Exposure Notification: A Call to Action
The U.S. leads the world in COVID-19 illnesses and deaths, according to John Hopkins University data. The nation headed into its Fourth of July celebrations—with over 2.8 million confirmed cases and approximately 130,000 lives lost to the coronavirus. Over 1,000 people have died each day since the country’s first known death by the virus in February. But 81% of Americans own mobile phones that could significantly curb this national failure in testing, tracing, isolating and quarantining.
Other countries have turned on smartphone technology to ramp up contact tracing. The U.S. has fumbled with a patchwork of state responses, citing technological, legal, and privacy problems.
Now, it’s time to address those concerns and create an efficient healthcare warning in infrastructure, using ubiquitous mobile phones. Tracing and notification systems can violate privacy, which Americans hold close as a fundamental right.
We need to protect our civil liberties, while persuading the public to adopt a technology that could save thousands of lives. Such a program would also help prepare the country for even deadlier and more contagious viruses in the future. Launching and testing a system now, would position the U.S. for a quicker, more effective reaction, next time.
At Stake: Our Health, Economy, and Privacy
The pandemic’s toll on human lives has meant people suffering painful deaths in isolation. Plus, more than 40 million adults have filed unemployment claims, amounting to 25% of working Americans. More than 100,000 small businesses have permanently closed their doors. The Congressional Budget Office projects that the pandemic will reduce U.S. economic output by $7.9 trillion over the next decade. In the past, contact tracing was an essential tool used to contain the smallpox, HIV, SARS, and H1N1 viruses.
It requires widespread testing, interviewing patients with confirmed cases, identifying whom they had been in contact with, then warning those individuals to take precautions to prevent further infections. However, the coronavirus spreads quickly and frequently through asymptomatic carriers. The slow and cumbersome process of traditional contact tracing has inadequately suppressed the disease. Experts estimate the U.S. would need 100,000 to 300,000 contact tracers to tame COVID-19.
Smartphones could rapidly collect data and instantly notify audiences about their exposure to the virus. Such digital exposure notification requires participants to trust both tech companies and the government. Controversies such as Facebook’s role in allowing the dissemination of false information and Russian interference in U.S. elections have heightened wariness of big tech. And only 30% of Americans trust the Trump administration to get its coronavirus facts right, according to a Pew Research Center survey conducted in June.
Monitoring movements using cell phones could potentially result in interference with our constitutional right to travel and freedom of assembly and association. Most Americans bristle at trading in their protection against governmental intrusion, including collecting personal health records and tracking whereabouts. The public also fears that privacy invasions, particularly with contagious diseases, can lead to discrimination in housing, employment, healthcare, and insurance. The popular catchphrase “data is the new gold” translates to corporations gaining profits, by using personal information for marketing and cost-cutting.
The Apple/Google Collaboration Privacy Measures
In a rare collaboration, Apple and Google updated their iOS and Android operating systems. They developed technology and an application programming interface (API) that supports apps for digital contact tracing. To participate, cell phone users turn on the “COVID-19 Exposure Notifications” setting, turn on Bluetooth, then download a contact tracing app from one of the app stores.
The system maintains user anonymity with encrypted keys that generate and exchange anonymous tokens via Bluetooth with phones in close proximity. Because the system does not use GPS, it does not record location. After testing positive for COVID-19, a person could voluntarily and anonymously upload an encrypted key onto a neutral server. The system does not collect any other data about any of the other users.
The server decodes the key from the infected person’s phone and broadcasts all the tokens that were generated in the past 14 days, to make them available to all the phones that were near the infected person’s phone. A user would have a “match” if one or more of the tokens collected match those created by the “infected” phone.
The Apple/Google architecture is decentralized because all matching occurs locally, and no information ever leaves the users’ phones. People notified of their exposure could then seek testing and self-quarantine as needed. The system constantly erases all tokens older than two weeks. Apple/Google also advocates turning off the exposure notification technology, when the pandemic subsides.
Exposure Notification Critics
Critics argue that current technology remains flawed. They point out Bluetooth would read signals between walls, across barriers and shields. It fails to account for people’s levels of precaution, such as wearing masks. Skeptics also say with a lack of mass participation, the system would be statistically flawed. Even with the Apple/Google system, apps could chisel away at the privacy safeguards by allowing third-party access. Cybersecurity can still leave holes in protecting data and information from malicious attacks.
Finally, privacy protection would also depend upon what the governmental health agencies ultimately will do with patient information collected separately. Proponents of the technology contend developers can address technological limitations by tweaking apps, adding information fields, or adjusting sensitivity levels. With time, technology invariably improves. They point out that other countries have forged ahead with the technology, while the U.S. continues to argue over wearing masks.
How Other Countries Are Responding to COVID-19
South Korea has gained international praise for quickly responding to the health crisis, containing the virus, avoiding the crippling shutdowns of other countries. By early July, the country had slightly over 13,000 positive cases, losing approximately 280 lives. The government quickly ensured hospitals had adequate personal protective equipment and maintained sanitized environments. South Korea comprehensively covered COVID-19 medical costs and made available widespread testing, pioneering drive-through testing sites.
Following the MERS and SARS crises, legislation gave the government emergency powers to gather and publish contact tracing information. The South Korean response heavily relies on advanced technology, although not the Apple/Google exposure notification system. When someone tests positive for COVID-19, health agencies text residents who have been in the proximity of an infected person and refer them to a website. Without listing names, the site provides the gender, age, and routes of the patient’s movements, using GPS, credit card transactions and CCTV feeds. Prioritizing health over privacy, public officials’ rapid actions flattened the curve and saved lives.
In China, contact tracing is just a small expansion of its existing digital surveillance network used to control and monitor people. Using a government app, people must complete a survey, reporting their body temperatures, medical conditions, and travel history. They receive a Q.R. health code connected to their mobile number and personal I.D. (such as passport number). At checkpoints in public spaces, stores, restaurants, and subways, everyone must scan their Q.R. code. The app factors in bio-metric data and GPS-derived locations tracked by the government. It provides a color-coded (green, yellow, or red) category of COVID-19 contagion, that allows entrance or requires self-quarantine or a government quarantine.
Chinese authorities can rapidly pinpoint suspected virus carriers, track their movements, and identify people they have encountered. This approach could effectively help contain the virus but tramples privacy rights in a way that few Americans would find acceptable.
Several European countries are using decentralized apps supported by the Apple/Google API. A few examples include Germany’s Corona-Warn-App, Italy’s Immuni, Poland’s ProteGo, and Switzerland’s SwissCovid.
Other countries adopted centralized apps: France’s StopCovid, Norway’s Smittestopp, and the U.K.’s NHS Covid-19 app. The infected patient and all users load data onto a government-controlled server where the matching occurs. Proponents of this protocol reason that the government is better positioned over big tech to use health data to further the public interest. These apps could not use the Apple/Google API. Norway pulled its app after data protection regulators warned it was overly invasive. Ultimately, the U.K. moved to a decentralized system. European countries are working on a unified approach, considering the General Data Protection Regulation implemented in May 2018. The different apps may function within each country but interoperability obstacles arise when travelers cross borders. Progress is underway with E.U. member states agreeing on technical specifications for national contact tracing apps built on decentralized architecture.
What the U.S. Still Needs to Do
Developers should work to iron out any kinks in the apps. Continued testing and learning from other successful technology, such as Germany’s contact tracing app developed by SAP SE and Deutsche Telekom, could help improve what’s offered in the U.S. Every state should have available an app using the decentralized Apple/Google API (or the exposure notification system Apple and Google plan to phase in, which will not require apps).
Congress needs to pass legislation addressing privacy concerns with exposure notification apps. On June 1, Senators Maria Cantwell of Washington and Bill Cassidy of Louisiana introduced a bi-partisan bill, the Exposure Notification Privacy Act. Lawmakers are also considering two other measures: the COVID-19 Consumer Data Protection Act and the Public Health Emergency Privacy Act.
Support for maintaining the Affordable Care Act, including insurance coverage of preexisting medical conditions, will encourage people across the economic spectrum to get tested and treated for COVID-19.
Epidemiologists say 60% of the population would need to use the technology for it to have an impact. So far, only Alabama, North Dakota, South Carolina, and Rhode Island have apps supported by the Apple/Google API, according to the 9To5Mac website. A coordinated national public education campaign will need to emphasize the importance of participating in the program. Leaders, even if not from the White House, could capably take on this initiative.
Exposure notification cannot replace traditional contact tracing, especially with the elderly and financially disadvantaged segments of the population who lack smartphones.
Admittedly, this technology is not a silver bullet. But it is an important piece of what we need to do. By defending our values, caring for our most vulnerable, and restarting our economy with entrepreneurial know-how, we won’t settle for just a “return to normality.” Instead, we can underscore civil rights that are integral to who we are, and emerge united from this crisis.
ABOUT THE AUTHOR: Piol is the founder and managing director of the New York-based technology venture capital firm, AlphaPrime. He’s the executive chairman of Epistemic AI, a biomedical research firm using artificial intelligence and natural language processing.
With more than 30 years of experience, he serves on the boards of several corporations in the U.S. and Italy, and is a member of the Columbia University SEAS entrepreneurship advisory board. LinkedIn bio: https://www.linkedin.com/in/apiol/
