There is little debate that contact tracing is an effective tool for slowing the spread of infectious diseases. But as states turn to technology-enhanced contact tracing to help slow the spread of COVID-19, there is growing concern over protecting the privacy of those sharing their personal information.

Contact tracing – the process of notifying people suspected of having been exposed to an infectious disease and providing them with information on how to proceed from there – is hardly new. It has in fact been used effectively for centuries to battle the spread of tuberculosis, measles and even sexually transmitted diseases.

That effort has always been typical shoe leather detective work – human beings interviewing infected persons to learn where they have been and who they have seen and then the tracers reaching out to the potentially infected contacts directly. But in the age of technology, states and dozens of governments around the world are increasingly turning to cell phone apps to help them do that job.

But not all apps are created equal. Dr. Prasant Mohapatra, the Vice Chancellor for Research at the University of California Davis, says there are three basic types of cell phone contact tracing apps: those that use GPS to track the user everywhere, those that use limited connectivity technology like Bluetooth, and those which use no tracking technology at all and which require the user to voluntarily log their information.  

“From a technical standpoint, the best ones are being used in China. The government there works with cell phone companies to track people’s activities at all times,” he says. “But there is no privacy so we obviously cannot use something like that here.”

Mohapatra and one of his graduate students recently developed one of the non-tracking apps, which they released for free to users this month.

Numerous private sector companies around the world are working on apps as well, some that sound as intrusive as what Dr. Mohapatra describes. Silicon Valley companies like Vantiq, for example, have been working on tools that allow developers to use facial recognition and even thermal cameras to track people.

This has many privacy advocates highly concerned, not only about how the data is acquired but how it will be used after all this is over.

“It is not like the big platforms are coming at this with clean hands,” Sen. Mark R. Warner (D-Va.), himself a technology entrepreneur, told the Los Angeles Times in April.

Nonetheless, at least four states – North Dakota, South Dakota, Utah and Rhode Island - have already produced their own cell phone apps to track users’ behavior, with South Carolina and Alabama currently working on developing their own as well.

But getting people to trust these apps is proving to be a heavy lift.

How heavy?

A new Axios-Ipsos poll indicated that a whopping 84 percent of Americans would self-quarantine if notified they had been exposed to the coronavirus. Seventy six percent said they would willingly share their contacts with public health officials in that case.

That’s the good news. The less-good news is that only 51 percent said they would opt-in to contact-tracing done via a cell phone app, and only if that app was produced and operated by the Centers for Disease Control or local public health officials. Opt-in would drop to 35 percent for apps run by cell phone companies or Internet service providers, 33 percent for apps run by Big Tech companies and just 31 percent for an app run by some other branch of the federal government.

This hesitancy is not just theoretical. Utah, South and North Dakota were the first states to push their tracing apps out to the public, making them available in early April. Only about 2 percent of South Dakota residents are currently using their app; North Dakota and Utah have even lower participation in theirs.

Their case was not bolstered when an analysis of the North and South Dakota apps published in late May showed that both violated their own privacy policies by sharing user data with Foursquare, a company that “provides advertisers with tools to reach audiences who have been at specific locations.”

State officials said they are working to end that sharing and to address other technical problems, but privacy consultant Mary Stone Ross says such foibles do nothing to help convince the public to willingly utilize a tracing app.

“Nobody is talking about making them mandatory, but these apps are only useful if people use them,” says Ross, a privacy consultant and the principle at MSR Strategies in California. “And that only happens if people have confidence that their information is protected.”

Big Tech is working on that. Google and Apple recently banded together to produce a new tool that uses Bluetooth technology rather than GPS tracking. That will allow most smartphones worldwide to detect each other and share information about potential exposure to the disease, while also giving assurance user data will be protected.

“User adoption is key to success and we believe that these strong privacy protections are also the best way to encourage use of these apps,” the companies said in a joint statement, noting the tool will be protected by encryption and anonymous identifier beacons that change frequently.  

The companies say 22 countries and states like South Carolina and Alabama would be using the tool in newly-developed apps. North Dakota is also incorporating it into its current app.

Ross says that only addresses part of the problem.

“They’re not going to share that information with public health authorities,” she says. “So they are actually weaponizing privacy. That is so backwards because it’s those authorities that need that information.”

Lawmakers have also shown a growing concern about how contact tracing apps are being used. In April, California Sen. Hannah Beth Jackson (D) sent a letter to Gov. Gavin Newsom (D) – a notorious technology advocate - urging him to ensure consumers’ privacy in any tracing effort the state undertakes.

“We must not lurch toward the Dystopian world of Aldous Huxley’s Brave New World” or George Orwell’s “1984” as the price of protecting our health and safety – and we don’t have to,” she wrote.

She is not alone in her concern. To date, at least seven states have introduced bills to codify some aspects of their contact tracing programs.

These concerns have also driven states like Massachusetts, New Jersey, California and Washington to primarily focus on hiring scores of new personnel to do traditional tracing by telephone.

Building that workforce might be as Herculean a task as the actual tracing. Many health experts have posited that the U.S. will need as many as 100,000 contact tracers, and two former U.S. officials - Andy Slavitt, former director of Medicare and Medicaid in the Obama administration, and Scott Gottlieb, a former Food and Drug Administration chief for President Trump – put that figure at 180,000.

Whatever the number, states are definitely going after it.

California Gov. Gavin Newsom (D) last week announced the Golden State would be bringing on huge numbers of new human contact tracers, with a goal of eventually having 10,000 on the job. Newsom said the program, dubbed California Connected, will get a kickstart with $5.1 million in funding from both public and private sources. It will also have a data management platform developed by Salesforce, with other technical services from Amazon and Accenture in the mix as well.

The trio is also working on a platform for Massachusetts, which has hired 1,600 human contact tracers. New Jersey Gov. Phil murphy (D) has said the Garden State will hire at least 1,000, while New Gov. Andrew Cuomo (D) said he expects to bring on “an army” of such workers.

But even going the human route is not immune to scams and wild conspiracy theories.

Colleen Tressler, an FTC consumer education specialist, issued a warning recently about thieves pretending to be contact tracers sending texts asking people to click on links that take them to a fake hotline designed to steal their private information. And social media platforms like Facebook and Twitter are rife with conspiracy theories making any number of absurd claims about the virus and the people trying to contain it.

The irony of this situation is that it might actually accomplish something that has so far been impossible to do: force a federal privacy measure through Congress. At least two bills have been introduced there, one by Republicans and one by Democrats.

Ross believes that could happen.

“All of this would work a lot better if people trusted their privacy would be protected,” she says. “This is going to put a lot more pressure on Congress to enact a federal law.”


Editor’s Note: This is an ongoing and fast developing story. An updated version will appear in our June 8 issue of State Net Capitol Journal.