Contact Tracing Apps Are Not a Silver Bullet

By: William Crumpler

As the first hopeful signs begin to emerge that the worst of the COVID-19 pandemic may be beginning to ease in the United States, many officials are turning their attention towards the autumn, when health experts are predicting a second wave of infections could emerge. If the United States hopes to avoid a repeat of the loss of life and economic disruption experienced so far this year, we will need new and better ways to monitor the disease, identify those who have been infected, and isolate potential carriers. The success of nations like South Korea, Singapore, and Taiwan at controlling the spread of COVID-19 have led many to look for answers in the way these governments have handled the crisis, and particularly the way they have leveraged digital technologies to assist public health officials in their work.

Around the world, governments have been using technology in a variety of ways to combat the spread of COVID-19. Some governments are using technology to enforce quarantine measures with the help of cell signal monitoring, facial recognition, and even drones. Others are promoting apps where citizens can self-report their symptoms to help public health experts monitor the spread of the disease. Still more nations are using anonymized cell phone location data to gauge the success of social distancing recommendations. The most common proposal, however, is to use smartphone apps to support contact tracing efforts. 

The goal of contact tracing apps is to make it easier to identify individuals who may have come into contact with carriers of the virus, allowing public health officials to take more rapid and targeted actions to prevent further spread of disease. Contact tracing has always been a key component of epidemic response, but traditional methods of interviewing each patient in person and then tracking down their contacts on foot aren’t feasible during an outbreak of this scale. Some public health experts have estimated that in order for manual contact tracing to be effective for the current pandemic, the U.S. government would have to hire 100,000-300,000 new workers at a cost of up to $12 billion.

Contact tracing apps have been pitched as a way to reduce these costs by automating the process of logging people’s contacts in case they later became infected. If effective, these tools would provide clear benefits for pandemic response, but the use of these apps inevitably require smartphone users to accept a loss of privacy in exchange for giving officials more and better data for public health measures. This has led to many civil liberties advocates raising warnings about potential abuses that could arise from contact tracing schemes, especially in authoritarian countries unlikely to relinquish control of these capabilities once the pandemic subsides.

Given these risks, it is important to understand exactly how much value these tools may provide so that societies can make an informed decision about whether their deployment is worth pursuing. There is no consensus way of achieving mobile contact tracing, and there are important variations between different tools being developed around the world. Understanding these differences is key to understanding the potential public health utility of these plans, as well as their risk to users’ rights.

Bluetooth

The first factor to consider is what data the apps will be gathering. Most proposed contact tracing apps include, at a minimum, the capacity to use Bluetooth signals to create a log of other phones that have stayed in close proximity for long enough that the virus could have spread between the phones’ owners (usually defined as being within 6 feet for at least 15 minutes). The value of medical professionals having such a list for every infected patient is obvious, but it is worth considering how much information is missed in this scheme. Bluetooth contact tracing would not account for encounters that happen quickly, but may be high risk—like those involving physical contact or one person coughing on another. It also does not account for the risk of touching contaminated surfaces after an infected person has been through an area. These are large coverage gaps, and while it is true that even incomplete information may prove useful during an outbreak, this must be balanced against the risk that imperfect tools could create a false sense of security among their users and cause them to abandon other sensible safety measures.

It is also important to keep in mind that Bluetooth tracing apps are prone to false positives. Due to irregularities in Bluetooth signal strength, these apps may accidentally log contacts from phones more than two meters away, or even from phones located on the other side of a wall. These errors could lead to many people being prompted to enter self-quarantine despite never having actually come into contact with an infected person. Further, since most people coming into contact with a carrier won’t ever contract the virus, alerts sent through these types of apps will capture a large number of unaffected people. This is not necessarily a problem in countries with robust testing infrastructure where those alerts can be followed up on and confirmed, but when apps are deployed in a country like the United States that still struggles to make testing available, policymakers must consider whether the scale of these false positives could create behavioral fatigue among the population or lead to unnecessary restrictions on people’s movement.

The efficacy of Bluetooth tracing also depends on what is done with the data, and whether it is being kept in an anonymized or identifiable form. Google and Apple have taken a firm position in favor of anonymization with their proposal for Bluetooth contact tracing. Under their system, once an app user had been diagnosed with the virus, the app would send out an alert to any of the individuals who had logged contact with the infected person, telling them simply that someone they had encountered on a certain day had tested positive, and that they should consider self-quarantine to prevent further spread. At no point would a government agency gain access to the list of people the infected patient had encountered.

This arrangement has won cautious praise from privacy advocates, but notably would do very little to support manual contact tracing efforts by public health officials, who require details about exactly who may be at risk so that those people can be followed up with, tested, and quarantined if necessary.  These competing interests have already created tensions, with France and the UK declaring opposition to the Google/Apple proposal due to their desire for health officials to have more complete information about who may be at risk. 

The final question that must be asked is whether the data collection will be voluntary or mandatory. In some countries like India, the use of contact tracing apps is being made a requirement for all workers returning from social isolation. In many other nations, however, the use of these apps is merely encouraged, raising serious questions over effectiveness. Because an encounter cannot be logged unless both parties are using the app, these tools will end up being ineffective unless a significant proportion of the population uses them. Public health experts have estimated the minimum adoption rate necessary for contact tracing to be beneficial at around 60%. So far, countries deploying voluntary apps have seen adoption rates far below this. Singapore, for instance, has only seen around 20% of its population use the country’s contact tracing app, despite it being available for more than a month. Worse, recent polls have found that only around 40% of the U.S. population would be able and willing to use the app, making it highly unlikely that the United States would ever reach the necessary saturation through voluntary measures.

Location Data

Not all proposed contact tracing methods rely exclusively on Bluetooth data, however. Some also would use location data from GPS, Wi-Fi, or cell towers to allow public health officials to go back through locations where an infected person had traveled, and identify others who may have been there at the same time. This form of contact tracing can address some of the gaps of Bluetooth-only schemes, but comes with its own set of issues. The first is accuracy. Cell tower data and Wi-Fi connection histories may be able to place two people in the same general vicinity, but are too imprecise to determine if they were in close enough contact for the virus to have spread between them. GPS data is far more accurate, but even GPS can only reliably place people within two meters of one another when used outdoors, and only when both users have allowed battery-draining location tracking to be turned on.

The value and risks of using location data also depend on the scale of collection and the ease with which public officials can access it. In China, few restrictions exist to prevent public health officials from collecting whatever data they deem necessary to support contact tracing efforts. This may be beneficial from the standpoint of pandemic management, but poses large and obvious privacy risks if duplicated in other countries. On the other hand, an approach requiring public health experts to gain consent from users before accessing their location data would be far more privacy protecting, but would also severely limit their ability to identify new potential cases.

There is a middle ground between these two ends of the spectrum, however, occupied by countries like South Korea, which has been notably successful in using cell phone location data alongside other information like CCTV recordings, payment histories, and in-person interviews to support contact tracing and avoid the need for societal shutdowns. Importantly, South Korea does not use location tracking as a replacement for manual tracing and testing, but rather as a complement. In-person interviews are used as a starting point to build a log of the confirmed case’ movements, with location data and credit card payment history used to help fill in the gaps and identify potential new cases. The conclusions from these investigations can then be checked against CCTV footage for confirmation. This is still very labor-intensive, but it allows officials to identify possible new cases that otherwise would have slipped through the cracks without resorting to over-broad surveillance.

Unlike in China, South Korea’s efforts are not indiscriminate, but focused only on those who are known or suspected to have contracted the virus. South Korea’s contact tracing also takes place under a clear legal framework—established after the MERS outbreak in 2015—that requires the government to notify those under surveillance and delete their data once tracking is completed. The presence of these authorities allowed the Korean government to move quickly when the first signs of COVID-19 emerged, and have increased public confidence in actions taken by the government. This has helped differentiate South Korea’s approach from that of countries like Israel, where due to a lack of any pre-existing legal framework, location tracking has had to take place under emergency legislation granting the country’s intelligence services broad and vague authorities that have inspired pushback due to fears of overreach.

Conclusion

Policymakers should avoid thinking of digital tools as a silver bullet that can bypass the need to invest in more fundamental pandemic response capabilities. Mobile apps will never replace the need for a robust testing infrastructure and effective manual contact tracing. There may be a place for digital tracking to play a complementary role in pandemic response, but only if there is evidence that the tracking would provide clear benefits to public health professionals, and only when a robust legal framework exists to ensure that data remains secure, is kept for no longer than strictly necessary, and is not used or shared for reasons unrelated to public health.

Policymakers should be particularly wary of placing too much hope on the Bluetooth tracking measures being developed with the help of Google and Apple. Apps that only collect voluntary, anonymized Bluetooth information will probably only have little effect on nations’ ability to combat the spread of COVID-19. Digital contact tracing is most effective when it empowers public health officials to leverage multiple sources of data to rigorously track potential routes of spread. Push notifications based on limited information that isn’t shared with health officials does not meet this standard, which is part of why Google and Apple’s proposal has so far been met with frustration by health officials.

Many app developers are also open about the limitations of these solutions. Jason Bay, senior director of the government department responsible for developing Singapore’s Bluetooth tracing app, recently wrote that “if you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No.” Even in Iceland, which has the largest penetration rate of all contact trackers in the world (38%), officials say the app “has proven useful in a few cases, but it wasn’t a game changer.”

While location tracking may seem attractive as either an alternative or complement to Bluetooth tracing, there are serious challenges in translating the success of a country like South Korea over to the United States. The first is political feasibility. The authorities granted to public officials under Korean law are highly invasive, and even after the loss of life and economic disruption suffered so far from COVID-19, it is unlikely that a majority of the U.S. population (or their representatives) would be comfortable granting similar powers to our own government. Korea’s success has also been dependent on easy access by investigators to other information sources like credit card records and CCTV footage. U.S. officials lack not only the authorities, but also the infrastructure to easily obtain the same information. The absence of this complementary information would make it more difficult to leverage location data in a useful way, bringing into doubt whether its collection would be worth the privacy risks. 

Ultimately, digital tools alone will not improve the management of any future outbreak. The most important common factor among the nations that have been most successful at managing this pandemic has not been apps, but competency. The countries that have suffered the least damage from the pandemic are those whose responses were fast, organized, and effective. The U.S. response has been none of these things, and a new app won’t change that.
 

William Crumpler is a research assistant with the Technology Policy Program at the Center for Strategic and International Studies in Washington, DC.

The Technology Policy Blog is produced by the Technology Policy Program at the Center for Strategic and International Studies (CSIS), a private, tax-exempt institution focusing on international public policy issues. Its research is nonpartisan and nonproprietary. CSIS does not take specific policy positions. Accordingly, all views, positions, and conclusions expressed in this publication should be understood to be solely those of the author(s).