Tracking may be hard sell
State OKs contact tracing, but some have privacy and equity questions
CORONAVIRUS IN MARYLAND
You probably want to know if you’ve come in contact with someone who has tested positive for the coronavirus.
But questions like who else would know, and what they might do with that information, have made some wary of a new cellphone notification tool developed by Apple and Google that Maryland will be among the first states to use.
Gov. Larry Hogan announced this week that the state would adopt the tech giants’ jointly developed software, Exposure Notification Express, or ENX, which uses smartphones to alert users if they have had contact over the past 14 days with someone who has tested positive for the virus.
State officials and the tech companies say all information is “de-identified” — users who opt into the system are assigned randomly generated codes. The tool operates via Bluetooth rather than GPS and thus is not linked to specific locations.
But at a time of heightened suspicion surrounding what Big Tech does with users’ personal information, coupled with how measures to contain the coronavirus have become politicized, ENX could be a hard sell even as many
see its value in alerting those who might have been exposed.
“A lot of these tech companies, even though they’re such a big part of people’s lives, they’ve done such a poor job of protecting privacy,” said Yuripzy Morgan, a WBAL talk show host who recently devoted an hour to the issue — and heard almost universally from those leery of the notification system.
In addition to concerns of confidentiality, others raise issues of equity and utility. Although 81% of Americans own smartphones, that share drops with income level, according to Pew Research Center. Among those making less than $30,000 a year, for example, 71% own a smartphone, Pew found.
Additionally, the system relies on enough people opting to use it, and, should they test positive for the virus, providing that information in a timely enough fashion for it to be useful to those who may have been exposed to them.
Hogan said the new tool will “greatly enhance” current contact tracing efforts that are largely handled by telephone calls. The other jurisdictions that have agreed to enable ENX are Virginia, Washington, D.C., and Nevada.
Maryland officials have tried to tamp down fears that the software would track users’ whereabouts or store or even monetize personal information.
“They should not be worried about that,” said Patrick Mulford, a spokesman for the state Department of Information Technology.
Mulford said one reason the state chose ENX was that it is not a data-gathering application but a notification system.
“At no time is the location of an end user stored in the system,” he said.
The system only notes when two users are in proximity to each other.
Additionally, Apple and Google have said they will not receive identifying information about users, are minimizing the data used by the system and will not monetize any of it. The companies are not charging the state for using ENX, and the only costs will be to make the system operational in Maryland and market it to get as many users as possible to increase its effectiveness, Mulford said.
Despite the reassurances, as anyone who has been targeted with ads related to recent Google searches knows, it’s hard to shake the feeling that tech companies watch, follow and try to make money off your every move online.
“The privacy issues are a concern because depending on the design, once you install an app on your smartphone, it does open up a potential, but not necessarily an actuality, for scraping data that are stored in your smartphone,” said Dobin Yim, an associate professor of information systems at Loyola University Maryland.
But, he added, tracking location data is typically the most useful as well as the most potentially invasive, and that’s something the Exposure Notification Express system explicitly does not do. Its use of Bluetooth rather than GPS and location data is an additional protection against misuse, he said.
Brian Seel remains skeptical, although he potentially could benefit from the software as a rider of public transit, which thrusts strangers together in confined spaces for extended periods.
Seel, a software engineer who lives in Upper Fells Point, said he’s worried about people’s personal data becoming the possession of Google and Apple, even without location data. It seems that the companies could still discern whom you spend time with or other patterns of behavior even without GPS data, he said.
But his concerns go beyond privacy and into the realm of who will and won’t benefit from a system based on having a smartphone.
“It’s really not taking equity into account,” Seel said. “Not everyone has a cellphone, and the members of the community most affected by [the coronavirus] tend to be lower-income.”
That also is something that worries Karen Webber, who directs the youth and education program at the Open Society Institute. Already, she said, the digital divide is harming families who don’t have the devices, Wi-Fi access and cellular plans needed for everything from remote schooling to telemedicine to applying for jobs or benefits.
“These are the people already most affected by COVID,” she said.
If anyone should be able to access information on potential exposure to the virus, it’s them, Webber said, but instead they find themselves on the wrong side of the growing digital divide.
Bennett Cyphers, a staff technologist at the Electronic Frontier Foundation, said policymakers need to acknowledge those left behind by a high-tech tool “and think of prevention and treatment in other ways that will address this divide.”
Cyphers said that while some privacy concerns stem from a misunderstanding of how this technology works, it isn’t “risk free.”
“But from what I’ve seen, it is the best option,” Cyphers said. “Apple and Google’s is the most privacy-protective and least risky of what’s been deployed.”
Others are reassured as well.
Anna Palmisano, who heads the advocacy group Marylanders for Patient Rights, believes there are adequate “checks and balances” built into the system to protect confidentiality. And, she said, it’s not as though people are otherwise shy about sharing personal information on social media.
“It’s ironic. People put so much of themselves out there, everything they eat, every friend they ever had,” she said. “But for some of these people, they are afraid to do something like this.”
Palmisano said even if not everyone opts in, she has high hopes for the software and its ability to track and contain infections.
“I think it could be a game changer,” she said. “It could be a very powerful tool. You’re not going to get everybody, but even if you get half of the people, that would be huge.”
How many Marylanders opt in remains to be seen. Mulford said research has shown even a low adoption rate will save lives.
Some countries and U.S. states have already been using various forms of digital tracking tools, many based on collecting much more identifying and location data than the Apple / Google software.
Countries like South Korea, for example, have accepted that sharing this level of personal information is worth it for the benefit to public health.
“It all happens in a cultural context,” said Emily S. Gurley, an epidemiologist with the Johns Hopkins Bloomberg School of Public Health. “They made a decision in their society that ... this is the compromise we’re going to make.
“We’re making a different kind of compromise,” she said. “You have to operate within your own social contract.”
Gurley, the lead instructor in Hopkins’ online contract tracing course, said there can be big gaps in coverage given that the ENX system is based on opting-in and self-reporting. Plus, people can be infectious before they are symptomatic, so by the time they get tested, receive the results and report them, there will be a lag before those who were in contact with them are notified, she said.
Once a positive test is reported, the system notifies all users who were in contact with that person in the previous 14 days.
“You only will be notified if a series of events happen,” Gurley said. “If the [infected] person also has the app on their phone, and if they get sick and they are getting tested in a timely way, and are entering the data in a timely way, and if the app functions well enough to notify you as a potential contact.”
Seel said his own experience with exposure to someone with the coronavirus also makes him question the efficacy of the new system. He said he had been at an outdoor gathering June 27, and someone else who was there found out he was positive for the virus the following week.
Seel said that person texted him to let him know, but because by then it was the Fourth of July weekend, he couldn’t reach his doctor or find an open testing site in the city. By the time he was tested, and waited to learn he was negative, about two weeks had passed, he said.
And, Seel added, he never received a call from a contact tracer.
That experience showed him how many gaps need to be filled: Without a car, he couldn’t easily get to the suburbs where there were open testing sites during the holiday weekend. If he hadn’t had Internet access, he would have faced an even longer wait for the phone call notifying him of the results.
“I don’t see the value,” he said of the notification system, “if everyone is not on it.”
State officials need to get as many people as possible to opt in to the system for the maximum benefit, Cyphers said. But even that needs to happen in conjunction with other measures, he said, such as social distancing and mask-wearing.
“This kind of thing will help a little bit, but it helps less when you have lower numbers of people opting in,” he said. “Don’t expect the app to save everyone; we should double down on the things we know are going to work.”