Self-isolation, our only current defense against the coronavirus pandemic, is devastating the economy. Yet efforts to “reopen” the economy could serve another blow to our collective health. With a vaccine possibly more than a year away, policy experts are proposing various plans for how society might safely return to normal. Most often, they involve strategies that rely on: 1) massively ramped up testing; 2) large-scale contact tracing; and 3) more narrow social isolation, based on the results.
There are some promising elements in some of the proposals, and frequently the proposals for contact tracing revolve around new Bluetooth-enabled apps, which may be worth exploring. But it is crucial, first, that policymakers ensure tests are widely available, and second, that public health officials account for the limitations of the technology and incorporate safeguards to avoid mass surveillance.
Contact Tracing Requires Tests for the Virus
The central element of these proposals, epidemiological contact tracing, has been at the forefront of the recent debate. This is where big tech companies come in, and government officials have quickly turned to them for their troves of data and ability to analyze and apply the information. But as with any surveillance, if the program lacks efficacy, we cannot justify any intrusion on privacy.
Therefore, it is imperative that the first pillar of these plans — widespread and accessible coronavirus testing — precede large-scale contact tracing. Contact tracing is nearly worthless without the data of confirmed positive cases. In other words, without tests, there is nothing to trace.
Estimates vary, but generally experts suggest the United States likely would need millions of tests available per week to return to even semi-normal: Harvard’s Edmond J. Safra Center for Ethics, for example, argues for millions per day, while economist Paul Romer calls for over 20 million per day. Health experts suggest that this degree of testing capacity will not realistically be available in the near-term, by a longshot. In the first week of April, the U.S. averaged about 147,000 tests per day.
Combating Coronavirus Using Big Data?
If at some point down the road enough tests are available, then, policymakers must tailor data-based solutions to what public health experts deem is both necessary and effective in combating the virus. This approach will also help us safeguard privacy and avoid the complete erosion of civil liberties that has characterized the responses of some other countries. For example, governments in South Korea and China disregard civil liberties altogether by combining a variety of invasive surveillance tools. Although South Korea has been more transparent in its efforts, both countries have conducted comprehensive surveillance — including location data, facial recognition, security camera footage, and credit card records — along with traditional methods of establishing transmission chains through manual contact tracing.
As U.S. policymakers turn to big data, they must assess the effectiveness of each different type of location and proximity data under consideration. As experts have pointed out, cell site location data (CSLI), the records generated by phones connecting to cell towers, is not precise enough to establish whether two people have come within a six-foot-distance of each other; GPS is more precise, but only works when one is outside; and Wi-Fi network data is not nearly comprehensive or granular enough. Thus, none of these types of data should be collected for contact tracing. However, this data may be useful to health officials in the aggregate, especially for purposes of mapping the spread of coronavirus and allocating resources accordingly.
Bluetooth for Contact Tracing
Many emerging contact-tracing proposals are being designed to employ Bluetooth technology, following the reported success (at least temporary success) of the “track and trace” app in Singapore. Apple and Google recently announced a new plan to provide interoperability, which, crucially, would allow these Bluetooth apps to interface between both the iOS and the Android operating systems.
Many questions remain about how the apps would function, as developers are creating them now; likewise, significant questions remain as to what information would be shared with the government and what safeguards would apply. But generally, the concept is: when individuals are within a close enough proximity, their smartphones would exchange Bluetooth signals, and if an individual later tests positive for coronavirus, public health authorities could provide the ability for the app to alert everyone who had exchanged signals with the coronavirus-positive individual over the previous 14 days. These alerts would anonymously notify people if they had been in contact with a coronavirus-positive individual, without providing information regarding the positive individual’s identity.
Limitations of Bluetooth Contact-Tracing Apps
The effectiveness of Bluetooth technology for contact tracing remains unconfirmed, as Bluetooth sometimes shows connections through walls and when individuals are more than six feet apart, leading to false positives. But Bluetooth data is far more granular than CSLI data, and the apps, done right, could offer much more privacy protection than having the government collect individuals’ location data from providers.
The most significant hurdle in using Bluetooth for contact tracing is that epidemiologists have said at least 60 percent of the country would need to participate in digital contact tracing for it to make an impact. This means over 198 million people would need to have smartphones, download an app, and carry their phones at all times, with Bluetooth enabled.
This raises serious issues related to the digital divide, and leaves out those who need protection most. While 81 percent of Americans now own smartphones, the population without smartphones is largely made up of lower-income people and seniors, the same populations that are at highest risk and hit hardest by coronavirus. Similarly, digital literacy is low among these populations. And, troubling new data shows that COVID-19 is disproportionately infecting and killing minorities, exacerbating the racial health disparities already present in our system.
It is commendable that use of the Bluetooth-enabled app systems would be voluntary, since that would protect privacy more effectively. But implementation would require a level of trust in government that seems extremely unlikely given the current political atmosphere. Misinformation and distrust, especially rooted in – and contributing to — political divisions, have already been at play during the spread of coronavirus. If many different state- or county-blessed apps are floating around in a patchwork-type approach, providing varying wording of notifications and advisories based on local public health policies, this could compound Americans’ confusion.
Unlike China, which required all citizens to download an app that then assigned them color codes indicating their permission to move about based on their likelihood of having the virus, it is constitutionally improbable – fortunately — that the U.S. government could require citizens to install and use an app. Further, many Americans are deeply skeptical of government surveillance, “big tech,” or both. Lower-income individuals and racial minorities are already more heavily surveilled and therefore would probably be even more doubtful of government efforts. Are these skeptical Americans likely to voluntarily download and install an app that appears to be designed for purposes of tracking?
Accordingly, public health officials must account for the likelihood that contact tracing via apps is likely to exclude vulnerable communities, and plan to supplement Bluetooth contact tracing with traditional epidemiological methods, such as manual contact tracing. In a positive recent development, health departments nationwide already are hiring to expand their teams of contact tracers.
Finally, it is essential that government officials and companies incorporate robust privacy safeguards to govern the new Bluetooth apps. The design of emerging Bluetooth apps appears to provide some baseline privacy protections. For example, Google and Apple have explained that under their plan, Bluetooth apps will only measure the relative proximity of two phones, not actual location or personally identifiable information, and therefore neither the app providers nor public health officials would be able to track particular individuals. However, we need strong guardrails to ensure these principles remain intact in practice, and that apps do not become, in effect, compulsory.
While it is not realistic that Congress will pass the comprehensive privacy legislation needed in the very near-term, Congress must pass, on an emergency basis, a narrower civil rights-protective privacy bill to ensure that the data generated by these contact-tracing apps is limited to public health authorities and barred from wider government use or commercial use. Additionally, these apps’ functionality must be time-limited and pinned to terminate whenever public health officials deem the pandemic has ended. Strong privacy protections go hand-in-hand with efficacy, as trust in these apps will likely lead to increased participation.
The Advantages of Bluetooth Contact Tracing
Despite these significant concerns, Bluetooth apps do offer an interesting opportunity for decentralized contact tracing, as opposed to surveillance plans through which the government would be able to amass new streams of personal data, akin to the Patriot Act post-9/11. Germany has been having an important debate over how to develop an effective and privacy-protective app for the European Union, with anonymous use of Bluetooth technology and without storing location data. The system being developed by the “Pan-European Privacy-Preserving Proximity Tracing” (PEPP-PT) team of more than 100 researchers would likely comply with the EU’s General Data Protection Regulation, but Germany nonetheless rejected its approach this week. Germany’s sharp turnaround followed an outcry from academics and organizations that PEPP-PT was too centralized (allowing the government to hold too much information) and that a decentralized contact tracing infrastructure would be more privacy protective, such as the alternative DP-3T proposal.
Any plans to implement these Bluetooth contact tracing apps, therefore, must still include robust privacy safeguards, including strict limits on who has access to the data, and how much personal information will be shared through notifications. Including too much personal or location data in notifications can be problematic, even if not shared with the government. As Dr. Anthony Fauci and others have pointed out, fear and stigma surrounding positive cases are reminiscent of the AIDS crisis; in South Korea, notifications provided enough information that they have turned some citizens into “imperious armchair detectives.”
Ultimately, Bluetooth apps may hold some promise for a future in which testing is widely available, though there remain many open questions and concerns about the effectiveness of the technology, the equity issues involved, the relationship and data-sharing between app providers and government officials, and the extent of additional privacy safeguards. Bluetooth contact tracing apps could be a tool for society to use in returning to some version of normal, but only if policymakers keep in mind the technology’s limitations, and build in robust safeguards now, during the development stage. Even done well, Bluetooth contact tracing apps alone will not be enough.