October 15, 2020
By Seth Rubinstein, J.D.
In prior pandemics, manual contact tracing has been key to slow the spread. Contact tracing entails conducting interviews with infected patients to identify with whom they might have been in contact, so those individuals could be notified and quarantined. Smartphones make it technically possible to digitally trace contacts made with someone infected with coronavirus. Much of East Asia began implementing this technology from the early stages of the pandemic, and in the spring there was much hope that digital contact tracing could help the U.S. “return to normal” sooner. But is this more hype than hope?
Hope: The promise of digital contact tracing
Digital contact tracing generally works in one of two ways. First, smartphones can track your location with GPS technology, making it possible to see if your phone’s location at any point overlaps with the phone of someone else identified to have coronavirus. [Footnote: the CDC’s recommended definition of a contact is within 6 feet for 15+ minutes.] Second, smartphones can use Bluetooth technology to send an anonymous, uniquely identifiable signal to phones within close proximity, enabling you to be notified later on if the person who sent a signal to your phone is identified to have coronavirus. The latter method requires less private data, as it need not track where you are on the map, but merely whether you are within proximity of an infected person. Either approach is meant to augment manual contact tracing, including interviews of patients conducted by healthcare professionals.
The coronavirus pandemic is the first pandemic to occur in the era of nearly ubiquitous smartphones. Various forms of digital contact tracing had already been deployed in South Korea, Taiwan and more before the coronavirus pandemic took hold of the U.S. in March. As the spring went on, some physicians and public health leaders in the U.S. advocated for digital contact tracing as one tool in the arsenal to reopen the economy and slow transmissions. In April, Google and Apple banded together to announce they would provide infrastructure upon which states could develop and deploy their digital contact tracing apps, on both Android phones and iPhones. Recognizing that privacy concerns would be paramount, Google and Apple proposed using Bluetooth technology which would identify contacts without requiring users’ location data.
Hype: Why has the U.S. struggled to implement digital contact tracing at scale?
Despite the initial fanfare, half a year later the U.S. still does not have digital contact tracing deployed at scale. While some states and some private organizations, including universities and companies, have deployed digital contact tracing, most Americans have not used any sort of digital contact tracing as of yet. Harvard’s own Digital Pandemic Response group, housed at the Berkman Klein Center for Internet & Society, worked with numerous groups from the spring onwards to identify relevant case studies from abroad and assess their applicability to the U.S. In many cases, however, it may be difficult for the U.S. to replicate what other countries have done — not to mention the fact that even in many other countries, digital contact tracing has struggled to take off.
Why is this? The main obstacles are (1) lack of trust, and specifically privacy concerns, (2) lack of a federally centralized approach, coupled with insufficient state resources, (3) technical issues and difficulty measuring the efficacy of digital contact tracing technology, and (4) pandemic fatigue.
Trust issues and privacy concerns
Urs Gasser, Executive Director of the Berkman Klein Center for Internet & Society at Harvard University and Professor of Practice at Harvard Law School, notes that for a skeptical public to adopt a sensitive, new technology like digital contact tracing, trust is paramount. Trust is like an onion, with numerous layers of trust required. Citizens must trust that the app works, and that their data will be secure, private, and disposed of when no longer necessary. More broadly, citizens must trust the organizations developing the technology — like Google and Apple. Finally, citizens must have a holistic sense of trust in the government at large.
These layers of trust are a tall order, and it’s no surprise that the U.S. scores low across the board. The state-by-state nature of the United States’ approach to digital contact tracing meant that people heard many different messages — messages from Google and Apple, from their state public health agencies, from hospitals, and from the federal government. Clear, consistent communication is key to engender trust during a crisis, and the U.S. failed on this front. This contrasts markedly with countries like Singapore or Switzerland, which featured much clearer, more centralized, and consistent messaging around digital contact tracing.
Serious concerns have also surrounded the issues of privacy and civil liberties. While some of these concerns are legal in nature, many reflect general cultural attitudes. Digital contact tracing apps raise concerns around possible data breaches, government or private-sector surveillance continuing beyond the pandemic, and the sharing of personal data with third parties. The recent “techlash” against Big Tech might have added to skepticism towards the effort. Recognizing this, Google and Apple rebranded “contact tracing” as “exposure notification” later in April, but this rebrand may well have been too little too late. While the Bluetooth method proposed by Google/Apple does not track any location data, unlike the GPS method, many Americans may be unaware of the difference and may still feel uneasy with an app having knowledge of their coronavirus exposure.
Finally, laws in the U.S. might both help and hurt trust. The lack of a national data privacy law means that American citizens might have less confidence than EU citizens, who may feel assured that any health data captured through digital contact tracing would be handled according to the clear and uniform standards set by the GDPR. At the same time, some in the U.S. have raised concerns around compliance with existing laws such as HIPPA and the California Consumer Privacy Act, which leave gaps relative to the GDPR, and even civil liberties enshrined in the Constitution, including the Fourth Amendment protection against search and seizure.
Federal vs. state-by-state approach
Like other aspects of the United States’ pandemic response, digital contact tracing in the U.S. has been a largely decentralized effort, with most progress happening in individual states or even individual organizations. This again contrasts with the countries that have leveraged digital contact tracing to greater effect. South Korea, for instance, implemented federal laws after the MERS outbreak in 2015 which laid the groundwork for swift, nationwide digital contact tracing efforts to respond to coronavirus. To contrast, Virginia became the first state in the U.S. to launch a digital contact tracing app on the Google/Apple protocol in August. Given that people can move between states, and the data of each state’s app might not be shared with other states, this approach would likely have lower impact than a national digital contact tracing solution. Recognizing this, in early October, several states announced they would try to combat this issue by using a shared national server, enabling them to share data from their digital contact tracing apps across states. This would, in effect, help provide something closer to national digital contact tracing coverage, though it remains to be seen how many states join this coalition.
Technical issues and efficacy doubts
Concerns over the accuracy of the technology itself have also dampened enthusiasm. Digital contact tracing apps may not identify when individuals are separated by walls, meaning they can erroneously notify a user of coronavirus exposure if they’re in an apartment adjacent to an infected individual. Given these limitations of the technology, this problem has proven difficult to fix, presenting problems for relying on these apps in the U.S. as well as other nations.
It is also difficult to identify and measure the impact of digital contact tracing, since it is generally deployed in parallel with other public health measures like manual contact tracing, mask-wearing, shutdowns, and the like. For instance, it is hard to argue that if the U.S. deployed digital contact tracing in the same manner as a country like South Korea, then it would achieve the same results, since South Korea also ran numerous other public health measures — like near-universal mask-wearing and extensive testing — rendering comparisons with the U.S. apples-to-oranges. Without such data to measure the benefits of digital contact tracing, and without a clear fix to the technical limitations, the case for digital contact tracing becomes harder to make in an environment like the U.S. which prizes privacy and civil liberties.
Pandemic fatigue
Finally, simple pandemic fatigue has hurt the chances for digital contact tracing in the U.S., particularly after half a year of restricted activity. After all, it becomes harder to make the case for an approach that involves privacy and civil liberties concerns when it is not absolutely necessary. The gradual reopening in the summer and fall has, for many, led to the perception that digital contact tracing is no longer a dire necessity in the U.S.
Future steps: Is it too late for the U.S.?
Thus far, digital contact tracing in the U.S. has been more hype than reality. Does the U.S. still have a shot at deploying digital contact tracing effectively and at scale — in a way that accords with laws, values, and technical feasibility?
Apple and Google, for one, think there is hope. At the end of August, four months after they originally announced their joint digital contact tracing effort, they significantly updated their plans to make it easier for states to get on board. Rather than requiring states to develop the digital contact tracing apps on top of the Google/Apple protocol themselves, Google and Apple now will provide the full exposure notification technology directly to users, subject to parameters specified by the state. This change could fix the problem states faced in spring and summer, where states needed their own resources to develop the app in accordance with the Google/Apple protocol — resources they often did not have. In addition, the recently announced decision by some states to share data across multiple states’ contact tracing apps might help get somewhat closer to national coverage. Measures to ensure security, privacy and eventual disposal of the data collected by these apps would also help build trust.
Even so, it’s unclear whether a sufficiently high share of the U.S. population would actually download and use the app. Considering how much the U.S. has struggled with enforcing mask-wearing, it may be hard to imagine much of the U.S. downloading digital contact tracing apps. Researchers at Oxford have noted that adoption by as little as 15% of the population would have an impact, helping to reduce case transmission by 15%, while 60% adoption of digital contact tracing apps may enough to control the virus. This is hard to achieve in practice. Ireland managed to get 40% of the country to download their digital contact tracing app after clear, consistent, centralized messaging on the part of the federal government — something the U.S. is exceptionally unlikely to replicate. Singapore has achieved 35% adoption, and Germany 20%. Even in these best-in-class countries, problems persist: technical glitches have plagued Germany’s rollout, and since the rollout of Germany’s digital contact tracing app, the share of the population believing that digital contact tracing would change the development of the pandemic decreased from 51% to 41%.
However, more targeted efforts by universities and employers in the U.S. may provide some hope. As they have greater control over their populations, and their populations are self-selecting groups which may feel a greater willingness to help the group than the public at large, semi-closed networks like universities or employers might hold insights for the U.S.. Harvard University has rolled out both an opt-in app and an opt-out, wifi-based system to help contact tracing on campus. The opt-out, wifi-based system has the advantage of greater accuracy than Bluetooth-based approaches (like the Google/Apple framework), though it only works on campus. Efforts like these, targeted to a university community, can be more nimble than state-led efforts and drive higher adoption within a semi-closed community. They can also serve as laboratories of experimentation. For instance, Harvard’s opt-out contact tracing app, MyDataCan, offers novel ways of storing user data so that users can control how or when their data is shared – an approach that could be replicated and scaled elsewhere.
The U.S. has lagged behind many other countries in leveraging digital contact tracing technology to slow to the spread of coronavirus. However, as the pandemic continues, the U.S. may still be able to learn from the digital contact tracing experiences of other countries, and its own slow start, to leverage digital contact tracing to some effect. The ship has already sailed on a coherent, centralized national approach. With clearly communicated digital contact tracing efforts that prioritize trust, however, there may still be hope to leverage this technology effectively.
Seth Rubinstein graduated from Harvard Law School in May 2021.
This post has been adapted and updated from its original form, which ran on April 28, 2021 on the COVID-19 and the Law blog.