What Digital Contact Tracing Can Teach Us About Public Trust, Health Equity, and Governance in the United States
Reflections from over a dozen Digital Pandemic Response Working Group meetings hosted by the Berkman Klein Center for Internet & Society at Harvard University.
By Adam Nagy with contributions from Hilary Ross
As of October 2020, COVID-19 cases are continuing to climb across much of the world. The global economy is in tatters. Education, commerce, worship, and all things in between remain disrupted. Over a million people are dead.
The overall situation was resoundingly similar five months ago when the Berkman Klein Center for Internet & Society launched its Policy Practice focusing on Digital Pandemic Response (DPR), along with a Digital Pandemic Response Working Group (“Working Group”). With generous support from the Ford Foundation, Hewlett Foundation, and MacArthur Foundation, the DPR Program and Working Group emerged as the linchpins of BKC’s response to the crisis. As members of the BKC staff supporting this project, we’ve had the opportunity to join the Working Group as observers, scribes, and contributors: the following is a snapshot of what we considered to be some of the significant learnings, unturned stones, and ongoing debates of the Working Group over the past several months.
About the Working Group
Amidst clouds of uncertainty, group members saw an opportunity to attenuate this unprecedented crisis — if not in whole, at least in part — using the equally unprecedented capabilities of the digital age. We wanted to examine those opportunities together, building bridges and regularly convening experts and policymakers from across sectors to dig into the complex social, technical, and political questions, and sharing learnings as we went. To start, the Working Group focused on contact tracing, an essential pillar of an effective public health response and a key locus for significant human and technological investment.
Composed of representatives from public health, technology, and state government, alongside civil liberties advocates, legal experts, and academics, the Working Group has operated as a weekly venue for issue-spotting, collaboration, and candid, Chatham House Rule discussion with invitees. The group’s attention has largely focused on the use of information and communications technology (ICT) to support or supplement traditional contact tracing efforts. Over the course of this work, the group gravitated towards several key questions around how technology and access to data can support contact tracing — and surfaced important concerns related to technical limitations, public health efficacy, and civil liberties risks. Succinctly, these interrelated domains are the essential relationship between public trust and digital interventions, the risks of uneven costs and benefits of digital interventions, and the urgent need for increased coordination between and among the private sector, public health professionals, researchers, and political leadership.
The Essential Relationship Between Public Trust and Digital Interventions
The pandemic struck at a time when Americans’ trust in government, institutions, in experts, and in information is at near-record lows. And it is precisely among some of the hardest-hit communities where these deficits are most well-founded — why should an undocumented immigrant trust a government-employed contact tracer? Why should people of color, especially Black Americans, trust that an app won’t use their data to harm them in the future? Why should anybody trust a tech company not to sell, misuse, or otherwise fail to protect their data?
This is an enormous problem, and barring enforced mandates, tools in the public health kit hinge on the public’s willingness to use them. Trust is a key enabler when it comes to the efficacy of different pandemic responses from population-level interventions such as wearing masks and social distancing, to downloading an app or picking up the phone to share information with a contact tracer.
More Privacy or More Data — Debating Difficult Trade-Offs:
Given this environment, many digital solutions, most notably the Apple and Google Exposure Notification system (GAEN), prioritized preserving user privacy at the expense of providing contact tracers with more comprehensive contextual data. Reasonable minds may (and do) disagree about whether any individual approach gets the balance of trade-offs right. GAEN is considered the ‘gold standard’ from a privacy standpoint, but there are a host of non-GAEN digital contact tracing apps in development or in use around the world. What is clear is that robust privacy protections are intended to make adoption more palatable for wary governments and populations. But a privacy-preserving app is certainly not a sufficient condition for high adoption among a population — adoption rates differ significantly across countries even when the underlying technology is identical — and adoption rates, while a crucial metric, are not a perfect proxy for efficacy and actual public health impact.
Even once someone has downloaded a digital contact tracing or exposure notification app, opportunities for attrition abound. First, users must activate the app and keep it on. Upon receiving a positive test result or an exposure notification users must be proactive — either uploading their result to warn others or heeding the instructions accompanying the exposure notification. In other words, it is not enough for people to simply download the app. As Working Group member Mary Gray has written elsewhere, solving the “wicked hard tech problem” of notifying exposed individuals in a privacy-preserving way does not solve the critical last mile problem of routing them to trusted care workers and ensuring they self-quarantine with the necessary support to weather COVID-19. Accomplishing that task — under the privacy-protective constraints of GAEN — will require creative, non-technical solutions such as employing trusted local institutions or community members to serve as extensions of public health agencies to encourage participating in contact tracing programs — digital or otherwise — and to connect people who’ve tested positive to necessary resources.
Trust, but Verify: Evaluating Efficacy
Aside from users, there is an additional, crucial layer of trust: do public health authorities have confidence in the contact tracing app? A major unresolved barrier to buy-in concerns the lack of large-scale, replicated studies measuring the efficacy of these digital interventions. While developers have expressed concern with ‘analysis paralysis’ and the slow pace at which jurisdictions adopt these apps — arguing in favor of deploying quickly and making improvements down the line — it is difficult to expect jurisdictions to invest time and resources into still under-proven products. There are significant concerns around the costs of releasing technologies that are not proven as efficacious in terms of spent political capital, eroded public trust, and overall reduced adoption rates. Striking the right balance will remain challenging until there is more data available on the efficacy of these interventions.
In the interim, technologists and developers must work diligently to reduce other areas of uncertainty and pain points for public sector implementers. These include the potential for privacy and security breaches, overall cost, and lack of input from subject matter experts during the design process. Organizations like the Linux Foundation for Public Health (LFPH) have attempted to reduce these challenges by channeling the attention of the OS community and substantial resources to the increasingly widely adopted GAEN-enabled COVID Shield and COVID Green apps, vetting developers and firms for jurisdictions to work with, and producing useful guidance documentation. Google and Apple’s Exposure Notifications Express — turn-key solutions to building and launching a contact tracing app — will expedite adoption while allowing local authorities to customize certain key elements. The willingness of organizations to serve as ‘air-traffic’ controllers — certifying third-party vendors, scaling testing, creating replicable best practices, and working closely with local officials and public health authorities — will be critical drivers of trust and buy-in.
Takeaways and Calls to Action:
- State and local public health leaders and policymakers should urgently invest in building and strengthening relationships with locally trusted community groups, which are critical to helping individuals and communities collectively support each other and understand strategies to weather COVID-19. In states that have adopted exposure notification apps, community groups could help members understand privacy-preserving exposure notification tech as part of a suite of holistic supports.
- As exposure notification and digital contact tracing technology is so new, we need further research on its efficacy. Who is responsible for evaluating efficacy, potential adverse effects, and the impact of these technologies across a variety of communities? What monitoring structures ought to be put into practice? (For example, Ireland established a COVID Tracker App Advisory Committee to continually assess the efficacy of the app alongside a mechanism to wind-down the app in 90 days if they find it ineffective.) What might cross-sector evaluation of these technologies look like, with companies, researchers, policymakers, and community groups working in collaboration? A complete cost-benefit analysis for policymakers will require research into a variety of questions — many of which are outlined in this robust research agenda from the University of Zurich. Some of this work is already underway — and it might be a useful exercise to catalog the existing literature.
Health (In)Equities: Uneven Costs and Benefits of Digital Interventions
The impacts of COVID-19 are not distributed equally — its devastating effects fall most heavily along pre-existing lines of socioeconomic and racial inequality. COVID-19 death rates are disproportionately high across communities of color, especially among Black Americans who are more likely to contract COVID-19, be hospitalized for it, and die of the disease in comparison to other racial groups. Longstanding disparities in access to health insurance, employment, education, quality healthcare, environmental justice, and other rights, increase the prevalence of comorbidities in Black, Latino/Hispanic, Native Americans, and Pacific Islander populations making them more vulnerable to COVID than other racial groups. In addition to causing compounding pre-existing medical conditions, social determinants can make transmission events more likely. For example, racial minorities in general and Black Americans in particular, are more likely than non-Hispanic White populations to use public transit as a primary mode of transport, to live in densely populated areas and in multigenerational households, and to work in essential frontline jobs that preclude isolating at home. The Working Group has grappled with how digital public health interventions account for these disparities and can risk exacerbating them further.
Data Disparities
A major issue of concern raised to the Working Group pertains to gaps in state and federal public health agency data collection regimes, particularly with respect to important demographic information such as race, ethnicity, language, and other factors. In the absence of this data, doctors and epidemiologists have had to build improvised solutions in order to better understand the disparate impacts of COVID-19 and create response strategies. These innovations, while highly impressive, are ad hoc and cannot substitute for improvements in collection, universal data standards, and best practices. Of course, the collection of demographic data is fraught — take, for instance, the legal fight over the inclusion of a citizenship status question in the 2020 Census — and without robust safeguards and public trust in how the data will be used there are risks such as stigmatization or suppressed response among vulnerable populations. Scholars Merlin Chowkwanyun and Adolph Reed Jr. recently explored the risks of relying on demographic data without also considering socioeconomic status data in The New England Journal of Medicine, arguing inter alia that on its own demographic data can erroneously feed perceptions that a social problem is actually a “primarily racial” one, which in turn can be “used to rationalize neglect and funding cuts.” They go on to argue in favor of incorporating data on socioeconomic factors alongside demographic information to help preempt these dangers, discover how risks intersect across different racial and social lines, and also draw attention to racial disparities. Data collection that ignores these key areas limits healthcare professionals’ ability to develop a complete hierarchy of risk on which to base the prioritization of care and resources.
The Working Group also discussed the potential of aggregated mobility data from mobile operators and sources like GPS trace data from social media applications to inform epidemiological models and to provide policymakers with important insights regarding movement patterns and a way to evaluate the efficacy of different strategies. But this data must be interpreted in context: urban and rural populations behave differently, as do communities of differing socioeconomic status. Further, data quality gets worse in rural areas. Each of these factors must be considered in interpreting data, finding and correcting for biases, and comparing across datasets.
Digital Divides
App-based digital contact tracing solutions risk leaving disproportionately vulnerable populations at a further disadvantage due to unequal access to smartphones. Furthermore, false alerts from inaccurate digital contact tracing tools will have greater impacts on essential workers — disproportionately people of color — who cannot work from home more than white-collar workers. Because the costs of a false-positive exposure notification are not borne equally, policymakers ought to consider necessary legal protections and social benefits to support individuals alerted that they should quarantine for 14-days. Overall, there is inadequate investment of key resources to protect communities of color; this lack of investment has both contributed to and revealed inequalities that make populations of color more susceptible to the virus.
Takeaways and Calls for Action:
- In order to understand people’s lived experiences of the pandemic and develop equitable mitigation strategies to protect communities, data-collecting organizations — both government agencies and academics — should be collecting relevant disaggregated health data on race, ethnicity, language, socioeconomic status, and environmental factors that contribute to inequities, such as ventilation and levels of crowding in living conditions.
- Policymakers, the private sector, and academics should consider how mobility data moves across sectors and ensure that government actors use datasets in a manner that is proportionate and necessary to achieve a legitimate aim. Social media data, adtech data, and data from third-party aggregators are particularly sensitive, and in some jurisdictions privacy regulations are far less rigorous than those imposed on mobile operator data.
- People need support to be able to effectively self-isolate and quarantine, but lack of resources prevents many people from being able to do so. Policymakers, community groups, and other relevant institutions should strongly consider offering funding and other community-based support to those who need to self-isolate and quarantine and therefore are unable to work. Policymakers should implement legal protections to protect those who need to self-isolate and quarantine from a broad range of adverse impacts at work, at home, and in their communities.
Domestic Disarray: The Urgent Need for Increased Coordination in the United States
In the United States, the COVID-19 response has been stymied from the start due to the Trump administration’s decision to delegate many decisions to industry, state, or local leaders. The lack of a national strategy on everything from mandatory mask requirements to the allocation of protective equipment has proven disastrous. Federal leadership and coordination of contact tracing efforts — digital or otherwise — continues to be lackluster. Expanding the contact tracing workforce, creating technological components, and bolstering public trust in contact tracing has been left to the states, albeit with guidance, assistance, and funding available from the Center for Disease Control and other agencies. What have been the consequences of limited federal coordination of contact tracing efforts across jurisdictions and the lack of standardized tools and practices? What is filling in the gaps? And looking outwards, are there lessons to be learned from international contexts?
Weighing the Costs and Benefits of a Decentralized Approach
Most countries engaged in digital contact tracing adopt a singular, national app. The United States has taken a decentralized approach. Currently, a growing number of states and territories use GAEN enabled apps, South Dakota, Utah, and Rhode Island use GPS-based apps, and the majority of states do not have an app. Meanwhile, employers, universities, and other private entities are steadily developing or adopting their own hyper-local solutions.
Decentralization gives the public health authorities actually engaged in contact tracing more flexibility with respect to the allocation of their funds and energies, enables them to customize apps according to their needs, and crucially, affords them the freedom to decide between GAEN and competing approaches.
But there are obvious trade-offs to this heterogeneous approach. These include the uneven adoption of digital contact tracing (most states still don’t have an app), interoperability problems, and a disjointed outreach/communications strategy. Thankfully, different GAEN enabled-apps can now communicate exposure events to one another across state lines if they are configured to use the Association of Public Laboratories national key server — but not all of them are configured to do so, non-GAEN apps do not work with the server, and it took months (and the generosity of private actors) to get the system up and running.
Lessons from Europe
A state-by-state model did not, however, force the Federal government to the sidelines. The European Union, which also adopted a decentralized approach, is instructive. Nearly every EU member state has a digital contact tracing app with far higher adoption rates than seen in the United States — and there are significant ways in which the EU has been more proactive than the Federal government.
Standardizing and clarifying privacy protections and requirements is one such aspect. Congress has proposed several COVID-19 privacy bills, but none have passed, so currently no single federal law creates consistent and clearly-applicable privacy protections with respect to contact tracing. The European Commission and the European Data Protection Board, on the other hand, have issued legal guidelines and decisions to EU Member States regarding digital contact tracing (See, 1, 2, and 3), aggregated mobility data (See, 1 and 2) and interoperability.
Providing detailed technical guidance and assistance is another. The CDC guidelines to states around digital contact tracing are high-level and cursory. Federal assets such as 18F or the U.S. Digital Service, which could have been deployed to assist states with the design and roll-out of their own apps, have not been empowered to do so. Meanwhile, EU organs have produced significant technical guidance to Member States as well as concrete technical solutions — most notably creating a single European Federation Gateway Service to make GAEN apps interoperable.
Other entities have attempted to fill the leadership vacuum left by the Federal government. Private non-profit organizations such as the Linux Foundation Public Health or PathCheck Foundation are providing jurisdictions with technical assistance and solidifying best practices. Organizations such as the National Governors Association, the Association of State and Territorial Health Officials, and many others are using their coordinating power and expertise to issue recommendations to members and concentrate efforts.
Takeaways and Calls to Action:
- Fully launched in October, the “Federation Gateway” enables European Union Member States with properly configured GAEN-apps to interoperate. Launched in July, the Association of Public Health Laboratories (APHL) National Key Server and Verification Server allows properly configured GAEN-apps in U.S. states and territories to interoperate. While the end results are similar the associated processes were markedly different. In the EU, the European Commission led work with member states to coordinate on interoperability guidelines, technical specifications, and the adoption of a legal basis for the service. In the United States, the APHL, a non-governmental non-profit, partnered with Apple, Google, and Microsoft to create and host a national exposure key server (as well as a unified verification server). The APHL-led approach brought an interoperable server online more quickly than the European Commission’s effort, but is it possible that the EU’s holistic approach will offer more enduring lessons? Our goal — if not for this pandemic, than at least the next one — ought to be a globally interoperable system for digital contact tracing. Accomplishing this will require tremendous synchronization across diverse legal and policy architectures. The EU’s effort, which confronted not only the technical question but legal questions as well, is a step in that direction.
- Uneven state-level adoption of contact tracing apps opened the door to hyper-local test and trace solutions by private institutions, namely universities and employers. Labeled the “company-town model” by Working Group Co-Chair Prof. Jonathan Zittrain, this approach has had some unsavory real-world consequences. In one extreme example, Albion College deployed a mandatory app with around the clock location surveillance that was discovered to have several security flaws, endangering the privacy of their students. As the chief enforcers of privacy protection laws, state attorneys general must remain vigilant about the privacy impacts of these apps — and would do well to issue guidelines to developers to help ensure safeguards are met. In instances where a private institution has both a large footprint in a community as well as the resources to conduct a rigorous testing and tracing program — as is the case with Harvard University — decision-makers ought to consider how to mitigate any negative community effects reopening may cause.
Concluding Thoughts
The early success of digital contact tracing in countries like South Korea — which had a critical combination of high levels of public trust, a legal framework that enabled sweeping public health surveillance using a variety of data sources, and a robust pandemic response infrastructure — inoculated belief in mobile technology as a critical tool to fight the spread of COVID. That belief persists in many corners, as evidenced by the slow but steady rollout of different contact tracing apps throughout the US and globally, but it has been tempered.
A silver bullet solution was always unlikely. An app cannot solve for an impoverished public healthcare infrastructure, for inadequate support of the sick and the possibly sick, or for leaders that actively spread misinformation and undermine trust in scientific authorities. But ‘no-app’ doesn’t solve these issues either.
Digital contact tracing solutions are arrows in our quiver, silver or otherwise, and ones that are increasingly affordable and accessible to public health authorities. The challenge now is making them as effective as possible and also, as with any weapon, working to prevent unintended harms. Invested stakeholders can re-invigorate enthusiasm for these solutions by supporting research that investigates the effectiveness of ongoing efforts and ways to improve their effectiveness. There are legitimate concerns that ineffective or insecure tools will erode the public’s trust in government-sponsored technological solutions or that the impacts of false positives will be unequally distributed. Authorities need to have a transparent plan for not only monitoring the effectiveness of these interventions in breaking transmission chains but also to guard against unintended consequences, particularly for already vulnerable or disenfranchised populations.
Until a vaccine is developed and widely dispersed, our work will continue. Despite the fact that many schools and workplaces are reopened (at least partially) and that states are easing restrictions on various activities such as indoor dining, we are still deep in this crisis. As the Working Group looks towards engaging in new topics — such as vaccine distribution schemes — it’s crucial to take stock of what we’ve learned during our examination of digital contact tracing, why we wrestled with these questions, and how we can best use what we’ve learned moving forward.
