Apps for COVID-19 contact-tracing: Too many questions and few answers

Abstract

Recently, for the second phase of prevention of the COVID-19 Pandemic, it is being assumed the use of an app for the prevention of infections COVID-19. The utility of these apps is not yet proven and the apps for COVID-19 contact-tracing probably cannot be used as a preventive tool until the bioethics and legal issues related to their use are resolved.

COVID-19 Pandemic, with its health and social consequences on public health, has caused significant medico-legal and bioethical problems worldwide [1], [2], [3], [4], [5], [6], [7].

Some countries around the world are starting to release the lockdown for COVID-19. In this post-emergency phase, some governments are considering the use of smartphone contact-tracing apps as a preventive tool. Thus, people who have been in close contact with someone found to have COVID-19 are now being traced and asked to self-isolate (usually for a fortnight). Most of these apps also have a second tool: a clinical diary that contains all the relevant information of the user (age, gender, previous pathologies, etc.). Since the theorization of these apps, a heated debate has arisen. One of the main issues is related to privacy. Many have objected that these apps may violate the privacy right. In response to these criticisms, many governments have stated that maximum security and privacy will be guaranteed in the processing of users’ data.

Despite this reassurance it is believed that the risk that cyber-attacks may induce a data leak is too high. In fact, it seems that in some cases the data will be stored centrally, so they will be vulnerable to hacker attacks with dissemination of sensitive data and potential harmful consequences for all users of the app. In addition, the software will use the Bluetooth system. This system is notoriously extremely vulnerable to cyber-attacks and its security depends on the quality of the smartphone. Therefore, some subjects will certainly be more exposed to cyber-attacks with the dissemination of their sensitive data. In this case the question is: will only citizens who can pay for a state-of-the-art smartphone with an effective security system be protected from data dissemination?

The other uncertainty concerns the nature of the data processed: the data should be anonymous. Unfortunately, in the tracking apps we are not in the field of data “anonymization” but in the field of “pseudonymization”, in fact we speak of a risk to privacy. The pseudonymisation process allows the data to be identifiable only if combined with other information, stored separately. This however means that it is not excluded with certainty that a subject can be recognized and identified.

Another problem concerns how the app is developed. It is believed that this software can be considered a healthcare intervention, therefore, as such, should be tested with rigid protocols that should include pilot studies and/or risk assessments. However, to date, these software have not been properly tested and their effectiveness/security is not proven.

In this regard, the effectiveness of apps in reducing infections is also still debated. It would seem that to be effective 60% of the population should use the software. Therefore, if this percentage is not reached, the effectiveness of this instrument could be greatly reduced. In this case there are two possibilities: the government imposes the use of the app for all citizens, violating a constitutional right; or it makes optional and voluntary the use of the app.

In addition, there are further unanswered questions: how accurate are these apps in recognizing a COVID-19 positive patient's contacts? Will the user of the app, who will receive a notification of contact with a positive person, be obliged to report the contact or will the health authorities be automatically informed via the app? Will health authorities be able to track, test and monitor all subjects at risk for suspicious contacts?

It is believed that the use of the apps for COVID-19 contact-tracing presents too many risks and unanswered questions in relation to its security, its effectiveness and its bioethical-legal issues. Therefore, it will be essential not to rely on tools of dubious utility but to focus on tools of validated effectiveness and security: testing, contact tracing, isolation and social distancing.

Funding

This work did not receive any grant from funding agencies in the public, commercial, or not-for-profit sectors.

Author contributions

AC made the main work. CC and CL made the revision of the manuscript.

Disclosure of interest

The authors declare that they have no competing interest.