Google and Apple’s rules for virus tracking apps sow division among states
June 10, 2020
The global rush to halt the coronavirus led countries like Australia and South Korea to launch smartphone apps to track its spread, using the technology as a key part of their push to tamp down the pandemic and restart their economies.
But U.S. efforts to do the same are running into an all-too-familiar problem that has plagued the pandemic response: a lack of national coordination. And Silicon Valley’s attempts to help aren’t resolving the confusion.
Instead, with varying opinions on what data these apps should record, the federal government has so far failed to institute concrete privacy standards. Apple and Google have sought to fill the void by asserting their own standards, flexing the power they hold over the software on almost all smartphones — but some states are refusing to follow their lead and fear the tech companies’ rules could render the apps nearly useless.
The result is a nationwide hodgepodge that has U.S. states struggling to take advantage of what sounded like promising digital tools to determine who has been exposed to the coronavirus. And the difficulties come at a particularly crucial moment. The number of cases is rising in roughly 22 states as they reopen and try to rouse their weakened economies. Nationwide racial justice protests have renewed concern about outbreaks.
Some Americans will have multiple, unconnected apps to choose from. Others will have none at all. And the level of adoption experts say is needed for these apps to make a meaningful difference — about 60 percent of the population — is looking all but impossible to hit.
“The more fragmentation there is, the less value there is,” said Bryan Sivak, who was a chief technology officer for the Department of Health and Human Services under the Obama administration. “How do you effectively analyze the data to understand what's happening?”
“It's kind of a waste of resources,” he added. “We don't need 50 apps to do this. We don't need 10 apps to do this. We need one app that does it the right way.”
Apple and Google encouraged each country to build a single app to prevent the patchwork now forming in the U.S. — and to simplify the process for users. Their framework also opens up the possibility of different apps communicating with each other. But ultimately, they said, the decision lies with public health authorities.
At least nine states have released or begun to develop these contact tracing apps, and more than a dozen told POLITICO they are actively considering them. But their approaches are far from consistent. Some states, such as Oklahoma and Virginia, are using the tech companies’ framework. Others, like Utah and Washington, are going with independent apps. North Dakota is doing both.
What’s more, at least 15 states have rejected the idea of using smartphone apps for contact tracing at all, instead relying largely on thousands of workers to do the tracing. Meanwhile, a handful of major cities have launched their own apps, and some employers and schools are working on tracking apps as part of their own reopening plans.
States choose sides
Rhode Island decided early on to go its own way, starting on its CRUSH COVID RI app in mid-April. State technologists spent a month huddled over computers with the IT services firm Infosys before releasing it on May 19. It has since been downloaded by 45,000 people.
The app uses the GPS data from a user’s phone to create a running “location diary” of the previous 20 days. If the user becomes infected, they can give the information to health workers to help identify that person’s recent interactions and pinpoint potential disease hot spots.
But that runs afoul of Google and Apple’s rules, which make their technology off-limits to apps that use GPS data. The companies’ software framework — the code that developers build into their apps — only allows apps that use Bluetooth signals to detect when two people have been near each other, without recording location information.
Rhode Island IT chief Chirag Patel said the state’s location-based app helps those who test positive recall where they’ve been and whom they have encountered, without relying on others to have a compatible app. Apps using the Apple-Google framework only exchange data when others have them installed. That’s important in Rhode Island where some residents, including Patel, commute across state lines from Massachusetts, he said. (Massachusetts told POLITICO it is in talks with Apple and Google but has yet to make a decision.)
Patel said Rhode Island will evaluate what Apple and Google have to offer, too, but that multiple apps would be counterproductive. “We want one-stop apps. If we ask you to download two apps for two purposes, it kind of defeats the purpose,” said Patel.
And yet, that’s exactly what at least one state has decided to do. North Dakota’s GPS-based app, Care19, launched in April and shared with South Dakota, has about 34,600 downloads. North Dakota is beta-testing another Bluetooth-based app based on Apple and Google’s technology, but it’s not available to the public yet.
Virginia is finalizing a contract with a developer to use the Apple-Google technology, but is also looking at adding a GPS-based app if it needs to map hot spots, said the state health department’s deputy commissioner for administration, Mona Bector. The department decided to make the Bluetooth approach a priority because it would work more seamlessly with more people’s devices.
Utah, meanwhile, has said it has no plans to use Bluetooth tracking and is working on a GPS-based app called Healthy Together.
Oklahoma went all-in with Silicon Valley. It has contracted with developer MTX to build a contact tracing app based on the tech companies’ technology. Health department spokesperson Kristin Davis also cited phone compatibility as the reason. A launch date has not been set.
Silicon Valley's fix
It’s not certain that the response would have been more coordinated if Apple and Google had not weighed in. The companies have said governments asked them to get involved, in part to solve technical challenges. But their rulings on how an app should or shouldn’t function are creating another layer of complexity for states to consider.
“Our public health system is strained to the breaking point just as our frontline health care providers are,” said Farzad Mostashari, the former national coordinator for health IT at the Department of Health and Human Services. “To introduce distraction, inefficiency, frustration in their work is not helpful — it means they don’t get to do their job.”
Mostashari and former CDC director Tom Frieden have argued in an op-ed that the tech companies’ Bluetooth approach uses data that also has the potential for abuse and with less hope of useful information.
“I certainly wouldn’t blame health departments for not engaging with those efforts,” said Mostashari. He said decisions about what data to collect and how to use it should be left to those combating the disease.
The Google-Apple rules do assure users of a level of privacy that they might not have otherwise. It only permits apps that store data on the user's phone by default, instead of automatically uploading it to a central database; users have to give permission to share it with authorities. But the limits on the type of data collection are the core concern for states.
The companies’ app stores still allow contact tracing apps that do not use their technology, so long as they are affiliated with a public health agency or meet other requirements, though those lose the advantage of being tied in with the Apple-Google framework. And a recent study from the watchdog group International Digital Accountability Council found that some of those independent apps had questionable privacy and transparency practices.
Google declined to comment for this story and Apple did not respond to requests.
One major reason for the divide, said Jeffrey Kahn, director of the Johns Hopkins Berman Institute of Bioethics, is that large consumer tech companies — which have been under fire for years over their methods of collecting and using personal data — have different motivations than health officials.
“Apple and Google’s incentive is to look like the good guys, related to the protection of privacy. That’s not a public health goal,” he said. He said the companies have done little to address states’ concerns that they won’t get the data they need. “At the moment, it feels kind of one-way.”
Global pushback
That skepticism isn’t limited to the United States. In Europe, Apple and Google are facing a backlash from some countries they persuaded to embrace their technology. Five countries, including France, Germany and Italy, published a letter in late May insisting the companies shouldn’t dictate conditions for contact tracing apps and arguing Europe must make itself less dependent on Silicon Valley. But those decisions are at least being made on a national level.
Singapore and Australia have seen some of the highest adoption rates of an app they both use called TraceTogether, in part due to intense government marketing. South Korea has integrated its app into a multipronged, nationwide response that includes extensive testing and detailed data collection.
China, meanwhile, has both a national app and a number of regional ones with disparate approaches to collecting data and keeping it private, according to the South China Morning Post.
In the U.S., Congress is trying to come up with a national strategy. Sen. John Thune of South Dakota, the chamber's No. 2 Republican official, said lawmakers can't just take tech companies at their word that their privacy rules are best, he said.
"I think that they're saying the right things, but as is always the case, you want to make sure that they're doing the right things," he previously told POLITICO. "In the past, assurances have been made by some of the companies in that space that we found out later didn't accurately reflect what was going on."
Thune said he hopes lawmakers will find a middle ground on legislation to include online privacy provisions in a next potential coronavirus relief package. Democrats and Republicans have introduced dueling bills to establish privacy rules, but preexisting partisan divisions, such as differing views on whether to allow states to enact their own laws, appear to make that compromise unlikely.
The Centers for Disease Control and Prevention has issued only rough, voluntary guidelines saying digital contact tracing tools should be able to share information, limit data to health agencies and require user consent. So thus far, U.S. states have been left to make the decisions.
It mirrors the U.S. approach to the pandemic as a whole. Even as the Trump administration pushed guidelines for social distancing and other preventive measures, it allowed states to decide whether to keep schools and nonessential businesses open to the public. States and, in some cases, cities and counties have decided whether to require face masks and how to secure tests and medical supplies. And though Trump himself pressured some states to return to normal, the federal government has again deferred to governors to make the final call.
Now, as more people resume interstate travel, the danger of disparate apps will become increasingly and dangerously clear, said Paul Jarris, chief medical officer at MITRE, a not-for-profit that manages federal research centers, and former executive director for the Association of State and Territorial Health Officials.
“Two people sit next to each other on an airplane for six hours. … When they go off to their different states, [the disease] has just jumped states and we’ll have no way of knowing that,” said Jarris.
Not sold on the app solution
At least 13 states and the District of Columbia are looking at the range of decisions and considering whether to wade into digital contact tracing at all.
New Jersey, for example, is not sure it’s worth the investment of time and money.
Beth Simone Noveck, the state’s chief innovation officer, said in a statement that though “the tech could offer promise,” officials worry it will be difficult to deploy, that many people won’t use it and that it may not help them meet their public health goals. That, plus “significant privacy and security concerns,” make it a complicated decision.
A number of states are opting out for now. Colorado, Connecticut, Delaware, Georgia, Idaho, Indiana, Iowa, Louisiana, Maryland, Montana, New Hampshire, New Mexico, Tennessee, Texas, Vermont and Wyoming have all confirmed to POLITICO that they aren’t currently planning consumer contact tracing apps.
“We have not written off the idea, but are not convinced to use our time and resources to commit to that as a direction,” said Mark Raymond, Connecticut’s chief information officer. “We are tracking the field, but are not convinced we would see sufficient uptake or how much it will fill in any data gaps that we have.”
Many in the public health community say the digital push will always be less important than the traditional method: people interviewing the sick and following up with their contacts.
“Technology people feel like they can solve all the problems with technology,” said Shyam Gollakota, a University of Washington computer scientist developing the state’s app, which will not use the Apple-Google software. They plan to use the app to help users recall where they’ve been when interviewed by contact tracers.
“In this situation, in most public health situations, a human has to be involved,” said Gollakota.
Darius Tahir and Cristiano Lima contributed to this report.
Source: https://www.politico.com/
