Apple and Google announced on April 10 that they will partner on contact tracing technology to help “governments and health agencies reduce the spread of the [COVID-19] virus.” This is an essential and entirely unique commitment these normally combative platform vendors are making. Why? Because the partnership of these two tech titans brings together the broadest consumer coverage, as Android and iOS cover nearly 100% of smartphones in the United States and on the planet.

The globe needs a way to identify and mitigate risk, identify infection transmission pathways, and provide public infrastructure that governments and others can use to protect their citizens and manage their economies. What everyone needs to keep in mind is that this partnership is both a generous and a substantial contribution to the contact tracing effort in the United States. It isn’t perfect — nothing is or will be. All technologies have limitations, and each solution depends on consumer participation. It’s a very good approach for a democracy where consumers value their privacy.

First, contact tracing as defined by the World Health Organization:

“[Contact tracing] can be broken down into 3 basic steps:

  1. Contact identification: Once someone is confirmed as infected with a virus, contacts are identified by asking about the person’s activities and the activities and roles of the people around them since onset of illness. Contacts can be anyone who has been in contact with an infected person: family members, work colleagues, friends, or healthcare providers.
  2. Contact listing: All persons considered to have contact with the infected person should be listed as contacts. Efforts should be made to identify every listed contact and to inform them of their contact status, what it means, the actions that will follow, and the importance of receiving early care if they develop symptoms. Contacts should also be provided with information about prevention of the disease. In some cases, quarantine or isolation is required for high risk contacts, either at home or in hospital.
  3. Contact follow-up: Regular follow-up should be conducted with all contacts to monitor for symptoms and test for signs of infection.”

 

Ambient tracking is the best way to do contact tracing because it depends the least on consumer action. The alternatives are process, consumer recall, or consumers self-reporting their location = Foursquare revisited. For example, I participate in a COVID-19 citizen science initiative in San Francisco. Each day I get a notification that reminds me to open the app and answer three questions. One of the questions is, “With how many people outside of your household have you been within six feet of today?” Then my mind goes back to the grocery store trip I made earlier in the day to guess. Then I also add and subtract the number of people with masks or not. The point is that consumer recall is imprecise.

How Does The Apple-Google Contact Tracing Work?

Apple and Google’s contact tracing platform will leverage Bluetooth beacon technology to exchange unique identifiers with other nearby devices. (For iOS owners, imagine using AirDrop, but this will happen in the background.) The platform will analyze Bluetooth signal strength to estimate how close the devices were to one another and how long they remained nearby. Apple and Google should be able to develop insights from the data more efficiently (equals less battery drain) than third parties.

From there, public health agencies will be able to build apps that interact with recent contact logs. To participate, the program will require that consumers download an app or update their operating systems (OSes), opt in to the surveillance program, and then manually report that they’ve been diagnosed with COVID-19 so those impacted can be notified.

Some Challenges Ahead

While contract tracing is a cornerstone of regional COVID-19 strategies, early results from contract tracing programs abroad shed a light on just how difficult it can be to derive meaningful outcomes from the digital versions of these programs. A myriad of technical, social, and regulatory barriers lay ahead for Apple and Google, including:

  • Low consumer adoption. Consumers may not volunteer to be part of the program. The value of track-and-trace programs relies on capturing a high percentage of community transmissions. What percentage of actual transmissions will an opt-in program capture, especially one that requires the user to either download an app or update their OS and then always keep an app running in the background if needed? Without a critical mass of consumers opting into contract tracing, this won’t work. According to Forrester Analytics survey data, only 13% of US online adults are willing to let companies track their location to send them offers for places they have been. Only 29% are comfortable sharing their location with apps “when it makes sense to do so.” Older adults are the least likely to feel comfortable with their location being tracked. Globally, countries pursuing opt-in digital contract tracing strategies have seen low adoption rates as well, around 20% of the general public, limiting the value of such tools. The value of participating erodes further as alternative protections emerge. Citizens may be near someone who is sick, but if all individuals take precautions, there is much less risk. Anecdotally, about 80–90% of citizens are wearing masks in public in San Francisco.
  • Mounting privacy concerns. Apple and Google have not laid out the specifics of how they will maintain privacy or what type of a token they will use. Apple and Google could maintain privacy by using the phone’s IMEI, or International Mobile Equipment Identity. These IDs are typically available to third parties for the purpose of tracking consumers. The ID alone can’t reveal a name or address. However, the phone is likely silent and in one place from 8 p.m. evenings until 8 a.m. mornings. It wouldn’t take much work to layer in the address and then lots of other third-party data to complete the picture.
  • High dependency on smartphones (it appears). Smartphones and connected devices are our best option, even if not a perfect option. The vast majority of consumers in the United States own smartphones, but they do miss core elements (e.g., the homeless or children). Also, smartphones track the location of the device — not the person. If a user goes jogging or to the store without their smartphone, it looks like they are just at home. In addition, the accuracy of measuring how long two devices are in close proximity is critical. A user may be on the same block or line or store as someone who eventually comes down with the symptoms of COVID-19. That does not mean the user was near them long enough to be at risk of contracting the virus.
  • Rapidly changing regulatory requirements. In the absence of consumer adoption, will governments mandate participation as a condition of free movement for citizens? How will Apple and Google respond to regulatory and public pressure to remove opt-out features? Will diagnostic testing keep up with the demand from consumers if they need to prove they are healthy or have the antibodies on an ongoing basis?

Other Questions And Concerns

  • Compliance with self-reporting requirement. The proposed app would do more than notify those you’ve come into contact with in the past of your COVID-19 diagnosis; it would also notify those nearby you in real time that they’ve just been exposed. Will the general public self-report their COVID-19 status if it means their phone will begin pushing real-time alerts to nearby app users?
  • Scalability. Apple and Google are building API frameworks to support public health organizations that want to build an app. How many public health organizations — state, federal, or global — will create apps? Will they be interoperable? Will tracing programs break down nationally or globally?
  • Behavioral changes. Will users self-quarantine because an app told them they’d been in proximity to someone with COVID-19? Will employers support these absences?
  • Data storage and protection. Where will this data live, and how will it be protected while being made available?
  • Partner ecosystems. How does Google plan to work with original equipment manufacturers on deployment and adoption of the upgrade? If third-party app builders want to tap into this resource, how would they do that?
  • Legal compliance. Who will be responsible for adhering to the law in each country?