Contact Tracing: The Battle Between Public Health and Data Privacy

In the fight against a global pandemic, contact tracing can be one of the most vital tools – if not the most vital in the absence of a vaccine – but it requires public acceptance. There has been a vast discrepancy in the take-up of such measures with some countries immediately implementing them and seeing them widely used by society, whereas other countries have shied away from contact tracing and only consider it several weeks after recording their first COVID-19 deaths. 

So what exactly is contact tracing and why are some countries reluctant to implement it?

The Centers for Disease Control and Prevention (CDC) describes contact tracing as “a core disease control measure employed by local and state health department personnel for decades” and “a key strategy for preventing further spread of COVID-19”.

Contact tracing itself is not new but the contact tracing apps hitting the headlines are a more recent development. Before such apps, contact tracing was a combination of social work and sleuthing involving conversations between an individual and their healthcare worker. It is an effective means of virus tracking and control but in the case of COVID-19 with 20,000+ new cases per day in the United States alone, this would be an enormous task and in many cases would miss tens, if not thousands, of contacts.

The apps utilize GPS or Bluetooth technology to alert users that they were recently in close contact with an infectious person. CDC describes close contact as being within six feet of a person for at least 15 minutes. In basic terms, the contact tracing apps are proximity monitors. So we could look at traditional methods as “active contact tracing” and the apps as “passive contact tracing”.

Not all apps are created equal. Some are termed “centralized” and others “decentralized”. Software being promoted by Apple and Google for example works with decentralized apps and gives users more control over their data by keeping it on their own personal cell phone. The centralized model meanwhile uploads gathered data to a remote server where matches are made with other contacts.

Apple and Google had offered its software tool to the United Kingdom, which decided instead to create its own centralized version like Australia, whereas Germany and Switzerland are working on decentralized apps. So far, public support for decentralized apps has been greater than that for centralized apps.

Passive contact tracing works – if we use it

Professor Christophe Fraser from Oxford University’s Big Data Institute, Nuffield Department of Medicine, explains why a contact tracing app could be deployed with urgency: “Coronavirus is unlike previous epidemics and requires multiple inter-dependent containment strategies. Our analysis suggests that almost half of coronavirus transmissions occur in the very early phase of infection, before symptoms appear, so we need a fast and effective mobile app for alerting people who have been exposed. Our mathematical modeling suggests that traditional public health contact tracing methods are too slow to keep up with this virus.”

In some Asian countries, contact tracing was used successfully during the SARS outbreak. It therefore not only had the trust of the people but it could be quickly rolled out for COVID-19 without the need to explain the importance of compliance to citizens – they had seen that it worked. There is also a low degree of government suspicion in these countries, another tick in the box for contact tracing apps.

South Korea is able to track and trace using not only contact tracing apps but police information from cell phone use transportation, credit card activity, etc. That degree of ‘surveillance’ would not wash with the U.S. public as a whole.

The U.S. has so far focused its efforts on active contact tracing. New York state, which is working with Johns Hopkins Bloomberg School of Public Health, wants every region to have at least 30 active contact tracers for every 100,000 residents before it can fully reopen. Neighbors New Jersey and Connecticut, as well as Massachusetts and California are also working on contact tracing programs.

In order to help allay data privacy concerns among Americans regarding passive contact tracing, Five Democrats from both houses of Congress introduced a bill on May 14 that they say would protect consumers’ health data when they use the contact tracing technology developed by Google and Apple. 

The Public Health Emergency Privacy Act would take several measures to protect any health data collected during a public health crisis, such as rules on the storing and deletion of data, use for public health purposes only, and ensuring that contact tracing apps remain opt-in, and are not made mandatory.

The politics of contact tracing

Because passive contact tracing relies on enough people using the apps, citizens of each country decide how effective a measure it is. Much has been written and spoken about the best technologies available. But even the very best contact tracing app will fail if only 20% of the population use it. Passive contact tracing’s greatest weakness is its reliance on citizens’ willingness to use it, leading some countries, like Austria, to consider mandatory download and use of the apps.

A contact tracing app does not need to have 100% of the country using it. That simply would not be possible. But the more users, the more successful it will be. Dr David Bonsall, researcher at Oxford’s Nuffield Department of Medicine and clinician at Oxford’s John Radcliffe Hospital, says, “Our findings confirm that not everybody has to use the mobile app for it to work. If with the help of the app the majority of individuals self-isolate on showing symptoms, and the majority of their contacts can be traced, we stand a chance of stopping the epidemic. The more people that opt-in, the faster the epidemic will stop, and the more lives can be saved.” 

Why do some countries have a higher success rate with public acceptance of contact tracing apps? Ultimately, it comes down to compliance and trust. If the country is known for trusting its leaders and complying with directives from government, like some Asian countries, New Zealand and Iceland, for example, the task of controlling the virus is much easier. If a government is not trusted, based on past experience and/or the inherent culture of the country (U.S. and U.K. I’m looking at you), then measures that rely so largely on citizen action will fail.

This is not to say countries like the U.S. and U.K. are wrong to question their governments or hold them accountable, but it does explain the widely varying views on contact tracing – and consequently the success rate of such measures. Remember, it’s ok to support your country and fellow citizens even if you didn’t vote for the current president or prime minister. We must “pick our battles” and not allow politics to hamper our response to this pandemic.

As with everything, there have been anomalies. Singapore, for example, is not known for having a deep level of government distrust, yet only a quarter of the population downloaded the app. Here, the concerns were mainly focused on the impact on device battery life.

When the U.K first launched its contact tracing app trial on the island of the Isle of Wight, many residents were adamant that they would not be “government guinea-pigs”. The most common concern was what personal data would the government be able to access (in truth, far less than they already have access to), and the “big brother is watching me” fear that contact tracers would know where you have been and who with. Other concerns included worries about viruses – of the cyber variety – infecting their phones, or it simply not being worthwhile as people considered “too much fuss” was being made.

The take-up for the trial was therefore less than expected, which makes it much harder for the government to roll out an effective contact tracing up for the whole country. Indeed, they may even consider not doing so if the amount of data would not result in beneficial results.

For the moment at least, the U.K. is going ahead with its contact tracing app. The original countrywide launch date has been delayed however. Initially intended to launch on June 1, the same day some children return to school, the app will not be ready, and a new launch date has so far not materialized. This has led to widespread concerns about the reopening of schools, with education authorities having been reassured that contact tracing would be in place, now finding out it will not be ready for the first day of school.

The delay may also be due to media reports mid-May that security researchers found flaws in the app ahead of its launch. These included the time taken to regenerate random ID codes, and weaknesses in the registration process. The government said it was already aware of the flaws and was working to address them.  

Instead, the British government has rushed to implement an active contact tracing program in time for the reopening of schools and some businesses. Thousands of contact tracers have been recruited and are taking online training with Johns Hopkins University that they need to pass before starting to contact those who may have come into contact with infected people. Someone who signed up to become a contact tracer for the U.K. recently completed his training and told Homeland Security Today that it was much more thorough than he had imagined, and that it took around eight hours. He was selected for his background in public health, therefore the training could take longer for those without relevant experience.

Active contact tracing works but has its limitations. Imagine you go to your local grocery store, you don’t know anyone there and you don’t know if they are infected. An app that works like a proximity monitor will be able to quickly tell that you were in the store at the same time as someone who later that day reported symptoms. That’s if they and you are using the app of course. With active contact tracing this will take much longer and in many cases be impossible. The infected person can report where they were but they will be unlikely to know the names and contact details of anyone else using the store, nor will the store itself have access to this information.

It is hard to understand why people would distrust a fully-tested contact tracing app yet regularly use food delivery apps which require their payment details, or various games from small-time app developers without security certificates. Does our privacy not matter if we want a pizza, but matters when lives are at stake? 

This situation shows that governments must do more to foster trust so that in times of crisis, citizens depend on them to pull the country through and not automatically distrust every speech and every measure. Compliance is not only gained by beating citizens into submission and agreement, we can be smart about it. 

Do or die?

If you are still wondering whether or not to use a contact tracing app, ask yourself  “what’s the worst that could happen?” If you do use the app the worst that could happen is that someone knows where you have been. Does that actually matter in the grand scheme of things? If you don’t use the app, you could come into contact with someone with COVID-19, not know it, contract the virus yourself and spread it to your family, some of whom may not survive. Nothing is worth taking that risk for.

One word of warning – beware of scams. As with any digital technology, rogue actors are capitalizing on the launch of contact tracing apps and creating their own for nefarious means or calling people pretending to be contact tracers in order to obtain personal data. 

Ultimately the most successful contact tracing program will combine both active and passive methods and be supported by the public. It is widely acknowledged that the Ebola outbreak in West Africa was stopped by the use of contact tracing. Taiwan also cited contact tracing as a key reason it was able to keep the number of cases low despite its proximity to China. It is no silver bullet, only a reliable vaccine will give us that, and should not negate the need for other preventive measures, but while we wait for that vaccine, if indeed it ever comes, we have much to gain and everything to lose when deciding whether or not to download a government-recommended contact tracing app to our phones.

Just as there was public kickback against biometrics when they entered widespread use at airports, so we are seeing now for contact tracing apps. Today, biometrics are a commonly accepted part of travel and have overcome initial concerns and glitches to play a significant role in ID and transportation security. With many experts believing COVID-19 will not be the last global pandemic in our lifetime, contact tracing apps could be here to stay.

 

(Visited 275 times, 1 visits today)

Kylie Bielby has more than 20 years' experience in reporting and editing a wide range of security topics, covering geopolitical and policy analysis to international and country-specific trends and events. Before joining GTSC's Homeland Security Today staff, she was an editor and contributor for Jane's, and a columnist and managing editor for security and counter-terror publications.

Leave a Reply

Latest from Coronavirus

Go to Top
X
X