Contact-Tracing Apps: A Promise to Save Lives but at What Cost to Privacy?

Imagine taking a quick look at your phone to check for notifications, but instead of seeing the latest news headlines or a text from a friend you see the words: “ALERT: You have recently been exposed to someone who has tested positive for Covid-19.” This news would seem pretty jarring, but it’s part of what public health officials and some tech companies see as an effective solution to help prevent the spread of the coronavirus.

On April 10, Google and Apple announced they were collaborating on “exposure notification” technology, an application programming interface (API) that would be used in apps on Android and iOS devices to let people know if they’ve spent time near someone who’s been infected with the virus. The program is voluntary, so users would decide if they want to download the apps and turn on Bluetooth which is required for the apps to work. 

The two tech giants see this use of smartphone technology as the next big thing toward ending the pandemic. An initial phase of the rollout for developers has just been released and a more comprehensive rollout is set for the end of May.

“Contact tracing can help slow the spread of COVID-19 and can be done without compromising user privacy,” tweeted Apple’s CEO, Tim Cook. Google CEO Sundar Pichai echoed on Twitter that the project would have “strong controls and protects for user privacy.” 

But while contact-tracing technology is intriguing and well-intentioned, we and other privacy advocates are raising red flags about how users’ health data would be collected and used. 

Unanswered Questions

We’ve all gotten better at washing our hands, wearing masks and practicing social distancing, so it doesn’t seem like that much of a leap to start using an app designed to keep us even safer. The problem is, there’s a lot we don’t know about how these apps work, and they raise huge questions about whether users’ privacy actually will be respected. 

For example, it’s uncertain just what governmental entity or entities will be collecting the health data. Apple and Google say that the data would be “relayed” through servers run by “public health authorities,” and the data won’t be centralized so it’s more difficult for the government to monitor. But what’s not been made public is just what defines a “public health authority.” Would this be the CDC, local health departments or both? 

Another big unknown is what constitutes a COVID-9 diagnosis. Would it be based on results from COVID-19 tests - which have been in scarce supply and reported to be unreliable - or a patient’s symptoms? Neither Apple, Google nor the federal government are offering information that answers these questions. 

Will the Apps be Effective?

While other countries have begun using contact-tracing apps, the jury is still out as to how effective they’ve been in containing outbreaks of COVID-19. The apps proposed in the United States could not replace conventional, more sophisticated methods of contact tracing performed by public health agency employees. 

There’s also the issue of false positives and false negatives. Consider this scenario: Jane, who is not infected with coronavirus, has a chat with Bill, who is infected. A false positive could be obtained if they are talking on their phones and standing close to each other but with a wall between them. A false negative could result if Jane and Bill meet on the street but Jane doesn’t have her phone with her. 

Finally, while we certainly oppose any kind of mandatory program, relying on individuals to opt in is likely to be the biggest obstacle to it being effective. A Washington Post-University of Maryland poll found that nearly 3 in 5 Americans say they’re unable or unwilling to use the Google-Apple system. The concern about user resistance is one reason why Ross Anderson, a security engineering professor at the University of Cambridge, called the Apple-Google project a “non-starter.” 

Privacy Concerns

According to information made available by Google and Apple, there are a host of privacy protections built into the app: Users must give their consent to have their data be used; the API doesn’t collect “personally identifiable information” or user location data (only relative distance between users); unique contact-tracing “identifiers” change every 10 to 20 minutes to limit the risk of tracking, and users can disable the service at any time. The tech companies pledge that user data will only be used for “COVID-19 pandemic management” and that they will disable the service region-by region once outbreaks have been contained. 

But despite these assurances, we’re still talking about two tech behemoths combining their efforts to plant data-collection technology in millions of smartphones throughout the world. Heretofore, tech companies haven’t shown themselves to be stalwarts of privacy rights, to say the least. (Google is still smarting from the 2018 discovery that the company was tracking user location data even after users had disabled the location-history feature.) 

An even bigger fear among privacy advocates is the mishandling of data by the government. Critics note that while contact-tracing privacy is protected now, such as by HIPAA laws, those laws can be shelved during a time of national emergency. Ross Anderson, who worked for Britain’s National Health Service for 25 years, saysthe government was “repeatedly breaking privacy promises” during his tenure. 

Golden Frog CEO Sunday Yokubaitis shares a similar concern: “American citizens are increasingly being put into a situation where their privacy is being compromised under the guise of increased safety. The reality is that if information if being recorded, it can be subpoenaed by the government, used by private companies to further their business model or compromised by nefarious hackers.” 

A Better Way

While it’s tempting to see tech as a panacea to solving a public health crisis, there is another way to protect people’s health and their privacy: invest in the country’s medical infrastructure. Such a solution should include establishing a reliable, widespread testing program, increasing the manufacturing of face masks and ventilators and improving the training of medical personnel so they are well prepared for a pandemic. This type of investment should be adopted throughout the United States and the world, particularly in low-income communities and developing countries where viruses have more of an opportunity to rapidly spread. 

Investing in medical infrastructure helps us prepare for the next pandemic. The Google-Apple initiative, on the other hand, appears to be more of a last-minute, bandage-type response whose details relating to privacy haven’t yet been made public. We wholly support exploring new technologies to keep people healthy and saves lives but not at the unnecessary cost of violating users’ right to privacy. 

Helpful Links

• From Google: Privacy-safe contact tracing using Bluetooth Low Energy
• From Apple: Apple and Google partner on COVID-19 contact tracing technology
• From the CDC: Preliminary Criteria for the Evaluation of Digital Contact Tracing Tools for COVID-19
• From the EFF: The Challenge of Proximity Apps For COVID-19 Contact Tracing

You can view our privacy policy here.