Deep Tech is a new subscriber-only podcast that brings alive the people and ideas our editors and reporters are thinking about. Episodes are released every two weeks. We’re making this episode—like much of the rest of our coronavirus coverage—free to everyone.

No sooner had the stay-at-home orders come down than mobile app developers around the world began to imagine how our smartphones could make it safer for everyone to venture back out. Dozens of countries and a handful of US states are now urging citizens to download government-blessed apps that use GPS-based location tracking, the Bluetooth wireless standard, or a combination of both to alert us when we’ve crossed paths with an infected individual—information that could tell us when we need to self-isolate for the protection of others. 

But who controls this data, and what kinds of privacy protections are built in? To get a handle on how different apps work, three MIT Technology Review journalists built the Covid-19 Tracing Tracker, a public database that rates tracing apps according to principles devised by the American Civil Liberties Union and similar organizations. They say they’re learning that not all tracing apps are the same, and that in the end, it may be Google and Apple, not governments, that wind up imposing key privacy protections.

Show Notes and Links

Why contact tracing may be a mess in America, May 16, 2020

Nearly 40% of Icelanders are using a covid app—and it hasn’t helped much, May 11, 2020

A flood of coronavirus apps are tracking us. Now it’s time to keep track of them. May 7, 2020

India is forcing people to use its covid app, unlike any other democracy, May 7, 2020

Full Episode Transcript

Wade Roush: Can our smartphones help to slow the spread of the coronavirus? Well, software developers think so. Each of us would just have to download an app that could alert us if we come into contact with a known carrier of the virus. There’s real promise that these apps could help end the lockdown phase of the pandemic. But to really be effective, these apps would need to be approved by local public health agencies, and tied into aggressive manual contact tracing efforts. 

Bobbie Johnson: And so while hundreds and thousands of technologists all sprung out of their chairs and started working furiously on automated tracing apps and protocols as soon as they could, if they don't match up with what a government is doing, then the efficacy of them is going to be very small.

Wade Roush: Bobbie Johnson is a senior editor at Technology Review, and he joined with two colleagues to build a new public database that shows which coronavirus tracing apps have state or national backing. We’ll hear what they’re learning about those apps, what contact tracing technology could mean for our privacy, and why the only two organizations that can sort out the mess of competing apps may be Google and Apple.

I’m Wade Roush, and this is Deep Tech.

[Deep Tech theme]

Narendra Modi: [translated from Hindi] Fourth thing – Download the Aarogya Setu Mobile App to help prevent the spread of corona infection.

Wade Roush: That’s Prime Minister Narendra Modi urging all Indians to download a mobile app called Aarogya Setu, which translates to “Bridge for Freedom from Disease.”

The app uses location tracking and the Bluetooth wireless standard to detect whether a smartphone user has come within six feet of an infected person, and it’s already been downloaded by over 100 million Indians.

It’s one of the contact tracing apps listed in Technology Review’s Covid Tracing Tracker—a public database first released in early May that tries to make sense of the growing jumble of tracing apps, by tabulating how each one works and what kinds of privacy protections are built in.

The US isn’t likely to get an app like India’s that’s approved by the national government. Instead the federal government is mostly leaving contact tracing to the state public health agencies. The editors behind the Covid Tracing Tracker say that over time, as states approve their own apps, they’ll add those listings to the database, starting with North Dakota, South Dakota, and Utah.

Wade Roush: So can we start by going around this virtual roundtable and having each of you introduce yourselves and explain what you do for Technology Review?

Bobbie Johnson: So my name's Bobbie Johnson. I'm a senior editor at Technology Review, writing features and our print magazine and covering some news.

Patrick Howell O'Neill: My name is Patrick Howell O'Neill. I'm also a senior editor at Technology Review. I typically cover cybersecurity, but right now my beat is almost entirely focused on coronavirus contact tracing apps and technology.

Tate Ryan-Mosley: I'm Tate Ryan-Mosley. I’m the editorial research manager. I’ve done some data reporting on economics and innovation and on some conflict and AI reporting.

Wade VO: Patrick says that inside the Technology Review newsroom it was clear that more and more governments and public health authorities were turning to mobile apps to help people figure out when they’ve potentially been exposed to coronavirus and whether they should go into self-isolation. But there are so many different tracing efforts underway that it’s hard to get a handle on the different approaches.

Patrick Howell O'Neill: And we realized that on a global scale, there was really no way to make sense of all the responses, all the technology and all the implications and consequences. And so before we could really start understanding these things on a very specific level, we realized we had to take a global view. So we built this database, the three of us, that tries to track contact tracing apps. Contact tracing apps being something new, which is just another reason that we need to put more effort into understanding them from a global scale. The database looks at mostly right now how the technology works and how it treats the data itself from a privacy point of view, so that we look at transparency, whether it's voluntary of the policies and the technology, because a lot of countries and technologists are taking very different approaches here, whether it be China, which offers virtually no transparency or a country like Australia where there is a bit more. 

Wade Roush: This might be a good moment to step back and actually sketch out why tracing is so important in the first place. How does manual tracing work? What's the philosophy behind these automated apps? What kinds of gaps in manual tracing do technologists hope to fill by building these apps?

Bobbie Johnson: So, people in the field will find a confirmed case. They will interview that person or they will somehow understand their movements and track back over time and try and work out who else they may have intersected with and then contact those people and tell them that they are potential carriers themselves. That's been proven to work in many infectious disease epidemics and pandemics. But now with automated tracing, the proposition is that we can use your phone largely to automatically monitor where you've been and even who you've intersected with and then try and trace that back rather than relying on your memory or on, you know, potentially misleading information about where you think you've been or who you think you've intersected with and do it on a technological basis. But whereas manual tracing is that tried and trusted approach, automated tracing is something very new and very unproven. And that's why we thought it was good to look at.

Bobbie Johnson: I think one of the critical things to remember here is that this is part of an overall picture of contact tracing, not just using an app, not just using technology that involves a lot of manual work. So a lot of phone calls, a lot of sifting through to work out who's been where, when. Any automated program needs to intersect with the manual tracing program as well, if it's going to be successful. And so while hundreds and thousands of technologists all sprung out of their chairs and started working furiously on automated tracing apps and protocols as soon as they could, you know, if they don't match up with what a government is doing, then the efficacy of them is going to be very small, let alone the fact that they won't actually be downloaded by people.

Wade Roush: Tell me a bit about what you've actually found. For instance, what range of sort of civil-liberties-friendliness are you finding in these different apps?

Patrick Howell O'Neill: There are a lot of civil liberties groups around the world that are looking at the kind of guidelines that you need to use to build these in order to respect civil liberties. We looked in particular at what the American Civil Liberties Union and a group called Access Now, which is similar, but a little more focused on Europe, the principles that they outlined in the way you can build these kinds of apps and still respect civil liberties and privacy. Things like, it must be voluntary. Data must be destroyed after, for instance, the pandemic is over. And we made it so that we could answer yes or no questions basically about these apps. China has approached this in kind of the classic CCP way, the Chinese Communist Party way of, “You're going to do it because we tell you to do it and we're not going to tell you much about it.” And then that ranges over to countries like Switzerland, which are helping to build open source frameworks that other countries can use.

Wade Roush: So, Patrick, can you sketch out the outlines of this collaboration going on between Apple and Google? My understanding is that their project is to make sure that Android and Apple phones can swap information, first of all, but also that developers can have deeper access to the operating system as they're building these apps.

Patrick Howell O'Neill: Google and Apple are building an application programming interface that works on Android phones and iOS smartphones. So that's 99 percent of phones on the planet. They work together and they do things that you can only really do if you change the operating systems of those phones. And so these other approaches run into technical difficulties. For instance, a lot of these apps, if you're on an iPhone, you have to constantly keep the app in the foreground or else it won't work. Apple can get around that. In their API, they are fixing that. So a lot of countries are switching to that API as a result of the fact that they work better. The consequence of that, though, is that the Google and Apple API are actually generally more privacy-protecting. They’re decentralized. They forbid location tracking and a bunch of other attributes. So that's an important trend that we're keeping track of. The API isn't fully released yet. So we don't know exactly what's going on in terms of adoption, but it's going to be something that is important to watch.

Wade Roush: I feel like the way the database is displayed here, basically what it amounts to is a way people to very quickly tell how invasive or how democracy-friendly, how privacy-friendly are each of these apps. 

Tate Ryan-Mosley: So that was definitely the intention. I also think there's a second layer to this, which is efficacy. Right now there's a big question mark hanging over these apps as to whether or not they're effective in actually understanding the spread of covid and slowing it, really, and helping people safely go back to normal and move around the world in a way that feels more secure and is indeed more secure. And I think that that tension between efficacy and privacy and voluntariness is a really big tension and a meaningful tension. Do we prioritize individual freedom and individual privacy over strict authoritarian and often more effective responses to a pandemic? And so I think we're collecting, actively, penetration data about these apps. So how many people have downloaded it in a particular population, and what's the degree of  penetration that we want? 

Wade Roush: Do you have any sense yet of what level of penetration is required before an app starts to be effective?

Bobbie Johnson: So obviously, penetration rate is possibly the most important statistic at the end of this. You know, if the more people use it, the better. And so, yeah, researchers are suggesting maybe 60 percent is a good target to try and go for. But realistically, nobody really knows until, until it gets out there, which is one reason there's so much emphasis on Apple, Google, because they can reach everyone with a smartphone, essentially. So Iceland, which currently has the highest per capita penetration for its app, they've seen 38 to 40 percent penetration. What they haven't seen is it being very useful. Now, in Iceland, that’s a special case. Right? Iceland is very small country. Not even 370,000 people live in Iceland. But they've also done a very good job of tamping down cases overall. They've really kept a lid on the expansion of the disease through a whole bunch of other means, including manual contact tracing. So it's kind of a limited data point. I mean, in India, for example, millions of people are using it. Does that cover a large portion of the population? No, because India has such a gigantic population in the first place. So but it could still hit penetration in different areas differently or it could hit certain segments of the population differently. And so really the underlying point of comparing across all of these is what can we as citizens learn from each other and what can the app developers and the policy makers learn from each other about good practice?

Wade Roush: Well, Bobbie, that goes to a really interesting point. Obviously, there is no centrally approved HHS or CDC contact tracing up. So I wonder whether part of the benefit of a project like this might be to help just shape the discussion around what kinds of features and protections we want built in?

Bobbie Johnson: Yeah, I mean, I think we're going to see a huge explosion in these apps in the US. I think there's been such a lack of coordinated federal response that it's going to be down to state by state. There isn't going to be a CDC app that we know of. They may be advising different states on how to better develop. But as you see with you know, with the way people approach lockdown, with the way people approach reopening the economy, state by state could be wildly different.

Wade Roush: So, Tate, I wonder whether any of the any of the apps that you have compiled here and are spotlighting here really jump out as apps that could be considered models as the world moves forward and builds more of these apps? Is anybody standing out here as a potential model?

Tate Ryan-Mosley: I don't know if we'll end up with a model or an idealized app, but I certainly think with Google and Apple, we'll get a lot more of a framework for best practices. I mean, I think that that's good and bad. I guess the other note that I, I for sure want to emphasize, is really how, if we see Google and Apple really becoming the global framework for all of these apps, they're really going to be setting the legal and economic and kind of operational terms for how we manage an international pandemic. And that's pretty unbelievable. I mean, one question we're asking now is like, where's the WHO in this? Where are the international power brokers? Where's the UN? We've got this great technology. Everyone's gonna use it. And Google and Apple are setting all of the terms.

Patrick Howell O'Neill: I think that the Apple Google standard will attract the majority of countries developing apps for exactly the reasons we've discussed. However, when we start to talk about the efficacy, it's a really tricky problem to talk about, for the simple reason  that these apps are one small part of contact tracing. I cannot emphasize enough that manual tracing is what will help. It will do more. It will require more people. It will require more money. But it will have a bigger impact. But even beyond that contact tracing isn't it? Right. Because it's one small part of a much larger constellation in terms of dealing with the pandemic.

Bobbie Johnson: We all want easy answers. Right? We all want a solution to the problem. We would all love some solution that made it possible to live an ordinary-ish life again. The sad reality is that it's not going to happen. It's a tapestry of all these approaches that will help us keep the disease from spreading further. You know, Apple and Google aren't going to kill coronavirus. They may play a role in helping you manage your own exposure. That's important. These are human lives at stake. But it's not….there is no silver bullet. There is no huge, gigantic, magical answer.

Wade Roush: Tate, Bobbie, Patrick, thank you so much for your time. This has been fascinating. Good luck with your future work.

Bobbie Johnson: Thank you.

Patrick Howell O'Neill: Thank you.

Tate Ryan-Mosley: Thank you.

Wade Roush: That’s it for this edition of Deep Tech. This is a podcast we’re making exclusively for subscribers of MIT Technology Review, to help bring alive the ideas our reporters and editors are thinking and writing about. But we’re making this episode free for everyone, along with much of the rest of our coronavirus coverage.

Before we go, I want to let you know about a new virtual conference coming up June 8 through 10. It’s called EmTech Next 2020 and it’s a co-production of MIT Technology Review and Harvard Business Review. We’ll cover topics like business agility in this time of unprecedented change. How to make businesses’ digital operations more resilient. Advances driven by new technology, like machine learning and 5G. And how to leverage these emerging technologies to work better, and smarter.

We’ll be joined by guest speakers such as Eric Yuan, the CEO of Zoom, Stewart Butterfield, the CEO of Slack, and Amy Webb, the founder and CEO of the Future Today Institute. Find out more and register for your spot at emtechnext.com, that’s E-M-Technext, all one word, dot com. We hope to see you in June.

Deep Tech is written and produced by me and edited by Jennifer Strong and Michael Reilly. I’m Wade Roush. Thanks for listening, and we hope to see you back here for our next episode in two weeks.