Do Contact Tracing Apps Put Privacy At Risk?

COVID-19 has hit the world hard, but as people begin to re-open after lockdowns across the country, there is some serious thought going into methods for maintaining public safety that still permit some level of normalcy amidst the pandemic.

One of the methods at the forefront of this conversation is contract tracing.

Contact tracing isn’t a new public health technique. In fact, it’s been used for hundreds of years and it can be quite effective. In fact, Germany was able to contain the spread of COVID-19 by aggressively rolling out a contact tracing program that aims to have 1 contact tracer for every 4,000 citizens. Germany went a step further with its tracing program by developing what it considers “the best contact tracing app” available in order to curb potential spread of a second wave as they entered re-opening stages after lockdown.

The country has been historically obsessed with protecting the privacy rights of its citizens and the health minister affirmed that this app was no exception to that policy. The app does not collect location data and is only triggered by proximity to other app users through Bluetooth enabled devices.

However, traditional contact tracing wasn’t widely implemented across the world because of how quickly COVID-19 spread, which forced many governments to resort to more blunt policies such as social distancing and quarantine lockdowns. Now that many places are taking steps to reopen after lockdowns, contact tracing is again rising to the forefront of the conversation and it has paved the way for an obvious tech solution — contact tracing apps.

While there are a few different models for these types of apps, the majority of them rely on Bluetooth to track proximity (and possible exposure to COVID-19) to other app users. Essentially, once a user has opted-in to the service, the app regularly sends out randomized Bluetooth identifiers like a beacon that is listened to by other users. When someone tests positive for COVID-19, they update their test status into the app and it alerts the users of other devices that have collected those beacons.

This is actually a fairly anonymous process as the beacons are not tied to anyone’s personal identity and they randomly change every few minutes for additional privacy protection.

However, part of the privacy problem is that in the wake of the COVID-19 pandemic, a flood of contact tracing apps have appeared to collect data and provide supplementary support to manual contact tracing.

While there is plenty of potential behind these apps, the sudden onset and rushed availability of these apps have some people questioning the level of security, and if their privacy will truly be protected.

Fundamentally, these apps can be built to be secure and anonymous, while still very functional in the fight against COVID-19, but it’s important to question who has developed the app and how they intend to use it.

Germany is a strong example of how contact tracing apps can be used effectively without any risk to user privacy, but there have been several critiques of other countries. In China, “the government collects the entire digital footprint of its citizens — their location data as well as their self-reported medical history — before labeling each citizen with a risk score and issuing them with a colored health code.”

That color-coded status determines a person’s ability to travel or even leave the house. It is still unclear exactly how the state assigns people a status, but while some may argue that this is a prudent step towards protecting public health, others see it as a breach of their privacy and the further entrenchment of state surveillance by the Chinese government.

Clearly, Germany and China are on opposite ends of the spectrum when it comes to protecting privacy, but regardless of how well any individual app can protect privacy, contact tracing apps appear to have a serious trust problem. This is particularly true in the U.S., where only 50% of smartphone users expressed a willingness to use a contact tracing app.

This presents a big problem for its effectiveness against the fight of COVID-19 as it’s considered that at least 60% of the population would need to adopt the usage of contact tracing apps to be effective, based on a recent Oxford University study.

With the increasing availability of competitive apps and divergent tactics for app-based contact tracing, it becomes harder and harder to know who is doing the best job for the right reasons. This breeds uncertainty in users, prevents rapid adoption, and it also means that adoption becomes fragmented across multiple apps, which ultimately reduces the quality of the data.

So how do you choose the right contact tracing app?

It’s important to consider who has developed the app, who is promoting its use, and what technology it relies on to function. That said, there are plenty of contact tracing apps that are developed by national health organizations such as the NHS COVID-19 app in the UK, or others developed in partnership between tech companies and federal governments such as the COVID Alert App in Canada.

As with any app you download to your phone, it’s important to do your due diligence before giving it access to your personal data — but the potential to help save lives and re-open economies make these apps worth taking a risk.