Public and Private Sectors Clash on Contact Tracing

Apple and Google’s API promises to put privacy first. State health authorities have other ideas.

Silicon Valley has been developing systems allowing state public health authorities to trace those who have come into contact with people who tested positive for COVID-19. But state officials are increasingly forgoing the use of privately developed "contact tracing" software in favor of government-created systems that often require far more manual tracking of contacts—and do a worse job of protecting people's privacy. 

In April, Apple and Google announced that they had jointly developed an application programming interface (API) for developers working on contact tracing software. The API serves as a shortcut so developers needn't build the technology from scratch, and it allows different apps and operating systems to communicate.

The Apple/Google project would have users opt in to sharing Bluetooth signals from their smartphone every 10 to 20 minutes. When a Bluetooth "beacon" pings someone infected with the virus, users who were close enough for a heightened risk of infection can be notified to self-isolate and get tested. Risk thresholds can be adjusted as more information about viral spread is discovered. For instance, lunch with a friend who tests positive would fit notification criteria; incidental exposure at the supermarket probably wouldn't.

Some privacy advocates prefer this approach, as the Apple-Google API would neither track location data nor store identifiable user information. Yet just three states―Alabama, South Carolina, and North Dakota―plan to use the API to develop their contact tracing systems. 

Instead, many cities and states have decided to hire platoons of contact tracers, who will conduct extensive interviews with coronavirus-positive patients and inform any notable contacts of their potential exposure to the disease. New York City plans to hire 2,500 contact tracers, while California will train up to 20,000. These interviews are voluntary, and some states are struggling with compliance.

Other states are choosing to develop their own apps, but most of these are largely uninterested in user privacy. For instance, Rhode Island's "CRUSH COVID RI" app logs three weeks of location data, intended to help users recall contacts and help health experts identify virus hotspots.

While all of these apps are voluntary to use, Rhode Island's approach drew criticism from the state's branch of the American Civil Liberties Union, which released a statement warning that "potentially substantial privacy issues are raised by the government's use of any technological location tracking program," adding that "significant questions remain about the program's operation and its true voluntariness in practice."

In Utah, another state using GPS info to fight the pandemic, state Sen. Dan Hemmert (R–Orem) introduced a bill that would require health authorities to delete user info when it is no longer necessary.

The Apple/Google joint venture has problems as well. A brief from the Brookings Institution points out that apps using Bluetooth signals could produce false positives by pinging other users through walls or alerting users of incidental interactions that have little risk of transmitting the virus. False negatives are also a concern: Only 81 percent of U.S. residents have a smartphone, and not everyone carries it on them at all times.

The Brookings report also notes that countries such as China and Israel have made similar public health measures mandatory. Google and Apple have promised not to let their software become compulsory. 

If state authorities want to increase the number of people choosing to use their contact tracing systems, they need to address these privacy worries. According to a CyberNews poll, 52 percent of Americans value "retaining [their] personal privacy" over "giving [it] up…to help authorities fight the spread of the pandemic." Just 30 percent of respondents would use a state-sponsored app "displaying your location to other residents of your city if you contracted the COVID-19 virus."

These concerns could explain why so few people are opting in to states' contact-tracing apps. In Utah, less than 2 percent of the population has downloaded Healthy Together, an app that cost $2.75 million to develop. Rhode Island has faced similar recruitment issues, with just 45,000 downloads (about 5 percent of Rhode Island's adult population) as of June 3. Brookings estimates that around 60 percent of the population would need to opt-in in order for the app to be effective. 

Bonus video: Check out Reason TV's on Apple and Google's contact tracing venture: