As COVID-19 rates sharply increase across the United States, it is becoming clearer that digital contact tracing tools could help alleviate the crisis. In order for digital tools to play a role, however, we need a better national strategy to ensure adoption, trust, and interoperability.
Contact tracing apps around the world are facing criticism. Some critics allege the apps are not as effective as promised. Others raise concerns about privacy and security. Due to the nascency of the proximity tracking technology and the rush to deployment, effectiveness is fairly unknown. But to quote Mark Twain, reports of the death of contact tracing apps are greatly exaggerated. Specifically, early reports indicate that decentralized apps based on the Apple-Google Exposure Notification API show great promise as tools that could bolster U.S. states’ contact tracing efforts with the help of a coordinated national strategy.
Contact tracing is a well-established epidemiological method of tracking and containing the spread of a virus during a pandemic. Traditionally, it works by conducting interviews with diagnosed individuals to discuss their movements and interactions so that others who may be at risk of exposure (such as family or coworkers) can be notified and take appropriate steps to self-isolate or quarantine.
As COVID-19 rates sharply increase across the United States, it is becoming clearer that digital contact tracing tools could help alleviate the crisis.
However, traditional contact tracing techniques are limited by COVID-19’s long asymptomatic period (10 days). A person speaking with a contact tracer will often be unable to identify the wide variety of people, including strangers, they may have come into contact with. As shutdown orders are lifted and individuals return to work, school, and other activities in greater numbers, this is a major limitation of traditional public health methods, and we already observe COVID-19 transmissions rising sharply in places such as Florida, Texas, and Arizona. To help overcome these limitations, digital tools can supplement traditional contact tracing efforts. However, in the absence of a national contact tracing strategy, nascent digital contact tracing efforts are being undermined by a lack of interoperability and low adoption due to concerns about privacy, security, and effectiveness.
As a first step, digital contact tracing efforts should be interoperable between states in order to be effective over time. As states reopen and individuals increasingly cross state lines for travel or work, exposure notification apps have to be able to “talk to each other” — that is, for Bluetooth signals sent from one person’s device to be detected by another person’s device even if she or he is using a different app or operating system. This can be technically challenging and require substantial financial and engineering effort such as Google-Apple’s partnership to create a new Exposure Notification API for decentralized Bluetooth signals to be sent and received between devices.
However, in the U.S., current efforts are disjointed. Utah, North Dakota, and Rhode Island have introduced their own apps that allow the user to share their location history with a contact tracer (a “centralized” model). However, these states have faced sharp pushback over concerns about privacy and security, and as a result have low adoption rates (between 1-4%). These states are also discovering that GPS location data is usually not precise enough to measure person-to-person exposure, particularly indoors and in urban areas where risk of infection is greatest. In contrast, Alabama and Virginia have committed to implementing apps that use Bluetooth signals through the Apple-Google API (a “decentralized” model). This follows the model of Germany, Switzerland, Canada, and dozens of others.
Governments around the world are turning to technology in an unprecedented manner to improve the efficiency and accuracy of contact tracing.
Decentralized apps are designed to broadcast rotating, randomized Bluetooth identifiers (ID’s) that can be “seen” and recorded by other nearby devices. When a person tests positive, the list of ID’s that their device broadcasted over the past 14 days can be uploaded to a server and accessed by other devices, which can compare this list to their own records and trigger an “exposure notification” for individuals who have been in proximity to the infected person. This allows exposed individuals to take appropriate actions (if they wish), while protecting privacy by avoiding any personal information becoming available to any central authority.
Although some countries have experimented with Bluetooth-based apps that do not use the Google-Apple Exposure Notification API — such as Singapore, France, and Australia — these efforts have largely struggled. This is almost certainly due to technical limitations caused by privacy protections built-in to the device operating systems which prevent Bluetooth from always scanning. The API enables expanded access to Bluetooth scanning, which improves the ability for Apple and Android devices to recognize one another. These compatibility and scalability benefits are key reasons why the UK recently switched from a centralized to a decentralized model.
In contrast, early indicators suggest that countries that have adopted decentralized apps have seen higher adoption rates, fewer concerns about privacy, and greater cross-border app interoperability. For instance, in Germany and Switzerland, adoption rates are as high as 13-20%. Despite early suggestions that adoption rates need to be as high as 60%, recent research from MIT has shown that they can be impactful at lower rates.
Governments around the world are turning to technology in an unprecedented manner to improve the efficiency and accuracy of contact tracing and other well-established methods of virus containment. Many countries have implemented detailed national strategies, including the deployment of a single exposure notification app.
Deciding which model is most appropriate depends upon the challenges and needs of each public health authority. However, national leadership is necessary to avoid potentially crippling technological fragmentation in the United States.
Pollyanna Sanderson is the Policy Counsel for the Future of Privacy Forum.