Covid contact tracing apps and building digital trust

SwissCovid app. Source: Keystone.

Switzerland was among the first countries to introduce the Covid tracing app in June 2020. Yet in November, the app was used by only 22 per cent of the Swiss population, according to its developers at the EPFL, citing privacy and data protection concerns.

A panel of experts came together last week at the Graduate Institute to discuss the case of Covid contact tracing apps and the complexity of digital trust. Along with speakers from the EPFL, the Internet Society and the Global Health Centre, Professor Michael Kende questioned the difference between health apps and regular apps in terms of security, and addressed the very notion of data sharing during a global health crisis.

A little history. Contact tracing is not new. Senior researcher at the Graduate Institute’s Global Health Centre, Meg Davis, explains that contact tracing is a standard public health tool. In the past, its manual form has been used very successfully in epidemic control, in the case of Ebola for example, where trained health workers interviewed individuals to identify movements during an infection, collecting data in writing.

The challenge with Covid is that once a certain number of cases is reached in any given country, this one to one action does not suffice. Widespread testing and access to quarantine is necessary. Davis further argues:

“You need to find and isolate 80 per cent of the context. In Switzerland, as of yesterday, we had approximately 2400 new reported cases a day. We would then need to find, test, and quarantine tens of thousands of people every day in order to bring the situation under control. This would require thousands of public health professionals, which explains why people have seen the digital apps as a potential solution.”

Privacy and mobile devices. There are several ways in which mobile devices can compromise a person’s privacy, starting with the recording of a person’s location, Director of Internet Trust at the Internet Society, Robin Wilton, explains.

“If that information is available to a third party, it takes very few points of location data to create a unique profile that allows you to either specifically identify someone, or to identify someone by saying, this is the same person I noticed taking the same journey yesterday.”

The other challenge is related to the technology’s security itself, where an application designed to do one thing is subsequently found to do something different.

“When it comes specifically to tracing apps, there is the added dimension that the data at stake has to do with healthcare. Therefore, in the European Union, for example, it comes into the category of sensitive personal information, which in theory should benefit from particular kinds of protection.”

Privacy and the Covid app development. The EPFL and ETH teams that developed the Swiss contact tracing app, SwissCovid, considered early on that using a GPS was not as necessary to know who a person was in contact with. The chosen option was then a system based on bluetooth as it is able to recognise other phones in proximity. Engineering a solution without privacy leakage was the objective, Head of the School of Computer and Communication Sciences at EPFL, Professor Jim Larus explains:

“We proposed a decentralised scheme, where the identifiers for most people never left their phone. Only people who were diagnosed with Covid were uploaded to a server, which then broadcasts them to everybody else's phone. The matching was done on your phone. The system is extremely private, and we had a great deal of hope for this. We thought that it was easy to explain why it was private, we thought it was easy to explain how it operated.”

But the public did not trust the app, despite the fact that it does not do more than simple contact tracing. Although it is difficult to state as firm evidence that the app is a hundred per cent efficient, as it does not replace manual contact tracing, there are many situations where it has a proven advantage, such as when using public transport. Pr. Larus continues:

“The hardest part was not building the app or the protocol, it was actually the embedding of it in the medical system. Switzerland has a first world medical system, and it was running on faxes, when the COVID epidemic started.”

This means that a positive response to the use of new tools has to be considered within a larger context, in this case, Switzerland’s digitalisation.

Digital trust is a matter of understanding. One could explain the lack of trust in contact tracing apps as a lack of information from potential users. Privacy and trust are prime examples of an incomplete predicate, Wilton argues. Trust is indeed meaningless unless one understands what one trusts the app for, and why.

In other words, it is also a matter of governance and education, to find a way to reach the public and ensure that this public understands how the technology works.

The system as a whole needs to function, Davis concludes. Strong health and social protection systems and a strong rule of law are necessary for people to develop trust that they can download an app and feel it will work for their good.