Do we really need a tracking app and can we trust it?

Privacy and transparency should be central to the use of a COVID-19 tracking app, but there are other ways to track infections, and an app may not work anyway

Kobi Leins, Dr Simon Coghlan and Dr Marc Cheong, University of Melbourne

Dr Simon CoghlanDr Marc Cheong

Published 24 April 2020

One day the Australian Prime Minister suggests that an app to track the movement of Australians might be made compulsory. The next he is back-tracking, saying the app won’t be compulsory after all.

What are we to make of this?

Prime Minister Scott Morrison back-tracked on initial suggestions the tracking app could be compulsory. Picture: Getty Images

Apparently, the app will be available for all Australians early next week. However, the proposed tracing app raises many troubling questions, including questions about safety, privacy, and security. Many experts are voicing concerns about the app as it stands.

As quarantine drags on and the dire economic impacts of COVID-19 become increasingly evident, both citizens and governments are keen to see a loosening of the limits on our freedom of movement. In order to do so, knowing when and where transmission is occurring, and locating those who are infected with the virus, has become an urgent problem that an increasing number of experts are trying to solve.

Naturally, many governments are looking to other governments to see what solutions work. Unfortunately, the transferability of success in one country is not guaranteed.

Professor Sheila Jasanoff, founder of Science, Technology and Society studies at the Harvard Kennedy School notes that while responses to COVID-19 are rightly based partly in epidemiology, nonetheless social and behavioural sciences are wrongly being ignored. What one culture will happily adopt or comply with, another may not, and the nuances of human behaviour are complex and require greater attention.

Many apps are being used or contemplated to track movement of people to determine where transmission occurs. Much is being written about the different technological models, and whether they trace, track, comply with privacy and human rights frameworks, including necessary technical analyses to contemplate the risks.

Some countries, like Singapore for example, have used apps. In Singapore, less than 20 per cent of citizens downloaded the app, which meant old-fashioned, extensive detective work was required to make tracing effective.

People having smart phones is no guarantee they’ll consent to using a tracking app. Picture: Shutterstock

So far the Government hasn’t provided the source code for that app for ‘security reasons.’ The problem with this lack of transparency is that the public can’t be assured of the app’s safety and privacy. Yet its success is dependent on the degree to which people trust the app enough to adopt it.

It is estimated that between 40 per cent and 50 per cent of Australians will need to use the app for it to be effective in limiting community spread of coronavirus. Indeed, some academic studies estimate this required figure is as high as 60 per cent.

Given the poor uptake in Singapore, Australia’s plans would appear to be a waste of time. Which raises the issue of the Prime Minister’s initial suggestion that if too few Australians adopt the technology, he may make the app compulsory. While he has subsequently ruled this out, the Government may yet make an about-face rather than risking the whole effort coming to nothing.

Making the app compulsory would raise a plethora of legal, constitutional, human rights, civil liberty, and ultimately, democratic questions.

If they are to be used, technological solutions that trace or track must have sunset clauses to ensure that privacy and human rights are protected. But even with sunset clauses, the large quantity of data collected is effectively “in the wild” where it can be potentially accessed and misused.

This could pose serious risks to democracy should certain actors acquire that data, as illustrated by the Cambridge Analytica scandal and Russian interference in the 2016 US presidential election.

We should be skeptical of assurances that we can’t be identified from our data. Picture: Shutterstock

Arguments that the data can be ‘de-identified’ should be met with skepticism, because in reality it is very difficult or impossible to prevent the re-identification of individuals.

Despite what many corporates and governments are suggesting, the use of apps to track the transmission of COVID-19 isn’t inevitable or even necessary. The suggestion that the only option here is one type of app versus another is a false dichotomy – we have at our disposal a wide menu of available solutions to what is a social, behavioural, and medical problem.

Some governments are hesitant to adopt apps for a wide range of reasons. Belgium has highlighted that investment in people and expertise is key.

New Zealand has suggested that people should keep a diary of their contact with others, which will assist even if they do adopt a technological solution to track movement further down the track.

The essential question to ask before seeking any technological solution is: ‘what is the problem we are trying to solve?’ Technology may be one of the answers, but it should never be the starting point.

In the current health crisis, being able to identify who came into contact with whom is key, not necessarily knowing exactly where people went.

There are other old fashioned ways to trace infections, rather than jumping to a new technological solution. Picture: Getty Images

There are also multiple social and behavioural factors that will influence the take up of any app, and therefore its effectiveness.

Across countries, phone ownership will vary, with the very demographic most as risk from COVID-19 perhaps being least likely to carry a smart phone – people aged over 60. Indeed, nine per cent of Australians don’t own a smartphone, which translates to more than 2 million people. And children, who can also carry COVID-19, rarely have smart phones of their own.

In addition, some Australians simply don’t trust their governments and are therefore likely to leave their phones at home to avoid their data being collected.

Arguably, the New Zealand option of keeping a diary may result in more accurate data in circumstances where significant restrictions on movement are in place. Keeping a diary is also less likely to be subject to scrutiny by authorities and hence may build trust and so encourage self-tracking.

Most problems have multiple solutions and often the best solution isn’t a high-tech one. If the app the Government is proposing doesn’t have enough uptake, or if it fails in one of many of the other possible ways to achieve its goals, then finding other solutions without leaping to high-tech ones will be crucial.

Where technological solutions are found to be appropriate, assuring their safety, transparency, and privacy both at the outset and throughout the design process should be mandatory.

Banner: Getty Images

Find out more about research in this faculty

Engineering & Technology