Last summer, when most countries were cherishing the quiet before the second peak in Covid-19 cases, the non-profit I was volunteering at was bustling with activity. It had developed an open-source digital contact tracing system -- one of those smartphone apps that tracks one's whereabouts and sends notifications.
Four months later, it was becoming clear how inadequately digital data and public health often intersect. Most public health officials we were meeting with did not seem prepared to include digital contact tracing apps in their operations, but governments wanted them anyway. So, their contractors were seeking the support of technology providers like the non-profit to deliver apps that were promising to slow the spread of the infection and still preserve privacy. One year later, there is limited evidence that those apps can accomplish both objectives. But in the midst of the pandemic, when the spread of the coronavirus seemed uncontrollable, it was easy to be seduced by a pre-packaged solution.
Meanwhile, my own curiosity was piqued by the wealth of information that the non-profit was able to catalyse.
This is how I came to know about the story of Hector Hugo, a 32-year-old urban planner, who used emergency call data to inform the Covid-19 response of Guayaquil, Ecuador. By the end of March 2020, the city had become the epicentre of the pandemic in Latin America. Mr Hugo came across the emergency call records of Guayaquil's residents on the internet. He filtered those that seemed related to Covid-19 infections and then coded those as points on a map, showing where the health crisis was most severe.
Then, with the help of a Spanish data analyst Carlos Bort, Mr Hugo crossed those with demographic data and was able to project the likely spread of the virus in the city. Guayaquil had a roadmap to allocate healthcare workers and resources to the most vulnerable neighbourhoods. The number of cases and deaths in Guayaquil dropped in the months following the introduction of this new system.
But data hacking is no public health strategy. In August 2020, data analysts from a development agency in Mexico were looking into digital contact tracing and exposure notification apps for their jurisdiction and reached out to our non-profit to explore feasible options. They wanted to add data analytics to their pandemic response, believing that, like in Guayaquil, it would help allocate public health resources.
"Bluetooth-based apps are quickly becoming the standard in this industry because they are highly privacy-preserving," I explained. "The app collects encrypted identification codes from other app users that happen to be around you. If one of them tests positive to Covid-19 and uploads the test result, the app sends a notification out to those whose codes it had collected. Ideally, those people get tested and self-isolate to stop the further spread of the virus."
"Does it work?" asked a local official.
"Nobody really knows, there is not much evidence yet," I replied. "A study had suggested that for it to make an impact, 60% of smartphone users need to download it."
But 60% is a high adoption level. Most of the contact tracing and exposure notification apps launched so far don't get to double digits. The most popular are now in the 20% adoption levels. That's because all data the app records remains safely stored on the smartphone, and does not go to a centralised dataset in order to preserve individual privacy.
It's a catch-22. Tech companies don't trust governments with personal information, so no data ever leaves the individual smartphone. But people don't seem to trust tech companies either, so they don't download the app in the first place. Governments don't trust themselves to be able to approach the pandemic without technology as a comfortable safety blanket, so they ask tech companies for apps. It's a cycle that's difficult to break.
While digital contact tracing made sense in theory, there was not enough evidence that it slowed the spread of Covid-19. Bluetooth signals travel across physical barriers, while the coronavirus does not. If two phones were close enough, one could receive an exposure notification even if the Covid-19 positive person were on the other side of a wall that would prevent transmission.
It might unnecessarily alarm people, but it might provide a false sense of security.
Countries like China had some success with it, but their solution was part of a large digital surveillance system. High adoption seemed attainable only with mandates requiring people to download the app.
The question was then how to nudge people into using the app. Nobody knew, so Belgium decided to ask with an open consultation. Anybody on the internet with enough digital literacy to upload a PDF into an online form could submit a comment on the design of the national exposure notification app and the policies that framed its use. It also inquired about the structure and composition of an independent oversight committee that would monitor the use of the technology.
It was an innovative approach. But the project proved more ambitious than a simple app. The contact tracing system would feed into a digital ID that acted as a pass. If one had tested positive or had been in contact with a Covid-19 positive person, the digital ID would deny access to public spaces. Ubiquitous digital readers would scan those passes and track individual movements. Cameras with recognition systems would match the identity of the pass owner to that of the smartphone holder.
It scared me. The technology of the non-profit was privacy-preserving, but the whole ecosystem planned around it was not. After such a large investment, it was reasonable to fear that this infrastructure would outlive the pandemic. ©ZÓCALO PUBLIC SQUARE
Maria Carnovale is a Technology and Human Rights Fellow at the Harvard Kennedy School and an instructor at Duke University.