How to choose a coronavirus tracking app wisely

EU says privacy needs to come first, but governments are weighing multiple parameters.

In just a few weeks developers across the globe have created a flurry of mobile applications to help governments fight the coronavirus pandemic.

The question that’s now troubling European leaders: How to pick the right one?

Startups and universities have raced to design applications for “contact tracing,” which gather data on people coming into close contact with one another and alert those that crossed paths with coronavirus-infected people. Last week Google and Apple announced a joint project to help out these efforts and develop their own tech to fight the virus. Controversial surveillance companies like Israel’s NSO Group and the U.S.’s Palantir have also pitched their products at government offices.

That presents Europe’s decision-makers with a stark — and potentially disastrous — choice on which app to push to the public.

Gathering too much data opens governments up to risks of privacy breaches and public backlash. Gathering too little could fail to give them the control they seek to stem the spread of the virus. Either way, they’re putting the keys in the hands of organizations that they and their voters must trust with highly sensitive data.

The European Commission on Thursday urged governments to pick applications that make privacy a top priority.

“We are sure that it’s very useful to have such a kind of [application] in the fight against the pandemic … But at the same time we are speaking about maybe the most sensitive data, because they are collected on the health of the citizens,” Justice Commissioner Didier Reynders told POLITICO in a phone call.

Commission guidance documents endorsed a project launched by a wide group of researchers at the start of April to build privacy-friendly tracing apps that analyze Bluetooth signals between mobile phones to detect users who are close enough to infect each other — without gathering personal data or even geolocation data.

The project has since led to a series of applications nearly ready for launch in Germany, Switzerland and elsewhere.

Switzerland is rolling out its app very soon, researchers involved in the development said. Others, like Ireland, are rolling out theirs in the coming week. German researchers and others have an app that “can run right now,” according to Chris Boos, an entrepreneur that’s part of the project.

Google, Apple trigger hope and reservations

Days after the European research project launched, Google and Apple made the surprise announcement that they would join forces to help fight the pandemic. The U.S. tech giants said they would unlock their smartphones’ metrics to researchers, app designers and health authorities through a so-called application programming interface (API) in May.

A key deficiency of contact tracing apps so far is that a user would have to keep the app open on their phone for it to be able to make Bluetooth connections with other phones. Google and Apple’s move will allow such apps to run in the background.

Julian Teicke, CEO of online insurance startup wefox that’s co-developing an app for Germany, said that Google and Apple’s API will be “very helpful.”

At the same time, Teicke warned that the unprecedented partnership could help the two U.S. behemoths, whose operating systems are used on 99 percent of all smartphones worldwide, gain ever-more access to sensitive user data.

“Let’s make sure we have an independent layer in between that is not controlled by Google or Apple,” Teicke said. “No matter how ‘privacy-first’ the setup is — we’re talking about contact lists, which are even more accurate than the data that the companies have today, and we’re talking about sensitive health data,” he added.

In France, the announcement triggered similar reservations. Aymeril Hoang, a member of the scientific council advising the French government on COVID-19, told the country’s Senate that Paris is in talks with Google and Apple about accessing some functionalities to be more in control of the apps’ parameters.

“If those negotiations were to fail and we had no other choice than use Google and Apple’s turnkey solution, then we should all collectively ask ourselves … what it means in terms of tech sovereignty and independence,” Hoang said.

The discussion could flame up further as the two U.S. companies signaled they also worked on contact tracing technology built directly into their core operating systems.

Researchers split over trust

As governments assess their options, Europe’s attempts at charting a singular, unified course on tech to fight coronavirus this week started showing cracks. The community of researchers that started the PEPP-PT project split into two camps amid trust issues and a disagreement over the architecture underpinning apps.

In one corner a group of researchers from France, Switzerland, the U.K., Belgium and other countries published embryonic code to build a contact tracing app on the internet, based on a “decentralized” design. The group, dubbed DP-3T, is preparing the Swiss application to go live soon.

In the other corner, a largely German group of researchers that include Teicke’s wefox, tech entrepreneur Boos, the renowned Fraunhofer institute and others, is developing an app that centralizes more data but still abides by strict privacy protections.

A letter out Monday signed by over 300 scientists from 25 countries — including former PEPP-PT backers — argues that decentralized app designs do a better job of preserving privacy than centralized models.

The letter “recommends that decentralized approaches be adopted. Interestingly, the PEPP-PT consortium, now largely composed of German research institutions, has been promoting an opposite, centralized approach,” said Kenneth Paterson, an ETH Zürich researcher who publicly withdrew support from PEPP-PT on Saturday in a statement accompanying the letter.

The letter also has the support of researchers across institutes and universities in Canada, the U.K., U.S. and other non-European countries. Apple and Google too have shown a preference to open up their systems to decentralized apps, and some privacy authorities – including the prominent U.K. Information Commissioner’s Office – have endorsed the approach.

Keeping control

But the real fight for privacy researchers is likely to come as they try to convince lawmakers to pick their privacy-friendly apps over commercial products.

Projects under PEPP-PT, DP-3T — and with the support of Google and Apple — won’t register location data to protect users’ privacy. That’s likely to give governments less control to monitor and steer the public through the health crisis.

In the U.K., that tension has already caused the government to slam Google and Apple’s initiative because it would bar the National Health Service (NHS) from building a central database of people’s contacts.

The U.K. is already laying the groundwork to launch its own NHS app. Health Secretary Matt Hancock said “all data will be handled according to the highest ethical and security standards and would only be used for NHS care and research and we won’t hold it any longer than it’s needed.” But privacy groups and political opposition are skeptical of the government’s ability to handle the data securely.

Other governments might be tempted to opt for different solutions, pitched by a range of surveillance, monitoring and e-health companies looking to offer their services.

Apps need users

The effectiveness of tools will also greatly depend on how many people are willing to use them. “It will only serve if people trust that it helps themselves [and] that autonomy is respected,” Christiane Woopen, a German medical ethicist working on the PEPP-PT project, told a recent news conference.

The app developed by Boos, Fraunhofer and others would work if around 60 percent of the population used it, according to the researchers. In the U.K., the NHS app would need up to 80 percent uptake. In Ireland, the planned app would need 45 percent uptake to be effective, according to people involved in the rollout.

It’s not certain every country will meet those thresholds.

In Belgium, researchers this month surveyed 1,700 people on the use of apps: Only 51 percent said they would use them and 39 percent said they wouldn’t. Singapore was one of the first countries to launch a contact tracing app but only about 12 percent of its population installed it, according to the BBC.

Experts say building trust is crucial.

According to Bart Preneel, a Belgian cryptographer who is co-developing the app for Switzerland and other countries, the privacy-friendly apps “can’t be used by governments to punish people breaching quarantine measures” or other invasive details of people’s movements. “People won’t trust the system if it does, and you won’t get uptake. People will boycott the apps and so they won’t work anyway,” he said.

Governments are expected to launch massive public awareness campaigns once the apps are launched, to encourage people to download them.

Several officials stressed strongly that they don’t plan to oblige the use of the apps, but rather rely on people installing them voluntarily. According to the Commission’s guidance document, this will be key if apps are to respect EU privacy rules.

One country, Poland, has put in place an app to monitor if quarantined people abide by their confinement. But that app is distinct from the contact tracing apps intended for a wider public.

Mark Scott and Laura Kayali contributed reporting.