Will an App Tell You Who Will Give You COVID-19?

If you catch COVID-19, you can spread it before you even know you’re sick. But if you received an alert that a friend or co-worker just tested positive, you could self-isolate and keep your own potential infection from spreading.

A group of Oxford University researchers say an app that draws on a central database of your movements could be used to send such an alert to your family, friends, and colleagues, and even to the managers of public spaces, you might have infected.

“We suggest that a simple algorithm for first-degree instantaneous contact tracing in the form of a mobile phone app could dramatically reduce onwards transmission from contacts to a level that is sufficient to reach herd protection and so stop the virus from spreading in a population.” they wrote in a paper posted this week on Github (currently under peer review.)

The idea relies on the concept of contract-tracing, long used by public-health workers to control epidemics. It works like this: a person who tests positive for a highly communicable illness tries to recall everyone they may have come into contact with, then tries to notify them of their possible infection. It’s a sound principle but it doesn’t work well for fast-moving illnesses because people have imperfect memories. 

App-based surveillance and contact tracing was first tried in China, outside of Wuhan, where it had some success in reducing transmissions of COVID-19. The government required anyone who wanted to use public transportation to download the app to their phones, then enter their location and coronavirus status. The app then tracked users’ movements into buildings and transit stations by GPS and QR code (which they would use for going into buildings and underground transit systems), and uploading the data to a government database. If a user crossed paths with a coronavirus-positive person, he or she would get an alert and an order to self-isolate.

Such an approach could be particularly effective in the case of COVID-19 because, by the researchers’ estimates, some 48 percent of transmissions come from people that are pre-symptomatic. (The CDC is less certain about that: "Some spread might be possible before people show symptoms; there have been reports of this occurring with this new coronavirus, but this is not thought to be the main way the virus spreads.") What’s more, they write that it could help to compensate for a lack of adequate testing, as is the case in the United States. 

“If testing capacity is limited, individuals who are identified by tracing may be presumed confirmed upon onset of symptoms, since the prior probability of them being traced is higher than for the index case, speeding the algorithm further without majorly compromising specificity,” they write. 

Not everyone has to use the app for it to help.

“If, with the help of the app, the majority of individuals self-isolate on showing symptoms, and the majority of their contacts can be traced, we stand a chance of stopping the epidemic,” David Bonsall, a researcher at Oxford’s Nuffield Department of Medicine, said in an email. 

But Bonsall said only a governmental push would get enough people to use it.

“To work, this approach needs to be integrated into a national programme, not taken on by independent app developers. If we can securely deploy this technology, the more people that opt-in, the faster the epidemic will stop, and the more lives can be saved,” 

But the idea of broadcasting users’ movements and health status to a central database has civil-liberties and ethical dimensions. Might infected or even possibly-infected people face stigma or hostility?

The researchers say the data required to make such an app in the United States would be the same that tech companies collect on their users for micro-targeted advertising, with those individuals’ consent. In the United Kingdom, it’s a bit different. 

“We can't confirm the technology the government / national health service are using, the project is being led by a team of biohealth experts and statisticians. They are looking at solutions, including Bluetooth and GPS. It is not using contacts,” Bosnell wrote. 

One question is: would more data help the app work better and what are the practical and ethical considerations of the U.S. government requesting, or possibly even compelling, the use of personnel data to make a more effective app?

Over the last few years, multiple stories have emerged of small companies, such as Cambridge Analytica, partnering with Facebook, to acquire and use personal data for self-interest. In the case of COVID-19 and the U.S. government, that could mean that small companies that collect data on user location, as well as things like immigration status, would be able to sell data to the government under the auspices of a pandemic prevention app.

“There are smaller companies that might say to the government, ‘Hey, you can buy this from us.’ They aren’t accountable in the way big companies are,” said Michelle Richardson, who directs the Privacy and Data Project at the Center for Technology and Democracy. “That’s going to be a risky thing that people are going to miss.”

Could the U.S. government, like China’s, essentially compel users to download such an app? Or could it legally obtain the abundant data that would go into such an app to make its own contact-tracing system? Privacy laws in the United States, like the recently signed California Consumer Privacy Act, make it difficult for app developers to use people’s data without informing the individual what they are doing with it and allow users to delete their data before it can be used. But there’s a big carve-out for research in the public interest. The law says that companies don’t have to delete consumer data if that data is necessary for the company to  “Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws.”

Even if the law would be on the government’s side, a heavy-handed approach could hurt people’s trust in the app and in the government, which would be counterproductive, says Richardson. 

There is a lot that app developers can do to make apps effective without harvesting lots of personal information, she said. “This is where you would want to see creative solutions… things like using synthetic data or differential privacy controls or work to make anonymization and aggregation more effective. Hopefully, there are very smart people out there making sure those sorts of more aggressive privacy controls are being implemented here if possible.”