For states’ COVID contact tracing apps, privacy tops utility

The digital contact tracing effort in Virginia is 2 million phones strong. Roughly a quarter of the adult population has downloaded the state’s COVIDWISE app or opted in on their iPhones to receive exposure notifications. Almost 26,000 times, a notification has been sent to let someone know they were likely exposed to a person with COVID-19.

But that’s the bulk of the information the state health department can glean.

The system doesn’t track user locations, so officials don’t know where exposures happened, according to Jeff Stover, an executive adviser to the commissioner of Virginia’s Department of Health. Officials can’t follow up on notifications to see whether exposed residents are isolating. Nor can they pinpoint potential hotspot locations. 

“The fact that we do not collect name or location data makes it a little more difficult to evaluate effectiveness,” he said.

Yet Stover and other health department officials say the limited data is the tradeoff required to assuage privacy concerns while still using the technology to slow the virus’ spread.

“I think the privacy concern of individuals is real,” he said. “It is a real issue and something we have to make sure we are getting right. I think we did do this right.”

Over the past year, 24 states and Washington, D.C., have spent millions developing and promoting the Apple and Google-based apps or systems. The tech giants made the basic platform free, but states have spent anywhere from $9,600 in North Dakota to $3 million in Washington state on app development and marketing.

More than 28 million people in the United States have downloaded the mobile apps or activated exposure notifications on their smartphones. The systems use Bluetooth technology and are both voluntary and anonymous.

Critics say the technology has overemphasized privacy at the cost of usefulness.

“I have yet to see any convincing evidence that they’re worth it,” said Ryan Calo, a University of Washington law professor who has written critically about the apps for months and testified in front of a congressional committee last April, in an interview with Stateline.

“A lot of money, a lot of attention, a lot of oxygen has gone into developing this app. That time and money should have been put other places,” he said, such as testing and manual contact tracing.

The states that haven't gone the route of digital contact tracing cite a range of reasons, from privacy concerns to a preference for manual contact tracing.

Still, even as the COVID-19 vaccine supply ramps up, the number of cases drops and states begin loosening restrictions, a few states have recently launched or are still planning to launch contact tracing apps. 

State officials and experts argue such systems add to their toolkits. They say the apps help to reach younger people and provide an alternative for those skeptical of traditional contact tracing, which relies heavily on public health employees reaching people by phone. And they say the technology has a role to play as Americans begin to travel again -- and face the uncertain effects of virus variants.

“There is a possibility that we could have another spike in cases coming up later this summer or in the fall,” said Sam Gibbs, deputy secretary for technology and operations of the North Carolina Department of Health and Human Services.

He hoped the state’s app would draw 500,000 people; it’s been downloaded 785,000 times.

“This is a time where we don't want to let our guard down,” Gibbs said. “We need to continue to be conscious of the disease even if we have been vaccinated.”

‘The perfect app would have failed’

In spring 2020, as states began shoring up responses to the pandemic, state officials realized cellphone data could be used to track the spread of COVID-19. Privacy advocates balked. Polling showed Americans were divided on whether it was acceptable for the government to use phones to track people who tested positive for the virus, according to the Pew Research Center. (The Pew Charitable Trusts funds the center and Stateline.)

In response to the public concern, Apple and Google forged an unlikely partnership to develop a form of digital contact tracing with a tamer name—an exposure notifications system. The Bluetooth-based setup is opt-in only and anonymous.

When a person opts in to exposure notifications, their phone emits a signal that is exchanged with nearby phones that also have opted in to the system. If a person tests positive for the coronavirus and enters a code from a public health authority into the system, notifications are sent to people whose phones picked up the infected person’s signal in the previous 14 days.

Codes change regularly, and the warnings are anonymous. You’re told you were possibly exposed, but not where and by whom.

Google’s Android phones use an app that each user must download. Apple offers apps but also has integrated the exposure notifications system into its operating system, iOS. States can use that to send notifications to users, encouraging them to opt in, without requiring them to download an app. 

Only public health authorities can activate the system.

“This was architected in a way to secure privacy,” said Calo, the Washington professor. “They sacrificed the ability to effectively measure if it worked.”

According to state health departments, the metrics available to states to gauge success are the number of people who download or activate the system, the number of times state-generated codes are used to notify possible exposures and the number of exposure notifications that are sent.

Some state health officials acknowledge the shortcomings of the apps. Gibbs, of North Carolina’s health department, said the state government is typically data-driven. “This particular program doesn’t give us the level of detail we use in other programs,” he said.

But knowing 785,000 residents have downloaded the app, officials can assume those people are more likely to be cautious, he said. “There are a lot of soft outcomes to this that we can’t really measure.”

Most state health departments contacted by Stateline said digital contact tracing complements manual contact tracing.

Wyoming, for example, had about 7,000 people use the app at its peak, but only about 75 of them have used a code to broadcast potential exposures, according to Kim Deti, a health department spokesperson. Instead, she said, the state relies primarily on in-person tracing.

“We have continued to consider phone interviews by trained epidemiologists with cases to identify those at high risk of exposure, followed by direct notification of an exposure by an epidemiologist, to be the gold standard of response,” Deti wrote in an email.

There are other barriers. One in five U.S. adults don’t own a smartphone. Of Ohio’s decision not to make an app, “Equity concerns were a factor, as a person must own a smartphone to use these apps or services, possibly leaving vulnerable Ohioans without access,” said health department spokesperson Alicia Shoults in an email.

Health departments in Mississippi and Texas cited privacy and accuracy concerns in deciding not to use digital contact tracing.

The one-two punch of politicized pandemic restrictions and early privacy concerns likely turned state officials away from digital tracing, said Brian Ray, a professor at Cleveland-Marshall College of Law and director of the school’s Center for Cybersecurity and Privacy Protection.

“I'm pretty confident even the perfect app would have failed,” he said. “There was this sort of vicious convergence of both broad, widespread concern on the left and the right over surveillance generally, which was legit.

“Despite the fact that Google and Apple created an entirely privacy protective model, but one that doesn't work that well, they still got hammered on the privacy concerns,” he said. “Politically it was too dangerous.”

Apps of the future

Still, even a year into the pandemic, with vaccine supply ramping up, some experts say it’s not too late to launch these apps—and that they may be even more important now.

New Mexico and Oregon plan to release apps soon. Arizona’s app, which was developed through a pilot project at the University of Arizona, is available to the public but has not yet been marketed.

Joanna Masel, a professor of ecology and evolutionary biology at the University of Arizona, said the value of exposure notifications only increases as coronavirus case numbers fall. 

“If there are 10 cases, and you quarantine one, you reduce the risk by a tenth. Each little bit of information you get is worth more,” she said. 

Separately, Masel is a consultant for WeHealth, a research-based technology platform for public health that helped develop Arizona’s app. In that role, Masel hopes to work with states to develop systems that would track locations -- still as an opt-in function but designed to collect more data. Masel thinks the technology would be useful for ongoing strains of the coronavirus or even for a future pandemic.

“It could be good for vaccine boosters with strains. It integrates everything, whether you’ve been infected before, whether you’ve been vaccinated,” she said. “It’s sort of a guide for people to navigate the pandemic.” 

Some state health officials have a similar future in mind. As more people prepare to travel, the exposure notifications will continue to work across state lines. The Association of Public Health Laboratories, which represents state and local health labs, hosts a national server to support all states with apps. 

“As people get vaccinated, as we hope to return to more quote-unquote normal life, I think the technology can play a bigger and bigger role,” said Katherine Feldman, director of the contact tracing unit at the Maryland Department of Health. She continues to urge people to opt in to the state’s exposure notifications system.

In a preprint of a University of Oxford study from September, researchers determined that all levels of exposure notification had the potential to “meaningfully reduce the number of coronavirus cases, hospitalizations and deaths.” (Google researchers co-authored the study.)

The Google and Apple system is in use in 36 other countries. A February report from the United Kingdom’s National Health Service estimated alerts from the app helped to prevent approximately 600,000 coronavirus cases since September. A peer-reviewed January study of the app’s use in Spain last summer determined the app identified nearly twice as many COVID-19 exposures as human contact tracers.

But Ray, the Cleveland law professor, thinks the urgency for making apps work in the United States during the COVID-19 pandemic has been lost. “Who cares right now? Vaccines are on the way.”

In the future, though, he thinks people would be willing to adopt technology to help their health. Many already do, through fitness applications and wearable devices.

“It's got to be linked to people's specific individual interest in their own health,” Ray said. “I think the trick will be that we need tech that will do all the potentially powerful things that contact tracing apps could have done, and just not call it that.”

This article was first posted to Stateline, an initiative of The Pew