Author: DGHH Lab

Sarah Quayyum, Rebecca Babcock

Since March 2020, there has been an unprecedented decline in the amount of domestic and international travel. With the emergence of a global infectious disease outbreak (i.e. COVID-19), travel and tourism sectors the world over have suffered from massive decreases in demand. In the past year, restrictions were placed in many countries. New Zealand banned all international travel into the country. In December, with the news of a new variant of the COVID-19 virus, Canada put into place a temporary restriction of travel into the country from the United Kingdom. Presently, over 7 billion people have been impacted by travel and social restrictions to curb the spread of the virus. As the COVID-19 pandemic enters its second year, many governments and travel industry companies have turned to technological responses to continue to keep the world moving. One such proposed solution is the implementation of digital health passports.

What are Digital Health Passports?

At a basic level, a digital health passport is a phone application (“app”) or online certification which provides a traveller’s health information. Digital health passports can function in two main ways: (1) they can provide information surrounding immunity through a lab test of immune response or immunizing event; or (2) provide information on whether a person is infected. It is a modernized tool of health certification. An individual would download an app on their phone, connect it to their travel provider or destination country, and then input their required verifications. Users may receive a QR code or other form of verification that they are eligible to travel. Currently, some digital health passports exist: Coronapass, Commonpass, and V-Health, among others. Digital health passports are intended to balance the re-opening of the economy through passenger movement with the core public health function of outbreak management. Digital health passports have been promoted as a viable means to see who may enter a country, though their use may potentially extend to entry into retail and workplaces, and even concerts. The benefits are tangible: it could allow individuals to travel, return to work, and connect with their loved ones.

(Photo/Forbes)

Practical issues of digital health passports

Despite the practicality and efficacy of digital health passports, there remains major issues to their adoption as an innovative solution to permit travel during the COVID-19 pandemic. Foremost, research develops and changes every day with regards to the SARS-CoV-2 virus. There still remains much that is unknown about its physiological functions. One such uncertainty is the length of antibody response. There is still work being conducted with regards to the length and degree of immunity that naturally acquired antibodies and vaccines acquired antibodies may provide. Additionally, it remains unclear whether those with antibodies may still pass the virus onto others without immunity. Largely, COVID-19 immune response remains a mystery. It may be premature to design an identity system without understanding the full extent of the problem upon which it is based.

The pandemic has also shone light on the difficulty of regulating human social behaviour when requiring adherence to public health measures. Individuals refusing to wear masks or continuing to partake in large social gatherings despite government instructions to do so may provide insight into the issues immunity passports may cause. It has been hypothesized that those who hold such passports may use it as an opportunity to flaunt public health measures. Combined with the lack of substantive knowledge surrounding COVID-19 immunity, it may permit for risky behaviour.

The ethical dilemma

(Photo/BBC)

There also has been criticism surrounding the implementation of immunity passports in relation to the social risks it creates, namely relating to privacy and marginalization.

Privacy

Foremost, digital health passports may potentially collect information about where and when a person has traveled, or otherwise “passed through doors.” The coupling of sensitive personal health information with this location-history based system that is then amalgamated into central databases may be a step towards “digital national identification” or a wider digital monitoring system of individuals. There have been concerns about the potential for wider use of immunity passports should they be successful. For instance, they may start to include other personal information, such as criminal history, immigration status, or precarious health concerns. The storage of COVID-19 status, and potentially other personal health information in a digital format, such as a cellphone or database, presents the risk of wide-scale data breaches, as is the case of any health information digitization. This is already a present issue, as a survey of 65 digital health certificate apps found that 82% had inadequate privacy policies, and asked for “intrusive amounts of data.”

Advocates also have raised concerns that digital health or immunity passports will provide police with a greater amount of power, or may lead to a police state. Digital health passports may provide police with the ability to know more about an individual’s health alongside giving them the power to stop people in order to ask for their health status. These concerns are not without basis, as internal Fido documents on immunity passports stated that they should be recognizable to law enforcement and other agencies. Digital health passports open up further risks for breaches of privacy when discussing law enforcement. For example, if digital passports are phone-based, there are major concerns raised with the potential for abuse when providing police access to an unlocked phone.

Marginalization

Illness and health status have great potential for stigmatization, an issue that some populations have faced since the onset of COVID-19 as a pandemic.There is a substantive amount of literature that vulnerable populations, such as the racialized or low-income groups are more likely to contract COVID-19. Advocates, therefore, have argued that digital health or immunity passports may exacerbate current inequities faced by these groups, such as police violence, precarious employment and lack of access to services as a result of their health status. There has also been evidence that in the United States, white people are more likely to have access to the COVID-19 vaccine than Black people, despite its impact on racialized populations. If digital health passports focus on immunity, and there is evidence that certain groups are less likely to receive the vaccine, this will only further the health divide more. Additionally, a digital-based platform may prevent those who cannot afford smartphones from engaging with these apps and from partaking in the freedoms these apps can offer.

Ultimately, advocates are concerned that widespread use of a health certification system may create a “two-tiered system”, made of one group of the privileged who may freely continue in society, and another whose movements and participation will be heavily restricted and placed under surveillance.

Final Thoughts

We at the DGHH Lab have identified similar risks associated with Digital Contact Tracing apps and these apps have been implemented worldwide, arguably without a proper risk-benefit analysis nor appropriate processes in place to mitigate the risks and amplify the benefits. While many people are itching to start traveling, whether to visit loved ones or to experience new things, the numerous real and potential risks associated with digital health passports must be thoroughly identified and considered alongside the potential benefits in order to determine if digital health passports should be implemented. And if they are implemented, there should be corresponding regulations protecting individuals – particularly those of vulnerable and marginalized communities – so that their rights are not further at risk of being breached. 

Laksmiina Balasubramaniam, Photo by Markus Winkler on Unsplash

Early on in the pandemic, many countries committed to developing digital contact tracing (D-CT) tools in the hope that these digital solutions would be an effective tool to help contain the spread of COVID-19. Yet, countries were scrambling to determine what type of app was most appropriate. Some countries, such as France and India, pursued a centralized approach to D-CT where information collected by the app is stored on a central server by the government. France, for instance, pursued this approach because it would be more useful for public health planning. Meanwhile, other countries, such as Singapore, Australia, and Iceland, opted for decentralized solutions where any information collected by the app is stored on the individual user’s device in order to maintain a higher standard of privacy for users (that the centralized approach may not adequately attain). Not only did countries have to navigate the risks and benefits of decentralized and centralized approaches, they then had to completely develop the app – a major undertaking.

An Unlikely Partnership

Then, in April 2020, Apple and Google announced that they were teaming up to enable the use of Bluetooth technology for D-CT to not only help governments and health agencies reduce the spread of COVID-19, but also protect user privacy. This collaboration resulted in the Google Apple Exposure Notification (GAEN) Application Programming Interface (API). The GAEN API provides the framework for governments to develop privacy-centric D-CT apps and enables decentralized D-CT apps to run in the background on a phone. This partnership and resulting API was a game changer: for good and bad.

(Photo/TechCrunch)

Love, Hate, or Love/Hate Relationship

The GAEN API was, and continues to be, supported by many privacy experts for its reliance on Bluetooth technology (rather than GPS) and decentralized information storage. The use of Bluetooth technology and storing information on users’ devices protects the privacy of users which could also facilitate higher levels of uptake. For these reasons, following the announcement of the GAEN API, some countries who were originally pursuing a centralized approach abandoned this for a GAEN API alternative, such as Germany. The GAEN API has since been adopted in many countries for their contact tracing apps including Canada, Switzerland, Ireland, and South Africa. Some countries such as Iceland have even indicated interest in switching from the app they had developed to one supported by GAEN API. 

However, not all countries were happy about the Google-Apple partnership or the decentralized requirement. France was particularly vocal against the Google-Apple partnership, the GAEN API’s decentralized requirement, and the role Google-Apple had in the pandemic. This attitude arose for two reasons. First, since the GAEN API excluded centralized apps from being able to run in the background on a phone, centralized apps ran into functional issues – such as not working if another application was running – which means they would not be as effective at facilitating contact tracing and controlling the spread of COVID-19. Second, if the government chose to switch to a decentralized mode of data storage, the government would lose the benefits of a centralized system, namely the ability to collect information about aggregate population movement (flow of people in different areas), the ability to track “near misses” – both of which would be beneficial for managing the pandemic – and as France claimed, the ability to provide greater security against the collection, storage, or circulation of the list of persons who had tested positive for COVID-19. Ultimately, some countries felt strong-armed into picking the GAEN API even when they preferred a centralised system to support their pandemic response.

Then there are countries – like the United Kingdom – that had a seemingly love/hate relationship with the GAEN API. The original NHS app used a centralized model and faced several issues. In April, the Guardian reported that the app would not work if the phone screen was turned off (requiring the screen to always be active would take a huge toll on battery life) or if another app was being used at the same time. While the government continued to devote significant amounts of effort and time into developing the centralized app, it failed to register substantial amounts of nearby Android and Apple devices and was therefore not useful. In June, it was reported that the UK decided to pursue a decentralized D-CT app using the GAEN API. Yet, one report in August stated that the UK has “stepped almost entirely away” from digital contact tracing applications after the GAEN API failed to meet experts’ standards. Finally, after many months of back-and-forth, in September 2020, the UK launched a decentralized contact tracing app using the GAEN API.

(Photo/The Atlantic)

The Dominance of the GAEN API

As the experience of the United Kingdom, and France in particular, illustrates, rejecting the GAEN API to maintain a centralized approach comes with its own problems surrounding functionality and effectiveness. This leads us to a discussion about the dominance of the GAEN API and the role of private tech companies in a public health crisis.

Google indicated that decentralized data storage was required because neither Google or Apple wanted to provide functionality that would allow for surveillance that could be abused. This is a legitimate concern. With centralized data storage, there are concerns of lack of transparency and risk of mission creep (i.e. when a project gradually expands beyond its original scope). For instance, with a centralized approach, there may be a lack of clarity on the limits of the use of data collected by governments. 

This emphasis on privacy is commendable. However, it is worth noting that the focus on privacy protection through a decentralized model comes with a trade-off on data that could have been useful for understanding the spread of COVID-19 through a centralized model. Furthermore, this situation highlights a concern of allowing private companies to direct the approach to a pandemic response. 

For example, France had asked Google-Apple to ease privacy restrictions on collecting user data given the country’s strong record on preserving privacy. Yet, these two tech giants did not make an exception for France. The question arises: why is this the decision of a private company and not that of the government and/or the public? An article by POLITICO highlighted the concern of the increasing, dominating role of Big Tech in dictating how governments respond to a health crisis. As expressed by Cedric O, France’s Digital Minister, deciding how to address a public health crisis should be determined by the government who is accountable to their citizens not by policy choices of individual companies or “US digital giants.” 

Finally, Google and Apple have promised not to monetize the COVID-19 exposure notification and their solution specifically minimized the personal data generated by users…this time. Can we rely on big tech companies to always make the choice to protect privacy and forgo profits for the public good? If we cannot, we should be more appreciative of governments who are willing to push back. While France’s request of Apple to lift technological restrictions were rejected, its willingness to push against Apple could have encouraged other nations to advocate for concerns they felt were not addressed by the GAEN API solution. 

Final Thoughts

As private companies, Google and Apple did not owe anything to any government. In fact, we should appreciate the effort these companies made to help governments across the world in their response to COVID-19. At the same time, we should be cognisant of the fact that following the Google Apple announcement, some governments felt effectively coerced into adopting the GAEN API model. The advantages for privacy protection with a decentralized model may make it a better alternative to centralized models. But for countries who debated the benefits of centralized vs. decentralized models and chose the former to better reflect the needs of their nation, it is worrisome that the decision of Google-Apple could have effectively limited their ability to pursue what was in their view the best option for their nation and limit the effectiveness of their COVID-19 response. We need to consider who we believe should be deciding how to balance privacy needs against effective contact tracing systems and public health responses in general – tech companies or the government? 

Dyllan Goldstein, Rebecca Babcock

At this point during the COVID-19 pandemic, the use of digital contact tracing (D-CT) technologies have become fairly widespread. Largely, these technologies take the form of exposure notification systems such as Ireland’s COVID Tracker, Germany’s CORONA-Warn-App, or Canada’s COVID-Trace. Albeit a popular form of D-CT, exposure notification systems are only one of many technological solutions being used to combat the spread of COVID-19 within our communities. 

To understand the scope of these technologies and their uses, we must first understand manual contact tracing, and how digital technologies interlace with this process. For those interested, further reading on the subject can be found here.

What is contact tracing?

At its core, contact tracing is the process through which potential contacts between an infected individual and other uninfected individuals are discovered. This generally occurs in three stages.

1. Identification: those who have a potential to infect others are identified.
2. Tracing: those with the potential to have contracted the disease from the original source are found.
3. Notification: those who may have been exposed to the disease are notified and next steps are taken.

It is through this process that exposure chains are broken. Traditionally this has been a manual process, utilizing contact tracers working tirelessly to slow the spread of the disease. Though manual contact tracing is a critical intervention in the fight against COVID-19, the rapid spread of the coronavirus and the complexity of effectively identifying potential contacts has made the leveraging of available tech necessary to increase the scale and precision of contact tracing operations. Therefore, a wide variety of digital contact tracing (D-CT) solutions have arisen that contribute to one or more of the three stages mentioned above.

What D-CT can look like…

… in the Identification stage.

Early efforts to identify a potential source of infection is needed to initiate the contact tracing process. For exposure notification applications, identification mainly can occur through the input of a unique code provided by a health or government authority upon receiving a positive COVID-19 diagnosis.

Beyond exposure notification applications, the use of thermal imaging to identify possible signs of fever is one of the available digital solutions. This method uses cameras or scanners to detect individuals with a heat signature that indicates a fever (one of the most common COVID-19 symptoms) in order to identify individuals that may have COVID-19. Other solutions utilize smart devices such as fitness trackers or watches to monitor vital signs and changes in overall health to detect potential coronavirus cases. Both thermal imaging and smart devices take advantage of digital biomarkers to help identify infected individuals. 

Alternatively, digital check-in services can help users initiate the contact tracing process themselves. The Irish COVID Tracker app is one such app. Beyond just proximity tracing and exposure notification, the app employs a symptom check service which allows users to answer a set of questions based on their current state of health. Upon certain COVID-19 symptoms being present, they are given advice to help reduce risk to both themselves and others.

(Photo/NBC News)

… in tracing:

Once a potentially infected individual is found, their contacts and movements during their infectious period must be established. Exposure notification systems rely on bluetooth or GPS technology to conduct proximity tracking – or identifying people with whom an infected person has shared a space. What exactly counts as sharing a space however, varies between public health organisations. Most apps use a combination of time and distance to determine potential risk. While this has the benefit of connecting with a wide range of people, this method suffers from general inaccuracy as physical proximity does not always equal high risk. 

Alternative approaches to proximity tracking can be seen in South Korea or the UK, where those entering certain areas “scan in” on the phones via QR codes to indicate where they have been, and in some cases, such as China, check to see if they are allowed to be in public spaces. Pursuing a similar goal, but using a different approach, some areas such as South Korea and Singapore also have utilized the tracking of credit cards or other banking information to identify areas in which an infected individual has been.

(Photo/Ministry of Health NZ)

…. notification

Individuals found to have been in contact with a person who has been diagnosed with COVID-19 must then be contacted and informed of what measures they should take next. This is most visible in the alerts delivered by exposure notification apps. These will often include a notice that the user has likely been in contact with a COVID positive individual, and offer a series of steps to take to minimize the risk to oneself and others. There appears to be lower diversity in the application of technology in this stage, though specific approaches may vary. 

What are the risks?

The digital solutions identified across these three stages have associated risks which have to be balanced with the potential for these digital solutions to provide benefit in mitigating the spread of COVID-19.

For instance, while smartwatches that track biomarkers enable remote healthcare (which is uniquely beneficial during a pandemic), these solutions may also push the boundaries on what kinds of information is private. QR Code scanning, on the other hand, has been perceived by some as a more privacy-centric approach that addresses some privacy issues that have been created in the traditional pen and paper contact tracing efforts (for some of the concerns on this subject, see The Scottish Sun article here). 

Yet, QR codes (and other digital interventions broadly) also come with their own unique barriers such as requiring an internet connection, having access to phones capable of scanning the codes, understanding how the technology works, and matters of efficacy. Therefore, while these technologies are leveraging the widespread use of digital technology to monitor and communicate with people – far surpassing any possible efforts of manual tracers – there are communities who are excluded from the digital public health response;. Further steps must be taken to ensure these communities are not disproportionately impacted by the pandemic as a result of this exclusion.

On the other end of the privacy spectrum, credit card tracing is potentially a valuable means of determining the locations visited by a person who has tested positive. For instance, South Korea claimed its contact tracing – which incorporates credit card tracing alongside the use of CCTV security cameras and mobile phone data tracking – is conducted with “military precision.”  Though these methods of tracing can provide accurate and detailed insight into where people have been, some feel it may be government overreach, as well as a new source for scams.

(Photo/ Federal Trade Commission) 

Finally, one must consider that due to the reactive nature of the digital response to COVID-19, alongside the perceived need to quickly develop and implement digital tools without rigorous oversight, many risks and benefits of these digital solutions are unknown or not yet completely understood. This further complicates accurately comparing the risks and benefits as well as determining if and what trade-offs individuals and communities are willing to make for the benefit of the broader public in mitigating the spread of the disease.

Where does this leave us?

Much of mainstream media attention is given to exposure notification apps, but to see that as the entirety of digital contact tracing (D-CT) is to be misled. As we now know, D-CT is a set of divergent processes intent on breaking chains of disease exposure that have a diverse range of associated risks and benefits. We are quickly learning that despite the many positive impacts of D-CT technologies, many of these digital solutions can also represent a significant trade off with civil liberties and personal security (that may last beyond the pandemic itself). As such, we must approach the development and implementation of these digital tools with a clear concept of what kinds of risks they pose, and what metrics we will use to determine their value. It is precisely for this reason, that efforts by groups such as the Digital Global Health and Humanitarianism lab are important. 

By Alisha Gauhar, Rebecca Babcock and Jennie Phillips

Are There Any Other Issues to be Concerned About?

It should also be stressed that there are many other known risks associated with digital contact tracing that have been identified in research that do not necessarily pertain to privacy. For instance, the digital divide (defined as the notable gap between those that have access to technology and those who do not) is a particular concern. For certain communities – such as the homeless population who may not own any type of mobile phone, the elderly population who may have a smartphone but not know how to use it, and communities of lower socioeconomic status who may own a phone but not a ‘recent’ smartphone that is capable of hosting the contact tracing application – this application becomes inaccessible. This would indicate these individuals are being left out and potentially being disproportionately impacted by the COVID-19 pandemic as these communities also are often more vulnerable populations. Concerns over accessibility have already been raised as phones that have not been updated within the last five years have been reported as unable to download the app. Furthermore, certain groups such as serving military members, First Nations people on reserves, and refugees are also raising concerns about the usage of the app. In a privacy review of the COVID Alert app the report stated “the Government of Canada has not yet determined how to onboard these groups.” 

Another issue associated with digital contact tracing apps include garnering enough trust with the population to get more people to use the app. Increasing trust will in turn increase uptake, making the app more effective. Garnering trust however, is more difficult with some communities than others. Communities that have a history of being discriminated against or are less privileged may have a more difficult time trusting the government. People are also skeptical when trusting politicians who are promoting apps such as COVID Alert.  In order to combat this, the federal government should ensure that the app is not discriminatory and that certain populations will not be targeted if for example they test positive. As well, the government should be stimulating interest in downloading and correctly using the app through incentives, awareness, and education.

Conversely, the consequences that can arise from not using digital contact tracing methods to respond to the COVID-19 pandemic must be considered. COVID-19 is a highly contagious, fast-spreading disease and manual contact tracing – which is a very effective public health tool used to identify and manage the spread of other diseases – is resource intensive, time consuming, and provides more delayed results. In many situations, it is not sufficient for containing this virus. This is not to say digital contact tracing applications are the panacea of a public health response to COVID-19, but that they are likely a vital component of an effective and comprehensive pandemic response. Therefore, there is value in trying to pilot digital contact tracing tools in real-time to expedite the process and try to make an impact on the spread of the virus. For example, app-based contact tracing was tested during the Ebola outbreak in 2015. During COVID-19, although national implementation has raised more push-back, places like the UK and Spain have done small-scale trials with mixed to positive results. 

It is also important to recognize that, with any form of innovation, there are many unknown risks yet to be realized. Studies outlining the risks and benefits of exposure notification apps are still ongoing and apps are rolling out around the world faster than they can be studied. 

Moving Forward

As of September 19th 2020, the COVID Alert app has been downloaded 3.9 million times nationally which is about 10% of Canada’s population. Although an uptake of sixty percent of the population has been the standard target for most exposure notification apps, researchers are stressing that the app “starts to have a protective effect at much lower levels.” Yet the number of downloads may be limited due to the app only being officially rolled out in half of Canada’s provinces.

The government however, is encouraging people in other provinces to download the app for two purposes. First, in case an individual from a non-reporting province or territory comes into contact with an individual from a reporting province or territory (i.e. Ontario, New Brunswick, Saskatchewan, or Newfoundland) then the person from the non-reporting province can be notified of an “exposure” to COVID-19. Second, once the application rolls out to other regions, people who have already downloaded the application will not only be notified but will also be able to report if they have tested positive for COVID-19 through the application. In fact, the Government of Alberta has announced they will be switching over to the COVID Alert app after experiencing technical difficulties with their province wide app ABTraceTogether. 

Interestingly, despite 86-445 people testing positive for COVID-19 each day in Ontario within the past month, only 110 individuals in total have reported their positive COVID-19 diagnosis through the application since its release almost two months ago. Although there are many theories pointing to why this may be the case, i.e. many of the issues raised in this paper for example (e.g. privacy concerns, lack of awareness, trust, and access to digital technologies), little research exists specifically focusing on the user end of digital contact tracing tool implementation. Study is needed to identify why some users download the app and others don’t, and, broader, why uptake and engagement varies so vastly between countries. This is the primary focus of our research in the coming months, and will be accompanied by a series of complementary blog posts providing commentary, examining specific questions and shedding insight on the evolution and efficacy of digital contact tracing. It is hoped that through this research we will be able to provide deeper insight into why app engagement may be high or low, and work towards providing guidance to enhance engagement using an ethical approach that prioritizes risk prevention and mitigation as much as possible. 

—

Header Image Source: The Government of Ontario; Retrieved from https://covid-19.ontario.ca/covidalert