Apple and Google’s Coronavirus Feature Might Be an Offer You Can’t Refuse
By: Will Oremus
Tags: Apple Google Collab, Contact Tracing, Coronavirus, Privacy, Surveillance

Apple and Google’s Coronavirus Feature Might Be an Offer You Can’t Refuse

The tech giants promise it will be opt-in. Will your employer, school, or church agree?

Photo: Jared Siskin/Getty Images

This story is part of a series on the possible impacts of Apple and Google’s contact tracing technology. You can read the others here.

When society begins to reopen, contact tracing will be a new fact of life. People who test positive for Covid-19 will be asked to trace their recent interactions with others, who will in turn be asked to get tested or stay home.

While contact tracing has traditionally been done via human interviews, Apple and Google last week announced a system that will use people’s smartphones to determine whether they’ve recently come within close range of anyone who’s tested positive for Covid-19. To protect users’ privacy, the system won’t track their geographic location or even their identity. And to protect civil liberties, the companies are adamant that the system will be opt-in — that is, you won’t have to use it unless you want to. The companies on Monday told reporters that government health authorities will be the only ones allowed to build apps using the technology, and they won’t be allowed to make those apps mandatory.

That system, if it works, promises to strike a real compromise between privacy and public health benefits. While no tracking system is foolproof, the companies appear to have taken great care to minimize the risk of exposing people’s sensitive information or becoming party to a surveillance state.

Yet there’s a paradox at the heart of opt-in contact tracing, as Apple and Google have conceived it. If it’s truly voluntary, then it may be hard to convince large swaths of the population to enable it: In Singapore, an app called TraceTogether that uses similar technology has been adopted by about 17% of that country’s population. And the fewer people who enable it, the less useful it becomes in facilitating the reopening of society.

Apple and Google are hoping to beat that number in the United States and other countries by eventually building basic tracing functionality into the operating system, so that at least some contact tracing features can work even if people don’t download an app. (The details are still being worked out.) That might help, but it’s likely months away, and even then public health authorities may be fighting an uphill battle to get individuals to opt in to a service whose primary benefit is to others, not themselves.

There is, however, a path by which contact tracing apps might go mainstream even without governments making them mandatory. It’s one that few have yet discussed, and Apple and Google themselves declined to comment on it when asked by OneZero. It involves private entities — workplaces, schools, and even social gatherings — telling people they have to use the app if they want to participate.

“Companies will require it before you’re allowed to go back to work,” predicts Ashkan Soltani, an independent security researcher and former chief technologist at the U.S. Federal Trade Commission, in a phone interview. “Your grocery store could require that you show it before you’re allowed to enter the store.”

Lewis Maltby, president of the National Workrights Institute and an expert in employment law, agrees. “Anything that can help keep Covid-19 out of the workplace is something employers will want to do,” he told OneZero. Unless a court rules that they can’t, he says, “Offices are going to have everybody lined up outside, checking your smartphone before you can come in.”

That would turn a system that’s designed to be opt-in into one that leaves people little choice: “Not mandatory, but compulsory,” as Soltani puts it.

This solution would be misguided, he believes: A Bluetooth-based system like the one Apple and Google are building has inherent technical limitations that will both produce false positives and miss some real exposures, along with potential for exploitation or abuse. (Imagine a student self-reporting symptoms in order to get classes canceled, or someone who tested positive turning their phone off before entering a crowded venue.) And while the companies have said they will dismantle the system once the coronavirus threat subsides, Soltani argues that to rely on smartphone apps to decide who can reenter society would set a dangerous precedent.

The efficacy of contact tracing is further limited, in the United States and many other countries, by the speed and availability of testing. If you can’t report Covid-19 symptoms until you’ve tested positive, the app will be days late in alerting the people you come into contact with. But if you can self-report symptoms, then some people who don’t actually have Covid-19 will be sending out false alerts that affect other people’s lives.

The U.K.’s National Health Service is working on an implementation that would give “yellow” alerts for self-reports and “red” alerts for those confirmed positive. But it’s not clear how the repercussions might differ.

For all its drawbacks, it’s easy to imagine how various institutions might decide that the benefits of requiring people to use such an app might outweigh the downsides. One obvious example would be nursing homes, where coronavirus outbreaks have proven especially deadly.

“For high-risk groups, I can really see the value,” says Mike Snyder, director of the Stanford Center for Genomics and Personalized Medicine. “If I were running a nursing home, I really don’t want people coming in who might have been in contact with someone who had Covid-19.” Requiring visitors to show that they have a contact tracing app installed, and that it shows no such contacts, could be part of preventing that — even if it’s far from a perfect method.

If it makes sense for nursing homes, might it also make sense for other hot spots of contagion, such as airplanes or cruise ships? What about businesses whose workers risk exposing the public, such as restaurants? College dorms? Gig workers? And might some employers, such as Amazon warehouses or Smithfield meat factories, be willing to trade their workers’ autonomy to decrease the likelihood of an outbreak that could compromise what they view as essential operations?

Maltby, the former director of employment rights for the ACLU, believes they will. “Put yourself in that employer’s position,” he says. “You’ve got employees, some of whom almost certainly have been exposed to Covid-19. Some of them don’t know they’ve been exposed to Covid-19. And they’re going to come to work and make everybody sick.”

The fact that the app is imperfect, Maltby says, may not deter them, as long as it’s better than nothing. “I’ve seen employers be more invasive than that with a whole lot less at stake. They’ll make you pee in a bottle to find out if you smoked pot on Saturday night instead of drinking beer.”

U.S. courts have historically granted employers broad leeway to intrude on workers’ privacy in the workplace, Maltby adds — with a few exceptions, such as eavesdropping on oral conversations. The tricky legal question in this case is whether employers will be able to force their workers to install and use the app on their personal devices when they’re off-duty, which would probably be necessary for the contract tracing system to be of value. “The ACLU will sue them over that,” he predicts. “But I’m not sure they’re gonna win.”

Tech companies, which were among the first to send workers home as the coronavirus began to spread stateside, might also be in the vanguard of requiring their employees to install contact tracing apps as part of their plans to safely reopen. Snyder, who has co-founded several biotech companies, says Silicon Valley tends to be more open to sharing data in service of innovative new technologies than other parts of the country.

It’s also possible that some workplaces will go further, especially in the early stages of reopening. Already, some experts are urging employers to consider implementing their own testing of workers. A doctor suggested in a Stat op-ed that some employers might also require vaccination, once a vaccine is available. Those measures could be much more effective than requiring workers to use an app but also more costly and invasive, and they’re not yet viable on a mass scale. Maltby, of the National Workrights Institute, says he could see a legitimate niche for smartphone-based contact tracing in the meantime as a way of identifying the asymptomatic people who most need to get tested.

The pressure might come not only from the top down, notes Karen Maschke, a research scholar at the Hastings Center, a bioethics think tank. Some employees might tell their employers they don’t feel safe going back to work without assurances that their colleagues aren’t carrying Covid-19.

For something like contact tracing, Maschke says, “The opt-in, in and of itself, is a problem.” The resulting data will necessarily be incomplete and may also be skewed toward demographic groups that are either more likely to sign up voluntarily or more vulnerable to being told they have to. And if the data is flawed, she adds, then it’s hard to justify using it to make decisions that affect people’s basic liberties.

In a blog post, the nonprofit Electronic Frontier Foundation echoes that concern. It suggests that an opt-in contact tracing app could be useful as a complement to other systems but warns that it would be a mistake to place too much importance on it. Specifically, the EFF’s experts argue, “Private parties must not require the app’s use in order to access physical spaces or obtain other benefits.”

While Apple and Google were clear that they won’t let governments mandate the use of their contact tracing technology, neither one responded to emails from OneZero asking whether employers and other entities could require it. Realistically, Soltani says, it’s hard to see how Apple or Google could stop them even if it wanted to.