Monday June 1, 2020

Comment: Contact-tracing app must be limited and transparent

While well-intentioned, the HSE’s smartphone proposal raises many questions and could have serious consequences for privacy protection

30th April, 2020
A mural in Tallaght in Dublin promotes social distancing as lockdown continues. A contract-tracing app is part of plans to ease restrictions, but there are concerns about its use. Picture: Sasko Lazarov/Rollingnews.ie

The Irish government is seeking to manage a way out of lockdown that will allow at least some of the population to return to work, lessening the economic impact of the pandemic.

In the absence of a vaccine, the predominant concern is how to prevent a second-wave surge of coronavirus cases after the current restrictions are lifted, and there is no single solution.

Serological testing for antibodies which indicate whether someone has had the virus will provide some insight into the depth of its spread through the population. However, immunity passports or certificates to prove someone is immune to it are of questionable value as the length and extent of protection from re-infection remains uncertain. They are also opposed by the World Health Organisation (WHO).

Mass testing and manual contact tracing will take too long at a time when speed in identifying and confirming new cases of the virus is of the essence to enable reopening of the economy.

In such a context, the new HSE digital contact-tracing app, which allows users to share their health data, seems like a positive initiative. This smartphone app gathers health and location data. It works on the premise that citizens experiencing symptoms of the virus will voluntarily register that information with the health authorities.

If the user subsequently tests positive, the app can use GPS and Bluetooth technologies to construct a history of the individuals with whom the user has been in sustained proximity and to automatically notify those contacts, advising them to self-isolate, without revealing the identity of the ill person. As the virus can be spread by people who are asymptomatic or pre-symptomatic, this contact-tracing app has the potential to speed up the tracking and alerting process. It certainly amounts to digital surveillance, but with the virtuous intention of protecting public health during an exceptional time.

The proposal, however, raises many questions. For a start, a large proportion of the population would need to download and use the app for it to be effective. As it is voluntary, we cannot be certain how extensive the take-up will be. Furthermore, in countries where these apps have been used successfully, such as China, Hong Kong and Singapore, usage is combined with other surveillance apparatus. China, for example, employs extensive CCTV facial recognition networks, permission systems to leave your residence and drones to monitor adherence to social-isolation rules.

Singapore’s TraceTogether app uses Bluetooth to track individuals who have been within two metres of a person diagnosed with the virus for at least 30 minutes, but their contact tracers also have access to other data sets, including public-transport and credit-card data. South Korea has been successful in containing the spread of the virus, but it undertakes that tracking using a combination of GPS data, CCTV networks, travel and medical records and credit-card data. None of these is proposed for Ireland.

In South Korea, a data-analysis platform is used to automate the process, one that can produce detailed tracking data on individuals with Covid-19 in less than one minute. In such scenarios, phone-based digital contact tracking is just “one more element” in an existing arsenal of national surveillance initiatives and tools. And even then, these surveillance initiatives are ineffective unless combined with widespread rapid testing to confirm new cases of the virus quickly.

The forthcoming HSE app is a voluntary system with anonymous users, which leaves it open to the possibility of abuse from people fabricating symptoms or trolling. Diagnosed individuals may be too ill to use their phone to register information. And notifications can potentially instil unnecessary fear and anxiety in members of the public who are perfectly well.

If you are waiting in a supermarket queue, standing two metres apart from other people, would you want to receive a notification that some person in that queue has now been confirmed as having the virus? Are you really at risk of infection in that scenario and should you be forced to self-isolate at each notification? As we await a vaccine, could this information be used to deny you access to particular stores or other facilities in the future?

If you think this type of scope creep couldn’t happen here, remember there is a long history of governments using crises to make surveillance more palatable. Just think of post 9/11.

Like keeping the public safe from terrorism, protecting public health is a compelling argument for pushing through solutions that infringe on the citizen’s right to privacy, and it is difficult to roll back digital surveillance once it has become normalised.

The British media recently reported on a leaked draft government memo regarding the NHS contact-tracing app. The memo mentioned the option of allowing ministers to enable de-anonymisation should they judge that to be proportionate at some point. This would be achievable by using the device ID that is unique to every smartphone to identify the user. Why such identification might be necessary, or the scenarios in which it might be considered proportionate to do so was not specified.

The digital transformation unit of the NHS quickly denied that there were plans were to enable de-anonymisation, but the fact that a government memo even mentioned such a possibility indicates what is at stake – namely rights we have long taken for granted.

Whether or not the voluntary HSE digital contact-tracing app will help in the battle against Covid-19 remains to be seen, but what we can be sure of is that public buy-in will be a test of the extent to which the state can command the trust of its citizens.

The recent debacle over the Public Services Card, including the statement by a government minister that the card was “not compulsory, but was mandatory to claim social welfare benefits” emphasises both the value that the public place on transparency and accountability when it comes to data governance and the lack of clear thinking at the political level. If this contact-tracing app is to be successful, rigorous safeguards, transparency and accountability must underpin the parameters of this data-sharing exercise.

There must be public oversight of the gathering and use, storage and sharing of this data, as well as a clear path to the deletion of old data and the discontinuation of this facility when the pandemic is over. There must be legal limitations and transparency on the purposes for which this sensitive health and location data can be used, where and for how long it is stored, and who will have access to it. We cannot end up with scenarios where individuals’ Covid-19 history has been shared with a private company and such information is used to deny entry to a store or building.

It is precisely because this is an extraordinary moment that governments must adhere even more strongly to citizens’ data protection rights. This app applies at a national level for now, but as we inevitably return to more normal working and travel, the need to move towards a single Covid-19 contact-tracing app that is coordinated at the European level will become more pressing. We have to get this right now, not in retrospect.

The experience of South Korea and Taiwan shows that transparency is the key to public acceptance and the success of contact-tracing apps. It is no coincidence that these are also countries that have invested heavily and pre-emptively in their public health services. And that is the real answer.

We tend to focus on technological solutionism. Rather than focusing our hopes on contract-tracing apps providing us with a techno-solution to the crisis, we need to focus on proper investment in public health.

For now, containing the spread of this virus is unlikely to be achieved through a contact-tracing app no matter how well-intentioned. It will be through our collective conscientious actions – staying home as much as possible, using social distancing when outside our homes, and regularly washing our hands.

Regina Connolly is professor of information systems/digital transformation in Dublin City University Business School. She is also a funded investigator in Lero, the Science Foundation Ireland research centre for software

Related Stories

Irish and British universities have discovered the fragility of their reliance on the huge fees paid by a seemingly limitless pool of international students, and will also have to ask themselves whether they are educational institutions focused on the public good, or primarily businesses focused on revenue raising

Deirdre Heenan | 1 day ago

The government instantly slapped down Michael O‘Leary for questioning the requirement of air travellers to self-quarantine for two weeks. But the lack of debate about the trade-off between Covid-19 risks and long-term damage to the economy is frustrating many businesses

Ian Guider | 1 day ago

It’s understandable that Michael O’Leary and other business leaders are lobbying for restrictions to be lifted immediately, but they cannot be allowed to undermine Nphet or determine policy

Elaine Byrne | 1 day ago