COVID-19 apps


COVID-19 apps include mobile-software applications for digital contact-tracing—i.e. the process of identifying persons who may have been in contact with an infected individual—deployed during the COVID-19 pandemic.
Numerous tracing applications have been developed or proposed, with official government support in some territories and jurisdictions. Several frameworks for building contact-tracing apps have been developed. Privacy concerns have been raised, especially about systems that are based on tracking the geographical location of app users.
Less overtly intrusive alternatives include the co-option of Bluetooth signals to log a user's proximity to other cellphones. )
On 10 April 2020, Google and Apple jointly announced that they would integrate functionality to support such Bluetooth-based apps directly into their Android and iOS operating systems. India's COVID-19 tracking app Aarogya Setu became the world's fastest growing application—beating Pokémon Go—with 50 million users in the first 13 days of its release.

Rationale

Contact tracing is an important tool in infectious disease control, but as the number of cases rises time constraints make it more challenging to effectively control transmission. Digital contact tracing, especially if widely deployed, may be more effective than traditional methods of contact tracing. In a March 2020 model by the University of Oxford Big Data Institute's Christophe Fraser's team, a coronavirus outbreak in a city of one million people is halted if 80% of all smartphone users take part in a tracking system; in the model, the elderly are still expected to self-isolate en masse, but individuals who are neither symptomatic nor elderly are exempt from isolation unless they receive an alert that they are at risk of carrying the disease. Some proponents advocate for legislation exempting certain COVID-19 apps from general privacy restrictions.

Issues

Uptake

, professor of security engineering at Cambridge University, listed a number of potential practical problems with app-based systems, including false positives and the potential lack of effectiveness if takeup of the app is limited to only a small fraction of the population. In Singapore, only one person in three had downloaded the TraceTogether app by the end of June 2020, despite legal requirements for most workers; the app was also underused, as it required users to keep it open at all times on iOS.
A team at the University of Oxford simulated the effect of a contact tracing app on a city of 1 million. They estimated that if the app was used in conjunction with the shielding of over-70s, then 56% of the population would have to be using the app for it to suppress the virus. This would be equivalent to 80% of smartphone users in the United Kingdom. They found that the app could still slow the spread of the virus if fewer people downloaded it, with one infection being prevented for every one or two users.
In August 2020, the American Civil Liberties Union argued that there were disparities in smartphone use between demographics and minority groups, and that "even the most comprehensive, all-seeing contact tracing system is of little use without social and medical systems in place to help those who may have the virus — including access to medical care, testing, and support for those who are quarantined."

App store restrictions

Addressing concerns about the spread of misleading or harmful apps, Apple, Google and Amazon set limits on which types of organizations could add coronavirus-related apps to its App Store, limiting them to only "official" or otherwise reputable organizations.

Ethical principles of mass surveillance using COVID-19 contact tracing apps

The advent of COVID-19 contact tracing apps has led to concerns around privacy, the rights of app users, and governmental authority. The European Convention on Human Rights, the International Covenant on Civil and Political Rights and the United Nations and the Siracusa Principles have outlined 4 principles to consider when looking at the ethical principles of mass surveillance with COVID-19 contact tracing apps. These are necessity, proportionality, scientific validity, and time boundedness.
Necessity is defined as the idea that governments should only interfere with a person's rights when deemed essential for public health interests. The potential risks associated with infringements of personal privacy must be outweighed by the possibility of reducing significant harm to others. Potential benefits of contact-tracing apps that may be considered include allowing for blanket population-level quarantine measures to be lifted sooner and the minimization of people under quarantine. Hence, some contend that contact-tracing apps are justified as they may be less intrusive than blanket quarantine measures. Furthermore, the delay of an effective contact-tracing app with significant health and economic benefits may be considered unethical.
Proportionality refers to the concept that a contact tracing app's potential negative impact on a person's rights should be justifiable by the severity of the health risks that are being addressed. Apps must use the most privacy-preserving options available to achieve their goals, and the selected option should not only be a logical option for achieving the goal but also an effective one.
Scientific validity evaluates whether an app is effective, timely and accurate. Traditional manual contact-tracing procedures are not efficient enough for the COVID-19 pandemic, and do not consider asymptomatic transmission. Contact-tracing apps, on the other hand, can be effective COVID-19 contact-tracing tools that reduce R value to less than 1, leading to sustained epidemic suppression. However, for apps to be effective, there needs to be a minimum 56-60% uptake in the population. Apps should be continually modified to reflect current knowledge on the diseases being monitored. Some argue that contact-tracing apps should be considered societal experimental trials where results and adverse effects are evaluated according to the stringent guidelines of social experiments. Analyses should be conducted by independent research bodies and published for wide dissemination. Despite the current urgency of our pandemic situation, we should still adhere to the standard rigors of scientific evaluation.
Time boundedness describe the need for establishing legal and technical sunset clauses so that they are only allowed to operate as long as necessary to address the pandemic situation. Apps should be withdrawn as soon as possible after the end of the pandemic. If the end of the pandemic cannot be predicted, the use of apps should be regularly reviewed and decisions about continued use should be made at each review. Collected data should only be retained by public health authorities for research purposes with clear stipulations on how long the data will be held for and who will be responsible for security, oversight, and ownership.

Privacy, discrimination and marginalisation concerns

The American Civil Liberties Union has published a set of principles for technology-assisted contact tracing and Amnesty International and over 100 other organizations issued a statement calling for limits on this kind of surveillance. The organisations declared eight conditions on governmental projects:
  1. surveillance would have to be "lawful, necessary and proportionate";
  2. extensions of monitoring and surveillance would have to have sunset clauses;
  3. the use of data would have to be limited to COVID-19 purposes;
  4. data security and anonymity would have to be protected and shown to be protected based on evidence;
  5. digital surveillance would have to address the risk of exacerbating discrimination and marginalisation;
  6. any sharing of data with third parties would have to be defined in law;
  7. there would have to be safeguards against abuse and the rights of citizens to respond to abuses;
  8. "meaningful participation" by all "relevant stakeholders" would be required, including that of public health experts and marginalised groups.
The German Chaos Computer Club and Reporters Without Borders also issued checklists.
The Exposure Notification service intends to address the problem of persistent surveillance by removing the tracing mechanism from their device operating systems once it is no longer needed.
On 20 April 2020, it was reported that over 300 academics had signed a statement favouring decentralised proximity tracing applications over centralised models, given the difficulty in precluding centralised options being used "to enable unwarranted discrimination and surveillance." In a centralised model, a central database records the ID codes of meetings between users. In a decentralised model, this information is recorded on individual phones, with the role of the central database being limited to identifying phones by their ID code when an alert needs to be sent.
In Moscow use of the tracking app was made mandatory during the lockdowns in April 2020 when most Muscovites were mostly required to stay indoors. Vladimir Putin signed laws introducing criminal penalties, including up to seven years imprisonment, for quarantine violations that led to others being infected. Moscow also implemented government-issued QR codes that were made mandatory. It was not disclosed what information the codes contain, but they must be shown to police when requested. Opposition members were uncomfortable with the Russian government's introduction of COVID surveillance tools. In May 2020 Human Rights Watch reported that the authorities in Moscow had wrongly fined hundreds of Muscovites for breaching self-quarantine. The dubious behavioral interpretations recorded by the social monitoring tracking application led to the mistaken fining of hundreds of people in Moscow.
Contact-tracing apps were deployed rapidly by governments and other organisations in spring and summer 2020. Initial releases were found to come with incongruent privacy policies, hidden built-in surveillance and location-tracing functions, and generally contained few cues about a proper specification and quality assurance process. Code quality in several apps was found to be poor, while hardly any of 28 apps surveyed in May and June 2020 managed to address all privacy principles laid forth in the EU's GDPR.