State considers contact-tracing app to combat COVID-19

SEATTLE -- Washington state is considering the use of a smartphone app that can notify the close contacts of someone who later tests positive for COVID-19.

The push notification would go to users of the app who swapped Bluetooth keys with the infected person, meaning the two phones were in close proximity for a set period of time. The use of contact-tracing technology spurs a slew of safety and privacy-related concerns, including where private information is stored and whether location or identity is shared.

"Contact tracing proposals that are ineffective, that are privacy-invasive and are inconsistent with democratic principles should be dismissed outright," said Jennifer Lee, technology and liberty project manager for the American Civil Liberties Union of Washington. "For others, like the Google and Apple proposal, there needs to be further exploration to determine if the tools are effective, practical, and worth any trade-offs incurred."

Apple and Google joined together to create contact-tracing technology that can be paired with an app sanctioned by a state's public health department. Because it uses Bluetooth wireless technology instead of location tracking, civil liberties experts consider it less privacy-invasive.

"That doesn't mean it's 100 percent perfect and that it won't require a lot of scrutiny," Lee said.

Washington Gov. Jay Inslee said the technology has "potential promise" and is something the state is considering as he looks to bolster contact-tracing effectiveness, key to his reopening plan. With the current stay-home order set to expire at the end of May, last week he indicated that some counties will still not qualify for the second phase of easing restrictions by June.

Meanwhile, the University of Washington has been building a smartphone app to facilitate technology-based contact tracing, which will incorporate the Apple-Google technology if the state agrees to use it.

"For alerting people, you don't actually need to know where someone's been," explained Sham Kakade, a UW professor of computer science and statistics who is on the team creating the app, called CovidSafe. "You just need to know the pairwise connection. It's just, 'Was I nearby to you?' We don't need to know when or where that's occurred."

The CovidSafe app would beam Bluetooth keys between phones in close proximity that have the app downloaded, making participation entirely voluntary. Kakade said the keys are random, rotating numbers that can't trace back to the user. The data, he said, is all stored on each phone, not in a centralized database.

"When you're negative, nothing ever leaves your phone," Kakade said. "And if it's a positive, then you get this voluntary disclosure. But again, it's only these random broadcasts that are revealed, nothing else about the person, not their location information."

The way CovidSafe works, if you test positive for COVID-19, confirmed by the health department, you'll have the option to anonymously notify close contacts: People with the app you had switched signals with for a set period of time while you were contagious, whether you know them personally or not.

"What's nice about this thing is it's helping in cases that would otherwise be missed," Kakade said.

State Health Secretary Dr. John Wiesman also praised that feature, considering manual contact tracing only works as long as the infected patient personally knows and has reliable contact information for people they may have exposed.

For people who get the potential-exposure notification, Kakade said the app will give clear guidance on the next steps to self-isolate and seek testing.

But technology-based contact tracing only works if people are willing to use it. A national poll taken last month by The Washington Post and University of Maryland showed smartphone users were split right down the middle on whether they would use the Apple-Google contact-tracing technology. When you consider 18 percent of respondents don't have access to a smartphone, willing and able users drops to 41 percent.

Research out of UW showed higher participation, 72 percent, if an unspecified contact-tracing app guaranteed perfect privacy. Trust dropped to 55 percent if the app makers know your location and 51 percent if they share that location with the government.

"We should have a national standard so there is clarity across the board," said Washington Rep. Suzan DelBene, D-1st District. DelBene recently introduced a bill that would ensure, in part, that all data collected by contact tracing is strictly used for public health purposes and nothing more.

The bill would require rigorous oversight, prevent other government agencies from accessing information and require data security protections.

"We're really relying on the decision by those who are using the data to do the right thing and I think we have to have very explicit rules of the road in place," DelBene said.

Republicans have also introduced privacy legislation in Congress, a show of bipartisan support for preventing abuse of private health information.

"We need to move forward very, very quickly and Congress doesn't always move quickly, so we will push," DelBene said of the lawmaking body that lags behind technological advances. DelBene has been among those fighting for increased data privacy legislation for years, including a bill that would require privacy policies be written in easy-to-understand language.

For now, with UW's contact-tracing app ready to be implemented in a matter of weeks, it'll be up to states to decide what rules to abide by and up to the public to decide if they trust it.

"Without the public's trust and without the public participating in tech proposals like the Apple and Google proposal, it's unlikely to be very effective at helping the public health effort," Lee said.

"This is in the exploratory phase and if this were to move forward, it would be a totally voluntary thing," Inslee said last week.

He and Wiesman iterated that it would be just one tool to supplement the state's manual contact-tracing army if they decide to move forward with implementation. All parties interviewed agreed that technology can be useful to help combat the spread of COVID-19.

"There's definitely some details we're still working out," Kakade said of the app.

The app has some accuracy shortfalls. Using Bluetooth technology, it can trigger false alerts through the walls of dense living situations, like apartment complexes. It also does not take into account protective equipment used during an encounter that could decrease the likelihood of transmission.

As for privacy, even with companies committing to strict privacy measures, Lee said she would still like to see additional legal protections laid out by governments. She also said the tool would need to have a termination date for when it's no longer necessary to tackle the pandemic or if it's proven not effective. She said it would need to be auditable, something Kakade says it is.

Widespread adoption is key to having an impact and there's no immediate way to equip the most vulnerable populations in our communities, who are less likely to have access to a smartphone. But Kakade said that if 50 percent of the general public downloads it, then about 25 percent of cases could be caught, a nontrivial amount when it comes to reducing the reproduction number of the virus.

"This is part of the toolkit, in addition to many other things that will help us actually get our lives back together," he said.

But privacy advocates like Lee stress the most important thing to remember is that people have a choice on whether to download, enable or delete any contact-tracing app that's proposed.