Apple & Google's contact tracing won't stop COVID-19, but it will help

The coronavirus has upended life for most Americans, and government and private entities are looking for a way out. On Friday, Apple and Google announced a joint initiative to develop systems for cross-platform contact tracing. But there's much more to the conversation, and the probability of the system actually working, than you might see at first glance.

Past attempts at COVID-19 surveillance

The U.S. government is already using smartphone location data to track the movements of Americans, per a March story from The Wall Street Journal.

According to the report, the lion's share of that data is sourced from mobile advertising firms, either from location-tracking applications or from app developers who resell the data. Some of it has been provided by Google's "Community Mobility Reports" project, which is collected on an opt-in basis from Google users.

But neither of those data types actually count as contact tracing. The data, stripped of personally identifiable information, is only really useful for keeping tabs on where people are congregating, and the general patterns of movement of large groups of people. It isn't useful for tracking out how and when COVID-19 spreads from person-to-person.

More than that, privacy advocates have long cautioned that this type of location data can never be truly anonymized. In 2019, a research paper published by the University of Washington shows that it was relatively trivial to figure out a specific person's location using location-based ad targeting. On the flip side, unmasking an "anonymous" user is also relatively easy for skilled attackers.

Apple has long been trying to fight against data collection from advertisers and third-party analytics firms. The iOS 13 update, for example, contained new features that Ad Age said "crippled" location-based advertising. Again, that's the same data type provided to the government by marketing firms.

All of this has largely lead to short-range Bluetooth signals being forwarded as the most realistic means to implement contact tracing on a widespread basis. Hence Apple and Google's Friday announcement. But while it does away with some of the pitfalls of mass geo-surveillance, it has its own hurdles to overcome.

The Apple and Google solution

In a rare show of unity, Apple and Google on Friday announced new plans for a cross-platform, system-level feature that will allow public health officials to track and possibly reduce the spread of COVID-19.

By leveraging short-range Bluetooth signals, the system will help public health officials identify and follow up with smartphone users who have possibly come into contact with someone infected by COVID-19. They'll even receive a notification on their phone that this event occurred.

Both companies are likely highly conscious of their respective privacy reputations, so they both claim that the system is being developed in a private and transparent manner. Out of the gate, they've published documentation illustrating how the system would work, including one document focused on the cryptographic standards used to protect privacy.

The initiative will apparently be deployed in two parts. In May, both companies will release a developer API for iOS and Android that app makers and public health teams can use in their own apps to enable contact tracing. Deeper system-level functionality, which will presumably negate the need for a third-party app entirely, will be released "in the coming months."

But while Apple and Google are the most high-profile proponents of Bluetooth contact tracing, they are far from the first to float the idea. Earlier in April, researchers at MIT developed essentially the same system partly inspired by Apple's offline Find My feature.

Contact tracing apps have also already been used in places like Singapore and South Korea, where they reached varying levels of success.

The problems with Bluetooth contact tracing

Bluetooth-based contract tracing still has one major downfall. Both Apple and Google made it clear that both waves of contact tracing deployment will be offered on an opt-in basis. The first wave requires that users download an app using the API. The second wave explicitly says users need to "choose to opt in."

Like social distancing, this type of contact tracing absolutely depends on adoption by a significant portion of the population. Otherwise, it won't make much of a difference. The fact that this is being deployed on both iOS and Android certainly helps, but it's not enough to ensure that most people will actually use it, particularly in the U.S.

Unless this type of system is government-mandated, we have serious doubts that enough people are going to volunteer for it to be effective. This is borne out by many states and local governments only starting to ensure compliance with social distancing requirements by force of law when citizens didn't voluntarily adopt suggestions.

On the flip side, government-mandated contact tracing runs into the same privacy and ethical issues as widespread location surveillance, and will likely meet the same resistance that voluntary lock-in did.

And, there are still some signs casting doubt on whether it really will help curb the spread of COVID-19. Just take a look at Singapore, which implemented fastidious physical contact tracing and surveillance methods, along with an app that used a mix of Bluetooth, Wi-Fi, GPS and cell tower signals to track user locations.

Prime Minister Lee Hsien Loong said that despite the "good contact tracing," the government has been unable to figure out how people are catching COVID-19 for "nearly half" of cases. While initially a "master class" for COVID-19 mitigation success, the BBC reports that there has since been a surge in new cases on the tiny island-state despite control measures.

Singapore is a small country with a population smaller than New York City. Adopting widespread contact tracing in the U.S. may be near impossible, even with the computing and financial might of Apple and Google behind it. Even though its effectiveness in Singapore is questionable, it probably won't do nearly as well in larger countries just because of scale.

And, of course, there are unanswered questions about what will happen to all of these systems and data once the shadow of COVID-19 no longer looms over daily life, as digital rights group The Electronic Frontier Foundation points out. Unless the systems are completely dismantled and the data wiped, the possibility for dragnet surveillance is still there.

Possible ways forward

As we've thoroughly covered, for a contact tracing app to be effective, it needs to be used by at least a majority of citizens. For that, it either needs the trust of the people or it needs to be mandated.

In the U.S., neither of those options seems particularly promising, with trust in both the federal government and technology juggernauts at a relative low. Even pro-privacy Apple may have a hard time persuading people to willingly undergo surveillance.

Even if a simple majority of people sign up for contact tracing, the system likely won't do much for most COVID-19 cases, as is evidenced by cases like Singapore and South Korea. If the government starts requiring the usage of the app or implements it was a prerequisite for testing, there will undoubtedly be a backlash.

Which begs the question of what will actually work, a question many officials in the U.S. are actively trying to answer. Without something of a return to normalcy, the economic impact may well be unimaginable. And if we return to normal too quickly, lives will be lost — and the economy will still see a major impact.

One of the possible alternatives, per several proposals seen by Vox, is to implement mass coronavirus testing in lieu of surveillance. Like with mass location tracking or contact tracing, that's a herculean effort.

The most realistic way forward is a balanced approach mixing these strategies. But that, of course, is easier said than done. The Apple and Google systems will help because they're privacy-respecting and cross-platform, reducing friction and centralizing data. But it's just piece of a larger puzzle, and past contract tracing attempts suggest it may not be a significant piece.

Until a vaccine is implemented — something that's at least a full year away according to experts and the companies developing them — solutions like these are only going to be able to do so much.