TraceTogether – the virus tracking app that has been a big winner out of the COVID-19 pandemic – but will YOU be the loser?

Assignment Question:

Identify an organization that has experienced significant growth during the outbreak because of its digital operating model. Discuss whether this growth is short term or not and what actions the organization can take to sustain its growth.

Singapore-based app TraceTogether has been a major winner out of the COVID-19 global pandemic. The app, which tracks your interaction with other people who have been diagnosed with COVID-19, has been successfully rolled out in Singapore and is being rolled out by the Australian Government (under the name COVIDSafe) as a way to supplement its existing contact tracing regime. The launch has been one of the most successful app launches in Australia’s history with nearly 2 million Australians downloading the app in the first 24 hours.

To date, Australia’s COVID-19 tracing regime has been limited to interviewing coronavirus patients in the hope they can recall where they had been and who they had been in contact with. This, in combination with strict restrictions on movement has put Australia in an enviable position in its fight against COVID-19. Unfortunately these restrictions come at a cost. IT consultancy Kearney estimated that every month of lockdown costs the Australian economy $30 billion to $40 billion in lost GDP. To help balance the needs of re-opening the economy against controlling future spread of COVID-19 the Australian government has proposed the TracingTogether app as a potential solution. The Australian Prime Minister, Scott Morrison has decided to not make the app mandatory but wants at least 40 percent of the community to download it to ensure its success – a considerably higher take-up rate than the reported 20% rate of the TraceTogether app in Singapore.

TraceTogether relies on Bluetooth technologies to exchange information between users of the app. Bluetooth signal strength is employed as a proxy for distance between users and to estimate whether ‘contact’ has been made. This information is then locally logged on the device by the app in an encrypted form.

How it works:

1. After installing the app the user submits their mobile number to the centralised authority
2. The mobile number together with a newly generated user ID is stored on a central server
3. When a TraceTogether user is diagnosed with COVID-19, they are asked for consent to upload the app’s encrypted data logs to the server
4. Through these data logs the central server administrator can contact other TraceTogether users who were in contact with the infected user

Concerns:

Contact tracing is considered one of the primary digital technologies with promise to improve our ability to flatten the COVID-19 curve. Unfortunately, authorities risk having their efforts for widespread adoption frustrated by users who fear the privacy implications of downloading the app. The app has sparked a significant debate over a perceived tension between achieving swift health and positive economic outcomes on the one hand, and allaying concerns about longer-term privacy impacts on the other.

User’s fears are that a corrupt or overly curious central authority can unnecessarily obtain and decrypt user data logs (mass-surveillance). Even though local data logs on devices are deleted after 21 days there is no guarantee that the data logs decrypted by any central authority would also be deleted. Further exacerbating fears is that no additional consent is required from a non-infected user who has come into contact with an infected user before their data is accessed. To ensure continued widespread adoption of the app, TraceTogether could amend their operating model to allow users to choose to identify themselves when they are notified that they have been in contact with an infected user. This functionality can be implemented either as a specific consent request to individuals or as an automatic response to identification requests if individuals opt in for self-identification.

Notwithstanding the privacy fears, some commentators suggest that healthcare artificial intelligence can’t pick up on nuances that human workers can, like false positives and false negatives. Tracing applications don’t account for factors beyond proximity like environment and activity, which health care workers do. For instance, a person could be flagged as having been in contact with someone through an app when in reality it could have been someone standing outside through a window, for example.

Centralized versus decentralized approach:

The biggest risk to TraceTogether’s operating model is not actually the potential security fears but the risk TraceTogether becomes obsolete due to the introduction of better alternatives. Both Apple and Google have launched major efforts to leverage smartphone technology to contain the COVID-19 pandemic. Like TraceTogether they plan to harness short range Bluetooth signals to gather a record of other phones that the person came into close proximity with.

In contrast to TraceTogether, Apple and Google have employed a decentralized operating model. This means that users’ randomized IDs are changed every 15 minutes and users are not required to provide their mobile phone number. When a person who has tested positive for coronavirus consents to upload the last 14 days of contacts, the health department can then alert those contacts via the app itself that they should get tested. The IDs are deleted from the server after 14 days. To assuage user’s privacy fears, Apple and Google retain the ability to disable the tech should governments across the world try to alter the purpose of the app.

So why is the Australian government promoting TraceTogether and not the Apple or Google solution?

Potentially one reason why Australia may be adopting a more centralized approach is so that eventually it could replace and/or supplement elements of manual contact tracing currently being undertaken by public health authorities.

Sources:

Australian Financial Review: Phone tracking the next step in virus battle (LINK)

Australian Financial Review: COVID-19 contact tracing app: ‘I get it, but I don’t like it’ (LINK)

Australian Financial Review: Apple, Google to help with virus tracking (LINK)

Australian Financial Review: Big tech’s virus-tracking apps explained (LINK)

Sydney Morning Herald: ‘Nothing particularly disturbing’: Coronavirus app safe, review finds (LINK)

The University of Melbourne: On the privacy of TraceTogether, the Singaporean COVID-19 contact tracing mobile app, and recommendations for Australia (LINK)

The Guardian: Australia’s coronavirus contact tracing app: what we know so far (LINK)

Cnet: Tech isn’t solution to COVID-19, says Singapore director of contact tracing app (LINK)

Allens-Linklaters: Trace but don’t track – Australia’s approach to digital contract tracing (LINK)