Six months into the coronavirus pandemic, Los Angeles County is partnering with a crime-reporting app to provide mobile contact tracing, but the rollout of the app and others like it highlights the nation’s slow, controversial and sometimes patchwork approach to replacing fallible human memories with cold, hard electronic facts.
A potential digital solution seemed near in April when Google and Apple joined forces to allow the billions of users on their mobile operating systems to opt into sending and receiving Bluetooth pings from other nearby phones to create an anonymized trail that would significantly speed up alerts when someone in the chain later tested positive.
However, their Exposure Notification system hit immediate roadblocks. It originally relied on others to create individual apps, under very strict guidelines that limited apps to one per state, and today, only eight states (and Guam) have one. California does not have an app that uses the framework.
Other apps such as Citizen SafePass, the new partner in L.A. County, have cropped up to fill the gap and collect data separate from the Google-Apple ecosystem. The for-profit Citizen’s partnership with the county immediately drew criticism from data protection advocates earlier this month, as have many contact tracing apps elsewhere in the country.
In South Carolina, lawmakers outright blocked state agencies from using such apps.
In response to the lack of progress, Google and Apple announced plans to unify their technology earlier this month, with Apple integrating it directly into its last iOS update, and Google planning to release a standalone app on Android in the near future. But even the tech giants might struggle to make a difference.
In June, an online survey suggested 71 percent of people in the United States would likely refuse to use a contact tracing app, according to Ars Technica.
Are apps effective?
There’s still significant disagreement on the best methods for digital contact tracing, and whether it can even be effective without widespread buy-in. Experts say Bluetooth can provide false positives by connecting two devices separated by a wall, for example. Interference also can complicate the accuracy.
A study at Oxford University suggested a hypothetical city of 1 million would need 60 percent of its population to use a contact tracing app to effectively halt the spread of the coronavirus. Citizen’s user base in L.A. County was about 3 percent of the population when the app was announced Sept. 9, according to the county Department of Public Health. Citizen states it has nearly 1 million users in the area now.
“With an already established Citizen user base in the City, we thought bringing SafePass to Los Angeles was an easy way to help residents stay safe,” said Citizen CEO Andrew Frame in a statement. “The City and County understand the need for residents to have modern tools to fight COVID and have been great advocates for contact tracing in their communities to help slow the spread.”
Citizen declined to provide the number of confirmed cases that have been reported through its app, but said the company plans to release that information in the future. In responses to questions, the Department of Public Health stated it was too early to determine the app’s effectiveness.
Distrust of contact tracing apps
A lack of public trust in how companies and governments handle private information — driven in part by high-profile breaches and data-selling scandals — has slowed the adoption of apps as a potential solution to traditional contact tracing’s greatest weakness: its reliance on interviews and human memory to determine who else may have been exposed, according to Cyrus Shahabi, a computer science professor at the USC.
USC highlighted Shahabi and his team when they received a grant to rapidly develop a contact tracing app back in April, but university officials soured on the idea when it came time to release it. Shahabi, an expert on protecting data, attributed the hesitation to the low student population on campus and concerns about the appearance of an invasion of privacy. While apps routinely persuade users to give up a significant amount personal information for coupons and shorter commutes, “contact tracing” has become taboo even with high levels of encryption, Shahabi said.
Alternative proposals, such as a program in which students choose to manually check in at locations, still could not overcome the negative perceptions, Shahabi said.
“The problem is that we never get there,” Shahabi said. “We can put this in papers and publish them, but to actually have an impact, we have need to have an app and have people use it. Even within a campus environment, we couldn’t get that to happen because of all these privacy issues.”
The SafePass partnership
In L.A. County, with more than 260,000 confirmed COVID-19 cases so far, officials described the Citizen SafePass app as a supplement to the 2,600 people hired locally as traditional contact tracers.
“Robust, efficient and thorough contact tracing is critical to interrupt the ongoing transmission of COVID-19 and reduce community spread,” said county Supervisor Kathryn Barger in a statement. “The SafePass app is an innovative program that will serve as a valuable tool for Los Angeles County in our continued efforts to keep residents safe and move forward on our path to recovery and reopening.”
Alerts tells users where, when and for how long they were potentially exposed if someone they connected with later tests positive, according to Citizen. The identity of the person who may have exposed them is not revealed.
The app encourages people to share their “SafePass,” a scorecard of their “meaningful” contacts, symptoms and test results, with friends and on social media.
Rocky history
Privacy advocates say Citizen’s rocky history is a red flag that is emblematic of the reasons why people struggle to trust these types of apps.
Citizen didn’t start with contact tracing in mind. It was originally “Vigilante,” an app that was ultimately kicked out of Apple’s App Store within a week of its launch in New York in 2016, according to TechCrunch. The app attempted to “open” the 911 system to the general public by sending alerts whenever a crime was reported nearby. The creators encouraged people to get involved by broadcasting “the incident live when it’s safe to do so.”
The app relaunched as “Citizen” the following year with new warnings to “never approach a crime scene, interfere with an incident or get in the way of police.”
Today, Citizen SafePass is a separate download from the original Citizen on iPhones, but is still bundled with the crime reporting app on Android, something the company says it plans to change in the future.
What SafePass collects
Unlike Google and Apple’s effort, SafePass uses GPS and Bluetooth to connect to nearby phones. The locational and identifying data collected by Citizen is anonymized and deleted after 30 days, according to the company.
The app requires a government ID and test results when self-reporting a positive test. The information is reviewed by humans to prevent false reporting. Only anonymized aggregate data is shared with the public health department. Users can opt into having additional information, such as their name or contact information, shared.
By comparison, Google and Apple use randomized codes — updated every 10 minutes — to protect privacy. Neither company, nor their public health partners, knows the identity of the Exposure Notification users, according to their announcement.
Citing privacy concerns, Google and Apple banned apps developed with Exposure Notification from using GPS. Developers say the increased accuracy from GPS is important in identifying hotspots, according to Reuters.
In a statement, Citizen stated the company created its own system because work on the SafePass app began in March before the Google and Apple framework was released. Citizen could connect with the Exposure Notification framework in the future, the company stated.
The data collected by SafePass, combined with the company’s history, is concerning, said Jon Callas, the technology project director at the Electronic Frontier Foundation. The company uploads and stores personal information on its servers, instead of the information being handled by a public health agency or only on the person’s phone, he said.
Though Citizen says it never shares a user’s information without consent, the company’s privacy policy suggests there are instances where that might occur, such as during negotiations for a merger, new financing or an acquisition. Besides subpoenas, Citizen may also provide personal information to law enforcement to “enforce the terms and conditions that govern the platform,” or to “protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.”
“They’re getting your location data. If you drove over the speed limit, that’s illegal activity,” Callas said. “We’re at the mercy of their interpretation. At the end of it, that means there’s no protections.”
Asked about the language of the privacy policy, Citizen reiterated its policy is to “only share location data with law enforcement under subpoena or court order.” No other information is shared with any other parties without consent, the company stated. To date, the company has not shared SafePass data with any form of law enforcement, according to Citizen.
Prior to the partnership, county health officials conducted a “technical review of the SafePass solution with the Citizen team to understand their privacy practices and data controls,” according to a public health spokesperson. The county anticipates additional safeguards will be needed on both sides to safely share SafePass data with public health in the future.
“At this point, the SafePass app development is still guided only by the Citizen team and our agreement with Citizen does not contemplate the County providing any input on the direction of the app,” the county spokesperson said in an email. “But, if the initial scope of the partnership does bear fruit, we could see that as a possibility.”
Source: Orange County Register
Be First to Comment