COVID-19 Apps: The Problem is Technology; Not (Just) Privacy
Since COVID-19 put civilizations in a deadlock, everyone’s been thinking about and working on solutions to understand, limit and trace the spread of the disease.
Parts of these programs have been a large amount of mobile applications that should support that exact mission. Early on private companies offered different solutions. More and more public authorities started projects — either centralised or decentralised like the PEPP-PT project.
Google and Apple even joined the stage april 10th in a joint effort, by partnering on a solution for contact tracing — with user privacy and security central to the design.
Don’t get me wrong. I am advocating privacy in many relations. I’m the founder of two startups with privacy as core. I am a huge fan of technology — As a Digital Product Developer I have built mobile services and products since 2001. I have been involved in numerous mobile projects with Microsoft, IBM, Ericsson, Verizon and telcos since back in the days. I know the difference between technology that works on paper and technology integrated in products providing real value.
Unfortunately COVID-19 apps will not provide significant value — if any — to either citizens, epidemiologists or public health authorities. The strong focus on Privacy has unfortunately distorted all focus and muted every question on what is technologically possible. Very few people tend to ask the questions on how the technology can be converted into a digital product that provides real value.
In other words: The technology on people’s phones cannot help us limit or trace the spread of COVID-19. Or even secure a stable re-opening of cities and countries as some public authorities dream about.
How “contact” is defined?
The brief answer to what “contact” is in a tracing context — We don’t really know. Public authorities, app developers, Google, Apple, epidemiologists etc. are not working from a fixed set of definitions.
When communicated from different parties it ranges from technological impossible scenarios (within 2 meters) to something vague about “Bluetooth contact” (which theoretically is within 100 meters). More about this later.
But for COVID-19 apps to provide real value I would assume that “contact” is defined as the fact that I have been in close contact with someone infected with COVID-19 — hence increasing my risk of picking up the disease myself.
It should be the woman standing next to me in line for 3 minutes. It should be my colleague I met for lunch. The teenager next to me on the train. It should be someone from the table next to us in the restaurant. Someone I have been close to for a while.
It should not be my upstairs neighbour. The group on the other side of the street. Or even worse; on the other side of the wall. Or everyone on the bus. Or anyone that I have spent time with while staying 4 meters away.
In other words — It should be fairly precise data to be valid and to provide stakeholders with useful information.
Mobile Technology — a primer
Mobile phones from the past 10 years are packed with great technology. Technology that could be useful to trace contacts and stop epidemies. GPS, Bluetooth, WIFI, accelerometers, a compass, light sensors just to name a few.
These are all standardized technologies while still working differently: Chipsets at different ages, sending and receiving at different signal strengths. Different antennas. The list goes on…
These are also technologies all consuming a vast amount of battery. If these services ran constantly, batteries would be drained in a few hours. The solution provided by Google and Apple — makers of iOS and Android — is different hooks and services for app developers to minimize battery drain.
Apart from Snapchat filters, GPS is probably the biggest battery drainer on your phone. Add to that the limited precision in an epidemiological context.
Take the Norwegian COVID-19 application — Smittestopp — which is based on GPS. According to the app, it is tracking your position. But in reality they are getting very limited GPS information in a contact tracing context by using the power-friendly GPS service provided by iOS. Personally the app only tracked 38 positions in 3 days.
I can’t see how limited data points with high inaccuracy can be helpful in tracing and stopping COVID-19.
Bluetooth — Nominated as the magic bullet
Originally invented less than 50 km from my home — named after one of Denmark’s first Kings. I’m a fan of mobile technology. I have all the reasons to love Bluetooth. And Bluetooth sure is a great technology for multiple purposes like pairing your headphones — just not for measuring distance or as a technology for tracing contact. No matter how it is implemented.
Imagine Bluetooth being a small beacon sending out a signal. Other mobile phones with Bluetooth can detect this signal. Bluetooth ranges from anywhere between 2 to 100 meters. In my apartment I can always detect between 40 and 70 other Bluetooth devices on my iPhone.
Bluetooth is also a patchwork of old and new implementations. Cheap and expensive. It is integrated on 100s of different mobile phones with different antennas and signal strengths.
Mobile phones which are put in covers, bags, front and back pockets. Or carried freely in your hand. The Bluetooth signal is also highly influenced by speed, movement or even if the phone is upside-down.
So when authorities and app developers are stating that they can detect if you have been within 2 meters of someone. That really isn’t possible…
Measuring distance with Bluetooth is based on calculations of the signal strength.
But taking the above stated factors into consideration, one can easily tell that it is impossible to calculate if someone has been standing next to you. Or have been on the other side of the street.
Google and Apple’s API does not change the fact that Bluetooth is not a reliable source for measuring distance. And Bluetooth is still a battery drainer — even used through their API.
Google and Apple’s documentation on their API does not mention signal strength.
But according to this article from Financial Times Google and Apple will offer the possibility to derive signal strength (which is not a measure for distance!) and set “exposure events” from 5 to 30 minutes. Nothing less than five minutes to save battery (!!!)
More details and very well explained for layman by @clevybencheton.
In other words: Using Bluetooth for measuring distance between people is like using a candle instead of a laser pointer.
Still not convinced?
Try downloading an app like BLE Scanner (iOS / Android) or Lightblue (iOS / Android).
See for yourself the vast amount of Bluetooth devices your phone is spotting. The small numbers are signal strength from different devices.
Now try moving around or “hiding” nearby Bluetooth devices in your pocket or bag.
The messy data collection
So no matter if you are using bluetooth in a centralised setup or through Google and Apple’s API, you will be collecting a messy set of contact data between different devices. A data set which is depending on multiple external factors and a technology not made for measuring distance. Software like apps or APIs won’t solve the fundamental problem with the hardware.
Health authorities can choose from 2 different scenarios, when deep diving into these data sets:
- No tracing or limiting of COVID-19; because piles of messy data is deemed useless.
- Returning too many False Positives on people who have been in Bluetooth contact, but never in real contact.
A best case scenario will be millions of phones drained for battery, while too many people will be sent off to testing centres.
In a worst case scenario a mobile application will give you a false sense of security, while health authorities will start warning people causing insecurity even though people warned have never been at any risk.
The discussion about understanding, tracing contacts and limiting the virus in spreading should not only be about privacy, a centralised or decentralised approach, or if Google/Apple’s API should be used or not.
Health authorities, app development companies, politicians and epidemiologists should focus on the fact that it is impossible to use the existing technology in people’s phones, to provide useful value to people, experts and health authorities.
Unfortunately we are seeing an excitement for technology combined with the fear of not doing enough. People have forgotten the actual capabilities of technologies like Bluetooth and GPS — and how the technologies are converted into real products that work.
It is rampant testing on citizens, when applying technology which is not built for the purpose. And it is public health authorities not getting proper advice from their technology providers.
Most COVID-19 apps for sure have the right vision and intentions. But they are swamped in discussions about privacy — making it impossible for questions and discussions about the technical implementation to surface.
If the lack of opportunities and reliability of Bluetooth for tracing contacts had surfaced before the discussions about privacy, the focus could have been moved to where it mattered. Away from mobile tracing applications that won’t work for the intended purpose.
So let’s leave the gimmick-y apps relying on distance between people to Tinder, Happn og Grindr. Though not really measuring the distance or knowing your real position — It works; I met my wife on Happn.
