone they might have been in contact with. Because COVID-19 is so prevalent and widespread, that simply isn't practical in this case. But contact tracing is still important, the director-general of WHO stating that "tracing every contact must be the backbone of the response in every country." As a recent paper from Johns Hopkins noted:
Several countries have demonstrated that an approach of aggressive case-finding and contact tracing can be an effective measure in helping to control the spread of COVID-19.
Automating the process
Contact tracing by way of a smartphone app is simply an extension of this established medical practice, whereby interviews and phone calls are replaced with apps, Bluetooth (or GPS), and notifications. Whilst governments are all working on their own apps, the principle for each of them remains the same. Apple and Google have teamed up to develop their own contact tracing technology, launching APIs, and operating system-level technology. First, Apple and Google will release APIs on April 28, enabling interoperability between Android and iOS devices using apps from public health authorities. Apple and Google are also looking to build the functionality into its underlying iOS and Android platforms, a solution they say will be "more robust" and allow more people to participate.
So how does it work?
So, you download a contact tracing app. Imagine you go out to buy groceries, or take a walk for some exercise. On that journey, you encounter (come close to) 10 people, each of whom also have a contact tracing app installed on their smartphone. A few days later, you or one of those 10 people is diagnosed with COVID-19. You (or whoever has been infected) notifies the relevant public health authority. With the consent of the infected party, the 10 other people who that person has been in contact are notified that they have come into "contact" with the virus, possibly with recommendations to self-isolate, or to take some other relevant measures.
What are the benefits of this?
Until there is a vaccine or treatment for COVID-19, it is vitally important that governments and health authorities can track and isolate cases, as well as notifying people who may also have been infected. This will help to prevent the cases and infections from spiking a second time as lockdown restrictions are slowly lifted. As such, contact tracing apps are not very effective in cases where infections are rampant and the virus is in full swing. They are also only likely to be introduced towards the back end of "the curve" when public health authorities have the capacity to deal with each person that is infected.
Dual approach
As the Financial Times notes, in the UK, the NHS is hoping to launch an app to provide contact tracing, but it's also significantly increased the number of human contact tracers on its books, that's because not everyone will download the app. (They use the example of Singapore, where a contact tracing app has only been downloaded by 17% of the population)
Just yesterday, NHSX, the digital branch of the UK's NHS, published a blog post detailing its plans to launch a contact-tracing app stating:
The app automates the laborious process of contact tracing - with the goal of reducing transmission of the virus by alerting people who may have been exposed so they can take action to protect themselves, the people they care about, and the NHS. We believe this could be important in helping the country return to normality and beating coronavirus.
This approach has also proven successful in countries like New Zealand and Iceland.
So am I being "traced"?
Well, not really. The moniker "contact tracing" has proven itself to be a little concerning for some people. And in some revisions to its contact tracing initiative Apple and Google yesterday revealed that they were now referring to it instead as an "exposure notification" system. What's being traced, is contact between humans, not your location or movement, at least where a system uses Bluetooth 'handshakes' rather than GPS.
Blueooth VS GPS
There are two main ways to monitor contact tracing. In Asia, where countries carry the lessons of the 2003 SARS outbreak, several metrics including GPS location data is used to monitor contact. As Johns Hopkins notes:
One example of extensive contact tracing comes from South Korea (population 51.47 million), a country that was able to develop contact tracing plans in response to the spread of a different coronavirus, Middle East respiratory syndrome (MERS) in 2015. This experience also prompted the revision of several laws to help improve outbreak response. Contact tracing in South Korea incorporates patient interviews as well as the use of medical records, cell phone GPS records, credit card transaction records, and closed-circuit television.
In countries such as the U.S. and in Europe, this level of surveillance would probably be considered a gross invasion of privacy (not that this already happens, we'll get to that). That's why most European countries, and Apple and Google's contact tracing technology is based on Bluetooth handshakes. Apple and Google's technology uses "anonymous identifier beacons" which change frequently, these are sent between devices via Bluetooth. This short-range, local technology means that whilst your interactions with other devices are being tracked (but held locally), your movement is not being monitored by GPS.
The issue of GPS has been raised by some concerned onlookers, such as Senator Josh Hawley who raised concerns at the prospect of this data being combined with GPS data and used for other purposes like advertising.
In contrast, however, a recent report from Reuters noted that states pioneering apps, North and South Dakota, as well as Utah, believe that using "GPS in tandem with Bluetooth is key to making the system viable."
It seems that GPS may become a sticking point of contact tracing discussions in the coming weeks. And perhaps the most important thing to understand about contact tracing is that this is uncharted territory and that countries and states are divided on how best to implement it whilst protecting its citizens. This is very much a work-in-progress.
Europe at loggerheads
A prime example of this is in Europe, where EU heavyweights France and Germany have both separately clashed with Apple over its own contact tracing apps. In Europe there are two distinct camps, revolving around centralized and decentralized tracing. The former involves contact tracing that includes a centralized database of users, the latter does not. Apple and Google have staunchly opposed centralized databases. Two tenets of their technology are that it doesn't collect personally identifiable information or location data, and the list of people you've been in contact with never leaves your phone.
Both France and Germany support a platform developed by the Pan-European-Privacy Preserving Proximity Tracing group or PEPP-PT. France has expressed its own anger over claims Apple is blocking its contact tracing app, and EU rhetoric aimed at Apple and Google has been fairly hostile. Similarly the NHS has clashed with the EU for the same reason, however it is unclear at this stage which approach the UK has decided to adopt.
Technically useless
Apple and Google have told countries that the privacy principles behind its technology "are not going to change." That means that if countries release apps not supported by Google or Apple, they'll be essentially useless. They will only work when the app is open on your screen, not in the background, as is practically essential for them to be effective.
Should I be concerned about my privacy?
No one can force you to download a contact tracing app, so if you're worried about privacy, you can abstain from partaking. The problem is that for contact tracing to be effective, a lot of people need to take part, some estimates have suggested as much as 80% of the population. So should you be concerned about privacy? We caught up with cybersecurity expert Rich Mogull regarding Apple and Google's recent initiative, and this is what the said:
Apple and Google appear to be working hard to maintain privacy but there is always some level of risk. The difference between these apps and normal cell phone tracking is the precision- they are designed more to track your direct contact with other individuals. However, I'm still more concerned with our telecom providers tracking all movement and basically selling it for marketing. The key with these apps is use and abuse, and that will be more on the government than the operating system providers.
Rich also said that the system is "pretty well designed" to limit abuse and that Apple and Google's system at least has "a lot of strong privacy protections." His most telling statement, however, is about telecom providers tracking your movement.
As a recent TNW piece stated:
Coronavirus didn't kill our privacy — it just exposed the corpse
The truth is that for those of us connected to the world through cell phones, not much of what we do is private anymore. TNW notes how "in most countries, only minor amendments of the laws sufficed to introduce Covid-19 surveillance", because of how anemic most privacy protections are globally. To Rich's point, if you decide not to download a contact tracing app because you're worried about your privacy, then you should stop using a smartphone altogether. If anything, Apple and Google's commitment to anonymized data, not tracking your location, and ensuring that the technology is only used for the COVID-19 pandemic (and not beyond it) makes its contact tracing technology a whole lot more private than most internet services.
Whilst there are plenty of issues and concerns to iron out, split opinions about the use of data and concerns about these apps and surveillance, it seems inevitable that contact tracing apps will become a vital part of our emergence from the COVID-19 pandemic in both Europe and the U.S. Contact tracing doesn't seem like something we should be afraid of, as mentioned, the offering from Google and Apple seems far less intrusive than plenty of other services and apps. Contact tracing needs to be done correctly, but if it is, there certainly isn't a reason to be more concerned about contact tracing than any other kind of mobile service you've already engaged with.
Got questions? Let us know in the comments!
