Covid contact tracing app: a risk to rights?
An official opt-in phone app to trace whether you have had contact with someone infected with Covid-19 is under review. Some say the risks are too high if rushed in
Plans for easing lockdown rules involve tracing people who have been in close contact with Covid-19 sufferers, alerting them that they might have been infected.
One method under review is an app, likely to be called StopCovid, that would work via the Bluetooth function in people’s smartphones.
Supporters say it could be an effective tool and would respect people’s rights, but many have expressed concerns over civil liberties, including rights charity Amnesty International.
People would voluntarily download the app and confirm in it if they have tested positive for Covid-19.
If you have spent an extended period close to an infected person in recent days, ie. you did not just pass them in the street, your phone alerts you so you can, for example, ask for a test and, if necessary, self isolate.
The government has put out minimal information on the exact workings but technology experts say it is expected to work by your phone emitting an identification code over Bluetooth that will change several times an hour.
App users’ phones will stock lists of codes of mobiles which the user has been in extended contact with. If users identify themselves as infected, a centralised platform collects their phone’s ID codes for the last 14 days, the Covid-19 incubation period, and sends them to other voluntary users’ phones, which compare them to contacts in the app’s list.
A task force led by the French information technology research agency Inria is working in partnership with a European network called Pepp-PT, including Germany, Italy and Switzerland. Inria head Bruno Sportisse said this “contact tracing” system respects European values and is not a “surveillance tool”, because it does not use geolocalisation, unlike a system in use in China, and is anonymous.
“Its design means that nobody, not even the state, has access to the list of people diagnosed as positive, or the list of social interactions between people.
“This isn’t an application for informing on people: if I’m notified, I don’t know who the notification originated from, and if I declare myself positive, I don’t know who is notified.
“The users choose to install it. They choose to activate the Bluetooth, they can at any moment deactivate the Bluetooth or uninstall the app.”
However, Philippe Gosselin, of data protection agency Cnil, which is being consulted on the idea, told Paris Match: “They say people will be protected because there is no transfer of personal data. But if you’ve only met four people recently… you have a good chance of knowing who it was.”
Other questions remain over practicalities and ethics of the plan, which is to be debated and voted on by MPs once the application is ready.
Google and Apple have suggested they supply part of the app’s code to ensure it can keep Bluetooth permanently activated on phones. A similar app that they developed, called TraceTogether, is being used in Singapore.
Another issue is how accurate Bluetooth can be in judging proximity to a person and how much take-up would be needed for effectiveness.
In Singapore, a million people have downloaded the app so far, less than 20% of the population. Authorities had hoped three-quarters would take it up.
An Oxford University study which simulated use of such an app in a city showed an epidemic could be stopped with a 60% take-up, though it said there would still be a reduction in new cases and deaths with lower amounts.
The study’s lead researcher said: “We estimate that one infection will be averted with every one to two users.”
Eric Léandri, co-founder of French search engine Qwant, has called the plan costly and useless, and said it lacked sufficient cost-benefit analysis.
One criticism is that Bluetooth signals are stronger for newer telephone models so could distort the data and lead to wrong alerts.
Amnesty International France civil liberties campaigner Anne-Sophie Simpere said there is insufficient information on how it would work.
“They say the data will be anonymous, but they need to clarify how this will be guaranteed,” she said.
“As for it being voluntary, yes, it must be but there could be subtle pressure if access to certain services is limited to people who download it.
“There is also very little information as to how data will be kept, for how long, how it will be protected from hacking risks, and if private companies will be involved.
“We need much more information before we can know if this will respect human rights.”
She added: “If people are asked to say that they have tested positive, there must be very strong protection of that data, as there are issues of medical confidentiality and discrimination risks.”
Ms Simpere noted that significant numbers of people do not have smartphones, or an up-to-date model.
That includes more than half of senior citizens, who are among those most at risk from Covid-19, but also young children, who are less likely to develop the disease but may be infected without symptoms.
The government should not rely too much on this one idea, she said.
She added that there are dangers if it is rushed in due to the state of health emergency. “In such situations, measures that infringe rights and freedoms are put in place very quickly.
“It’s complicated. We are in a crisis which justifies restricting certain freedoms temporarily – I insist on the word temporarily.
“Experience suggests that when such measures are brought in, there are always a few that remain afterwards. We must take care that measures don’t last longer than required, and that they don’t go beyond what is necessary.”