When people mention “Covid tracking apps” it would be useful to first define what is meant by “Covid tracking app”. There are many approaches in use and many that are proposed. The various methods are remarkably different. When you hear that “Country X used a tracking app and they have fewer cases”, this does not mean they used a tracking app like you have in mind.
Most apps use location data provided by the cellular network itself or on GPS/Wi-Fi position fixes stored on the phone and shared directly with public health authorities. Some use the data for contact tracing, coupled with free Covid-19 testing, while others use location data to enforce strict geo-fenced quarantine procedures that if violated, may result in arrest and imprisonment. Few existing apps use close contact tracing based on Bluetooth.
Contact tracing apps, by themselves, appear to provide little value. As we will see, to be useful there needs to be supporting infrastructure outside the app – such as Korea offering Covid-19 testing to those in close contact. And the app must be installed by nearly all smart phone users (and this will miss about 15% of phones that are not smart phones). Most countries are not using phone-based apps to track location – they are using the phone network to report locations on 100% of phones in use, which is very different than voluntary installation of a tracking app.
Consequently, when you hear someone refer to “contact tracing app”, you need to ask them to define what they mean by “contact tracing app”.
What follows is a review of various “contact tracing” apps used in different countries.
Google – Apple Covid-19 App
Their proposed app concept uses Bluetooth Low Energy and Received Signal Strength Indicator (RSSI) to estimate distance between phones (which is not very reliable distance measure in many situations). The phone creates a log of other phones you may have been in contact with. If someone tests positive, later, you will be notified that your phone has been in close proximity and you may need to self quarantine for 14 days.
Singapore is the only country (as best I can tell) that has used a similar technology for tracking. As of mid-May 2020, the UK’s NHS is trialing a tracking system based on similar technology.
A problem with the BLE model is that it cannot distinguish between actual close contacts, and contacts separated by a barrier, such as hotel wall, an apartment wall, the car next to you in a parking lot or traffic jam, or while sitting outside Starbucks drinking coffee – while the person testing positive was sitting on the other side of the window, inside the shop. Your risk is zero in these situations.
One way to handle false positives would be to immediately offer free Covid-19 testing to close contacts (this is what Korea does) such that 14-day quarantines would not be mandatory.
BLE uses a low power (1 mw) signal that is normally used for up to 10 meter connections. To make this work for tracking near by contacts – and exclude those across the street, for example – they check the phones Received Signal Strength Indicator (RSSI) value and use signal strength to estimate the distance. For a variety of reasons, RSSI is a crude approximation of distance and can be off by a lot due to signal blockage (path loss) and reflections in the environment. When used “in the clear”, RSSI can work “okay”. But when used in a typical indoor environment filled with clutter, the RSSI is not a reliable distance indicator.
For this system to work, many people need to install the app. An estimated 81% of adults in the U.S. population have a smart phone. If half of them, say 40%, install the app, then the probability of person 1 having the app is 40%, and the probability of person 2 having the app is 40%. The probably of person 1 and person 2 (any person you meet) both having the app is .4 x .4 or 16%. Is that sufficient for useful contact tracing? If only 20% install the app, then the probability any two people have the app is 4%. And this does not take into account children who do not have smart phones.
This article quotes unnamed “experts” saying at least 60% of smart phones are required to download the app. Then, that would be .6 x .81 or about 48% of the population would have the app. The odds of two people coming together is then about 25%.
Is Catching 25% of Potential Contacts Enough?
There is a quote in this report that a model (based on numerous assumptions) suggests this is the minimum necessary level to reduce the spread just enough and eventually keep R-0 below 1.0. (If this is true, this also implies less draconian measures than everyone locked down in their homes would suffice.)
There are potential privacy issues with a system like this as well. For example, leave your phone on a table with a video camera running. A day later you are notified of a contact. You then review the video to see who that contact might be.
Could the U.S. government mandate installation of these apps on your phone? Could the government mandate that everyone own a phone and that they carry it with them at all times?
Public health officers believe they have unlimited power (in my state, they do, under the law) unconstrained by laws, regulation or Constitutions – so perhaps they will try to mandate that everyone have a smart phone, on them and turned on at all times.
Keep in mind that many countries are, in fact, mandating use of these apps. In some cases, employers are requiring their use to return to the work place.
UK’s NHS App
NHS COVID-19: The UK’s coronavirus contacts-tracing app explained | TechCrunch– Their self implemented app uses the BLE approach, and allows users to self report being sick, which then alerts others who may have been in close contact. The problem with self reporting is that anyone can then claim to be sick after, say, riding the subway, visiting a coffee shop, walking through a mall – and just like that, huge numbers of people may be falsely identified as having been in contact. The Google/Apple approach envisions their app being coordinated by public health agencies and the designation of someone being sick would be at the discretion of public health officers; you could not self report an illness without confirmation from public health.
Korea combines location data, cell site tracking data, credit card purchase data, hotel and lodging data, surveillance video and far more in a vast surveillance dragnet, and tracks contacts within 100 meters of your location. This can result in a high false positive rate – however Korea offers Covid-19 testing upon notification. With widespread testing, most did not need to be quarantined. This suggests tracking must be combined with widespread free or low cost Covid-19 testing if it is to be widely used. Having testing available would be an incentive to use a phone-based contact tracing system.
Also, because Korea’s “app” is the network monitoring all phones plus additional data sources, their source data is based on 100% of all operating phones (even older, non-smart phones). Network-based location tracking uses a variety of methods including cell site base staton location, Angle of Arrival, Time Difference of Arrival, signal strength, triangulation and more – to identify locations down to about 100 meters (which is the contact radius used in Korea). These techniques were originally developed for Enhanced 9-1-1- over wireless, to give 9-1-1 dispatchers approximate location of a caller.
Iceland’s tracking app records your location on your phone, throughout the day, and stores your location data for 14 days. The app requires registering your unique ID number with the government. If you are diagnosed with Covid-19, then the Icelandic public health authorities will contact you and ask to access the location records stored on your phone, which they will then use in attempting to track contacts with other people. This system is not based on Bluetooth.
19 countries use cellular networks to track all phone users and some, like Taiwan, use it to draw a “geo fence” around you. In Taiwan, if you are mandated to quarantine, and if you turn off your phone or leave your home without your phone, the police will arrive within 15 minutes.
Hong Kong uses both a smart phone app and a wrist band on you – your wrist band must be connected to your phone at all times. If you turn your phone off or do not carry your phone with you at all times, the authorities will be notified. Violating quarantine carries a large fine and up to six months in prison, and transfer to a government run quarantine facility.
Singapore uses a Google/Android-like BLE tracking system and stores all data on your phone. However, if you are contacted by a public health officer, you are required to turn over your tracking data. If you refuse you may be criminally prosecuted. Use of the app itself is voluntary, however. This is the only existing tracking system that uses BLE.
Just 12% of smart phone users ever installed the app making the probability of contact equal to .12 x .12 or .014 or about 1.4%.
You must use your phone to send a selfie photo from your home, to the authorities to show that you are quarantined.
Photos must be sent every hour between 7 am – 10 pm. If you oversleep, you are in danger of being in violation of quarantine.
Another country sends a text, at random time intervals, and you are to respond with a selfie taken in your home. A problem with this is that some people were a sleep when the text was received and did not respond within the few minutes required for a response.
Russia, together with areas in China, have used a system where you must scan a QR code when entering various locations. This confirmed loation is then logged in a cloud-database. As with network tracking, this is a system where the government maintains a detailed log of your activities.
A MIT developed app records and tracks your location, with all data stored on your phone. You can interrogate the database to see if you passed by a location that public health has identified as possible contact source (these would be doctor-verified Covid-19 confirmed patients to reduce the chance of spoofing the database). No location data leaves your phone.
Apps Do Not Track “Across Time”
Another problem with contact tracing apps is they cannot detect contacts across time.
Another problem with contact tracing apps is they cannot detect contacts across time. Some one sits on a bus seat or commuter light rail seat, coughs. Then gets up and leaves. Another person boards and sits in that seat and touches it with their hands. The BLE model is unable to detect this contact. Considering that the NYC subway is now thought to have been a major vector for diseases transmission, this is a serious short coming.
Another example – some one sits at a table at Starbucks, coughs on the table a few times and then leaves. 3 minutes later, someone else sits at that table and touches their hands on the table and later scratches their nose. The contact tracing app cannot detect surface contamination scenarios across time. While Starbucks might clean tables frequently, there is no guarantee.
There is no way to solve this problem using a BLE contact algorithm that does not store actual location data.
What some experts say
“It looks very messy,” Douglas Leith, a computer scientist at Trinity College Dublin, says of recent data he collected using a version of Singapore’s Bluetooth-based TraceTogether app. He and Trinity computer scientist Stephen Farrell found that when people sat across a table from each other, signal strength was much lower if their phones were in their pockets than if they set the phones on the table. Sometimes, the strength of the signal increased as people moved farther apart—potentially because of reflection off of metal surfaces such as supermarket shelves. (The results have been posted online but not yet peer reviewed.) Leith worries Bluetooth-based apps will fail to alert people of risky encounters and flood them with false alarms.https://www.sciencemag.org/news/2020/05/countries-around-world-are-rolling-out-contact-tracing-apps-contain-coronavirus-how
Privacy and Public Shaming
Korea’s public health shares a map of confirmed cases – in hopes that people might see that they had contact. However, this led to Internet sleuths tracking down – and publicly shaming – those diagnosed with Covid-19.
Other countries provide public announcements of who is in quarantine – and asked friends and neighbors report quarantine violations to authorities. In some cases, addresses and photos of those in quarantine – or diagnosed – have then been shared on social media and used to publicly humiliate the sick.
That some countries chose these approaches to quarantine enforcement will act against public acceptance of phone tracking by citizens in countries where heavy-handed approaches will not be tolerated.
Would we have public shaming in the U.S.?
On local Facebook community groups and NextDoor.com we already have public shaming. I have seen people post commentary and photos of “suspicious” persons, 3 young children playing at a park (wondering if they should have called 911 to report this to the police), accusations about those wearing masks (when it was politically incorrect to do so), wearing the wrong type of mask, or now, accusing persons of not wearing a mask of being “homicidal”, and publicly shaming businesses that chose to enforce a mask requirement or those that chose not to enforce a mask requirement, and so on. We already have public shaming in the U.S.
The EU is constrained on what it can do with smart phone tracking apps due to the General Data Protection Regulation which provides strong privacy protections to EU citizens. In the U.S., only California has a GDPR-like regulation on data collection. However, the U.S. does have other laws including the Children’s Online Privacy Protection Act (COPPA), which has strong rules against collecting data on children, and the Foreign Intelligence Surveillance Act that prohibits the government from collecting electronic communications of U.S. citizens. And with COPPA, even if permission was granted to collect data on a child, a guardian may rescind collection at any time and request all data be deleted and never again collected. These add complexities to the use of smart phone-based contact surveillance apps in the U.S. and especially to using network-based cell tracking of all smart phones.
There are proposals to use smart phones in other ways too. One is to carry a digital certificate proclaiming your heath. You would have to share this certificate in order to enter public spaces or board public transit or airline flights.
There is another proposal (unknown if serious) for which you would specify a set of close contacts, say 10 people. This would become your “social bubble” (such as extended family) and you would be limited to close contact only within this social bubble. A smart phone tracking app would report to the government if you violate your social bubble boundaries. This government surveillance would be “sold” to the public by offering families more freedom than being under house arrest for months on end.
Many worry this pandemic will unleash an increase in government surveillance and mandated tracking of everyone’s movements and associations, 24 x 7, long term. This is not far fetched – the FAA currently has a pending rule making that would mandate real time (once per second) logging into the Internet of all flights of consumer toy model aircraft flown by anyone including children in their backyards or inside their homes.
Do Contact Tracing Apps Work?
Many claim contact tracing apps slowed the spread of Covid-19 in parts of Asia. However, most claims like this are based on correlations that are often disputed by other data. For example, I have read that most people in Taiwan cover their faces, therefore, the lower incidence of disease in Taiwan is due to face masks. I read of another country that established a lock down early and has a low incidence, therefore an early lock down leads to success. But then there is Peru, a nation that
- established one of the most strict lock downs in the world,
- started their lock down before they identified a single case,
- enforced lock down with police and military checkpoints throughout the country,
- Gave face masks to citizens.
- has an excellent health care system
And yet they have the second highest incidence of Covid-19 in all of Latin America (only Brazil, which did nothing, is worse).
As Peru’s situation illustrates, it is easy to draw probably incorrect conclusions by looking at data selectively.
Do contact tracing apps work? Korea might be the only country that has used contact tracing via phones successfully – but it relies on a substantial “outside the app” supporting structure and network surveillance of 100% of phones to make it work, combining tracking with a large public health tracing system and widespread disease testing.
Phone-based contact tracing is a population wide experiment. Korea thinks its useful, Iceland not so much. But their systems are very different.
To be useful in North America or the EU requires widespread voluntary adoption. (Even though Google and Apple will put the code in future OS updates, it must be voluntarily enabled.) If we achieved 50% adoption, it would detect close contacts of 16% of adult intersections. Is that sufficient to be useful? Again, Korea’s data base was 100% of all operating phones (not just smart phones) tracked by the network itself, not by user installed apps.
Our best possible scenario is for all 81% of smart phone owning adults to have a BLE app installed (but we will never get that high). Even then, we can only track up to 65% of potential contacts – assuming they have their phone on them. Two days ago I made a quick trip to a local store – and of course, forgot my phone, at home on my desk. Have you ever left your phone in your car? Delivery people leave their phones in their vehicles when they leave a package at your home or at a business. These become missed opportunities.
Ultimately, tracking relies extensively on traditional public health contact tracing and testing in order to actually work.
If these “outside the app” services are not available, is voluntary smart phone app-based contact tracing useful?
My guess is probably not.
With likely adoption rates being low, lack of trust in tech companies, expectations of privacy plus legal constraints, problems with false positive and false negatives, and that our public health infrastructure cannot keep up now – contact tracing apps may not be so useful in the United States.
Others think – based on models – that if enough people install tracking apps, and if the tracking apps work, and if the disease spreads the way they think it spreads (this understanding changes over time) – then even a small pool of app users might be sufficient to reduce the spread and keep R-0 below 1.
- “App developers are creating tools to monitor people when they shop and work, despite lacking proof that it works or has safeguards to protect your data.“
- “The American Civil Liberties Union has pointed out that privacy and public health go hand in hand: if people don’t trust the technology to protect their data, they won’t use it. “
“lacking proof that it works” – supporting evidence is so 2019. If someone says it’s a cool idea, then what ever!