Coronavirus contact tracing apps struggle to make an impact

In the toolkit of strategies to stop the spread of COVID-19, many countries are reaching for smartphone apps¹. From Iceland to Israel, more than 30 contact-tracing systems are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives². Such apps can complement a country’s overall COVID-19 control strategies — including testing, contact tracing, isolation and social distancing — but they cannot serve as a replacement for them, or the thousands of contact-tracing teams they require. Like any health-care intervention, coronavirus apps need to conform to the highest standards of safety and efficacy. And yet, despite the pandemic’s global nature, countries are developing apps independently, and there are no global standards — which is rightly raising concerns².

COVID-19 apps have, to some extent, been inspired by the experiences of South Korea and Singapore — where electronic surveillance methods have helped to control infections. South Korea, in particular, is regarded as a model because it avoided severe lockdowns¹. The foundation for South Korea’s COVID-19 response is a comprehensive testing strategy, backed by a nationwide network of highly-trained contact-tracers. The strategy includes the use of phone alerts. When a person tests positive for COVID-19, a text alert is sent to everyone living nearby. This alert typically includes a link to a detailed log of the infected person’s movements — in some cases to the nearest minute. These movements are reconstructed from public data, such as closed-circuit television cameras.

It must be noted that the South Korean strategy is based on a degree of surveillance that people in many other countries would find hard to accept¹. The South Korean government is also permitted to access confidential records, such as credit-card transactions. The data are then stored centrally by government agencies. At the same time, people’s movements are anonymized and published online. As of July 16, some 6 months after the outbreak spread to South Korea, only a handful of new cases are being reported daily and only 291 deaths have been recorded in total³.

India is one of the few democracies that has made downloading its contact tracing app mandatory. Employees must use the app in order to get into offices or to travel. If they do not, they could face criminal prosecution. The Aarogya Setu app, meaning “healthcare bridge” in Hindi, has racked up more than 100 million downloads since launching on April 2 — a substantial number but only a small fraction of India’s population of 1.3 billion⁴. Using a phone’s Bluetooth and location data, Aarogya Setu lets users know if they have been near a person with Covid-19 by scanning a database of known cases of infection. While names and numbers of individuals won’t be made public, the app does collect this information, as well as gender, travel history, and if someone is a smoker. As Aarogya Setu stores location data and requires constant access to the phone’s Bluetooth, experts say that the app is invasive from a security and privacy viewpoint. Additionally, Aarogya Setu is not open source, which means that it cannot be audited for security flaws by independent coders and researchers⁵.

Apps with more limited scope have had some success. Police in Kerala, the first Indian state to report a coronavirus case, used the Covid Safety App to help enforce the quarantine of about 20,000 people in Kasargod, one of the worst-affected districts. Users voluntarily downloaded the app so police could track their location. The app had an SOS button that people could press if they needed essential goods or were in an emergency. As of April 15, Kerala had reported only four coronavirus deaths⁴.

While there have been successful attempts at mobile tracing technology in some countries, these efforts so far have fallen flat in the U.S. For example, the state of New Jersey is neither pursuing nor promoting exposure notification or digital alerting technology, according to Phil Murphy, the governor of the state⁶. New Jersey isn’t alone. Most states are giving the cold shoulder to smartphone apps. A survey of state health officials from Business Insider conducted the week of June 12th showed that only three states — Alabama, North Dakota and South Carolina — said they were going to use the software provided by Apple and Google. The number hasn’t grown since the same three states reported interest in May, and none have launched an app with the Google-Apple software⁶.

One serious concern with contact tracing apps is accuracy. Apps that link to official validated tests are obviously more likely to give accurate results. An alert based on self-diagnosis that turns out to be wrong — a false positive — could, of course, be corrected. But if incorrect information has been sent to a large group of contacts, it will have caused unnecessary alarm, and could have wrongly sent people into isolation for weeks.

An equally important concern is privacy. Researchers have shown that it is possible to re-identify individuals even when anonymized and aggregated data sets are incomplete. And then there’s the communications technology itself. Most apps share information using Bluetooth, a radio-frequency technology that allows devices to exchange information at close range. This is convenient, since most smartphones have it. But it has a history of security breaches that have been well-reported and studied. Smartphone users are usually advised to turn off Bluetooth when it is not needed, and especially when in close proximity to other phone users. But to work, COVID-19 apps need users to keep Bluetooth running — particularly when they are in public places¹.

Researchers and policymakers have worked hard over many decades to ensure that medicines, vaccines and health-care products conform to agreed standards of safety and efficacy. These often need to be global standards. COVID-19 smartphone apps are a health-care intervention, too, and will potentially affect hundreds of millions of lives. But they are being rolled out without pilot studies or risk assessments being published. Speed is, of course, of the essence — but so is due diligence and due process. This includes public dialogue; more involvement from researchers, including those who study ethics, law and public engagement; and a cast-iron commitment from governments that the information being harvested is secure and will only ever be used for the reasons it is being requested¹. 

References

1. Show evidence that apps for COVID-19 contact-tracing are secure and effective. (2020). Nature, 580(7805), 563–563. https://doi.org/10.1038/d41586-020-01264-1
2. Burgess, M. (2020, May 1). Coronavirus contact tracing apps were meant to save us. They won’t. WIRED. https://www.wired.co.uk/article/contact-tracing-apps-coronavirus.
3. COVID-19 CORONAVIRUS PANDEMIC. (n.d.). Retrieved March 22, 2020, from https://www.worldometers.info/coronavirus/
4. Findlay, S. (2020, May 18). Coronavirus contact-tracing apps struggle to make an impact. Financial Times. https://www.ft.com/content/21e438a6-32f2-43b9-b843-61b819a427aa.
5. Clarance, A. (2020, May 15). Aarogya Setu: Why India’s Covid-19 contact tracing app is controversial. BBC News. https://www.bbc.com/news/world-asia-india-52659520.
6. Ingram, D. (2020, June 12). Coronavirus contact tracing apps were tech’s chance to step up. They haven’t.NBCNews.com. https://www.nbcnews.com/tech/tech-news/coronavirus-contact-tracing-apps-were-tech-s-chance-step-they-n1230211.