People proving to be weakest link for apps tracking COVID exposure

Reviewed by Emily Henderson, B.Sc.Nov 19 2020

The app builders had planned for pranksters, ensuring that only people with verified COVID-19 cases could trigger an alert. They'd planned for heavy criticism about privacy, in many cases making the features as bare-bones as possible. But, as more states roll out smartphone contact-tracing technology, other challenges are emerging. Namely, human nature.

The problem starts with downloads. Stefano Tessaro calls it the "chicken-and-egg" issue: The system works only if a lot of people buy into it, but people will buy into it only if they know it works.

"Accuracy of the system ends up increasing trust, but it is trust that increases adoptions, which in turn increases accuracy," Tessaro, a computer scientist at the University of Washington who was involved in creating that state's forthcoming contact-tracing app, said in a lecture last month.

In other parts of the world, people are taking that necessary leap of faith. Ireland and Switzerland, touting some of the highest uptake rates, report more than 20% of their populations use a contact-tracing app.

Americans seem not so hot on the idea. As with much of the U.S. response to the pandemic, this country hasn't had a national strategy. So it's up to states. And only about a dozen, including the recent addition of Colorado, have launched the smartphone feature, which sends users a notification if they've crossed paths with another app user who later tests positive for COVID-19.

Within those few states, enthusiasm appears dim. In Wyoming, Alabama and North Dakota, some of the few states with usage data beyond initial downloads, under 3% of the population is using the app.

The service, built by Google and Apple and adapted by individual countries, states or territories, either appears as a downloadable app or as a setting, depending on the state and the device. It uses Bluetooth to identify other phones using the app within about 6 feet for more than 15 minutes. If a user tests positive for COVID-19, they're given a verification code to input so that each contact can be notified they were potentially exposed. The person's identity is shielded, as are those of the people notified.

"The more people who add their phone to the fight against COVID, the more protection we all get. Everyone should do it," Sarah Tuneberg, who leads Colorado's test and containment effort, told reporters on Oct. 29. "The sky’s the limit. Or the population is the limit, really."

But the population could prove to be quite a limit. Data from early-adopter governments suggests even those who download the app and use it might not follow directions at the most critical juncture.

According to the Virginia Health Department, from August to November, about 613 app users tested positive and received a code to alert their contacts that they may have exposed them to the virus. About 60% of them actually activated it.

In North Dakota, where the outbreak is so big that human contact tracers can't keep up, the data is even more dire. In October, about 90 people tested positive and received the codes required to alert their contacts. Only about 30% did so.

Researchers in Dublin tracking app usage in 33 regions around the world have encountered echoes of the same issue. In October, they wrote that in parts of Europe fewer people were alerting their contacts than expected, given the scale of the outbreaks and the number of active app users. Italy and Poland ranked lowest. There, they estimated, just 10% of the app users they'd expect were submitting the codes necessary to warn others.

"I’m not sure that anybody working in this field had foreseen that that could be a problem," said Lucie Abeler-Dörner, part of a team at the Big Data Institute at Oxford studying COVID-19 interventions, including digital contact tracing. "Everybody just assumed that if you sign up for a voluntary app … why would you then not push that button?"

So far, people in the field only have guesses. Abeler-Dörner wonders how much of it has to do with people going into panic mode when they find out they're positive.

Tessaro, the University of Washington computer scientist, asks if the health officials who provide the code need more training on how to provide clear instructions to users.

Elissa Redmiles, a faculty member at the Max Planck Institute for Software Systems who is studying what drives people to install contact-tracing apps, worries that people may have difficulty inputting their test results.

But Tim Brookins, a Microsoft engineer who developed North Dakota's contact-tracing app as a volunteer, has a bleaker outlook.

"There’s a general belief that some people want to load the app so that they can be notified if someone else was positive, in a self-serving way," he said. "But if they’re positive, they don’t want to take the time."

Abeler-Dörner called the voluntary notification a design flaw and said the alerts should instead be automatically triggered.

Even with the limitations of the apps, the technology can help identify new COVID cases. In Switzerland, researchers looked at data from two studies of contact-tracing app users. They wrote in a not-yet-peer-reviewed paper that while only 13% of people with confirmed cases in Switzerland used the app to alert their contacts from July to September, that prompted about 1,700 people who had potentially been exposed to call a dedicated hotline for help. And of those, at least 41 people discovered they were, indeed, positive for COVID-19.

In the U.S., another non-peer-reviewed modeling study from Google and Oxford University looking at three Washington state counties found that even if only 15% of the population uses a contact-tracing app, it could lead to a drop in COVID-19 infections and deaths. Abeler-Dörner, a study co-author, said the findings could be applicable elsewhere, in broad strokes.

"It will avert infections," she said. "If it's 200 or 1,000 and it prevents 10 deaths, it's probably worth it."

That may be true even at low adoption rates if the app users are clustered in certain communities, as opposed to being scattered evenly across the state. But prioritizing privacy has required health departments to forgo the very data that would let them know if users are near one another. While an app in the United Kingdom asks users for the first few digits of their postal code, very few U.S. states can tell if users are in the same community.

Some exceptions include North Dakota, Wyoming and Arizona, which allow app users to select an affiliation with a college or university. At the University of Arizona, enough people are using the app that about 27% of people contacted by campus contact tracers said they'd already been notified of a possible exposure. Brookins of Microsoft, who created Care19 Alert, the app used in Wyoming and North Dakota, said that offering an affiliation option also allows people who've been exposed to get campus-specific instructions on where to get tested and what to do next.

"In theory, we can add businesses," he said. "It’s so polarizing, no businesses have wanted to sign up, honestly."

The privacy-focused design also means researchers don't have what they need to prove the apps' usefulness and therefore encourage higher adoption.

"Here there is actually some irony because the fact that we are designing this solution with privacy in mind somehow prevents us from accurately assessing whether the system works as it should," Tessaro said.

In states including Colorado, Virginia and Nevada, the embedded privacy protections mean no one knows who has enabled the contact-tracing technology. Are they people who barely interact with anyone, or are they essential workers, interacting regularly with many people that human contact tracers would never be able to reach? Are they crossing paths and trading signals with other app users or, if they test positive, will their warning fall silently like a tree in an empty forest? Will they choose to notify people at all?

Colorado's health department said it's issuing thousands of COVID codes a day. As of Wednesday, 3,400 people have used the codes to notify their contacts, it said. An automated system issues codes for positive COVID-19 tests even if the infected people don’t have the app, making it impossible to know how many users are acting on the codes.

"I have hope that the vast majority of Coloradans will take this opportunity to give this gift of exposure notification to other people," said Tuneberg. "I believe Coloradans will do it."