What we’re reading about contact tracing

We know it can be hard to keep track of resources and conversations about many of the topics currently in the news, so we’ve compiled some of the pieces we’ve been reading on the topic of digital contact tracing, below. 

Contact tracing refers to the practice of collecting and analysing information about where a carrier of a contagious virus has been, and who may have been infected, in an effort to understand and slow the virus’ spread. Lately, contract tracing has become a topic of conversation as society works to trace the spread of the Covid-19 virus and, hopefully, minimise its human toll. While contact tracing is generally agreed to be a critical part of containing the spread of viruses, it has historically been manual work. As policymakers increasingly consider tech tools meant to assist or replace human contact tracers, many legitimate concerns have been raised about the potential harms incurred by automating this process. For example, Sean McDonald at FrontlineSMS sees this as an ‘all-hands-on-deck’ moment which provides an opportunity for the community to transfer learnings from disaster technology work around data governance and data trusts. 

The biggest concerns cited around the use of digital contact tracing include issues related to user privacy, data protection, data access and the use of advanced technology as a proxy for wealth. These aren’t problems with simple solutions—we’ve seen a flurry of resources shared on the RD listserve that speak to the range of perspectives on these issues. To share some of what we’ve been reading so far, we’ve gathered a few resources around the implementation and use of these applications. 

Where are digital contact tracing apps being deployed?

If you’re looking for case studies:

1. Digital Reach has conducted a detailed disassembling of Trace Together, Singapore’s government-developed contact tracing app. The team dove into the application’s codebase and the pitfalls of its use of Bluetooth technology.
2. Citizen Matters reviewed various apps available throughout India that were created by local governments and agencies. The team specifically looked at the technical and usability issues that prevent quarantined users and the rest of the public from meaningfully using the apps, and they considered the privacy of these app’s users.
3. GDPRHub has collected projects from around the world that are using personal data to combat Covid-19. This resource page aims to highlight different approaches by government and private projects to use personal data to combat the virus.

Mapping the societal implications of contact tracing

If you want to dive into the societal implications of using these tools:

1. The Electronic Frontier Foundation has written about protecting privacy when aggregating location data, including common pitfalls of various aggregation methods and the importance of establishing consent. 
2. Similarly, the ACLU has prepared a whitepaper on the limits of location tracking in an epidemic, which also details the pitfalls of using the data collected. This report categorises considerations to keep in mind by the proposed use of the data: for example, to identify individuals exposed to a contagious person, locate where an infected person was in the recent past, gather aggregated location data and/or the enforcement of rules.
3. The Future of Privacy Forum prepared a comparison of six contact tracing apps and their approach to data privacy, including the scope of the data collected, privacy safeguards, access and storage.
4. The Markup dove into Google and Apple’s Covid tracking partnership and listed the pros—opt-in, anonymity, decentralization—and cons—vulnerability to trolls, spoofing and eavesdropping by other apps—of the proposed system
5. In addition, the Ada Lovelace Institute prepared a rapid evidence review of the technical considerations and societal implications of using technology to transition from the Covid-19 crisis. Their review also includes three-page explainers tailored to government, parliament and technologists to help them get up to speed quickly. 

Learning from past disaster & health technology

If you see echos of concerns you–or others–had in past crises, from Ebola outbreaks to post-earthquake contexts:

1. Linnet Taylor breaks down and builds upon Sean McDonald & CIS’ paper on the humanitarian use of big data, especially during the public health response during the Ebola crisis in Liberia.
2. In 2016, the Responsible Data blog included a post by Willow Brugh, which summarised key highlights of a community call around the use of call detail records in Ebola response efforts. 
3. Reflecting on a 2015 event around Responsible Data in humanitarian responses, Alix Dunn and Tom Walker explore how both humanitarian and advocacy organisations have different ways of using data responsibly in the midst and aftermath of crises.

How can the tech contribute to a responsible roll-out?

If you’re more interested in the technology used:

1. Harvard’s whitepaper, Outpacing the Virus: Digital Response to Containing the Spread of Covid-19, outlines the advantages and disadvantages of various technology architectures. This report dives into the accuracy and security considerations of using Bluetooth or GPS methods as well as the various levels of database centralization available to ensure the protection of users private data.
2. Researchers around the world have also come together to establish open source protocols. Some examples include DP-3T, the underlying protocol in the Google-Apple partnership, PACT (Private Automated Contact Tracing) which broadcasts “constantly changing and randomly chosen chirp values” or phone transmissions, and the other PACT (Privacy Sensitive Protocols And Mechanisms for Mobile Contact Tracing) which similarly generates random ‘seeds’ that are shared between phones.
3. The Defensive Lab Agency (DLA) actively tracks new Android applications and analyses them for security and privacy. The DLA uses their Aether platform to determine what trackers are embedded in an application, which permissions the application requires and what operations the app is allowed to run.

What could ‘responsible’ contact tracing look like?

1. If you just need a primer to get started, Chaos Computer Club has outlined the 10 requirements for the evaluation of “Contact Tracing” apps. Their list can help you think through the general societal and technical implications of digital contact tracing apps. 
2. Access Now has also put out their top dos and don’ts for contact tracing apps in this clear and in-depth piece.

While we hope these resources are useful and provide some of the context necessary to make informed decisions around this issue, our next post will dive further into what a responsible digital contact tracing implementation could look like.