Without a trace: Why did corona apps fail?

Abstract

At the beginning of the COVID-19 pandemic, high hopes were put on digital contact tracing, using mobile phone apps to record and immediately notify contacts when a user reports as infected. Such apps can now be downloaded in many countries, but as second waves of COVID-19 are raging, these apps are playing a less important role than anticipated. We argue that this is because most countries have opted for app configurations that cannot provide a means of rapidly informing users of likely infections while avoiding too many false positive reports. Mathematical modelling suggests that differently configured apps have the potential to do this. These require, however, that some pseudonymised data be stored on a central server, which privacy advocates have cautioned against. We contend that their influential arguments are subject to two fallacies. First, they have tended to one-sidedly focus on the risks that centralised data storage entails for privacy, while paying insufficient attention to the fact that inefficient contact tracing involves ethical risks too. Second, while the envisioned system does entail risks of breaches, such risks are also present in decentralised systems, which have been falsely presented as ‘privacy preserving by design’. When these points are understood, it becomes clear that we must rethink our approach to digital contact tracing in our fight against COVID-19.

Digital Contact Tracing: Large-Scale Geolocation Data as an Alternative to Bluetooth-Based Apps Failure

“…In particular, it aims at guaranteeing that the contact-tracing applications using this protocol cannot be misused in the future for privacy-intrusive practices, such as advertising or even massive surveillance. While the authors of this paper agree that the DP-3T protocol provides very strong privacy guarantees, other researchers have exposed that the solution does not provide full-privacy guarantees [5].…”

Digital Contact Tracing Solutions: Promises, Pitfalls and Challenges

“…At a minimum, the system should be able to demonstrate clear benefits in comparison to a purely random selection of users to be quarantined in specific at-risk groups (e.g., where the infection rate is higher) [15]. Although some GAEN-based apps do provide reports on some measures related to the system's effectiveness, such measures can be biased, unreliable or misleading [21], [8] as we will discuss in detail in Sect. V-B1.…”

“…Hence, R-P1 is not achieved. SP can use this information to extract the encounter graph of infected users (i.e., which users have been in contact with infected users) since the matching is performed by SP [29], [8]. This could allow SP to build the social graph of the infected users [30].…”

“…1) Effectiveness: Although GAEN-based apps have been deployed in many countries since 2020, their contributions with regard to confining the spread of the pandemic have been heavily disputed. Indeed, several existing studies raise serious questions concerning the effectiveness of GAEN-based apps [8], [33], [34] as well as the trustworthiness of the self-reported effectiveness of some GAEN-based apps. For example, a report of Wymant et al [2] states that 6,1% of users who got notified via the NHS Covid-19 App were eventually tested positive.…”

“…The controversial debate on tracing apps goes significantly beyond purely technical concepts and includes also questions related to effectiveness, socio-political impact, surveillance capitalism, and technological sovereignty (see, e.g., [8], [9]). In this paper, we contribute to this debate by providing a systematization of the development, deployment, effectiveness, security, and privacy of contact tracing apps aiming to cover these relevant aspects.…”