COVID-19 Tracing Apps Have to Go Viral to Work. That’s a Big Ask

To be useful, any COVID-19 tracing app has to go viral.

But with concerns about privacy running high, getting a contact tracing app voluntarily adopted at scale is a big ask. Governments around the world are weighing different privacy-enhancing designs, with some saying an app would be voluntary to begin with, but not ruling out making it compulsory. 

A now oft-cited statistic, Singapore’s TraceTogether app was adopted by only 10-20 percent of the population, with the country’s government now calling on everyone to download it. In the U.K., for example, experts believe some 60 percent of the population would have to download the app to make it work effectively, which equates to 80 percent of all smartphones in the country.

Meanwhile, we are seeing a digital divide between centralized and decentralized approaches. (From a high level, the debate turns on whether pseudonymous data is stored on centralized servers or stays on the phone.) Privacy advocates may be relatively relaxed about a solution with Apple and Google on board, but the question of voluntary mass adoption of the app remains uncertain.

“It’s hard to predict,” said cypherpunk Harry Halpin, the CEO of privacy startup Nym Technologies. “I honestly think a relatively small number of people will install the app. We don’t want to live in a world where we have to have an app on our phone to go outside.”

A big problem for a voluntary app comes down to the interaction between privacy and economics, says Ross Anderson, professor of security engineering at Cambridge University. 

“If the app’s voluntary, nobody has an incentive to use it except tinkerers and people who religiously comply with whatever the government asks,” Anderson said in an April blog post. 

Studies on privacy regulation and technology incentives in the context of health information exchanges (HIEs) show only U.S. states that combined incentives with consent requirements saw a net increase in operational HIEs.

It’s worth remembering that the Estonian government – which successfully rolled out a digital identity scheme to 98 percent of its population – enticed people to sign up by telling them digital citizenship meant they could ride on the bus for free.

‘Here is your NHS app’

If only one in six people use the app then it’s no use to anyone; so how do you persuade people to forget their privacy concerns and keep Bluetooth turned on all the time, said David Birch, author and director at Consult Hyperion. 

“The government could say, ‘Here is your NHS app. Please turn on Bluetooth and run it so everybody can get back to work.’ I don’t know what proportion of the population could even understand that, let alone make a rational decision whether to do it or not. Life just doesn’t work like that,” said Birch.

“What you have to say is, ‘Here is an app that can get you into a pub, you’re going to have to run it or you won’t be allowed in,’” he said. 

Making the app a requirement for entering certain public places has precedence in so-called implied consent laws, such as agreeing to field sobriety tests when getting a driver’s license. It’s possible to imagine grocery stores, schools and universities requiring a contact tracing app to be installed as a precondition for entrance.

Still, there are calls for more draconian measures. 

A recent opinion piece in The Times in London warned readers not to be blind to the fact that “we need Big Brother to beat this virus.” Why not force biometric ID cards as well? 

The joy of contact tracing

As food for thought, Consult Hyperion’s Birch, an authority on digital identity, suggested some novel ways to get more people using a COVID-19 tracing app. 

“What if the contact tracing APIs could facilitate other useful purposes?” said Birch. “For example, what if you could message people who were at a concert with you last night; say the half-dozen other fans around you, without access to their real names and addresses.”

As such, the app could work like the “missed connections” section of Craigslist, facilitated by everyone being online in a privacy-enhanced environment. If the recipients of messages granted their consent then the system could send back identifiers so they could be contacted, said Birch.

“If that interface could be delivered in a privacy-enhanced environment, it’s possible that other people would come up with clever applications to sit on top of it, which would make it useful, and therefore people would carry it and have it turned on,” he said. “And a happy byproduct is that contact tracing would work and fewer people would drop dead.”