Coronavirus

Public and Private Sectors Clash on Contact Tracing

Apple and Google’s API promises to put privacy first. State health authorities have other ideas.

|

Silicon Valley has been developing systems allowing state public health authorities to trace those who have come into contact with people who tested positive for COVID-19. But state officials are increasingly forgoing the use of privately developed "contact tracing" software in favor of government-created systems that often require far more manual tracking of contacts—and do a worse job of protecting people's privacy. 

In April, Apple and Google announced that they had jointly developed an application programming interface (API) for developers working on contact tracing software. The API serves as a shortcut so developers needn't build the technology from scratch, and it allows different apps and operating systems to communicate.

The Apple/Google project would have users opt in to sharing Bluetooth signals from their smartphone every 10 to 20 minutes. When a Bluetooth "beacon" pings someone infected with the virus, users who were close enough for a heightened risk of infection can be notified to self-isolate and get tested. Risk thresholds can be adjusted as more information about viral spread is discovered. For instance, lunch with a friend who tests positive would fit notification criteria; incidental exposure at the supermarket probably wouldn't.

Some privacy advocates prefer this approach, as the Apple-Google API would neither track location data nor store identifiable user information. Yet just three states―Alabama, South Carolina, and North Dakota―plan to use the API to develop their contact tracing systems. 

Instead, many cities and states have decided to hire platoons of contact tracers, who will conduct extensive interviews with coronavirus-positive patients and inform any notable contacts of their potential exposure to the disease. New York City plans to hire 2,500 contact tracers, while California will train up to 20,000. These interviews are voluntary, and some states are struggling with compliance.

Other states are choosing to develop their own apps, but most of these are largely uninterested in user privacy. For instance, Rhode Island's "CRUSH COVID RI" app logs three weeks of location data, intended to help users recall contacts and help health experts identify virus hotspots.

While all of these apps are voluntary to use, Rhode Island's approach drew criticism from the state's branch of the American Civil Liberties Union, which released a statement warning that "potentially substantial privacy issues are raised by the government's use of any technological location tracking program," adding that "significant questions remain about the program's operation and its true voluntariness in practice."

In Utah, another state using GPS info to fight the pandemic, state Sen. Dan Hemmert (R–Orem) introduced a bill that would require health authorities to delete user info when it is no longer necessary.

The Apple/Google joint venture has problems as well. A brief from the Brookings Institution points out that apps using Bluetooth signals could produce false positives by pinging other users through walls or alerting users of incidental interactions that have little risk of transmitting the virus. False negatives are also a concern: Only 81 percent of U.S. residents have a smartphone, and not everyone carries it on them at all times.

The Brookings report also notes that countries such as China and Israel have made similar public health measures mandatory. Google and Apple have promised not to let their software become compulsory. 

If state authorities want to increase the number of people choosing to use their contact tracing systems, they need to address these privacy worries. According to a CyberNews poll, 52 percent of Americans value "retaining [their] personal privacy" over "giving [it] up…to help authorities fight the spread of the pandemic." Just 30 percent of respondents would use a state-sponsored app "displaying your location to other residents of your city if you contracted the COVID-19 virus."

These concerns could explain why so few people are opting in to states' contact-tracing apps. In Utah, less than 2 percent of the population has downloaded Healthy Together, an app that cost $2.75 million to develop. Rhode Island has faced similar recruitment issues, with just 45,000 downloads (about 5 percent of Rhode Island's adult population) as of June 3. Brookings estimates that around 60 percent of the population would need to opt-in in order for the app to be effective. 

Bonus video: Check out Reason TV's on Apple and Google's contact tracing venture:

Advertisement

NEXT: The Cops Who Sicced a Dog on a Surrendered Suspect Got Qualified Immunity. SCOTUS Won't Hear the Case.

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. Anonymous my rosy red rectum! The whole point is to alert ME if anyone I;ve been on contact with might be infected. How is it anonymous if it knows how to contact ME?

    They can crow all they want about encryption, no location data, I am not my phone, etc, but if it knows how to contact my phone, it knows how to contact me, and it ain’t anonymous.

    1. Not necessarily. Here’s a protocol that could contact-trace without letting you or me (or any third party) knowing anything about the other.

      1. Load an app on your phone. As part of installing the app, your phone gets assigned a unique but otherwise random ID.
      2. I and a thousand of your neighbors load the same app and generate our own IDs.
      3. My phone broadcasts my ID. Your phone records the IDs of all phones close enough to “hear”.
      3a. To keep from overloading the system with false-positives, your phone automatically prunes the list to only keep the last 14 days of entries (for example).
      4. At some point, you get diagnosed with coronavirus. You self-report using the app.
      5. Your app takes your recorded list of IDs that were nearby and publishes it to a website. But only the recorded list of nearby IDs are published. Your ID is NOT listed.
      6. My phone periodically checks that website to see if my ID is on the list. If it is, my app alerts me.

      I know that I was near someone who tested positive. I don’t know who, where or when (other than that it must have been within the cut-off window). Your phone has a list of IDs that you were near but you have no practical way to match those IDs to humans. Third parties can see the list of IDs on the website and nothing else.

      7. I go get tested. If I am positive, I self-report using my app and my history of nearby IDs gets added to the list.
      Possible modification: If my test comes back negative, I self-report that through my app and it removes my ID from the website list (for now).

      1. How about this? I will NOT download an app, period. I will not self-report ANYTHING.
        When I get sick, I stay home. I won’t wear a mask because they DON’T DO ANYTHING!
        Doesn’t anyone out there question things? Do y’all believe everything you hear or see on TV?
        In my almost 70 years, the “experts” have ALWAYS been wrong.

        1. like ideas. wish subscribe newsletter.

          1. I have been working from home for 4 years now and I love it. I don’t have a boss standing over my shoulder and I make my own hours. The tips below are very informative and anyone currently working from home or planning to in the future could use these.Make 5000 bucks every month… Start doing online computer-based work through our website… Reading Articles

          2. I am now making extra $19k or more every month from home by doing very simple and easy job online from home. I have received exactly $20845 last month from this home job. TEda Join now this job and start making extra cash online by follow instruction on the given website.

            This is what I do……… Buzz Cash

        2. Your choice. I was merely rebutting Abc’s claim that it’s not possible to create a tracking app that honors privacy. I would not install such an app either unless it were open-source and I reviewed the code myself. Just because it’s possible to write a good app does not mean I trust them to actually do it.

          re: masks – It’s an overstatement to say that they “don’t do anything”, though they don’t do as much as the hype says. Masks do two things.
          1. Masks protect you some by reminding you not to touch your own face. Most germs, including viruses, are picked up by things we touch. But most can’t infect us until we transfer those germs to a vulnerable place by licking your fingers, biting a nail, picking your nose, rubbing your eyes, etc. Masks don’t stop you from doing any of those things but they can remind you not to until after you’ve washed your hands.
          2. Your mask protects me some by trapping most of the virus-laden water droplets from your coughs and sneezes during the about-two-week period where you are infectious but not symptomatic. Staying home when you’re sick only works once you know to stay home.

          1. Ummm…if you’re “not symptomatic”, what the hell do you call those coughs and sneezes???

            Also, that “two-week period” number: Cite please.

            But yeah, point 1 is well-put. Might have changed my mind about actually wearing one.

            1. It’s allergy season. I’m sneezing like crazy but have no symptoms of COVID-19 (or any other viral condition). Coughs and sneezes alone are not considered symptoms of infection.

              re: the about-two-week pre-symptomatic period of infectiousness.
              When I went to look for the cite for you, I found updated information here which lowers the estimate to about 3 days. I stand corrected. It doesn’t, however, change the logic that wearing a mask provides some protection to others. It just lowers the magnitude.

              1. I am now making extra $19k or more every month from home by doing very simple and easy job online from home. I have received exactly $20845 last month from this home job.USd Join now this job and start making extra cash online by follow instruction on the given website.

                See…………..Money90

          2. Rossami
            June.15.2020 at 5:10 pm
            […]I was merely rebutting Abc’s claim that it’s not possible to create a tracking app that honors privacy.[…]
            And you did nothing of the sort.
            You suggested an idealized circumstance where all was just wonderful! A pile of bullshit.
            Did you think that would fly here?

      2. Wonderful!
        And we are to assume none of this changes as a result of, well, ‘public health’
        Are you serious and that stupid, or just posting sarc?

  2. The more I think about Gorsuch’s opinion in the transgender cases, the more I find myself wondering if the decision was actually misguided, or if he was secretly channeling Moses (“Ye want equality? Then equality ye shall eat—not one day, nor two days, nor five days, neither ten days, nor even twenty days, but a whole month, until you vomit it out at your nostrils, and it be loathsome unto you.”)—and the liberal wing that went along with him was too stupid to see the game that he was playing.

    Would any of our resident attorneys care to comment on my speculation?

    1. IANAL (although I play one to pick up sleazy chicks at bars), but FWIW my comment is: You are commenting on the wrong article.

    2. Protecting and enshrining civil rights for an aggrieved minority to own the Libs. Well, whatever works

      1. You’re delusional if you think “civil rights legislation” protects or helps anybody other than lawyers and judges.

  3. Only 81 percent of U.S. residents have a smartphone, and not everyone carries it on them at all times.
    I sure as hell am only going to be carrying my work-issued phone when on duty or on call. The rest of the time it’s going to be powered off and languishing in a drawer at my apartment.

    1. I think the hypothesis is that most people with a work-issued phone either a) also use it as their personal phone and therefore keep it on and with them after work or b) have a separate personal phone which they keep on and with them even while they are at work.

      To me, the bigger problem is the stacked assumptions. For example, this app requires you to leave bluetooth on constantly – a real power drain on my phone. So if, say, 80% of US adults have a smartphone and on average they carry it 80% of the time and leave bluetooth on for 80% of that time, you’re down to 50% even before figuring out the app adoption rate.

  4. It’s over. The pandemic, and any worries surrounding it are dead. The Floyd riots and protests, with the media and corporate support killed it.

  5. “Only 81 percent of U.S. residents have a smartphone, and not everyone carries it on them at all times.”

    And for damn sure, the bluetooth is going off, and staying off. I will not download this app for the same reason I do not download a whole lot of apps; lack of privacy. I have to trust that there is at least one honest person at Google/Apple who will rat them out if they load this kind of spyware into the OS without telling us.
    Any government spy that pretends “to be from the government, and here to help me” is going to get the spambot brush off.

  6. Can’t we just use facebook, twitter and instagram for contact tracing? All the info is pretty much right there.

    1. Thank you for reminding me why I got rid of my Facebook account. I’d almost forgotten.

  7. Remember, when you’re contacted by a contact tracer:
    – don’t take the call [who answers calls from unknown numbers anyway?]
    – don’t respond
    – if you cannot avoid talking to them at all, when asked for names of people you’ve been near: no one

    Dangerous and irresponsible? Perhaps, but remember they had the option to do this without sacrificing my privacy, but that gave them no opportunity to use the information for other purposes later.

    [If our government weren’t listening in on phone calls, we wouldn’t have to argue about which uses of the recordings were ‘inappropriate’.]

    1. “when asked for names of people you’ve been near:”

      Look them right in the eye, and say with feeling, “just you”.

      Or, if you prefer the ‘oldies’ radio stations; “I have no recollection of those events as you have described them . . “

  8. If state authorities want to increase the number of people choosing to use their contact tracing systems, they need to address these privacy worries.

    Like this? “Public safety is our top priority. Therefore, you *will* use our contact tracing system.”

  9. “when asked for names of people you’ve been near:”

    Name your mayor, your governor, your congressmen and senator, and as many of your city councilmen as you can name.

    CB

  10. DeBlasio actually told contact tracers NOT to ask minorities if they were at BLM protests unless the person offered it themselves! What’s the point of tracing but not tracing. This guy is the most incompetent I’ve ever seen. I guess its racist to ask. I don’t wanna hear a fucking word more about blacks being disproportionately affected by the virus. If DeBlowhard doesn’t care I sure don’t give a fuck.

    1. I am now making extra $19k or more every month from home by doing very simple and easy job online from home. I have received exactly $20845 last month from this home job. TEda Join now this job and start making extra cash online by follow instruction on the given website.

      This is what I do……… Buzz Cash

  11. Apple has a pretty good webpage with links to detailed information about how the API works and a FAQ. Check it out: https://www.apple.com/covid19/contacttracing

    1. If you know the meaning of the word combination Internet of things (definition: The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction). Then you will understand that in any case the data will leak, it is worth asking all the leading firms, as the same https://www.intellias.com/internet-of-things/, that work with IoT. Everybody will tell you how it works.

Please to post comments