Proposals to use the tracking capabilities of our cell phones to help fight Covid-19 have probably received more attention than any other technology issue during the pandemic. Here at the ACLU, we have been skeptical of schemes to use apps for contact tracing or exposure warnings from the beginning, but it is clearer than ever that such tools are unlikely to work, and that the debate over such tracking is largely a sideshow to the principal coronavirus health needs.

We have said from the outset that location-based contact tracing was untenable, but that the concept of "proximity tracking"—in which Bluetooth signals emitted by phones are used to notify people who may have been exposed—seemed both more plausible and less of a threat to privacy. Indeed, a number of serious institutions began working on this concept early in the pandemic, most notably Apple and Google, which have already implemented a version of the concept in their mobile operating systems.

Some of the problems with tech-assisted contact tracing have been apparent from the beginning, such as the social dimensions of the challenge. Smartphone ownership is not evenly distributed by income, race, or age, threatening to create disparate effects from such schemes. And even the most comprehensive, all-seeing contact tracing system is of little use without social and medical systems in place to help those who may have the virus—including access to medical care, testing, and support for those who are quarantined. Those systems are all inadequate in the United States today.

Other problems with technology-assisted contact tracing have become more apparent as the pandemic has played out. Specifically, such tracing appears to be squeezed from two directions. On the one hand, a tool shouldn't pick up every fleeting encounter and swamp users with too many meaningless notifications. On the other, if it is confined to reporting sustained close contacts of the kind that are most likely to result in transmission, the tool is not likely to improve upon old-fashioned human contact tracing. Those are the kinds of contacts that people are likely to remember. And those memories, relayed to human contact tracers, are more likely to identify a patient's significant past exposures than an automated app that can't determine, for example, whether two people were separated by glass or a wall.

A Difficult Disease to Trace

The first problem—the danger of generating far too many "exposure notifications"—is considerable. As one commentator put it, "actual transmission events are rare compared to the number of interactions people have." Swamping users with false notifications would be useless and annoying at best, and seriously disruptive and counterproductive at worst. Ultimately, people will stop taking the notifications seriously, or just uninstall the app.

That problem is made worse by the fact that Covid-19 is a more difficult disease to trace than many. As a group of prominent epidemiologists from the University of Minnesota explained in a report on contact tracing, contact tracing is less effective when:

1. Contacts are difficult to trace, such as when a disease is transmitted through the air. Respiratory transmission appears to be the primary way Covid-19 is transmitted. Compared to the kind of contact tracing that has long been done with HIV, where transmission takes place through sex or blood, the virus that causes Covid-19 is much harder to track. One cough or sneeze from a stranger may be enough to infect an unlucky passerby—as can sharing an interior space with a "super-spreader" who is on the other side of a large room.
2. The infection rate in a community is high. In the United States, as of this writing (July 2020), there are currently around 50,000 new coronavirus cases being identified every day. As the Minnesota report puts it, "contact tracing is most effective either early in the course of an outbreak or much later in the outbreak when other measures have reduced disease incidence to low levels." The U.S. may someday reach the point where cases are once again sporadic rather than widespread, but for now experts recommend concentrating contact tracing on contacts within households, healthcare and other high-risk settings, and case clusters—an approach much more amenable to manual contact tracing.
3. A large proportion of transmissible infections are from people without symptoms. In May the CDC estimated that 40 percent of new Covid-19 infections come from asymptomatic carriers.

The Technology is Not Reliable Enough

These factors increase the risk of generating too many exposure notifications to be useful. Serious technical challenges with using smartphones for contact tracing also increase that risk. One of the biggest questions has always been how to use Bluetooth to judge which encounters are worthy of being recorded as potential transmission events. Judgments have to be made about how close a person needs to be, and for how much time, to meet the warning threshold. That becomes even trickier since Bluetooth can't reliably measure distances. The strength of a Bluetooth signal varies not only with distance, but also from phone to phone, and from owner to owner. The frequency at which Bluetooth operates (2.4 GHz) is one that is easily absorbed by water, including the water in the human body, which means that signal strength can vary significantly depending upon whether a person has their phone in their front or back pocket, and how much that person weighs.

Complicating matters is the fact that existing contact-tracing apps are being thrown together very quickly. Google and Apple moved from concept to a finalized product in less than 12 weeks. They should be commended for stepping up in an emergency, but we shouldn't expect it to work well anytime soon. As is clear to any experienced software developer, their product is basically an early prototype that's being pushed into production. In a normal world, they would be testing their app on groups of hundreds and then thousands of people in cities and a variety of other real-world situations. Through no fault of Apple and Google, there simply hasn't been the opportunity to do the kind of engineering development and refinement that a project like this really needs.

And of course, what is true of software developed by Apple and Google is even more true of apps developed in a rush by state governments like North Dakota and Rhode Island, or other nations like South Korea. South Korea has been lauded for its high-tech coronavirus response. But the quarantine app the country has been using put people's names, locations, and other private information at risk by failing to follow basic cybersecurity practices.

Compliance

While effective technology-assisted contact tracing apps must avoid generating too many exposure notifications, they must also establish that they can improve upon or significantly augment old-fashioned human contact tracing.

Epidemiologists emphasize that contact tracing has always been a tricky and sensitive job. Getting people to trust any official enough to open up about their potentially privacy-sensitive whereabouts and contacts is a skill—one that requires "training and development of a specialized skill set" as well as "consideration of local contexts, communities, and cultures."

That is especially true since those who are identified as having been exposed to the coronavirus are asked to self-quarantine for two weeks—putting much or all of their life on hold, and possibly risking the loss of a job or income, necessitating the finding of new caregivers for dependents, and imposing various other costs. That's something that a friend will be reluctant to impose upon another friend by giving their name—especially where no social support is provided to those asked to self-quarantine. As the Minnesota report warned, "If people perceive the economic, social, or other costs of compliance with contact tracing are greater than its value, it won't be successful."

There are many reasons to doubt that these tricky issues can be navigated better through technology. As report co-author Michael Osterholm put it, "Having been in public health for 45 years, and having cut my teeth in surveillance in many different ways—I don't think most people would comply. If I got notifications that I'd been exposed to [someone] with COVID, would I self-isolate for 14 days at home, because I got a text on my phone?"

The sensitive privacy and trust issues that human contact tracers face are likely to be amplified in the technology realm. People who are reluctant to tell contact tracers where they've been are likely to be even more reluctant to let an app carry such information. By building tools with very strong, cleverly constructed privacy protections, Apple, Google, and others have created the best possible chance of engendering trust in those apps, but those protections still have gaps. People who refuse to wear a mask are unlikely to deliberately install tracking software on their phone, whatever privacy assurances they are given. Nor are many members of Black, Brown, and immigrant communities for whom "trust in the authorities is non-existent."

Some experts have estimated that at least 60 percent of a population would have to run an app for it to become effective. Others think apps can be modestly helpful even with much smaller adoption rates. But aside from trust issues, the number of people willing to participate seems to have gone down since the first months of the outbreak, as "social distancing fatigue" has set in and public panic over the virus has given way to a more measured caution (and in too many cases, an abandonment of all caution whatsoever).

The bottom line is that there are too few reasons to think that apps will prove more helpful than human memories elicited by experienced contact tracers. The promise of exposure notifications lies in the space between the large pool of incidental contacts that people have, and the smaller number of significant contacts that they remember. The apps promise to track contacts that are close and sustained enough to pose a serious risk of exposure yet beyond the subject's memory. For most people, that space may simply not be large enough to be useful.

Real-World Experiences in States and Other Countries

Unsurprisingly, given these problems, the states and countries that have experimented with using technology-assisted contact tracing have not met with much success. The use of technology by China and some other Asian countries has received a lot of attention, but as the Minnesota epidemiologists point out, "we don't know exactly what methods were used, how many cases were involved, and what the estimated impact was in reducing transmission since other mitigation strategies were employed at the same time" in those countries.

That lack of measurement is true throughout the world. An MIT survey of global digital contact-tracing efforts found 43 countries in some stage of offering a product. Ten of those countries are relying on the privacy-preserving Apple/Google protocol, with the rest a jumble of different architectures and policies. It may not be quite true, as UK Prime Minister Boris Johnson declared on June 24, that "No country in the world has a working contact tracing app"—Germany has launched an app that has been downloaded over 14 million times so far, and India claims 131 million downloads for its app and 900,000 users who have been contacted and told to self-isolate. But we don't know if those numbers represent a high enough proportion of the populations to actually have an impact on slowing the disease in Germany and India, let alone in countries with lower adoption rates. We also don't know how effective it is to simply tell people to self-isolate, in the absence of social support for them to do so.

It's also worth noting that in some countries such as China and India, digital tracking is imposed in authoritarian ways that would cause most people who value civil liberties to recoil.

In the U.S., a few states have attempted to launch apps, including Utah, where things went so badly that one program was shut down within 72 hours of its launch, and another one had not led to any contract tracing a month after its launch. An app in North and South Dakota ran into trouble quickly when it was revealed to be sharing data with a private location-data company. Overall, state efforts so far have been plagued by "technical glitches and a general lack of interest by their residents." A survey by Business Insider found that only three states planned to use the Apple/Google technology. Others had not decided, but 17 states reported that they had no plans to use smartphone-based contact tracing at all.

Those who have worked on privacy-preserving exposure notification apps should be commended for stepping up. They have dedicated their skills toward trying to save lives and restore people's freedom, and they did a very good job creating a privacy-preserving approach that was not only the most likely to be trusted and effective, but also the least likely to permanently change our world for the worse.

Nevertheless, it does not appear to be working out. "A lot of this is just distraction," Osterholm concluded of all the talk over digital contact tracing. "I just don't see any of this materializing." Given what we know about the technology, we are inclined to agree.