While the ongoing Covid-19 pandemic has put a spotlight on contact-tracing mobile phone apps as tools to help contain the spread of coronavirus, two University of Washington professors affiliated with the Center for an Informed Public (CIP) have cautioned that the technology should not be viewed as a panacea to the current public health emergency.
During a Hive Think Tank livestream discussion on April 23, Ryan Calo, an associate professor at the UW School of Law, and Carl Bergstrom, a professor at UW’s Department of Biology, also raised concerns that contact-tracing apps could open the door to potential misuse by malicious actors to spread misinformation and disinformation. That includes possible targeting of elections to suppress voting and foreign actors manipulating the apps to create confusion and uncertainty. Calo, one of CIP’s principal investigators, also testified to this effect before the U.S. Senate in a recent, first-of-its kind paper hearing.
“… [I]f you don’t address the problem of how do you deal with malicious activity on these systems,” Calo said during the Hive livestream, “then you wonder whether they have the potential to not only be inaccurate and to give people a false sense of reassurance or panic but actually be a vector for attacks on our political, economic and social infrastructure.”
In a jointly-written article for the Brookings Institution published Monday, Calo, Bergstrom and independent researcher Ashkan Soltani, a former chief technologist at the Federal Trade Commission, explored the topic in greater detail, writing that automated contact-tracing apps could give “a false sense of security to justify reopening local and national economies well before it is safe to do so.”
Automated contact-tracing apps rely on the capability of mobile phones to communicate with one another through Bluetooth signals. The technology can be used to trace potential coronavirus transmissions from an infected individual to others by figuring out which signals were in close proximity. Apple and Google recently teamed up to create a contact-tracing framework that supports the development of apps that work on both of their operating systems. There are also partnerships between tech companies and some universities to develop contact tracing apps, including a current research collaboration between the University of Washington and Microsoft.
But as Bergstrom, a CIP affiliate researcher, pointed out during the livestream, the apps, for all their promise, have limitations and policy implications that need to be addressed before they are used more widely by the public and health authorities.
Just because an infected individual’s mobile phone came into close proximity to the phone of another person, that doesn’t necessarily mean there was an actual transmission. In an apartment building, for instance, the cellphones of people in adjacent apartments could trigger a false positive since Bluetooth signals “are oblivious to walls,” Bergstrom said. Similarly, false positives could be triggered by the phones of adjacent people walking down a sidewalk where the risk of an actual transmission might be very low. There’s also the risk of false negatives since a contact-tracing app can’t detect when someone is infected by touching a surface that might harbor water droplets from an infected individual who coughed on it.
“It is really key though to not view [automated contact tracing] as a panacea or even to view it as a replacement for manual contact tracing and think through the issues around false positives and false negatives in a way that will prevent us from deploying a product that does more harm than it does good,” Bergstrom said.
Calo identified a more nefarious challenge: Since app users self-report whether they’ve tested positive for coronavirus, there’s risk of people falsely reporting a positive status. “Unfortunately, we live in a world where people will do that just for fun,” he said during the livestream.
Calo outlined scenarios where reporting false positives could be used by an election operative to target a certain locality or a struggling business owner to spread false information about competitors.
That potential misuse could scale up, too.
“You could imagine foreign interference or foreign operatives who do a kind of denial-of-service [attack] by flooding the system with false positives,” Calo said. “Until you address that and make it impossible to use the app unless you’ve actually been diagnosed — so the health status for example, has to be uploaded by a trusted source or verified by a trusted source — you unfortunately run into these kinds of attacks. And they’re worse than doing nothing because they create the possibility for mischief. It’s only a matter of time, if people start downloading these apps [more widely], I think we will see things like this.”
Despite these technological, security and epidemiological challenges, Bergstrom noted that contract tracing via mobile phones could be useful in certain situations, like helping to determine whom to test and identifying infection flare-ups once the current coronavirus crisis is brought under control.
“I don’t want to rule it out entirely because there may be ways … to provide some sort of marginal benefits to society if we can think of clever ways to use the technology,” Bergstrom said.
ADDITIONAL RESOURCES
- For the full discussion on digital contact tracing apps, watch the April 23 Hive Think Tank livestream.
- Additional reading from Soltani, Calo and Bergstrom at Brookings TechStream: “Contact-tracing apps are not a solution to the COVID-19 crisis”
