(Image by Miguel Á. Padriñán from Pixabay )

As the world works to figure out a way to end/ease the nationwide lockdowns as a result of the Coronavirus pandemic, one of the ‘solutions’ being touted is the use of tracing technology via mobile phones’ Bluetooth signals. 

The basic idea is that a system will keep track of people that have come into close contact with each other, by recording when they detect each others’ Bluetooth signals. 

Then if you begin to experience COVID-19 symptoms, you notify an app which then, in theory, sends out an alert to everyone that you came into contact with. 

Health Secretary Matt Hancock said this weekend that the NHS is now developing such an app and is working with Google and Apple on recently announced APIs and platform-level tracing tech. 

Although it’s worth noting the NHS wasn’t aware of the Google and Apple development until recently and had been developing a solution with a central authority. Making use of Apple and Google’s tech would mean that public authorities would never have to be notified of who was showing symptoms, which is likely to be perceived as a pro-privacy approach to deployment. 

That being said, despite Hancock’s comments, it’s not clear to what extent the Apple/Google tools will be used. 

States such as South Korea and Singapore have already deployed similar solutions. 

However, some experts are already highlighting that tracing apps are not the panacea to the effective management of Coronavirus. One of the experts in question is the product lead for Singapore’s TraceTogether app. 

Whilst a number of concerns have been raised, the key point to note is that technology alone will likely not be effective - human judgement will need to be applied. 

Lessons from Singapore

As noted above, Jason Bay, who was the product lead for Singapore’s TraceTogether solution, has published a blog post that warns other countries against looking to technology as the sole solution for figuring out an exit strategy to the Coronavirus lockdowns. 

He notes, unequivocally: 

If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain.

Bay states that any attempt to believe otherwise is an exercise in hubris and technology “triumphalism”. In short, the solutions are hard and nuanced and believing that an ‘app’ will provide you with all the answers is misguided at best. 

Rightly so, Bay argues that theory is theory, but application and execution is something else entirely. 

On the point about human intervention, Bay states: 

An automated algorithm will necessarily generate both false negatives and false positives. A human contact tracer will similarly make mistakes. However, because a human contact tracer would seek to incorporate information beyond just physical proximity, he/she can correct for systematic biases introduced by automated notification system.

Encounters between individuals can be classified into close, casual and transient contacts for epidemiological purposes, based on proximity and duration of contact. However, these classifications depend on factors such as location/environment. For example, short-duration encounters in enclosed spaces without fresh ventilation often constitute close contact, even if encounter proximity and duration do not meet algorithmic thresholds.

Since Bluetooth-based contact tracing solutions do not, by themselves, record location/environment data, this information needs to be obtained through other means — a human-led contact tracing interview.

Bay rightly argues that a no-human system will yield better results than having no system at all, but where a competent human-in-the-loop system exists, there should not be an over-reliance on technology. 

Singapore has learned, Bay writes, that contact tracing should remain a human-fronted process. 

Other concerns

Another security expert, University of Cambridge’s Professor Ross Anderson, who was consulted on the creation of the NHS’s app, has written a separate blog-post outlining his concerns. 

Professor Anderson also highlights the human aspect, citing examples of how people may come into close contact but environmental situations mean that their risk of transmission is negligible. 

However, he also highlights the following problems that will need to be overcome (if they can be overcome at all): 

• The apps will be open to trolling. Anderson notes that “performance art people will tie a phone to a dog and let it run around the park; the Russians will use the app to run service-denial attacks and spread panic; and little Johnny will self-report symptoms to get the whole school sent home”. 

• Bluetooth goes through plasterboard - in other words, ‘contacts’ could be logged with people in other rooms to the one you’re currently in. 

• Decentralised systems are hard to update and relying on cryptography can make things even more complex, fragile and hard to change. Public health officials may have to change all sorts of parameters regularly - how will this be done on apps running across hundreds of different types of phones? 

• Singapore’s uptake stands at around 10-15%. The UK government has said that for an app to be effective it would need to see uptake at around 60%. How do you make that happen if uptake is voluntary? 

• Sometimes diagnosed patients - if they’ve been tested - are too sick to operate their phones. 

Professor Anderson sums up his thoughts by stating: 

I suspect the tracing apps are really just do-something-itis. Most countries now seem past the point where contact tracing is a high priority; even Singapore has had to go into lockdown. If it becomes a priority during the second wave, we will need a lot more contact tracers: last week, 999 calls in Cambridge had a 40-minute wait and it took ambulances six hours to arrive. We cannot field an app that will cause more worried well people to phone 999.

Our effort should go into expanding testing, making ventilators, retraining everyone with a clinical background from vet nurses to physiotherapists to use them, and building field hospitals. We must call out bullshit when we see it, and must not give policymakers the false hope that techno-magic might let them avoid the hard decisions. Otherwise we can serve best by keeping out of the way. The response should not be driven by cryptographers but by epidemiologists, and we should learn what we can from the countries that have managed best so far, such as South Korea and Taiwan.