Coronavirus applications: the risk of falling into a state of vigilance

When Steve Jobs discovered that Google was developing a smartphone platform to compete with Apple’s iPhone, he declared “thermonuclear war” on his Silicon Valley neighbor.

Now, in the face of a global pandemic that threatens millions of lives, more than a decade of hostilities between two of the world’s most valuable companies have been put on hold. In a new “spirit of collaboration,” Apple and Google are jointly developing a system to track the spread of the coronavirus.

“We see this as an existential threat to large sectors of humanity,” says one person involved in the effort. “Rivalries have been reserved for the common good.”

The tech giants are building a contact tracking system with the goal of using wireless signals to inform people if they encounter someone who has been diagnosed with Covid-19 or who was later diagnosed. Testing of its first incarnation is scheduled to begin this week, and within a few months the tool will be directly integrated into two smartphone platforms used by billions of people. Its goal is to provide health authorities around the world with “tracking and tracing tools” that help isolate infected populations and reopen the economy.

But by presenting their own idea of ​​a single, global system that emphasizes privacy over centralized oversight, Apple and Google have established a new confrontation between Silicon Valley and governments around the world.

Many nation states have their own ideas on how best to take advantage of technology to stop the outbreak, including by monitoring the detailed movements of their populations and creating vast databases of information about their citizens.

If governments push for access to more data using these apps, they could find public opinion on their side. “[The extent to which] people are concerned about privacy depends on the relative benefits, “says Leslie John, an associate professor at the Harvard Business School, whose research focuses on the psychology of privacy decision-making.” At a time when people are concerned about life and death, people may be more willing to provide information for better health. “

The central problem with the new applications is that there is a direct tradeoff between how effective they could be in helping to control new outbreaks and the possible invasion of privacy, whether it is the type of information being used or the level of compulsion. to use technology.

Some activists fear the apps may start as a tool to help track contacts of newly infected patients, but end as de facto “immunity passports”, with citizens forced to display their health status on their smartphones before can use public transportation or attend a soccer game.

Even President Donald Trump has outlined the debate ahead. Describing the Apple-Google solution as “surprising,” he warned earlier this month: “We have more of a constitutional problem than a mechanical problem … A lot of people have a problem with that.”

Apple and Google have insisted that their technology be banned for public health agencies that do not comply with their privacy guidelines. Hoping to persuade as many people as possible to use their tool, the tech giants are banning more extensive surveillance and want people to be able to choose whether to use the scheme. Its strict control of the software gives already powerful companies a great influence on the success or failure of any public health application.

The result of this showdown between governments and Big Tech could help determine how quickly the world can lift its blockages and return to normal for the long months before a Covid-19 vaccine is ready.

However, critics also fear that maintaining such high targets for these applications places too much emphasis on a single solution to a complex problem like no other the world has faced in decades.

“Everyone is desperate. It is technological utopianism; we are looking for technology to save ourselves,” says Ashkan Soltani, an independent privacy investigator and former chief technologist at the Federal Trade Commission.

When combined with other measures, such as social distancing, widespread testing, and isolation of affected people, contact tracking apps can help “break the chain” of infection. But, Soltani adds, “the objective and how they are sold is that they will be silver bullets, which they are not.”

Even without recruiting devices Living in the pockets of half the world’s population, contact tracing is an intrinsically invasive practice. Traditional techniques involve tracking down each individual and place visited by someone diagnosed with an infectious disease. According to the WHO, infected people are encouraged to “identify each contact on the list and inform them of their contact status.”

Now, faced with the challenge of scaling that process to entire populations, dozens of technology companies led by Apple and Google hope to take this painstaking process and turn it digital. By relying on digital connections instead of faulty memories, the hope is that they can trace the path of illness with unprecedented clarity.

But the effort faces a huge ethical dilemma. Arguably the most effective contact tracking tools would completely ignore privacy concerns: apps would be mandatory, each user would be identified, and people would be constantly tracked wherever they go.

The system would be based on all possible means to track a person’s location, including credit card transactions and surveillance cameras. A new tech company even suggested using artificial intelligence to monitor via CCTV that people remain a safe distance of six feet away while walking the streets.

China’s ability to dramatically flatten the curve of Covid-19 infections is in part a testament to how an authoritarian government can implement such technology to contain the virus.

The West seeks to replicate the success of these efforts, but without becoming a totalitarian state. So when Apple and Google unveiled their scheme in mid-April, their emphasis was put directly on privacy.

The proposed solution uses Bluetooth to send and receive anonymous signals that change every 15 minutes. If an infected person reports that the software tested positive, any other smartphone user who has had a recent encounter will be alerted and given information on what to do next. Most of the data is stored on people’s phones, to minimize the potential for “anonymization” by hackers or an overzealous government.

Users can choose to unsubscribe as easily as doing so, companies say. And if any government tries to make participation mandatory, collect the information in a central database, or overlay additional trackers like location, the tech giants just wouldn’t let it.

Still, privacy activists and some politicians have warned about the overreach. Last week, Democratic Senator Edward Markey wrote to Vice President of the United States, Mike Pence, urging strict limits on data usage. “Contact localization efforts should collect only information from individuals that is absolutely essential to achieving specific, evidence-based and predetermined public health goals,” he said.

However, some believe that a comprehensive surveillance system is justified in the current situation, as Covid-19 kills hundreds of thousands of people and paralyzes the global economy. A poll by the FT-commissioned pollster Ipsos Mori found that two-thirds of Britons are in favor of government telephone tracking to help tackle the pandemic.

Chris Yiu, executive director of technology and public policy at the Tony Blair Institute, says the gravity of the situation justifies measures that would normally be “out of the question” for democratic societies.

“This is quite different from the traditional debate about whether facing security threats to our way of life deserves to sacrifice the values ​​of freedom and privacy that define us,” he says. “Covid-19 is not an ideology, and rebalancing the contract between citizens and the state to take advantage of new technologies is not a capitulation.”

Leverage Powers of Apple and Google from your control over how third-party applications can access sensors on your smartphones. In their current configuration, iOS and Android make it difficult for developers to constantly access Bluetooth when their apps are running “in the background,” such as when a device is locked or the owner is using a different app for a long period of time. Google and Apple have said they would lift these restrictions for public health authorities to track contacts, using new developer tools that would allow near-constant access to Bluetooth.

However, that also means that any contact tracking app that is developed without complying with Apple and Google guidelines will face severe technical limitations and practices. To be effective at tracking other nearby users, the smartphone would have to unlock with the screen on for long periods of time, probably draining the battery in a matter of hours.

An Australian contact tracking app that launched without using new Apple and Google tools tries to get around these limitations by sending push notifications to users to remind them to “update” the app. Despite these issues, almost 2 million people downloaded it within hours of its launch.

Recommended

Silicon Valley groups are walking a fine line between privacy and effectiveness, and many governments fear they have not struck the right balance. The French government is pressing the two companies to relax their position on the use of Bluetooth in the background.

The fact of the matter is whether contact tracking in the digital age can really be anonymous and effective at the same time. Unlike GPS, Bluetooth does not track a person’s location, only proximity between users.

Furthermore, the tech giants have been vague about what constitutes “an encounter” with someone who is infected in terms of the time the two individuals are together.

If the required duration of contact in the application is set too limited, for example to a few seconds, users can be repeatedly blocked.

A grocery store employee or public transit passenger can be within 10 meters of an infected person multiple times in a single hour. Each alert is likely to be read as a personal doomsday message directly from the health authority. The result could be numerous false alerts that create havoc and total paranoia, or simply lead people to choose not to participate.

But set the parameters too broad – that is, half an hour, as Singapore has done for your application, TraceTogether – and the tech giants risk calming populations into complacency. If people go several weeks without their phone pinging them, they may end up feeling safe and choosing to relax their social estrangement.

Apple and Google have proposed that smartphones can send and receive Bluetooth signals every five minutes for tracking purposes.

Even that could be too long. Covid-19 can spread from the briefest of encounters, inhaling the fog from a stranger’s cough at the grocery store or touching surfaces that Harvard Health says can remain infected for up to 72 hours.

“None of them has brought the terrain into play in terms of duration of duration,” says Marc Rogers, executive director of cybersecurity at Okta, a software group. To be effective, the tools must be refined only over short distances and include interactions of less than 30 seconds, “because someone just needs to cough, and you walk through the fog, and that’s it – you’re at risk.”

Around the world, apps they are already being developed with the clear backing of governments and public health authorities before the Google / Apple platform is ready. In the UK, the national health service’s innovation arm, NHSX, is already testing its application across the country. Europe has two competing groups exploring what they call “proximity tracking”, PEPP-PT and DP-3T.

In the United States, a mosaic of different applications is emerging, some of which plan to fit in with the Apple / Google proposal, while others plan to remain independent. Many have begun collaborating to ensure they are interoperable.

But only one application is expected per state. Among the top candidates for widespread adoption is a protocol and application from the Massachusetts Institute of Technology, Safe Paths. Ramesh Raskar, an associate professor at MIT who is leading the initiative, says the group was “in talks with 40 different jurisdictions,” including individual cities, states and countries. The group is exploring the use of WiFi and GPS location tracking technology, arguing that Bluetooth alone is not scalable or reliable.

Raskar also pointed to data security issues related to using Bluetooth. “A third party application can spy on these [Bluetooth] signals, “he said.” Why would you carry a phone that constantly emits a beacon? “

France also argues that its system is more secure against piracy because it uses a central server to maintain a list of devices belonging to people exposed to the virus (without identifying them by name). This is in contrast to the “decentralized” approach taken by Apple and Google, which primarily stores those details on individual devices, using a central server as a simple “relay” to update the network of participants in the latest infections.

“Our scheme does not follow this principle because we believe that sending information about all infected users [to everybody’s smartphones] reveals too much information, “wrote the French researchers developing the application, known as” Robert, “in a recent article describing their approach. Europe’s PEPP-PT is taking a similar approach.

But many privacy activists, including those belonging to PEPP-PT’s rival DP-3T, disagree. Last week, nearly 300 academics endorsed the Google and Apple approach in a letter, saying any central database risked “mission loss” and could “catastrophically hamper trust and acceptance of the app by part of society at large. ” “It is vital that, in emerging from the current crisis, we do not create a tool that allows large-scale data collection on the population, either now or later,” warned the international group of researchers.

The UK has rejected the technology giants’ approach in favor of having a centralized database, while Germany, focused on privacy, has endorsed it.

Some privacy activists also fear that tech company assurances that the apps will remain voluntary will be difficult to apply in practice, if contact tracking apps evolve into “passports” that are required to enter supermarkets or others. public places.

“We need to keep a very careful eye as a society to make sure they don’t actually become mandatory,” says Daniel Kahn Gillmor, senior personnel technologist at the American Civil Liberties Union. “Willingness is really a characteristic and not a mistake. We don’t need to get to 100% participation if the goal is to just flatten the curve in some way. “

The ACLU also urged health authorities to build something that many might forget in their rush to implement a solution: a promise not to allow contact tracking apps to silently become part of everyday life, even after end the pandemic.

“If these systems turn out to be ineffective in helping to flatten the curve, then we also want a commitment to close them,” says Kahn Gillmor.