Written by Susan Kohn Ross and Timothy Carter

As the individual states struggle to define how best to reopen in a manner that minimizes the renewed spread of the novel coronavirus/COVID-19, the subject of contact tracing has become a major focus. To aid in this effort, Apple and Google announced late last week a joint contact tracing project that would leverage Bluetooth technology to identify and selectively alert individuals who have been in close proximity to someone who tested positive for COVID-19. Once alerted, that user could self-isolate or seek testing. Individuals who are diagnosed with COVID-19 can self-report their diagnosis, and any users who have been in recent contact with that individual will receive a notification. Public health agencies would be responsible for checking and verifying test results provided by users in order to prevent spoofing or fabrication.

Contact tracing has long been “a central pillar” of traditional infectious disease control. It works by identifying everyone a sick person may have potentially exposed, with the goal of identifying newly infected individuals before they become infectious to others. Such tracing, for example, was instrumental during the 2014 Ebola outbreak in West Africa. As applied to a fast moving respiratory virus like SARS-CoV-2, however, traditional contact tracing by way of in-person interviews simply cannot keep pace. Hence, the need for a technological solution.

Initially, Apple and Google plan to add the ability for iPhones and Android phones to wirelessly exchange anonymous information via apps run by public health authorities. Thereafter, both companies plan to add the technology directly into their operating systems, and enable the contact-tracing software to function without requiring users to download a mobile application. Users would still be required to opt in, but the functionality as described would be quickly available with minimal user effort.

While this new tool may help hasten resolution of the ongoing pandemic, it also comes with a host of potential privacy concerns. Theoretically, because the system is Bluetooth-only, fully opt-in, and would not collect or store any sensitive location or identifying data from users, the joint proposal sounds promising. However, there are other important considerations with providing such data to ensure it is not abused.

According to the ACLU, which has published a white paper on the potential privacy concerns with such contact tracing, any proposed program should be guided by strict technology principles by which such contact tracing protocols must be judged. Among other things, the ACLU posits any proposed program must be voluntary, used for purely public health related reasons, and collect no more information than absolutely necessary. Any collected data must be destroyed after the need to hold it has passed, and any information obtained by the government must be disclosed. Finally, it is imperative that such contact tracing not outlive the effort to combat COVID-19 crisis.

There is some skepticism about what will be done with the data, but executives of both companies have been publicly quoted as saying there will not be any reporting or consolidation of the personally identifiable data to a centralized authority. Rather, the process is intended to allow the user to control what data is gathered and how it is used. A careful review of the user options will be key to making sure that those who decide to implement this technology feel more comfortable with the idea they do indeed control their own data and that “Big Brother” is not watching!