The result may be a setback for the efforts of public health officials, who say a majority of a society needs to use the trackers for them to be most effective.
Austria, which began to loosen coronavirus restrictions this past week, was one of the first countries in Europe to deploy coronavirus tracking technology. Its “Stop Corona” app, released by the Austrian Red Cross, has managed to make privacy advocates happy, yet has stoked public concern all the same.
“Usually the privacy professionals, the activists, are the people who are saying it’s crazy what you’re doing, think about it twice,” said Max Schrems, an Austrian privacy lawyer who successfully sued Facebook over its data practices but who has embraced his country’s tracking app.
“I sense that the public is often more afraid of these things than the privacy professionals right now,” he said. “If you have a proper design, it’s hard to misuse, but that’s something that in daily life people do not differentiate.”
The Austrian app uses the Bluetooth transmitter on users’ phones to monitor other phones that come near to them. It keeps that information on the phone. If a person later suspects he or she has come down with covid-19 or has received a formal diagnosis, that information can be uploaded from the app to alert others, anonymously, that they may have been exposed. If users want to stop being tracked, they can simply delete the app and the data. No central database exists.
Germany, France, the Netherlands and Britain are among those exploring apps that work along the same lines: opt-in rather than mandatory, with data kept anonymous, and no GPS information going to governments or telecom companies. The approach could appeal in the United States, where many citizens are likewise distrustful of government snooping. Google and Apple announced this past week that they would collaborate to build a similar system that could work on iPhones and Android phones.
Earlier in the outbreak, many countries looked at anonymized GPS data to assess how well their lockdown orders were working and how many people were still moving around. But policymakers and engineers like Bluetooth for contact-tracing, because it is more accurate than GPS in dense urban settings — even though it doesn’t pick up certain kinds of indirect contact, such as when someone with covid-19 sneezes in an elevator, then leaves, and another person enters minutes later, potentially facing exposure. Bluetooth also has an advantage in that it doesn’t require the sorts of centralized databases that privacy advocates fear would be prone to abuse.
“If you’re going to store all this stuff in the cloud somewhere, at some point, there will be some guy somewhere saying, ‘Oh, isn’t that interesting.’ If you have the key to all that data, they’ll find a new purpose,” said Sophie in ’t Veld, a Dutch member of the European Parliament who works on privacy issues and has called for hearings about the tools under development.
Some countries have done little to allay concerns. Poland last month started requiring people who have covid-19 to download a tracking app and upload selfies to prove they are staying indoors, or else they could face visits from the police. The data may be held for years.
“Even if it’s done with the best of intentions, we need to be careful that these measures don’t become permanent,” said Diego Naranjo, the head of policy at European Digital Rights, an advocacy group that seeks to protect digital privacy.
The European Union’s strictest-in-the-world data privacy law, known by its abbreviation, GDPR, contains exceptions for public health emergencies, meaning its most stringent measures do not apply to tools intended for use in fighting the pandemic. But privacy advocates say leaders still need to follow the law and to be mindful of how data is collected and stored.
“We need to find a way to harness technology that respects our values, especially when that technology is about deeply personal things, your health,” said Julian King, who until last year was the European Union’s top official charged with improving the bloc’s response to security crises. “You’re only going to get broad uptake of these measures if there’s a discussion about what consent means, what people are signing up to do.”
As Austria demonstrates, however, even apps designed with privacy in mind may not be sufficient to overcome deep cultural distrust.
More than 230,000 Austrians have downloaded the “Stop Corona” app since its release late last month. But in a country of 8.9 million people, that percentage of users may be too low to make a major difference.
A report by University of Oxford medical researchers and bioethicists published in the journal Science last month suggested that even if relatively few people use digital contact-tracing tools, the spread of the virus could be slowed. But bringing it under control would require 60 percent of a population to use the app.
“There is no doubt privacy is to be respected,” said David Bonsall, one of the researchers. “And the privacy concerns need to be put in context with the severity of the situation we are in. If people are concerned about privacy with the effect on civil liberties, I think they need to consider the effects on civil liberties right now with the coronavirus: We are all locked up.”
Some public health researchers say that systems that build in the strongest protections for anonymity might hamper the medical response.
“The real problem with the Google and Apple approach is it won’t give enough information for epidemiologists to track the virus effectively,” said Ross Anderson, a professor of security engineering at the University of Cambridge who has reviewed the British project. “The epidemiologists can get some useful information, but, to use it effectively, you have to link up the different sightings of the phone with different people — and that compromises privacy to a certain extent. Google and Apple are not comfortable making that choice.”
He said advocates of contact tracing technology may be overpromising what the technique can offer, noting that in Singapore, where apps have been used, “old-fashioned public health work” still shouldered much of the labor in tracing people who may have been exposed to the virus.
Spolar reported from London. Quentin Ariès in Brussels contributed to this report.