The Importance of Equity in Contact Tracing

Commentators and policymakers appear to have slowly rallied around “contact tracing” as a means to ease society out of restrictive social-distancing measures. Unlike in past pandemics, some observers assume that this iteration of contact tracing should involve a technological supplement to manual contact tracing undertaken by legions of public health workers. But this technology-aided contact tracing presents serious challenges, including concerns about equity that many commentators have so far overlooked.

During the current pandemic, public health experts have made the persuasive case that dramatically increasing our capacity to implement contact tracing is one of several steps necessary to allow us all to get back to work, school and socializing. Some are suggesting that we augment this human-based contact tracing with mobile apps that use our phones to track whether we have been in contact with an infected person. It’s understandable that policymakers and others are looking to technology to help us alleviate the substantial hardships of our current stay-at-home situation as quickly as possible. Yet precisely because of this pressure, it’s worth taking a moment to think about the implications of using mobile apps for contact tracing—not just the efficacy of the idea, which has been written about elsewhere, but also its costs. Analysts have already begun litigating one potential cost: loss of privacy. But it’s important to examine the disparate privacy implications for people already hardest hit during this pandemic—people living in poverty, African Americans, and Latinx, among others.

The regional outbreak of the novel coronavirus grew into a worldwide pandemic at breathtaking speed. At the same breathtaking speed, technologists have bandied about ideas—from GPS data-tracking to Bluetooth apps—to assist public health efforts with location tracking. In recent weeks, attention has coalesced around the possible use of mobile apps to assist with more traditional contact tracing. Calls for contact-tracing technology are growing as some states begin to relax stay-at-home orders and to reopen nonessential businesses, increasing the likelihood that large numbers of people will be exposed to the virus in coming weeks.

A number of groups have seized on this suggestion, with teams at MIT, in Europe, and elsewhere now working to develop privacy-protective Bluetooth contact-tracing apps, enabling people to find out that they have been exposed to known coronavirus carriers without revealing when or through whom the exposure occurred.

Perhaps most directly in the spotlight is the effort by Apple and Google to create an interoperable system based on Bluetooth that will work on iOS and Android mobile devices alike. The proposed system is designed to be privacy protective; if Jane’s phone comes in contact with yours—that is, is within a specified distance of yours for a predetermined threshold of seconds or minutes—then the two devices will exchange nameless identifiers, which will be stored on the devices, not in a centralized database. If Jane later discovers she has COVID-19, the respiratory disease caused by the coronavirus, then (and only then) the identifiers her phone used over the previous days will be published in a central database. Everyone’s phone periodically checks this database, looking for identifiers of those who have tested positive. If your phone finds a match between the identifiers in the database and one of the identifiers your phone has been in contact with recently (including Jane’s), you will be alerted that you may have been exposed to the disease.

So far Apple, Google and the researchers designing privacy-protective app specifications have done an admirable job of getting technical privacy protections right. In addition to developing underlying infrastructure that minimizes the amount of individual users’ data shared with a central database, Apple and Google have said they will impose strict rules for whatever apps eventually implement this interoperable system. At least in the first phase of the effort, apps will be run by public health authorities. For security’s sake, such apps will be the only apps using the system that will allow users to report that they are positive for the disease. In other words, no one—not a hacker, not a nation-state—will be able to use the system to pretend to be someone who has tested positive, thus causing many to falsely believe they have been exposed and potentially infected.

While the central database will keep track of the nameless identifiers of people who are reported ill, the database will not be able to track who has been exposed. That’s thanks to a design feature that changes these nameless identifiers frequently. The Apple and Google system does not collect location information, which means the contact-tracing apps can’t either. The system also will not track which people are spending time together.

Contact-Tracing Technology May Not Work Very Well

Although thus far they seem to be doing well on privacy, Apple and Google have not solved—nor can they—the more fundamental question of efficacy. Will a contact-tracing system actually work? Will it help public health authorities diminish the spread of COVID-19? This is something that policymakers will need to address before deciding to deploy contact-tracing apps. As noted above, many have written about why contact tracing may not be very effective, and this is not the focus of this piece. Nevertheless, a few efficacy problems are worth highlighting.

Adoption rate will be critical to determining the impact of an app; without a high rate of use, when a person who is infected does have contact with another person who is at risk of contracting the disease, there is a low probability that both will have the contact-tracing app installed on their phones and in use. Consider, for example, if one-third of the population adopts an offered contact-tracing app. When an infected person comes into contact with another person, the likelihood that both have the app in use is only one-third times one-third, or about 11 percent.

Indeed, achieving a high adoption rate will be challenging. Singapore has been pushing a contact-tracing app for months, but as of a week ago, only one in five had downloaded the app—not enough of the population for the app to function effectively. One government official there told the press, “In order for [the app] to be effective, we need something like three-quarters—if not everyone—of the population to have it.” There’s reason to believe that the U.S. won’t get the voluntary adoption rates needed to make such a contact-tracing app effective.

In addition, a contact-tracing app likely will suffer from a high rate of false positives—falsely informing users that they may have been exposed to someone with COVID-19 following situations in which transmission would be highly improbable. As Ross Anderson and others have noted, just because Bluetooth registers two people within six feet of each other does not mean that the two phone users have experienced viral exposure to one another. The two people could be walking past each other outside, where exposure is brief and transmission is unlikely. They could be inside, within six feet but in different apartments or office suites (Bluetooth signals go through walls).

Contact tracing false positives could lead to other problems. For example, if a high volume of contact-tracing app users receive notice they may be infected, it could lead to a stark increase in the demand for testing. This, in turn, could intensify the test shortage problem. False positives also could lead to rapid loss of trust in the system. After a few false positives, people will likely remove the contact-tracing app from their phones.

Contact-tracing apps also are likely to suffer from false negatives. As one of us wrote earlier, that is likely to be the more serious problem. We don’t know the rate of asymptomatic carriers of the coronavirus—early numbers from Wuhan are increasingly suspect—but recent studies from Iceland indicate it may be as high as 50 percent of those infected. Infected children appear less likely than adults to exhibit serious symptoms—but children also are less likely to have smartphones with any contact-tracing app installed. This means that there will be a large cohort of asymptomatic transmitters who are unlikely to be tested (and unlikely to have a smartphone) and thus will remain outside the contact-tracing app’s ecosystem; because of that, the app will never be able to determine definitively whether or not a given user has been exposed to the disease. Even if the app is widely used, a user who has been in close contact with an asymptomatic, untested carrier would never be notified.

Contact-tracing technology also threatens to create a false sense of security. None of the proposed systems is designed to protect individual users from contracting the disease, but only to notify people who may have been exposed after the fact. Proponents of these systems have not claimed otherwise, and notifying people who may have been exposed could of course still have important epidemiological benefits. But some users who adopt a contact-tracing app may nevertheless feel that having such a tool on their phones means it’s safe to prematurely relax or abandon the precautions they take to avoid contracting the disease. This is especially likely in the event that government officials promote contact-tracing technology simultaneous with a relaxing of stay-at-home orders.

Perhaps the biggest hurdle to the app’s efficacy is simply that the virus remains largely an unknown. Even five months into the pandemic, we are learning new facts that are critical for halting coronavirus transmission. For example, we recently discovered that the virus was circulating in numerous U.S. cities months before it was detected. We’ve learned that the six-foot distancing rule won’t necessarily work in all conditions; we’ve learned, for example, that air conditioning causes people at a greater distance to become infected. Until we can accurately model how the virus spreads, the value of contact-tracing apps will remain unmeasurable and unclear. This is because a contact-tracing app might be designed to capture likely transmissions when two users are in close proximity but not to capture transmissions that occur in other conditions. What if the wind is blowing from one runner to another 10 feet behind? Or a few people are sitting well-distanced from each other in a restaurant, but the air conditioning is turned on high?

Contact-Tracing Technology May Not Benefit All People Equally

Any system designed to keep track of every significant interpersonal interaction that every person has is likely to have privacy implications. The Apple and Google system is decentralized; your and Jane’s phones know you have been in contact—but no one else does. But some governments, including France, have sought that systems be centralized. This would allow health care authorities—and not just the device owners—to learn who had been exposed to someone who tested positive for the coronavirus. Apple and Google’s set of tools have been designed deliberately to Advertise on IT Security News.