Will Americans Actually Use Contact Tracing Apps?

Apps that track users are being hyped as the way to lift lockdowns. But there are reasons to be skeptical.

Governments around the world are touting software-based contact tracing as a novel response to a novel coronavirus. The software aims to replace manual tracing of contacts of people with suspected or confirmed infections, done laboriously by public health workers, with automated tracing based on the proximity of mobile devices.

Their promise: If you install our app, lockdowns may be lifted. "If you want to return to a more liberated economy and society, it is important that we get increased numbers of downloads," Australian Prime Minister Scott Morrison said this week. "This is the ticket to ensuring that we can have eased restrictions."

"For these apps to work, we will need everyone's cooperation to install and use them," Singapore Prime Minister Lee Hsien-loong said in a nationally televised exhortation.

In the U.S., state and federal health officials are beginning to link app installation to escaping lockdowns. "It's certainly something we should try to figure out," Massachusetts Gov. Charlie Baker, a Republican, said this week.

Legacy media already has been lecturing Americans on the inevitability of installation. The Atlantic's headline called it "Technology That Could Free America From Quarantine." Time.com listed it under "What We Must Do to Prevent a Global COVID-19 Depression." The New York Times promised that contact-tracing software will "speed lockdown exit."

Different strains of contact-tracing software are emerging. All of the more prominent systems rely on a centralized server of some sort, either to perform matching of COVID-positive identifiers or to distribute lists of COVID-positive identifiers for matching locally on your device.

The U.K.'s approach gives a nod to privacy concerns, although the app has not yet been released. Public Health England describes it: "Once a member of the public installs the app, it will start logging the distance between their phone and other phones nearby that also have the app installed using Bluetooth Low Energy." If anyone is determined to be COVID-positive, the log can be used to identify anyone in close proximity. (It probably won't be long before police use the logs to answer questions like "Who was within Bluetooth range of the bank teller during the robbery?")

Other approaches are more privacy-protective. The Bluetooth-based system announced by Apple and Google falls into this category. If you choose, your device will transmit random numbers called beacons that change every 10 to 20 minutes. At least daily, the companies say, participating mobile devices "will download a list of beacons that have been verified as belonging to people confirmed as positive for COVID-19 from the relevant public health authority." Matching is done locally and many details seem to be left up to local or regional health officials. (The companies say they won't allow the system to be mandated.)

Software-based contact tracing may work. It may not. To be effective, it will need to overcome significant hurdles, including the limitations of Bluetooth, which can transmit through walls and was never intended as a proxy for close contact. It will need to overcome the problem of limited testing, especially of people who show no symptoms. And it will do little to identify infections arising from lingering aerosols or fomites, virus particles that can remain viable on surfaces for more than a day. (The University of Cambridge's Ross Anderson has a good writeup on the technical and social obstacles.)

The most formidable hurdle will be convincing people to trust the technology. Singapore says fewer than 20 percent of its population has installed TraceTogether since its launch on March 21. In a nation of 1.4 billion people, the Indian government's contact tracing app, Aarogya Setu, has reached only 75 million downloads.

Many technocrats will surely succumb to the temptation to make tracing technology mandatory. Australia's government has given mixed signals on this point. India has not: All federal employees are required to install Aarogya Setu, and it reportedly will be pre-installed on smartphones by default. Travel on some forms of public transport in India now requires installation of Aarogya Setu, and many large employers are mandating it. It doesn't seem exactly illegal to decline, but soon it may be difficult to live a normal life unless you give in.

Americans remain obstreperous: A Reuters poll this week found that only half of smartphone users say they would enable contact tracing voluntarily. So expect calls to make it mandatory. Marketplace already is informing us that "COVID-19 tracing apps might not be optional at work" and "it's definitely legal for your employer to require you to use a tracing app." The regulatory enthusiasts at the Center for American Progress suggest: "As a condition of receiving a COVID-19 test in the future, individuals may be required to download the app." Technocrats will point to a model suggesting a 60 percent adoption rate is needed.

Stewart Baker, an attorney who was previously an assistant secretary at the Department of Homeland Security, argues at Lawfare that states could force operating system vendors to install contact tracing software on your phone—and even make it unlawful for you to deactivate it. "The governors probably don't need to ask," Baker writes, noting that around 40 states have adopted a public health "emergency" law that sweeps in "communication devices." In addition, he writes, "governors likely have authority to require that residents of their states activate the app."

There are legal arguments that could be made about the scope of public health emergency law. There are constitutional arguments about the First Amendment–protected status of computer code. But more fundamentally, many governors simply haven't proven themselves worthy of trust during the COVID-19 outbreak. Michigan's governor banned motorized boats while allowing non-motorized ones. Kansas churches had to go to court to secure their right to remain open subject to distancing rules, even though shopping malls, libraries, restaurants, and bars were exempted. In the San Francisco Bay Area, where I live, liquor stores, marijuana shops, and summer camps have been deemed "essential" while churches, gun stores, and even 60-acre outdoor shooting ranges must remain closed.

We should not expect officials who get it wrong on the First Amendment and Second Amendment to get it right when it comes to delicate issues of security and privacy.