Contact-tracing apps for COVID-19: What you need to know (and do)
With communities nationwide moving to reopen non-essential businesses, scientists are embracing every possible tool for minimizing new coronavirus infections.
Among the most promising, yet also controversial: new smartphone applications that perform contact tracing, currently under construction by private companies and government agencies.
The idea of sharing information about our lives with strangers or the government has, understandably, raised significant fears about surveillance and privacy. (The editorial board at the journal Nature recently called for “a cast-iron commitment from governments that the information being harvested is secure and will only ever be used for the reasons it is being requested.”)
Knowing how smartphone-based contact tracing apps work, however, and how they can exchange information without revealing our identities, will enable us to embrace this potentially life-saving technology— and make sure we hold app providers accountable for our right to privacy.
Contact tracing is exactly what it sounds like: After someone is diagnosed with a contagious disease, a trained public health worker interviews that person, then takes steps to identify and reach out to all those who came in contact with the infected individual. This approach is time-consuming and error prone; identifying all possible contacts depends on records and memory, and individuals may be likely to overlook unmemorable encounters (such as standing in line at the grocery store, passing someone on the sidewalk, etc.).
Today’s smartphones however, can supplement manual contact tracing with applications that notify you if you’ve been near someone with a positive diagnosis.
GPS-based tracking: Most smartphones already have highly accurate location-tracking capabilities in the form of GPS, or Global Positioning System. Digital contact-tracing apps that rely on GPS (like those being used in places like Norway, Hong Kong and even South Dakota) can create second-by-second records of our precise location, to within 16 feet. Your GPS record is compared to those of infected individuals to see if you, quite literally, crossed paths during an infected individual’s contagious period. While these location-based apps may prove effective in identifying physical contacts, this detailed and specific physical location data is not something anyone ought to feel comfortable releasing to others.
Bluetooth systems: For this reason, various companies and government agencies around the world are racing to build new contact-tracing apps that rely instead on your smartphone’s Bluetooth radio, with several already available in Australia and the U.K., and more emerging every day.
Bluetooth technology, which is also readily available on most smartphones, has two distinct technical functions: advertising and listening. When Bluetooth is “advertising,” your phone emits short, digital “chirps” (called beacons) that can be received by other Bluetooth devices that are “listening” nearby. In everyday uses, these inaudible chirps allow personal devices to discover each other. Your earbuds and smartwatch get connected this way, and your phone becomes a hands-free device after it hears the chirps emitted by your car. Most often, your phone is a listener: It receives chirps from other devices and, after connecting, can receive information (like a podcast or a record of your workout).
To perform contact tracing with Bluetooth, however, your smartphone must act as both an advertiser and a listener, continuously switching between sending out and receiving beacons. Any chirp your phone receives indicates a detected contact and gets stored on the local device. Later, if a person receives a positive COVID-19 diagnosis, their device can publicly release the record of beacons sent during his or her contagious period; if the app on your phone finds that one of these released beacons matches one on your stored list, you’ll get an alert that you may have had contact with the infected individual.
This Bluetooth-enabled method of contact tracing is preferable to one based on GPS because it identifies contacts based solely on the exchange of a digital beacon rather than providing details of your precise location.
Although beacon-based apps are preferable to location-based ones, they are not without their own privacy concerns.
Hiding non-essential data: To ensure that privacy is preserved, all new contact-tracing apps should ensure that the list of beacons your device receives is kept private. Why? The beacons you receive may say as much or more about you as the beacons you emit. They reveal how often you were alone, or in the presence of others, how many people you were in contact with throughout the day, and the population density in the areas you visited. Admittedly, this information may be useful for epidemiologists studying the spread of the disease, but allowing someone to peer into your personal activities in this way opens up a Pandora’s box of threats to privacy.
For the purpose of contact tracing, there is no reason for your device to share any information about your received beacons with anyone else. When someone receives a positive COVID-19 diagnosis, they can release the beacon identifiers their app used during their contagious period, and your app can check and notify you if any overlap exists. (And if you’re a contact? Behave appropriately and self-isolate, self-monitor and follow other guidelines from the CDC).
Preserving privacy: A second essential feature that should be built into all privacy-sensitive contact-tracing apps is an algorithm that prevents the beacons you send from revealing your identity. When advertising, your phone needs to distinguish itself from other phones, so it includes a digital identifier in each beacon that allows any device receiving it to record the contact. If your device includes the same identifier in every beacon it sends, then anyone receiving your beacons can follow you through space and time and likely ultimately identify you. While many applications and devices already protect privacy by using algorithms to periodically change the identifier, Bluetooth itself does not require it, and it is therefore not universally performed.
So important are algorithms for generating random identifiers that Apple and Google have announced a joint effort to standardize beacons used for contact tracing and exposure notification, requiring all applications that use their standard to change the beacon identifiers at least once every 20 minutes. (Recognizing that a standard is important if contact-tracing apps are to be effective, Apple and Google are making programming capabilities available for free for developers, on both iOS and Android platforms, that they plan to release sometime this month).
Adding usefulness: Beyond privacy, there are additional considerations developers must address before contact-tracing apps should be widely adopted. For instance, the frequency with which a device sends beacons has implications for how long you need to be in another person’s presence before a contact is detected. The distance and duration of a Bluetooth contact is not necessarily representative of the duration of contact needed for virus transmission (a Bluetooth beacon can be recorded in under a second, in ideal conditions; experts at the Johns Hopkins University say that viral transmission is unlikely to occur in less than 10 seconds). Researchers and developers across the country are working strenuously to resolve these issues, and solutions are well within reach.
The largest hurdle to successful use of digital contact tracing may not be the technology, but the humans that use it. Digital contact tracing apps only work if a large fraction of the population install them. The integration of the new beacon standard in all iOS and Android phones will increase the number of devices capable of participating, but people will need to activate the feature or download an app that will guide them through activating it.
It is also necessary that people with positive diagnoses use the apps to initiate notifications for contacts, and for those who receive notice that they may have been exposed to the virus to voluntarily self-isolate, which may be difficult because of stigma and potential loss of income. And we need more testing for potential cases identified through contact tracing so we can treat positive cases and “release” negative cases to minimize unnecessary self-isolation.
Smartphone-based contact-tracing apps are not a panacea, and they will not, and should not, replace manual contact tracing. However, in confronting the current pandemic, smartphone-based contact tracing can be an important tool to help minimize the spread of disease, deliver care and improve quality of life.
Christine Julien holds the Annis and Jack Bowen Endowed Professorship in Engineering at the Cockrell School of Engineering at the University of Texas at Austin. She specializes in mobile software engineering and computer systems, and is also a Public Voices Fellow with The OpEd Project.
_____
Click here for the latest coronavirus news and updates. According to experts, people over 60 and those who are immunocompromised continue to be the most at risk. If you have questions, please refer to the CDC’s and WHO’s resource guides.
Read more:
Obama says in private call that 'rule of law is at risk' in Michael Flynn case
Yahoo News/YouGov coronavirus poll: Almost 1 in 5 say they won't get vaccinated
Army scientists working on vaccine had long feared emergence of new coronaviruses
Flight attendants see a very different future for airplane travel in the age of coronavirus
