Why COVID-19 contact tracing apps are causing deep division in Europe
As governments around Europe look to come out of lockdown sooner or later, most acknowledge the need to keep track of the viral spread, and the most universally agreed idea is to do so by contact tracing – but like most things about COVID-19, it is far from easy.
Contact tracing is the identification of those who may have been infected by known carriers. Previously the domain of disease detectives and subject to much guesswork, this process can theoretically be largely automated by technology – namely the smartphones that so many of us now carry in our pockets.
Using the tracker technology within smartphones, if a user tests positive it is possible to check back and inform all "contacts" – not just those the user knows, but all those who have been within infectable distance while a carrier was contagious. Usually this is done with either GPS information or, more commonly, the short-throw wireless transmission known as Bluetooth.
Harald "Bluetooth" Gormsson was a 10th-century Scandinavian king who united various tribes in what is now Denmark and Sweden, honored a millennium later for his ability to bring people together. It's perhaps ironic, then, that his name is now at the center of a dispute running throughout Europe, pitting governments against globally dominant tech companies and leaving the general public confused and in some cases worried as to what their rulers are choosing to do in their name.
Contact tracing is a very technical business and it's very easy to get lost in the details of the various frameworks and platforms. In essence, the choice comes down to two different philosophies, each with its supporters and opponents.
The decentralized model
In the "decentralized" model, all the relevant contact information is held solely on the user's phone rather than a central server or database.
This is the approach favored by privacy watchdogs and backed by Apple and Google, providers of the iOS and Android operating systems which between them power 99.47 percent of the world's smartphones. On 10 April, these two tech titans announced a joint initiative for contact tracing, which they insist would protect privacy.
The backing of the two major mobile operating systems gives the decentralized model a lot of technical potential, unifying researchers on friendly platforms that should be user-friendly to the public and developers alike. However, governments have not been unanimous in their praise – and France accused Apple of sabotage. "Apple could have helped us make the application work even better on the iPhone. They have not wished to do so," said Cedric O, France's minister for digital technology.
"I regret this, given that we are in a period where everyone is mobilized to fight against the epidemic, and given that a large company that is doing so well economically is not helping out a government in this crisis. We will remember that when time comes."
Immediately afterwards, Apple and Google announced a new operating system tweak called Exposure Notification, overriding their previous prohibition of the always-on Bluetooth which any sort of contact-tracing app would need. In an attempt to allay fears, the companies noted that the exemption would only be permitted for one app per country, and the system would only be granted to public health authorities.
Even so, the European Union has called for strict rules to ensure privacy. "Strong privacy safeguards are a prerequisite for the uptake of these apps, and therefore their usefulness," said Thierry Breton, the EU commissioner for the internal market. "While we should be innovative and make the best use of technology in fighting the pandemic, we will not compromise on our values and privacy requirements."
The centralized model
While the level of public trust in Apple and Google is up for debate, civil-liberty experts agree their model is less intrusive than the alternative "centralized" model, in which the collected information is stored on a single database – one controlled by the relevant country's government or healthcare service.
The benefit of the centralized model is that the relevant authority, while pledging to protect privacy, owns more details about the information it receives – thus making it easier to act upon it for the benefit of the wider population. As France's Cedric O acidly put it: "We consider that oversight of the healthcare system, fighting the coronavirus, is a matter for governments and not necessarily for big American companies."
But, besides the resulting decrease in privacy, the centralized model raises concerns of efficiency and mission creep. Governments aren't always the nimblest of software developers, with a number of high-profile failures; certainly it can't help to go against the two companies whose platforms dominate the planet.
Less politically and more technically, there is also concern that centralized systems will not be interoperable – that the app from your country won't work in the country next door, with obvious ramifications for travel and business. By contrast, all decentralized apps will be able to plug into the Apple/Google framework to share information and cover international travelers.
Privacy campaigners have worried that if a centralized app works well, would a newly elected government be tempted to use the huge amount of collected information for other ends? Australia, which launched its centralized Covidsafe software on Sunday 26 April, has pledged to delete the database after the pandemic ends – but who defines when that happens?
These arguments aren't solely at the chin-stroking intellectual level: the experts themselves – researchers, scientists, technicians – are suddenly having to make urgent decisions about which system to support. A cross-continental group called the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) project was split in late April when ETH Zurich and the Ecole Polytechnique Federale de Lausanne pulled out, citing privacy worries.
Who's doing what?
It's safe to say the understandable rush to get some sort of contact tracing app released – not least to help countries tip-toe out of the harsher lockdowns – is not helping European unilateralism. The continent is split between those countries chasing centralized systems and those preferring the Apple/Google model – and meanwhile, private companies are also entering the market with apps.
Norway, which enacted a swift and strict lockdown in contrast to its neighbor Sweden's more laissez-faire approach, was quick to market with its centralized app. Smittestopp launched on 16 April and within four days was downloaded by more than 60 percent of the population, reaching the threshold recommended by researchers at Oxford University's Big Data Institute to achieve so-called "digital herd immunity" against COVID-19.
One Norwegian who didn't download was Solveig Schytz, a Liberal politician who decried the app's security and said its hackable nature could affect public trust in the government. "If a security breach happens," said Schytz, "and the data comes astray or the data from it ends up in an app or program in a few months, it would be very negative for that confidence."
A week after most of Norway downloaded a decentralized app, Switzerland announced it would be following the decentralized approach with an app due to launch on 11 May. By the time of that announcement, 400,000 Austrians had already downloaded the national Red Cross's Stopp Corona app, but after consulting privacy experts, the app's developers upgraded it to align with the decentralized DP-3T protocol.
The what? Well, the Decentralized Privacy-Preserving Proximity Tracing protocol, to give it its full name, is a Swiss-led framework to which the researchers from Zurich and Lausanne signed up after deserting the PEPP-PT project.
In late April, the European Commission threw its weight behind the sort of decentralized system favored by Apple and Google rather than the centralized solutions some countries have sought. And on 26 April, PEPP-PT – backed by tech entrepreneur Chris Boos and also featuring the Fraunhofer HHI research institute – received a blow even closer to home when Germany's chancellery minister Helge Braun and health minister Jens Spahn announced the country would pivot away from PEPP-PT to a "strongly decentralized" approach for its own app.
Further details for Germany's app are yet to be revealed but on 1 May, Italy announced its decentralized Immuni app would be available "within weeks." Developed by Milanese app company Bending Spoons, Immuni will exclude personal information from the data it reports; Italy's COVID-19 crisis commissioner Domenico Arcuri insisted upon a "full and absolute guarantee of privacy."
Not all countries are following the trend toward decentralization, and some of the centralizers are reaching the market quickly. France aims to start testing its centralized StopCOVID app on 11 May for general release on 2 June. Meanwhile, the UK has also pressed ahead with a centralized system, testing it on the offshore Isle of Wight with a view to launching around the country in two to three weeks.
Other state-run centralized apps include Bulgaria's ViruSafe, Cyprus's public/private venture CovTracer and Spain's regionalized STOPCOVID19CAT (for Catalonia) and CoronaMadrid. State-run centralized apps include Iceland's Rakning C-19, North Macedonia's StopKorona! and Poland's ProteGO Safe, although it's not known whether Poland's much more popular GPS-based Kwarantanna Domowa is centralized or not. In Czechia, the Android-only eRouska is decentralized, but the privately-run app Mapy.cz – centralized and available on both Android and iOS – has been downloaded by around 10 times as many users.
Clearly, there is anything but unity among Europe's various tribes: Harald Bluetooth would be appalled. But whatever system prevails, we'd all better hope that technology can help us keep COVID-19 at bay.
Originally published by CGTN Europe, 7 May 2020
