Exit through the App Store?

Abstract

This Preview summarizes the Ada Lovelace Institute rapid evidence review Exit through the App Store?, which sets out proposals for whether, and how, the UK government should use technology to transition from the COVID-19 global public health crisis. It examines the potential development and implementation of technical solutions to support symptom tracking, contact tracing, and immunity certification. The full rapid evidence review takes into account societal, political, legal, and ethical perspectives and gives findings and recommendations for the transition and rebuild phases that follow containment, delay, and mitigation.

This Preview summarizes the Ada Lovelace Institute rapid evidence review Exit through the App Store?, which sets out proposals for whether, and how, the UK government should use technology to transition from the COVID-19 global public health crisis. It examines the potential development and implementation of technical solutions to support symptom tracking, contact tracing, and immunity certification. The full rapid evidence review takes into account societal, political, legal, and ethical perspectives and gives findings and recommendations for the transition and rebuild phases that follow containment, delay, and mitigation.

Main Text

The Ada Lovelace Institute rapid evidence review Exit through the App Store?,¹ produced in early April 2020, responded to the UK government’s policy investment in data-driven technologies as tools to support the transition from emergency lockdown measures in response to COVID-19—in particular symptom-tracking apps, digital contact-tracing apps, and digital immunity certificates.

The evidence review is pertinent and continues to inform the private and public policy debate: as epidemiological and public health knowledge increase, the extent to which technologies can inform research into the disease, prevent further infections, and support the restoration of system capacity and the opening up of the economy remain contested.

The progress of the NHSX COVID-19 contact-tracing app illustrates the delicacy of the balance of technical, legal, and societal factors needed to implement new technologies successfully at scale: originally scheduled for launch in mid-April, and trialed on the Isle of Wight in early May, the app has come under widespread criticism from data analysts, privacy experts, social justice campaigners, and civil society organizations; is the subject of surveys and public media debate that indicate a lack of trust in its technical robustness and its ability to help contain the virus; and is now scheduled for roll-out in June.²

Exit through the App Store? examines the potential development and implementation of technical solutions to support symptom tracking, contact tracing, and immunity certification, taking into account societal, political, legal, and ethical perspectives, to provide recommendations for the transition and rebuild phases that follow containment, delay, and mitigation of COVID-19 (Figure 1).

Figure 1.

Overview of the Uses of Technology to Transition from the COVID-19 Crisis

It concludes that the government is right to explore non-clinical measures in its attempt to relax controls without an unacceptable rise in COVID-19 cases: data-driven technologies can be effective tools in any transition strategy, but they are not a replacement for policy. If technologies are implemented, they must form part of holistic public health surveillance strategies and other pandemic response initiatives. Unless considerable supporting evidence arises to the contrary, they cannot and should not replace other proven methods for epidemiological containment.

Digital Contact Tracing

Contact tracing is a standard method in public health surveillance during pandemics. It enables public health authorities to understand who is at risk of catching the disease, put in place proportionate health measures to help people who may have been infected, and reduce the chance of it spreading further.

Typically, contact tracing is performed manually. Manual contact tracing involves speaking with patients, identifying people with whom they have been in close contact while infectious, and then locating those people and placing them in isolation or quarantine.

Digital contact tracing uses devices carried by people, such as smartphones. It measures these devices’ proximity to each other and uses it as a proxy for contact between two or more people. A risk-scoring algorithm then determines whether a user or public health authority should be alerted about potential contact and what action should then be taken.

Different approaches to digital contact tracing are being proposed and implemented around the world. At the time of writing, 28 countries had launched official contact-tracing apps, with a further 11 countries—including the UK—known to be developing them.

Based on the current evidence reviewed, there are significant technical limitations, and deep societal risks, to implementing digital contact tracing.

There is a lack of evidence on the effectiveness of digital contact-tracing apps as part of a wider pandemic response strategy, meaning that governments will need to measure and report on effectiveness, while retaining the ability to change direction.

Digital contact tracing uses measurable vectors such as distance and time to ascertain when a contact incident occurs. However, these measurements will necessarily be imprecise and could lead to high numbers of false positives and false negatives.

Digital contact tracing relies on high levels of accuracy in data about infection rates, which remains problematic given currently low levels of testing in the UK. It also requires widespread uptake of the application by the population, with studies suggesting at least 60% of the population would need to use it.

Digital contact-tracing apps will only become an effective tool for transitioning out of the crisis if they enjoy public buy-in. Efforts to increase the ubiquity of digital contact-tracing apps, including through mandating their use, could have the opposite effect, undermining public trust and confidence in government and even provoking civil disobedience.

Government policymaking will also need to consider social considerations of widespread deployment of digital contact tracing, including the potential exclusion of vulnerable groups and exacerbation of health inequalities.

Symptom Tracking

Symptom-tracking services take the form of apps and websites that encourage citizens to share some information about themselves (such as their age, gender, and medical history) and report their symptoms, usually on a regular basis. This may be useful in helping public health authorities and medical researchers expand understanding of the disease, track its spread, and plan healthcare responses.

However, symptom-tracking apps suffer from limitations, including the low quality of data obtained through self-reporting of symptoms, imbalances in the representativeness of the data collected, and false-reporting risks.

These limitations translate into risks that could exacerbate health inequalities and raise societal risks. For example, if made available to a recruitment or insurance service, symptom data might reveal information about an individual that they have the right not to share with those organizations. Symptom-tracking databases may also centralize large amounts of personal data, turning them into “honeypots” prone to adversarial attacks and breaches.

Immunity Certification

There is broad agreement that widespread testing is the only route through which the UK can exit the coronavirus crisis, and the UK has highlighted immunity testing as a key strategy.

If evidence emerges that long- or short-term immunity to COVID-19 can be established through contracting the virus or through a vaccine, and credible immunity tests are established, then a means for certifying immunity may need to be developed.

Immunity certificates need not form part of an immunity testing strategy, but Health Secretary Matt Hancock has suggested there is government interest in developing immunity certificates, while other countries are investigating the potential for immunity passports.

The establishment of a regime for immunity certification will have deep societal implications. It may lead to arbitrary and unfair restrictions on individuals’ access to transport, services, employment, movement, and other rights and freedoms, on the basis of their immunity status. Discrimination and stigmatization may become commonplace if immunity becomes an integral element of an individual’s identity as we transition from the crisis.

Policy Implications

Taking Account of the Societal Impact of Technology

Effective policy interventions using technology are designed with the input and involvement of people across society and are monitored and evaluated to assess their social impact on individuals and communities. Government must broaden the range of actors involved in decision making around the COVID-19 crisis beyond scientific advisory bodies and adopt a new independent oversight mechanism. To ensure the evidence base for the development, deployment, and evaluation of technical interventions during the crisis is robust, experts should be diverse and representative, including data and technology; the social sciences and humanities; and representatives of vulnerable groups, civil society, and local authorities.

Ensuring Effective Regulation of Data Processing

There is a real risk that the expansion of state intrusion into individuals’ lives that occurs during emergencies endures beyond the originating crisis. Technical and legal infrastructure built during this pandemic may be difficult to dismantle once it is over, unless proper safeguards are in place. Legal and technical sunset clauses must be built into the design of new powers and technologies.

To achieve this, government should advance, and Parliament should adopt, primary legislation regulating the processing of data by both public and private sector actors in the use of technology to transition from the crisis. Government must encourage privacy by design in technical implementations and must choose privacy-preserving protocols to underscore technical measures.

Defining the Role of Immunity Certification during Transition and Beyond

Until a robust and credible means of immunity testing is developed, government should focus on developing a comprehensive strategy to establish how immunity testing will be conducted, how immunity will be certified, and how immunity certification will be integrated into policy and processes including those pertaining to travel, movement, work, and schooling.

The strategy should be made public and open to public scrutiny. It must be clear to the public what values are being prioritized and traded off in a transition strategy that centers on immunity certification.

Should an immunity certification regime be determined necessary, a secure digital system based on open standards may be an effective way of maximizing benefits while minimizing fraud and abuse. However, it would need to be bolstered by non-digital methods in order to account for digital exclusion and prevent further harm to vulnerable groups.

Gaining and Maintaining Public Trust

Effective deployment of technology to support the transition from the crisis will be dependent on widespread public trust and confidence in those interventions.

Government must be transparent about the technical measures under consideration in advance of their deployment. Technical interventions should not be deployed until the evidence base for their use has been examined, their likely impact has been assessed, and specific recommendations have been made for their deployment. Open debate and scrutiny must be encouraged, to increase trust and raise public awareness of the complexity of the issues.

Enabling Real-Time Scrutiny, Evaluation, and Independent Oversight

As we move into the transition phase, the government should be thinking about how decision making at pace can be underscored with real-time scrutiny, evaluation, and independent oversight.

An independent oversight mechanism should be established to lead scrutiny of the government’s policy formulation and decision making in real time during the crisis. There is a real-time scrutiny initiative underway in Scotland, where the Scottish Police have appointed John Scott QC to lead scrutiny of how the police are using their powers. This type of model could be applied in other domains and may be particularly critical to bring accountability and oversight to the use of data and technology to support transition measures.