Is Digital Contact Tracing Over Before It Began?

Jonathan Zittrain
Berkman Klein Center Collection
9 min readJun 25, 2020

Last month I wrote a short essay covering some of the issues around standing up contact tracing across the U.S., as part of a test/trace/quarantine regime that would accompany the ending of a general lockdown to prevent the spread of the Coronavirus pandemic:

Until a vaccine or other transformative medical intervention is developed, the broad consensus of experts is that the only way out of mass sheltering in place, if hospital occupancy curves are to remain flattened, entails waiting for most of the current cases to resolve, and then cautiously and incrementally reopening. That would mean a sequence of allowing people out; promptly testing anyone showing symptoms — and even some who are not; identifying recent proximate contacts of those who test positive; and then getting in touch with those contacts and, if circumstances dictate, asking or demanding that they individually shelter until the disease either manifests or not. The idea is to promptly prune branches of further disease transmission in order to keep its reproductive factor non-exponential.

In the intervening month, some things have remained the same. As before, tech companies and startups continue to develop exposure notification apps and frameworks. And there remains no Federally-coordinated effort to test, trace, and isolate — it’s up to states and respective municipalities to handle anything that will happen. Some localities continue to spin up ambitious contact tracing programs, while others remain greatly constrained. As Margaret Bourdeaux explains, for example: “In Massachusetts, many of the 351 local boards of health are unaccredited, and most have only the most rudimentary digital access to accomplish the most basic public health goals of testing and contact tracing in their communities.” She cites Georgetown’s Alexandra Phelan: “Truly the amount of US COVID19 response activities that rely solely on the fax machine would horrify you.”

There remain any number of well-considered plans that depend on a staged, deliberate reopening based on on testing, tracing, and supported isolation, such as ones from Harvard’s Safra Center (“We need to massively scale-up testing, contact tracing, isolation, and quarantine — together with providing the resources to make these possible for all individuals”), the Center for American Progress (calling for “instantaneous contact tracing and isolation of individuals who were in close proximity to a positive case”), and the American Enterprise Institute (“We need to harness the power of technology and drive additional resources to our state and local public-health departments, which are on the front lines of case identification and contact tracing”). The official White House plan for reopening calls for the same, with testing and tracing as one of the three sets of “Core State Preparedness Responsibilities.”

But the bigger picture momentum appears to have waned. The work on planning and standing up contact tracing is being overtaken by a public sensibility that the disease has been sufficiently managed for things to more or less return to normal. Where before, the question of voluntary participation in a tracing and isolation scheme was seen as how to get from, say, 50% participation up to 70% or more by the general public, the question now is whether nearly anyone would bother to install or use contact tracing tools at all — or, apps aside, change their behavior should they receive a call indicating that they’ve been exposed by someone who has tested positive. In New York, contract tracers are having a hard time completing interviews. And in Massachusetts, a mixed bag: on the one hand, so many contact tracers were admirably stood up so quickly that there isn’t enough work to go around. On the other hand, most of the cases being diagnosed haven’t been identified beforehand through contact tracing — which means that transmission chains can’t be pruned.

Of course, it’s hard to blame people for failing to participate in schemes that haven’t fully materialized. Testing capacity remains unfulfilled, or not directed in ways that might find new cases for a region, such as with arriving travelers, or at large (so-called “sentinel testing”). Raw test numbers aren’t impressive if they simply reflect the repeated testing of, say, health care providers several times a week. And there are currently some states where the positive test rate is climbing, which means almost by definition that they’re testing too few people. This against a backdrop of the Federal government ending funding for local testing sites, and the CDC offering no public-facing role in countering the crisis.

https://www.nytimes.com/2020/06/25/upshot/virus-testing-shortfall-arizona.html
https://www.nytimes.com/2020/06/25/upshot/virus-testing-shortfall-arizona.html

Google and Apple made changes to Android and iPhone operating systems respectively, and published a standard for state-approved exposure notification apps to use the new OS features — apps not to assist with state contact tracing interviews, but rather to simply alert people to contact their health department if, on the basis of that app’s recording of proximity to others alone, they are thought to have been exposed. As a result, health departments appear to be curious but not thrilled with that framework, and Apple and Google do not appear to have much appetite to expand the framework to explicitly assist with professional contact tracing, given the companies’ assessments of privacy risk.

The result is, so far, a plateau in visible activity on the tech side of the ledger since the May 20, 2020, launch of the Apple/Google exposure notification framework. There was a round of media reporting around that time when a first batch of three states — Alabama, North Dakota, and South Carolina — signed on to use the framework. Other states, such as Virginia and Maryland, have indicated interest, at least once they’ve gotten traditional contact tracing up and running. But it does not seem that any state has yet approved or launched an exposure notification app based upon the framework.

Efforts outside of the United States have made a little more progress. Switzerland has led the charge, piloting an app that implements the Apple/Google framework within hospitals, government agencies, and the military. Other nations — many of them among the 22 granted access to the Apple/Google framework in May — are developing and deploying apps of their own. We’ve also seen the emergence of a number of apps not based on the Apple-Google framework, including in Singapore and Australia.

Indeed, outside the Apple/Google framework there are a range of apps in development that seek to respond to a demand for contact tracing. (An ongoing survey of the apps from the COVID-19 Technology Task Force can be found here.) Some apps appear to have poor privacy and security protections, which could tarnish those that do, and in the absence of local government buy-in it’s hard to see them achieving critical mass, and in at least one instance, that of Utah, a procurement process for an independent contact tracing app has run into a number of problems, calling into question whether a fully functional app will ever be rolled out.

Problems of trust aren’t just arising from uneven app development from startups. There is mistrust of government, too. In at least one instance law enforcement officials have confusingly described their investigative work in tracking protesters as “contact tracing.” On May 30, 2020, Minnesota Public Safety Commissioner John Harrington, in speaking of protesters who have been arrested, said:

“It’s contact tracing of who are they associated with, what platforms are they advocating for, and we have seen things like white supremacists who have posted things on platforms about coming to Minnesota.”

Statements like these can erode public support for even traditional contact tracing, as they think the sensitive information they’re asked to share might be used against them or their friends. And there’s an understandable general mistrust of strangers who call asking for sensitive information. (Indeed, there’s little to protect against scammers misrepresenting themselves as contact tracers to glean personal information.)

Many of these problems are to be expected. Designing something as complicated as privacy-sensitive digital contact tracing or exposure notification is no easy task, and for it to work it requires broad uptake and a timeline for release so aggressive as to be impossible, given the current breakneck pace of public re-openings. All against a backdrop of not only Federal government abdication, but also White House hostility to public health measures that may be fostering an environment of threats to public health officials:

Ohio’s top public-health official, Amy Acton, also resigned this month after armed protesters showed up at her house to register their displeasure with her role in the state’s efforts to stop the spread of the coronavirus. Facebook groups explicitly devoted to her firing gathered more than 4,000 members.

Two Scenarios: YOLO and the Company Town

This suggests two plausible scenarios for what will happen next — with a comprehensive test/trace/isolate regime for most regions of the country not among them.

The first scenario is roughly the same as Sweden’s approach: re-open all but the most high-spreading services and events; ask people to exercise social distancing where they can; have people wear cloth masks to minimize the spread of the moisture in their breath to others; and try to make available testing so that people who wish to know if they’re infected can find out and then self-isolate if they test positive or show worrisome symptoms. We might call this the YOLO scenario.

This approach risks lots of preventable misery, and death, should hospital capacity be exceeded, or the disease affect far more people than it would if we were able to mitigate spread before a vaccine or treatment is available. (The architect of Sweden’s YOLO plan has expressed some regrets over it, though the numbers appear to be attenuating at the moment.) We rest our hopes of avoiding bad outcomes on the prospect that general distancing, and in particular the use of masks, will keep the viral replication below exponential levels. (It may also be that exposure notification apps will have a lot of false positives if individual mask-wearing makes a big difference for transmission on a given exposure, and if the apps can’t readily record whether people in proximity were masked.)

With the President resuming his campaign rallies, the line between partial re-opening and full re-opening may become quite blurred. Universities are coming to different answers about whether they will welcome back students in the fall. (Some thoughts on that here.)

Another blurring of the lines between lockdown and reopening will remain geographic. Especially to the extent that long-distance travel has been reduced, the pandemic can express as a series of local epidemics, and some regions may find themselves inundated at times that others are not. That might reinforce the idea of locally managing rules and practices around pandemic mitigation, and of accruing data to have a sense for where resources should be deployed. But the localization of the disease and the best response to it shouldn’t obscure the fact that a more centralized effort to assist in testing and tracing infrastructure could prevent each state or municipality from having to reinvent the wheel.

Should the YOLO-approach not work, we must either take the hit from uncontrolled spread of the disease, or attempt to reinstate the prior spring lockdown in places that are overwhelmed.

A second approach can be a pocket within the first. I call it the Company Town Model. It’s one in which some big companies and institutions decide to implement their own test/trace/isolate regimes as employees return to workplaces. A company whose employees don’t physically interact much with the public during the day — an insurance company, or a tech firm like Facebook or Google — might require its employees to undergo regular testing, and then cease coming to work if they test positive. Such a company could stand up its own tracing program, and use data from company-issued devices, with notice to employees and no permitted opt-out, to assist in that tracing. Those who are deemed to have been exposed can also be required not to come to work. Universities might choose to require much the same for their faculty, staff, and students.

The overall regime may thus remain nominally a voluntary one, with respect to government coercion, but participation in private regimes like this will be by choice only in the sense that employees can quit their jobs, or students can choose to drop out of school, if they don’t want to participate in their institutions’ programs. And it of course leaves most people behind: if you don’t work for an institution that can pull off its own internal testing and tracing, you won’t directly benefit from such a program.

Failing to commit to a broad program of testing, tracing, and supported isolation amounts to a big gamble. It would be a difficult program to implement even in the best of times and with strong and coordinated leadership across the country. It’s one that, in the summer of 2020, we appear to be taking, not by together choosing to forego it, but by having so many partial or missing ingredients that at best we can muster only a few worthy, localized efforts with the odds very much stacked against them.

--

--

Jonathan Zittrain
Berkman Klein Center Collection

Prof. @Harvard_Law, @HSEAS, @Kennedy_School + @BerkmanCenter for Internet & Society; @EFF board member; a small creature who likes to run around in universities