Contact-Tracing: Lifesaver or Liability?

Posted by graham.westbrook
April 27, 2020

Share Article

Across the world, governments and health authorities are working together to fight the COVID-19 pandemic and help people get back to their normal lives. The stakes are so high that competitors, Apple and Google, announced they are teaming up to create a coronavirus tracking app which will help them manage the current crisis. That got us asking, can new technologies really help in this fight? And if so, at what cost? 

What is contact-tracing?

Contact-tracing means tracking people infected with a disease and collecting information about those they’ve come into contact with. It has been used for decades by public health authorities to manually track the spread of disease such as Ebola virus disease, tuberculosis, measles and HIV. It has required phone calls and paperwork and manual effort to trace contacts, but Apple and Google are considering alternatives. 

Contact-tracing via smartphones

The two giants teamed up to develop an app which will help trace potentially infected networks of people. It’s actually not too complicated. Basically, instead of tracking down all relatives, neighbors, contacts and dog-watchers of someone diagnosed with coronavirus, your smartphone would do it for you. The app proposes to use Bluetooth Low Energy technology available on iPhones and Android smartphones, making it accessible for many people around the world.

The way Apple and Google are proposing, an app or operating system update would allow you to opt-in to bluetooth low energy technology in your settings to share an anonymous key with nearby smartphones. The idea is that if one person tests positive for coronavirus, that person’s key will be flagged, and then alert all the other keys it’s come into contact with so people can self-isolate, stop spreading and seek care. IF everyone with smartphones participates, it’s like a covid-tracking machine. If not, it’s less effective.  

The app will be available for downloading in May and will be compatible with iOS 13 and Android 6 smartphones. In the months to follow, all Apple and Google smartphones will have the app built in.

Security Implications of the app

As soon as Google and Apple announced the news, they encountered waves of criticism. 

Users are worried about the implications the app may have on their privacy. Their concerns range from privacy infringement to digital dictatorship. Will authorities want to track location and other private information, too, to better analyze virus hotspots and spread? Couldn’t those databases be leaked or breached? What about China? There, contact-tracing means sending location updates to the police, storing your temperature data and scanning your face or a QR code to make sure you have a greenlight to use public transportation or check-into your own house. 

Sound like science fiction? It isn’t. So we feel really passionate about getting the word out and opening up a discussion about contact tracing, here and now, so you can make an informed decision.

Cost/Benefit Analysis

Here are some things to think about so you can do your own cost/benefit analysis… 

  • How the data will be collected and used
    • In a joint statement Apple and Google made clear that no data will be collected without the explicit users’ consent. In fact, users will need to download the app to use it, and if they buy a phone with the functionality built in, they will have an option to opt out. The identifying beacons will change every 10 – 15 minutes so they will not allow to follow anyone’s movements. The data they exchange will not contain information on location – what will be collected is the proximity to other devices, not the location of devices. What’s more, the data will be used only when a user is infected. And in this case, it will only be accessed by the health authorities and only for the COVID-19 pandemic management.
  • Will my data be confidential?
    • According to the rules, public health authorities must do everything they can to stop the pandemic. At the same time, when it comes to our health, we have the right to confidentiality. Can the app compromise it? The app’s creators assure that the contacts will only be notified they have been exposed to an infected person, without giving out the person’s details.
  • What about security of data?
    • This seems to be the biggest issue as we all know there is no such thing as an unhackable system. And if the security is compromised, how and by whom will the data be used?
  • How to manage false positive and false negative results?
    • This is another big challenge, as entering wrong data could provoke huge chaos. But Apple and Google are already working on a system which will enable doctors to give patients a code they would need to enter in order to send information about their results to other users. This would make the system more reliable.
  • Can the app raise the fear of coronavirus even more?
    • The virus does not work beyond walls, but the Bluetooth does. When you hear you were exposed to the virus, it means that an infected person was in the same building as you but could have been on a completely different floor.

Security apart, can the app really help?

The technology is new and is still being developed. All questions and discussions around it are extremely helpful, as they allow the app’s creators to challenge the system and find better solutions. As Apple and Google say, “there has never been a more important moment to work together to solve one of the world’s most pressing problems”. And it seems the two giants are doing everything they can to create a system that would be secure and trustworthy.

Security issues apart, many health professionals are worried the app will not be that useful. For it to work well, it needs to be used by a huge number of people. And the users need to have greater access to coronavirus tests in order to know whether they were infected. These two issues alone show that the app, however safe and comprehensive, may have serious limitations.

The future will show whether the app will really help. But it is good to know the pandemic is being addressed at different levels and by so many. 

Decision Intelligence: How to Make a Decision about Contact Tracing

  1. Understand Your Values | Ask yourself: How much risk am I willing to accept with COVID-19 trackers? How much data is too much?
  2. Consider potential actions | Answer: What if there were no COVID-19? Could anybody convince me to send my data to other smartphones, even anonymously?
  3. Choose default | Default decision example: Don’t use contact-tracing | Alternative decision: Opt-into contract-tracing, if I feel that my privacy and concerns from above are addressed
  4. Find quality sources that could change your default | Laws? New research? Trusted advice?

Subscribe To Learn How To Prevent Cybersecurity Breaches

Additional Reading