By building contact-tracing into their operating systems, the companies could make a difference in the global pandemic response
Last week, Apple and Google surprised us with an announcement that the companies are spinning up a system to enable widespread contact tracing in an effort to contain the COVID-19 pandemic. The effort is barely two and a half weeks old, the companies said, and so there are many open questions about how it will work. On Monday afternoon, the companies invited us to call in and ask some questions, and I joined the group and did.
The basic idea is that as jurisdictions flatten the curve of infection and begin to consider re-opening parts of society, they need to implement a comprehensive “test and trace” scheme. You want to test people widely and thoroughly for the disease, as this article by Umair Irfan from Monday explains. And then, as you discover new cases, you want to see who those people may have come in contact with during the time that they were infectious.
Historically, this has been a manual process. Since the COVID-19 outbreak began, some countries have turned to technological means in an effort to enable public health authorities to find more people who may have been exposed and do so more efficiently. So far, it’s not clear that tech-enabled contact tracing has been all that effective. The system relies on voluntary participation, which has generally been weak. And the Bluetooth technology on which the system depends carries with it a high potential for false positives: it’s just not powerful enough to distinguish between cases where people were in very close proximity from ones in which they were 15 or more feet away.
My primary interest in this story — beyond the highly unusual nature of the collaboration between Apple and Google — is how effective it could be. But there are lots of other questions about how it will work that strike me as just as interesting. Let’s take a look at what people are saying, and what we learned today.
The biggest concern most people have expressed about the collaboration is that it will lead to damaging privacy violations. Democratic senators have led the charge here, sending an open letter to the companies expressing their fears. I’m less worried. For one thing, Apple and Google’s system is cleverly designed to maximize individual privacy; it avoids capturing location data and instead records only the proximity of your smartphone to someone else’s. And for another, I value my own privacy less during a public health emergency. I trust Apple and Google to prevent my personal health information from being identified as mine and shared with others, but given the design of the system, I fail to see how a breach would be catastrophic even if it did somehow materialize.
Still, if you’re the sort of person who likes to think through worst-case scenarios, my colleague Russell Brandom walks through some ideas about how data collected as part of this scheme could theoretically be de-identified. The schemes are generally so elaborate that it’s hard for me to imagine even a nation-state undertaking them, though it’s something to keep an eye on.
The second set of concerns has to do with how the system will work in practice. Apple and Google answered a lot of questions about that subject today; here are what I took to be the most consequential.
First, the companies said that by phase two of their effort, when contact tracing is enabled at the level of the operating system, they will notify people who have opted in to their potential exposure to COVID-19 even if they have not downloaded the relevant app from their public health authority. My understanding is that the operating system itself will alert people that they may have been exposed and direct them to download the relevant public health app. This is significant because it can be hard to get people to install software; Singapore saw only 12 percent adoption of its national contact-tracing app. Putting notifications at the system level represents a major step forward for this effort, even if still requires people to opt in.
Second, Google said it would distribute the operating system update through Google Play services, a part of Android controlled by the company that allows it to reach the majority of active devices. (Google says it will be available to everyone running Android 6.0, also known as Marshmallow, and higher on devices that have the Google Play store.) This is highly preferable than relying on carriers, which have historically been slow to distribute updates. It remains to be seen exactly which devices will be eligible for the update, on Android as well as on iOS. But it seems likely that the companies will be able to reach most active devices in the world — a significant feat. (Related: someone asked the companies what percentage of the population we need to use the system to get it to work. No one knows.)
Third, the companies said they would prevent abuse of the system by routing alerts through public health agencies. (They are also helping those agencies, such as Britain’s National Health Service, build apps to do just that.) While the details are still being worked out, and may vary from agency to agency, Apple and Google said they recognized the importance of not allowing people to trigger alerts based on unverified claims of a COVID-19 infection. Instead, they said, people who are diagnosed will be given a one-time code by the public health agency, which the newly diagnosed will have to enter to trigger the alert.
Fourth, the companies promised to use the system only for contact tracing, and to dismantle the network when it becomes appropriate. Some readers have asked me whether the system might be put to other uses, such as targeted advertising, or whether non-governmental organizations might be given access to it. Today Apple and Google explicitly said no.
Fifth, I’ve heard conflicting claims about the ability of Bluetooth-based tracking to measure distances. Last week I told you that Bluetooth could not distinguish between phones that were within six feet of one another, in contradiction of advice from public health agencies, and those that might be 20 or even 30 feet away. One reader pointed me to a part of the Bluetooth standard known as received signal strength indication, or RSSI, that is meant to offer fine-grained location detail.
Apple told me that the effectiveness of RSSI is blunted by various confounding factors: the orientation of the devices relative to one another, whether a phone is in a backpack or otherwise shielded from the signal, and so on. Taken together, those factors undermine the confidence of the system in how close two phones might be to one another. But it continues to be a subject of exploration.
So, to wrap up: do we feel more or less optimistic today about tech-enabled contact tracing than we did before? This post from security researcher Ross Anderson from over the weekend lays out a lot of the concerns I first shared here last week, plus some extra ones. “ I suspect the tracing apps are really just do-something-itis,” Anderson writes. “Most countries now seem past the point where contact tracing is a high priority; even Singapore has had to go into lockdown.”
On the flip side, argues Ben Thompson, there could be value in laying the technological groundwork now for expanded efforts later. He writes:
“They are creating optionality. When and if society decides that this sort of surveillance is acceptable (and, critically, builds up the other components — like testing — of an effective response) the technology will be ready; it is only a flip of a switch for Apple and Google to centralize this data (or, perhaps as a middle ground, enable mobile device management software used by enterprises, centralize this capability). This is no small thing considering that software is not built in a day.”
I still think that digital contact tracing is unlikely to be one of the two or three most important aspects of a country’s coronavirus response plan. Experts have told me that social distancing, wide-scale testing, and isolating sick individuals are significantly more important. And when it comes to contact tracing, we know that human beings often do a better job than smartphones — and some have argued that we need to hire hundreds of thousands of them to do the job.
At the same time, it’s possible to see how digital contact tracing could at least complement other, related efforts, including manual contact tracing. Compared to what, say Hong Kong is doing to test and trace, distributing digital tracking bracelets to everyone getting off the plane at the airport, what Apple and Google have proposed can only be described as a half measure. But in the United States at least, it may be the case that a series of half measures are all we will have to rely on.
