COVID-19 apps hampered by practical and privacy concerns

19 June 2020: Governments around the world are racing to implement COVID-19 track and trace apps to ease the path out of lockdown, but are struggling to make them work.

Track and trace apps aim to identify people who have been near anyone with symptoms or have tested positive for the virus, using Bluetooth technology. Close contacts can then be told to self-isolate and thereby reduce the spread of the disease.

However, while the idea is simple, governments are struggling to make them work effectively. The UK app has been in pilot stage since May with no date for a wider rollout and reports of a changing strategy. Other countries have pulled their apps or are reporting significant issues.

Privacy concerns

The first challenge is privacy. Given that the apps can share data about contacts and locations, depending on how they are built, this can generate a lot of concerns about surveillance and breaches of privacy. Norway, for example, fell foul of privacy protections; the Norwegian Data Protection Authority sharply criticised its app. The app was collecting location data from phone users, which was argued to be a very intrusive measure that was not justified. The app was withdrawn on the 15 June and associated data deleted. Amnesty International has criticised the apps in Bahrain and Kuwait for the same reason.

Another issue in the privacy debate has been the use of centralised apps rather than decentralised approaches. Centralised apps hold data and do any risk assessments about contacts on central servers, rather than doing it on phones. It enables government agencies to do more analysis about the spread of the virus but raises many more concerns about who has access to what data and how they use it.

Google and Apple have released a solution which supports decentralised apps and enables high levels of privacy. Apps that use this approach are now starting to roll out, particularly across Europe. Germany, for example, launched its decentralised app on 16 June. Italy announced the full rollout of its app following a pilot in its northern regions. They hope that the privacy-centric approach will encourage adoption.

Practical issues

There are also a lot of practical problems with using a centralised approach. The Google/Apple solution is optimised to work on their devices, whereas central versions are not, which creates a lot of performance issues, such as draining batteries. There are also significant issues with the 'handshake' between phones, whereby the users' identifiers are exchanged. Locked i-phone screens create particular problems, and data from Australia suggested that in some cases, the handshake only happened 25% or 50% of the times that it should have done.

Interoperability is another issue, especially across Europe as citizens start to travel again. The EU has released technical guidance to enable decentralised apps to operate cross border and support safe travel. But enabling decentralised apps to share contacts with centralised apps will be more difficult. This is a concern for France, for example, because it has taken a more centralised approach and therefore may not integrate with the decentralised apps of countries such as Germany and Italy.

Impact on adoption

One result of these issues is that people will be more reluctant to download and use the app. While experts have downplayed the initial thinking that suggested 60% adoption would be needed for the app to be effective, clearly the higher the adoption, the better. And the signs to date have not been too promising. For example, only 43% of Germans said that they would be willing to adopt the app when it was launched.

Singapore's app, TraceTogether, has been operational since March but has been adopted by just 25% of the population. In a change of tack at the beginning of June, the government started testing a wearable token. It could be attached to a lanyard or kept in a bag, doing the contact tracking instead of the app. This avoids some of the technical issues found with iPhones, and makes it more inclusive, as individuals do not need to have a smartphone to use it. If the trial is successful, the government could issue the device to all citizens.

As more apps move into full operation over the coming weeks and months, it will be interesting to monitor success stories, as well as failures, and see how many citizens are prepared to download them in practice.