Tracking and trust

On Aug. 5, Virginia became the latest testing ground for the tech sector’s global push to combat the coronavirus pandemic when Gov. Ralph Northam announced the launch of Covidwise, a new smartphone app designed to notify users of potential exposure to COVID-19. In his official statement, Northam appealed to Virginians to download the app “to protect yourself, your loved ones, and your community.” A press release from his office twice mentioned that the app is free, and noted that the same technology has been used in similar apps deployed in several European countries. The announcement repeatedly guaranteed that participation in the app was voluntary, anonymous and in no way a threat to personal privacy.

The rollout of Covidwise was a profound moment not just for Virginia, which invested $229,000 in the app’s development, but also for Apple and Google, which have spent the past four months jointly fine-tuning a way to use Bluetooth technology for contact tracing without compromising users’ private information. The app gives Virginians the option to let their phones keep an automatic log of wireless interactions, to anonymously inform the system if they test positive for the disease, and to receive an alert if they’ve been in close proximity to a confirmed case.

“Knowing your exposure history allows you to self-quarantine effectively, seek timely medical attention, and reduce potential exposure risk,” Virginia State Health Commissioner M. Norman Oliver said in a statement about the launch. “The more Virginians use Covidwise, the greater the likelihood that you will receive timely exposure notifications that lead to effective disease prevention.”

Google and Apple both declined interview requests by Montana Free Press regarding their contact tracing system. Google consumer communications manager Briana Feigon referred MTFP to the tech giant’s exposure notification FAQ, which credits the joint Apple-Google effort to “a shared sense of responsibility to help governments and our global community fight this pandemic through contact tracing.”

Virginia is now the latest government to embrace a technology that’s been touted as a critical component of early successes by South Korea and Singapore in flanking the deadly disease. Officials in Japan spent much of late spring endeavoring to convince the public of the benefits of its own digital contact-tracing efforts. Italy, France, Germany and Britain all waded into the app waters to varying depths this summer, and Canada launched a nationwide app this month after an initial test run in Ontario. Utah introduced its own Healthy Together app in mid-May, relying on a mix of cell tower, GPS and Bluetooth data to paint a picture of COVID-19’s spread and flag individual cases of potential transmission. North Dakota was quickest to move on the trend in the U.S. this spring, adapting an app originally designed to connect fans of the North Dakota State University football team to assist in its pandemic response. And Pennsylvania is slated to join the club next month, having invested $1.9 million in an app first developed in Ireland that uses the same Apple-Google tech as Virginia’s Covidwise. 

So far, though, most states have turned their shoulders to the tech, Montana among them. According to spokesman Jon Ebelt, Montana’s Department of Public Health and Human Services “is not currently pursuing the use of contact tracing apps or technology at this time.” Numerous county officials told MTFP that they, too, have given app-based contact tracing little more than a passing thought. Even if the idea were to take root in Montana, Gallatin County Health Officer Matt Kelley believes, it would require a robust conversation and the laying of considerable groundwork to be of any use.

“It’s not going to be as simple as activating an app across the county and having COVID go away. It’s going to have to be connected to the larger public health system,” Kelley said. “I’m not saying it can’t happen, I just would caution everyone to be somewhat wary of silver-bullet promises.”

Indeed, Kelley’s recommended wariness has already translated to vocal condemnation of the digital contact tracing approach. Where some see a cutting-edge strategy for addressing a daunting public health crisis, others see a Orwellian boogeyman, a canary in the coalmine of digital privacy, civil liberties and government surveillance. Following reports in May that North Dakota’s Care19 app was sharing data with third parties, Fargo-based developer Tim Brookins issued a stream of passionate reassurances that he alone had access to the information. Gov. Doug Burgum, himself a tech entrepreneur and former senior vice president of Microsoft, likewise defended the app’s security.

Such pledges are hardly enough to convince Albert Fox Cahn, founder and executive director of the Surveillance Technology Oversight Project at New York’s Urban Justice Center, who likens the initial wave of enthusiasm about contact tracing technology to the unsupported theory that hydroxychloroquine represented some sort of miracle cure. In Cahn’s view, the benefits of these apps remain poorly defined, and are far outweighed by the potential for abuse.

“We see all of these folks in power who, when faced with impossible decisions and impossible alternatives, want the magical reality that somehow technology will save us,” Cahn told MTFP. “We now have states all around the country developing these apps. We see private sector apps in development. We see countries in Europe developing these apps. It’s really been a mass proliferation, and I think this is probably the single biggest expansion of mass surveillance that we’ve seen anywhere since 9/11.”

As the Brennan Center for Justice noted in a May report, America’s regulatory framework doesn’t offer much in the way of data protections, with significant gaps at the state and federal levels and virtually no guarantee where information harvested in the name of pandemic response will end up or how it will be used. Montana law specifically guarantees the right to individual privacy, and has for more than a decade boasted some of the strongest consumer privacy measures in the country. But when it comes to ensuring information security in the context of digital contact tracing, the onus is on government officials and app developers to bake such protections directly into whatever digital products they launch.

“The impulse to turn to technology as a solution during this time of crisis is really understandable,” said Laura Hecht-Felella, a legal fellow at the Brennan Center’s Liberty and National Security Program and co-author of the May report. “But it’s important to proceed cautiously, to consult with public health officials and see if these applications are effective and if there’s less intrusive ways to achieve the same outcome.”

Even with Northam’s privacy guarantees in Virginia, widespread skepticism about the merits of tech-based contact tracing was apparent in the mixed reception to Covidwise this month, with some on social media deriding the app as “ridiculous” and others proclaiming it a “hard pass.” And it’s here that the concerns of data privacy advocates merge with perhaps the greatest hurdle to efficiency in digital contact tracing: public buy-in. Epidemiological modeling by a team of researchers at Oxford University in April indicated that an app’s effectiveness directly corresponds to how many people download it, and put the rate of app use necessary to fully suppress the disease at roughly 60% of the overall population. Within the first few months of North Dakota’s Care19 launch, less than 5% of the state’s residents were using the app. In Utah, only 3% of state residents had installed the Healthy Together app as of last month. A June poll revealed that 70% of respondents nationwide said they would not download a contact tracing app; in April, that figure was 50%.

The primary concern fueling skepticism or all-out opposition appears to be trust, something every county health official interviewed for this story pinpointed as the most valuable commodity in effective contact tracing.

“From a contact tracing standpoint, if we don’t have trust, we cannot do our jobs and we cannot keep the community safe and help stop the spread of disease,” said Barbara Schneeman, public information officer for RiverStone Health in Billings.

Safeguarding public trust isn’t the only reason contact tracing technology hasn’t elicited much excitement in Montana. Jennifer McCully, public health manager for Lincoln County, said she frankly doesn’t see much use for such an app in her area. With the exception of some lengthy testing result delays in July, she said she and the one nurse on her staff have been able to handle contact tracing and other pandemic response duties just fine. In Cascade County, city-county health officer Trisha Gardner said traditional contact tracing methods have proven effective so far, even though some positive cases have had upwards of 20 to 30 close contacts. Some question whether an app-based approach would gain enough traction to be useful in a state like Montana, especially in rural areas with older populations.

“It might be useful for younger populations who would prefer not to have a phone call from us on a daily basis and would rather just punch in something over a text message or an app on their phone,” said Teton County Public Health Director Melissa Moyer. “But I don’t know that we will ever see buy-in across the board from our population here in Montana, and especially in Teton County.”

That’s not to say technology isn’t contributing to the state’s coronavirus response. Since the onset of the pandemic, Missoula County has made use of a locally developed app called PatientOne to help monitor individuals who are in quarantine for potential exposure to COVID-19. The app enables participants to answer a smartphone prompt confirming that they’re still at home and identifying any symptoms they might be experiencing. Incident commander Cindy Farr said roughly 90% of people who download PatientOne respond to the prompts, taking pressure off a staff that would otherwise have to call each quarantined close contact daily — no small feat considering Missoula County had 368 close contacts on a single day in late July.

“It definitely has opened up time for our staff to be able to focus on contact tracing instead of having to just constantly be monitoring people,” Farr said.

Two other Montana counties have worked technology into their pandemic practices over the past month. On July 29, Gallatin County launched a pilot app called Sara Alert, developed by the MITRE Corporation, that allows individuals who have been exposed to or tested positive for COVID-19 to report daily symptoms via email, text message or robocall. According to Kelley, Sara Alert also enables information sharing between contact tracers, a feature he said will come in handy when students return to Montana State University this fall. The county, which was averaging between 30 and 40 contacts per case last month, has already helped secure contact tracers dedicated exclusively to the MSU campus — tracers who, as a privacy precaution, will be able to input data to Sara Alert, but will not be granted access to non-MSU information through the system.

“What Sara Alert helps us do is create a mechanism where if we need to share that information with contact tracers that are dedicated to MSU, they can see and they can add to the sort of wealth of information that we have on those folks that we’re working on together,” Kelley said, noting that everyone with access to Sara Alert information has been trained in HIPAA privacy rules. “Likewise with a school. If Belgrade High School had cases, we could kind of share that, the access to that, with the nurses in Belgrade if necessary.”

In mid-August, Yellowstone County began using an unnamed software of its own. Schneeman said the software isn’t public-facing, but is instead designed to make searching and trend identification easier for health department staff reviewing information on positive cases and contacts. Streamlining those back-end duties, Schneeman added, will free up time to focus on traditional contact tracing.

Technology may be aiding a few Montana counties in small ways, and several public health officers acknowledged that they’re keeping the possibility of contact tracing apps on the table in case the situation evolves in such a way that deploying apps makes sense. But none of those interviewed believed an app could ever take the place of a tried-and-true practice that’s been used to combat mumps, pertussis and STDs for decades. As Kelley said, “This isn’t taking tolls on the highway. This is a human interaction and we’ll always treat it that way.” 

If anything, the widespread attention that contact tracing technology has attracted nationally and internationally has served to elevate a larger issue. As the Brennan Center stated in its report, the patchwork nature of laws governing disclosure of location data in America “does not adequately protect Americans’ privacy.” There’s an emergent fear that in the rush to find new and faster methods of tracing coronavirus’ spread, those regulatory inadequacies may be overlooked, and that promises of privacy from app developers and governments simply aren’t a reliable bulwark against misuse. 

Montana counties have put the technologies they’ve embraced so far through rigorous HIPAA compliance reviews, and seem reluctant to go too far down the tech path for fear of compromising both the trust and the privacy of the people they serve. But as other states and nations continue to adopt more location-centric tools, Hecht-Felella is wary of the potential blurring of lines between public health surveillance and policing, which she said would “undermine the intended purpose of these applications.” 

Cahn doesn’t need to look far for an example of how emergency response can succumb to mission creep, citing the Patriot Act and its stated goal of cracking down on terrorism after the 9/11 attacks. That law quickly became a subject of considerable scrutiny, fueling legal challenges and allegations of flagrant information-gathering and government surveillance activities far outside Congress’ original intent. Absent stricter legal guarantees that data gathered in the name of coronavirus response won’t be turned to other purposes, or even proof that the picture Bluetooth data can paint of COVID-19 transmission represents anything more than a “funhouse mirror look at reality,” Cahn is unconvinced that the benefits promoted by private tech companies outweigh the dangers.

All eyes are on the pandemic, and as such, all eyes are now on the threat that some strategies may pose to citizens’ long-term safety and security beyond COVID-19. For Cahn, the time has never been more ripe for wider public discussion of the type of digital future Americans want to live in.

“If we see further investment in mass surveillance in the name of fighting COVID-19, it will just bring this debate even more aggressively to the foreground, and we’ll have to decide really what sort of society do we want,” he said. “Do we want one where the government is given a license to peek into our most intimate moments and to use that data as it sees fit? Or is it a country where we believe that we have the right to keep our privacy and to really push back on that sort of dystopian tracking? I mean, this stuff is way worse than anything George Orwell could have imagined.”

This story is part of continuing Montana Free Press coverage of community responses to COVID-19 supported by the Solutions Journalism Network.