Ethical Framework for Assessing Manual and Digital Contact Tracing for COVID-19.

The coronavirus disease 2019 (COVID-19) pandemic has challenged the traditional public health balance between benefiting the good of the community through contact tracing and restricting individual liberty. This article first analyzes important technical and ethical issues regarding new smartphone apps that facilitate contact tracing and exposure notification. It then presents a framework for assessing contact tracing, whether manual or digital: the effectiveness at mitigating the pandemic; acceptability of risks, particularly privacy; and equitable distribution of benefits and risks. Both manual and digital contact tracing require public trust, engagement of minority communities, prompt COVID-19 testing and return of results, and high adherence with physical distancing and use of masks.

Public health interventions to control a contagious disease must balance benefiting the community and restricting individual liberty (1). The coronavirus disease 2019 (COVID-19) pandemic has challenged traditional balancing of these countervailing aims. Some opponents of wearing masks, restricting public gatherings, and closing businesses regard these measures as assaults on individual liberty, reject medical science, and downplay the threat of infections (2, 3). Contact tracing presents particularly vexing challenges of balancing societal versus individual interests. We analyze major aspects of manual and technology-assisted contact tracing that raise the thorniest ethical issues.

Contact Tracing

State laws authorize contact tracing by public health officials, with safeguards. It is routinely carried out, for example, in tuberculosis cases and during measles outbreaks (4). With COVID-19, contact tracing aims to notify all persons who were within 6 feet of an infected person for at least 10 minutes during the 14 days before diagnosis. Although public health laws allow “mandatory” contact tracing, in effect contact tracing is voluntary because people who do not want to cooperate can decline to talk or say they do not recall contacts or locations (5).

Manual Contact Tracing

In manual contact tracing, public health staff contact persons exposed to an infected person and ask them to be tested and to self-quarantine to prevent further transmission. Manual tracing has not been successful with COVID-19 because of the very large numbers of infected persons, the downsizing of public health departments, the shortage of experienced contact tracing staff, mistrust of government, and lack of cooperation by contacts (6, 7). Contact tracers in different U.S. jurisdictions completed interviews with 64% to 71% of COVID-19 cases; of these, 53% to 70% reported no names of persons whom they might have exposed (6, 8, 9).

What might be the reasons for such low cooperation? Some infected persons may worry that they will lose their jobs or be stigmatized. Students may fear disciplinary action if they admit to attending a high-risk event. Furthermore, there may be insufficient numbers of appropriate bilingual contact tracers to address the disproportionately high number of infected persons who do not speak English at home; language and cultural barriers greatly hamper building rapport (10). Some people are mistrustful, fearing that “contact tracers” are actually police, Federal Bureau of Investigation, or U.S. Immigration and Customs Enforcement agents (7, 11). Some people fear that contract tracing will lead to government surveillance, detention camps, and taking away their guns (2, 3). Contact tracers have been threatened with violence and called “Gestapo” (2). Fox News host Laura Ingraham compared being contacted by a contract tracer to being groped by a Transport Security Administration worker (3).

Smartphone Exposure Notification Apps

Smartphone apps might facilitate contact tracing by providing a record of the user's recent close exposures to the phones of persons later found to be infected with COVID-19. Unlike manual contact tracing, infected persons then do not need to recall their movements during their contagious period or know the identities of people close by. These apps can use Bluetooth, GPS, or WiFi technology. Table 1 compares important features of these technological approaches. Some apps are designed to prioritize privacy and require explicit consent.

Table 1. Characteristics of Exposure Notification Apps Based on Bluetooth, GPS, and WiFi Technology*

Bluetooth-based Apps

Using Bluetooth technology, Google and Apple have developed a joint privacy-preserving app, called Exposure Notifications Express, that allows phones to detect nearby Android and iOS phones (16). The app collects and stores on the user's phone randomly generated encrypted Bluetooth keys that contain no identifying information about the other phones or the location or time of the exposure. If the phone's owner later contracts COVID-19, these Bluetooth keys can be used to notify exposed phones electronically without revealing the identity of any of the parties.

Exposure Notifications Express is an app that allows public health authorities to utilize the privacy-preserving platform developed by Apple–Google without having to spend substantial effort and cost to develop their own exposure notification apps (17, 18). Some other Bluetooth exposure notification apps implement a similar privacy-preserving approach as Apple–Google, but other apps that combine Bluetooth with other approaches, such as those developed by Citizen and Everbright, do not have strong privacy and consent protections (19, 20).

GPS-Assisted Apps

In the United States, cell phones' locations are continually tracked by service providers and apps from retailers and map services. Apps that log a user's locations on his or her phone can facilitate manual contact tracing by helping users who later become infected with COVID-19 recall where they have been and potentially whom they were near. Some state or local governments and private companies have developed exposure notification apps using GPS technology (21, 22).

WiFi-based Location Tracking

Universities routinely track the locations of students, employees, and guests who enable WiFi access on their campus. Location is triangulated on the basis of the strength of signals that users' devices send to wireless access points to connect to the WiFi network. Each user is identified by a unique access address. A few universities are developing a contact tracing system based on this location information (23, 24). Some companies are also developing WiFi-based tracking programs for business clients. Finally, some universities and companies are developing apps that use more than one of the above technologies (19–21, 24, 25).

Unresolved Challenges for All Exposure Notification Apps

Context of Exposure

No app can assess whether the exposure risk is lower because persons were wearing masks. Bluetooth-based apps cannot determine whether there was a floor or wall separating the persons. Although apps based on GPS provide locations and times of exposure, they may not identify physical separation and different rooms, floors, or offices at a GPS location. For WiFi-based location triangulation, the ability to distinguish different rooms or floors in a building depends on the density and configuration of the wireless access nodes.

Privacy Breaches

Serious privacy breaches have been identified in many COVID apps, all contrary to the apps' stated privacy policies. The North Dakota app Care19 shared information with a digital advertising firm, including the unique advertising identifier that allows targeted advertisements in other apps (26). Earlier, Google collected location data with its “privacy-preserving” contact-tracing application programming interface (27). Furthermore, technology and data companies have a history of violating their own privacy and consent policies, including sharing data beyond the scope of their policies, as Facebook did in the Cambridge Analytica scandal (28, 29). Even decentralized exposure notification apps cannot eliminate the possibility of privacy breaches. For example, a malicious party running accounts on multiple phones can deduce the identity of a case by triangulating the notifications (30).

Coordination Among Jurisdictions

Infected persons living or working near borders and travelers may expose persons from several jurisdictions, presenting a challenge for both manual and digital contact tracing. The European Union has a pilot program to allow users of the Apple–Google app to report a positive test and receive alerts if they border (31). The U.S. Association of Public Health Laboratories is setting up a secure national server to host the deidentified Bluetooth keys from the Apple–Google app that infected persons voluntarily share; this national server will facilitate interoperability across states (32).

Low Uptake

In a national survey, only 42% of U.S. residents said they would download and use a mobile contact tracing app (33). Actual downloading rates are shown in Table 1 (12–15). Although maximum effectiveness requires about 60% of the population to be using the same app, lower levels of uptake may still provide some public health benefit (34).

A Framework for Balancing Protecting Public Health and Respecting Privacy

The traditional ethical and policy framework sets criteria that justify liberty-limiting public health interventions, including contact tracing, to benefit the community by limiting spread of a disease (1, 4, 35–37). Balancing these countervailing considerations depends on a jurisdiction's attitudes toward privacy, trust in government institutions and technology companies, and the curve of infections. A public health measure that restricts individual liberty is appropriate if the answer to all of the following questions is “yes” (Table 2) (1, 35–37); public health officials would be justified in implementing a digital or manual contact tracing program.

Table 2. Ethical and Policy Framework for Public Health Interventions That Restrict Individual Liberty

1. Is the risk to public health serious and likely?

The COVID-19 pandemic is clearly severe, owing to the large number of cases and excess deaths.

2. Is the public health intervention effective for diminishing the public health risk?

In apps introduced before the new Apple–Google platform, errors were frequently reported, and several apps needed to be withdrawn to make corrections (26, 27).

The downloading of current exposure notification apps and the number of positive cases reported to the apps and contacts notified remain to be seen (6, 33). Apps that prioritize privacy cannot track those notified or how many of these people test positive for COVID-19. Thus, their effectiveness in preventing spread is hard to assess.

Exposure notification is only the first step toward the goal of reducing new COVID-19 infections; testing and quarantine or isolation are also needed. However, in the United States, access to testing and timely return of results still fall far short of the need (38) and undermine the value of exposure notification (39). Moreover, many people exposed to COVID-19 cannot quarantine because they live with others in close quarters or need to continue working to pay for food and rent (40). Some jurisdictions have offered logistic and financial support to exposed persons to help them overcome these challenges (39). Thus, for many reasons, the real-world effectiveness of exposure notification apps is likely to be limited.

3. Are the risks of the public health intervention acceptable?

To assess the risks of exposure notification apps, the public needs readily available answers to the following questions. “Yes” answers to these questions indicate lower risks (Table 2).

A. Is specific informed and voluntary consent required from the cellphone owner for the app to collect data and to notify potential contacts?

B. Are both the app user and potential contacts anonymous to each other? The app user and contacts may also be anonymous to public health authorities, which heightens privacy but may reduce the public health benefits.

C. Are the collected data the minimum needed to carry out an authorized public health purpose?

D. Is data use restricted to the public health purpose by designated public health officials? Is sharing data with other entities, such as law enforcement, immigration officials, the Department of Homeland Security, and commercial organizations expressly prohibited? Is combining the collected data with other data prohibited, so that individuals cannot be reidentified?

E. Are the data destroyed after a defined period, when they are no longer needed for the public health purpose?

F. Are strong security protections in place and tested?

G. Has the app been tested under field conditions?

Public health departments, app developers, and businesses and universities that implement apps should provide transparent and detailed answers to these questions. In Colorado, basic information originally was not disclosed about how an app was gathering and using cellphone location data. Investigative reporters who obtained such information identified significant privacy concerns (41). Apple and Google have provided detailed information about their app and platform and use open-source programming that facilitates independent review. In contrast, businesses, business consultants, and universities developing proximity detection apps have generally provided little specific information to evaluate these questions (42, 43).

Privacy and security should be evaluated and audited by independent cybersecurity firms, to verify answers to these questions (44). Such independent analyses have revealed serious flaws in many COVID apps (26, 27). The Apple–Google app does more to minimize these risks than other exposure notification approaches.

4. Are the benefits and risks of the public health intervention equitably distributed?

Historically, public health measures and contagious disease morbidity and mortality have fallen most heavily on disadvantaged and vulnerable groups, particularly ethnic and racial minorities that are already stigmatized (45). The number of COVID cases is strikingly higher among Black and Latinx persons, and COVID deaths are higher among Black persons (46). Manual contact tracing programs that do not match tracers to infected persons in terms of language, ethnicity, race, and culture have failed to build trust and overcome the disproportionate harms of the pandemic on these groups (10). Moreover, both manual and digital contact tracing in disadvantaged communities may be unsuccessful unless they mitigate contacts' poor access to testing, crowded housing, and financial pressures to continue to work in jobs that require close contact with many other persons (39, 40).

5. Is the intervention the least restrictive alternative for achieving the public health goal?

In the United States and Europe, unlike Asian countries, such as South Korea and Singapore, voluntary and privacy-preserving public health interventions are strongly preferred. Involuntary exposure notification tracking smartphone location would be a significant step beyond current U.S. public health practice and is not being considered by any state or local government. However, some U.S. businesses are requiring employees to use location tracking or exposure notification apps (43). Moreover, some universities are tracking location routinely; one allows people to opt out only by forgoing WiFi access on the campus (23). As previously discussed, “mandatory” contact tracing by public health workers is de facto voluntary (5). Thus, privacy-preserving exposure notification apps coupled with voluntary cooperation of infected persons with public health officials to notify contacts who may not be using the app provides the best combination of public health benefit and protection of privacy.

In conclusion, in the United States, proven public health measures, such as wearing masks, physical distancing, and restricting gatherings in crowded venues, have not been consistently implemented or followed (47). In some areas, these measures, as well as contact tracing, have been resisted as unacceptable infringements on liberty (48).

Many U.S. government leaders have failed to articulate clear, effective, and consistent evidence-based messages on the value of placing some restrictions on liberty and privacy to serve the common good. In contrast, Germany and New Zealand, whose leaders have successfully communicated such messages, have maintained much lower percentages of cases in the population than the United States (49). During the COVID-19 pandemic, many governments around the globe lost public trust. Without trust, the public is unlikely to accept restrictions on liberty and privacy.

In addition to government officials, opinion influencers can urge people to protect others and build trust for public health measures. A positive example is professional basketball players making public service announcements to reinforce following public health measures. Football coaches and players, whose in-person audiences are now limited, should exhort fans to work together as a team toward the common long-term goal of overcoming the pandemic. Ministers and bishops should appeal to their congregations to follow Biblical exhortations to care for other people. Engagement is particularly important with communities of color, where there is more mistrust of contact tracing and addressing the basic needs of infected persons and contacts is crucial (50).

The urgent need to reduce the spread of the pandemic may lead national, state, and local governments, as well as businesses and universities, to rush to institute digital COVID-focused apps that seem desirable in theory. Even if apps have acceptable risks to privacy, complex cultural, political, and ideological problems and tradeoffs need to be resolved. Broad support must be forged for a coordinated and sustainable spectrum of effective public health measures that include prompt testing and return of results and consistent use of masks and physical distancing, as well as digital and manual contact tracing.