LONDON – Goodbye lock, hello smartphone.
The race for governments to develop mobile tracking apps to help contain infections after the easy-to-lock coronavirus focuses attention on privacy. The debate is particularly urgent in Europe, which has been one of the hardest hit regions in the world, with nearly 140,000 people killed by COVID-19.
However, usage monitoring technology can evoke bitter memories of massive surveillance by totalitarian authorities in much of the continent.
In recent years, the European Union has paved the way globally to protect people’s digital privacy, by introducing strict laws for tech companies and websites that collect personal information. Academics and civil liberties activists are now pushing for better protection of personal data in new applications.
Here is an overview of the issues.
WHY AN APP?
European authorities, under pressure to loosen lockdown restrictions that have been in place for months in some countries, want to ensure that infections do not increase once detentions are over. One method is to determine with whom infected people come into contact and to inform them of a potential exposure so that they can self-isolate. Traditional methods involving face-to-face interviews with patients are time consuming and labor intensive, so countries want an automated solution in the form of smartphone contact tracking apps. But it is to be feared that the new technological monitoring tools will be a gateway to increased surveillance.
The intrusive digital tools used by Asian governments that have successfully contained their virus epidemics will not stand up to scrutiny in Europe. EU residents cherish their privacy rights, so mandatory apps, like South Korea, which warns authorities if users leave their homes, or location bracelets, like those used by Hong Kong, don’t will simply not fly.
The most eye-catching contact finding solution is to use low-energy Bluetooth signals on mobile phones to anonymously track users who come into prolonged contact with each other. Officials of western democracies say the apps must be voluntary.
The battle in Europe has focused on competing systems for Bluetooth applications. A project led by Germans, Pan-European Privacy-Preserving Proximity Tracing, or PEPP-PT, which received early support from 130 researchers, involves data uploaded to a central server. However, some academics were concerned about the risks of the project and supported a competing project led by Switzerland, decentralized proximity monitoring preserving confidentiality or DP3T.
Privacy advocates support a decentralized system because anonymous data is only kept on devices. Some governments support the centralized model because it could provide more data to aid decision-making, but nearly 600 scientists from more than two dozen countries signed an open letter warning that it could, “via mission creep , lead to systems that would allow unprecedented monitoring of society in general. “
Apple and Google have joined the fray by supporting the decentralized approach as they unveiled a joint effort to develop digital tools to fight viruses. The tech giants are releasing a software interface so public health agencies can integrate their apps with iPhone and Android operating systems, and plan to release their own apps later.
The EU’s Executive Board has warned that a fragmented approach to application tracing is detrimental to the fight against the virus and called for coordination by unveiling a digital “toolbox” for member countries with which to build their applications.
The approach chosen by Europe will have broader implications beyond the practical level of developing tracing applications that work across borders, including the many found in the EU.
“The way we do it, the safeguards we put in place, the human rights that we look at very carefully” will influence other places, said Michael Veale, a conference on digital rights at University College London, who works on the DP3T project. “Countries are looking to Europe and activists are looking to Europe”, and will expect the continent to take a privacy-friendly approach, he said.
COUNTRY BY COUNTRY
European countries have started to adopt the decentralized approach, including Austria, Estonia and Switzerland, and Ireland. Germany and Italy are also adopting it, changing course after initially planning to use the centralized model.
But there are notable exceptions, increasing the risk that different apps won’t be able to speak to each other when users cross the borders of Europe.
France, a member of the EU, wants its own centralized system, but finds itself in an impasse with Apple concerning a technical obstacle which prevents its system from being used with iOS. The government’s digital minister wants to deploy it before May 11, but a legislative debate on the application has been delayed after scientists and researchers warn of the risks of surveillance.
Some non-EU members are following their own path. Norway has deployed one of the oldest and most invasive applications, Smittestopp, which uses both GPS and Bluetooth to collect data and upload it to central servers every hour.
Britain has rejected the system that Apple and Google are developing because it would take too long, said Matthew Gould, CEO of the National Health Service’s digital unit overseeing its development. The British app is a few weeks away from being “technically ready” for deployment, he told a parliamentary committee.
Future versions of the app would allow users to download an anonymous list of people they have been in contact with and location data, to help draw a “social graph” of how the virus spreads through contact, said Gould.
These comments sounded the alarm among British scientists and researchers, who warned last week in an open letter not to go too far by creating a data collection tool. “With access to the social graph, a bad actor (state, private sector or hacker) could spy on the real activities of citizens,” they wrote.
Although it has announced its intention to support European initiatives or to develop its own application, Spain’s complex plan to roll back one of the strictest confinements in the world does not include a tracing application at all . The health minister said the country will use the apps when they are ready, but only if they “add value” and not just because other countries are using them.
By The Associated Press