The App Trap: COVID-19 Tracers Worry Privacy Advocates

With more governments around the world pushing the use of mobile phone apps to track potential contacts of people infected with the COVID-19 Coronavirus, the worry they could be used for surveillance is growing too.

In Australia, more than five million people have downloaded COVIDSafe, an app lauded by Prime Minister Scott Morrison, whose government has significantly expanded the intelligence and law enforcement agencies’ surveillance powers under law since being elected.

Utah is one of the first US states to try a similar approach with an app called Healthy Together, developed by a social media startup previously focused on helping young people hang out with nearby friends.

While many European countries are opting for an alternative approach using new features introduced by Apple and Google, the United Kingdom’s National Health Service technology unit (NHSx) is forging ahead withits own app t despite uncertainty about its efficacy, privacy protection and whether it is compatible with central iPhone and Android features.

The push comes as more countries are moving toward usingcell phone location or proximity tracking as a critical tool in controlling the pandemic. Critics warn that this opens the door for even more surveillance and civil liberty losses, with some kinds of contact tracing system being worse than others.

What these technologies have in common is that they are designed to alert anyone – sometimes weeks later - who may have come into contact with an infected person. In the UK, adoption of the app, which is expected to be rolled out nationwide this month, is being linked to the lifting of a lockdown imposed in March. But the UK’s plan has collided with Apple and Google’s partnership which has a more privacy-preserving, decentralised design..

“Unless Britain changes course, the companies are refusing to provide full access to a Bluetooth signal on iPhones and Android phones that is needed to measure proximity,” The New York Times said in a feature on the app’s planned rollout

The “Test, Track and Trace” app is being tested on the Isle of Wight but will require at least 60 percent of the population or 80 percent of smartphone users to download it to have a critical impact on lifting lockdown restrictions..

The contact tracing app has had a troubled development history to date, failing clinical safety and cybersecurity tests and could be a danger to people’s privacy, according to a report published in the Health Service Journal. In the wake of criticisms, the Financial Times reported that the UK had contracted developers to construct a different app that conforms more closely to the Google/Apple model, leaving open the possibility of a change in policy at a later date

GONE CLANDESTINE

Given how fast the Coronavirus raged around the world, governments are betting on technology both to supplement manual contact tracing and to supply population-level epidemiological data. Hoewever, the collection of so much sensitive health, location and associational data that has set off a debate about control , data rights and mission creep.

“There are conflicting interests,” Tina White, a Stanford University researcher who was involved in developing a privacy-protecting approach in February, told the AP.

“Governments and public health (agencies) want to be able to track people” to minimize the spread of COVID-19, but people are less likely to download a voluntary app if it’s intrusive, she said.

The hope that technology could be a game-changer to slow the spread has run head-on into privacy advocates shouting it will be another intrusive device by governments using the pandemic as an excuse for people to the apps on their phones.

Rapidly identifying people who test positive for COVID-19, tracking down others they might have infected, and preventing further spread by quarantining everyone who might be contagious is critical, governments argue.

The UK has been left with a choice whether to alter the design or risk using an app that could have major technical flaws, a wild card incompatible with science, which could skew its use and accuracy.

The UK prefers the option of a centralized database, believing it will provide more research capabilities to spot emerging hot spots and patterns of how the virus spreads to rein it in faster.

But Apple and Google are urging a decentralized approach that would protect against invasions of privacy, the UK government arguing there are other considerations, an approach that some critics have said does not rule out turning app-collected data toward surveillance.

“If privacy was the only thing that we were optimizing for then it may be that a decentralized approach should be the default choice,” Matthew Gould, the head of NHSx, the division of the NHS building the app told Parliament.

BIG BROTHER PHONE

British officials said data would not include personally identifiable information, and access would be limited to those working on the pandemic response but after a series of hearings in early May a Parliamentary committee, the Joint Committee on Human Rights, has calleds for more privacy safeguards.

Apple and Google, bolstered by academics, security researchers and privacy groups that want to restrict government data collection said a centralized database creates too much potential for abuse. Britain’s top privacy regulator, Elizabeth Denham, said a decentralized model should be a “starting point” for contact tracing, the paper said.

“It is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance,” a group of more than 170 scientists wrote in an April 29 statement opposing the British app’s design.

Germany and a number of other European Union countries prefer the Apple and Google decentralized approach, the tech companies saying they will have working on billions of phones when the software is ready in May, while France has said it will be developing its own, centralised solution.

Many COVID-19 tracking apps rely on Bluetooth, a short-range wireless technology, to locate other phones nearby running the same app.

Apple and Google have barred governments from making their apps compulsory and are building in privacy protections to keep stored data out of government and corporate hands.

The companies said only national level governments for now will be granted permission to the feature's application programming interface, won’t be allowed to collect location data, must ask users consent before collecting proximity data and also to upload information from the phones of those with the virus.

MIT Technology Review, in a bid to keep track of the apps, has created a COVID Tracing Tracker, a database which captures details of many contact tracing efforts around the world, some intensively invasive.

China’s system, for example, grabs dataincluding identities, locations, and even online payment history so that local police can watch for those who break quarantine rules.

Carly Kind, Director of the Ada Lovelace Institute, a policy research group focused on technology, told the Times that if the UK jumps the gun with an ineffective app it would undermine public trust. “A bad app is definitely worse than no app,” she said.