After exaggerated claims about their importance, here’s the reality of contact tracing apps

Back in February, this blog was one of the first to warn that the obvious technological response to the coronavirus – the use of contact tracing apps – raised important privacy questions. Since then, both the apps and their implications have been the subject of debate around the world. That’s particularly the case for the UK’s approach, which was even more contested than others. There were two key areas that were problematic. One was the decision not to use the Apple-Google contact-tracing framework. The UK government was unwilling to agree to the strong data protection safeguards built in to that, since it wished to adopt a centralized approach – the other problem – something ruled out by Apple and Google. Things went badly, and the UK has bowed to the inevitable, and abandoned its own code in favor of the Apple-Google framework.

Australia has persisted with its own approach, which has also not been a great success: the app has failed to detect a case despite 6 million downloads. Australia is not the only one that has chosen to forgo help from Apple and Google. France, too, has taken this route. A recent vote in the French parliament cleared the way for it to be released to the public, and the government there claims things are off to a good start. However, it’s not yet known how well this system is working.

Some have argued that the US tech giants are dictating to countries how they can trace contacts, and that the centralised/decentralised debate is the wrong one:

In the manual version [of contact tracing] authorities do not reveal the identity of the infected person, be they a bus driver or a secret lover, nor do they explore the nature of the contact. The same approach ensuring privacy and data security can be achieved in the digital world. It does not have to be a binary choice. The data collected and used for a limited time by the national disease-control body in a democratic country does not have to be shared with law enforcement or sold to a third-party advertiser – as is true for all data gathered manually.

Of course, that assumes that national authorities can be trusted not to share highly personal data with the police or companies – not the easiest thing to accept these days.

Germany, by contrast, has been firmly in the Apple-Google camp for a while, after initially planning its own app. Now, it is well ahead of not just France, but Italy too, in rolling out its contact tracing app to millions of its citizens:

With 6.5 million users, the app has been taken up by about 7.8% of the German population in 24 hours. In contrast, the French StopCovid app was downloaded by 2% of the population since it was released at the start of the month. And just over 3.5% of Italians have taken up Immuni in the two weeks since the launch of the app.

Germany’s app is open source, as are those in many other countries, including Austria, Australia, Czech Republic, India, Italy, and Singapore. Denmark’s isn’t, and the Free Software Foundation Europe says it should be. That’s because it believes all software should be made freely available as a matter of principle. But in this case, privacy concerns also dictate that code dealing with sensitive personal data should be open to scrutiny.

One advantage of using the Apple-Google framework is demonstrated by the fact that Georgia, a nation of just 3 million people, was able to roll out its own contact tracing app quickly. It is already in use and has located people who were infected. Another potential benefit – not yet realized – is that contact tracing apps could be made compatible between different country systems, if they use the Apple-Google framework, which most do now. That’s particularly important for countries that are part of the EU, where freedom of movement is a key benefit. A requirement to download a different contact tracing app for each of the 27 member states is clearly impractical. Once the basic functionality has been sorted out, interoperability is likely to become a key issue for EU nations. That, in its turn, could create a de facto global standard, since non-EU countries may well choose to make their apps compatible with the EU version in order to enable their citizens to travel to the region without needing to install a new contact tracing app.

As well as writing apps that work, another major hurdle is getting people to use them – the more, the better. Germany has been very successful in this, others less so. In this regard, there’s a new problem on the horizon: infections have fallen to a low level in many countries, so the probability of coming into contact with an infected person is now very small. As a result, many people may see little benefit in installing the apps. That’s been the case in Norway, where privacy concerns coupled with minimal benefit have led to the data collected being deleted.

After the initial flurry of announcements earlier this year about contact tracing apps, and how they were vital tools to help stop the spread of the coronavirus, it’s clear that they will play only a minor role in countries with relatively low rates of infection. For places with large numbers of infections – or during second waves, for example – they could help people to self-isolate after being near infected individuals, without requiring direct intervention from medics who may be struggling to respond to the flood of cases. That means these apps are still worth having, especially given the relatively small cost of developing them – provided privacy issues are dealt with properly.

Featured image by SuperFantastic.