How Big Tech is dictating the terms of the coronavirus response to national governments

Source: The Verge

April 28 2020

By Casey Newton

Apple’s operating-system policy reportedly forced a change to a German contact-tracing scheme.

On Monday the six Bay Area counties announced that they would extend stay-at-home orders through May, citing ongoing difficulties in preparing for future spikes in new cases. A prominent question as elected officials attempt to govern through the next several months is to what extent they will rely on technology solutions to help them identify possible infections. Over the weekend, we saw a variety of ideas on this subject begin to play out around the world.

First, Apple and Google announced some changes to their collaboration on a system-level API for public health authorities, which will use people’s smartphones to inform them when they have been in the presence of someone who is later diagnosed with COVID-19. The changes are largely meant to address privacy concerns, but to me they’re most notable for a change in terminology. Instead of “contact tracing,” the companies are now referring to their project as an “exposure notification” system. I had previously argued here that Bluetooth-based solutions were unlikely to be effective for real contact tracing, which requires human beings to track down leads. But “exposure notification” seems like something these companies are well suited to do, and I’m glad they’re now thinking about it in those terms.

One country that has been persuaded of the companies’ approach is famously privacy-conscious Germany. Germans were instrumental in devising the (tongue twister alert) Pan-European Privacy-Preserving Proximity Tracing project, an effort to do exposure notification in a way that protected citizens from their governments. But the project would have required operating system-level changes to Apple’s iOS by making Bluetooth available to public-health apps that sought to process exposure notifications on a central server controlled by the government.

For privacy reasons, Apple said no, and now Germany has signed on with Apple’s system. Here are Douglas Busvine and Andreas Rinke in Reuters:

Germany changed course on Sunday over which type of smartphone technology it wanted to use to trace coronavirus infections, backing an approach supported by Apple and Google along with a growing number of other European countries. [...]

Germany as recently as Friday backed a centralised standard called Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT), which would have needed Apple in particular to change the settings on its iPhones. When Apple refused to budge there was no alternative but to change course, said a senior government source.

(As an aside, the idea that we live in a time where Apple is telling Europe what forms of exposure notification will be permitted is basically the entire thesis behind / pitch for the existence of this newsletter. Not because I believe Apple abused its power, but because the world is still catching up to the idea that Apple and a handful other tech giants have this power.)

England, on the other hand, has said to hell with it. The country’s National Health Service is developing its own contact-tracing app that it says will work even when it is in the background and the screen is off, a limitation that has stymied other such apps. The reason it is developing its own app is so that it can process exposure notifications on its own server — the thing that Apple declined to implement for Germany at the operating system level. Here’s Leo Kellion reporting for the BBC:


“Engineers have met several core challenges for the app to meet public health needs and support detection of contact events sufficiently well, including when the app is in the background, without excessively affecting battery life,” said a spokeswoman for NHSX, the health service’s digital innovation unit. [...]

It has opted for a “centralised model” to achieve this - meaning that the matching process, which works out which phones to send alerts to - happens on a computer server. This contrasts with Apple and Google’s “decentralised” approach - where the matches take place on users’ handsets.

The NHS says it will be easier to notify people believed to be infected using a centralized approach. We’ll see! Meanwhile, Australia says 1 million people have downloaded its own contact-tracing app, COVIDSafe, which also uses a centralized approach. The app is based on Singapore’s open-source TraceTogether app, whose effectiveness at exposure notification is somewhat under dispute. (Not least because only a small minority of the population is using it.)

Western approaches to exposure notification continue to be rooted in privacy fears, but that’s not the case everywhere. Last month, Israel’s internal service, the Shin Bet, was granted emergency powers to track confirmed cases of COVID-19 and analyze patients’ movements to aid in contact tracing. It reportedly marked the first time Israel had used technology built for counterterrorism purposes for civilian uses.

But Israelis have their privacy sensitivities, too. On Sunday, Israel’s top court ruled that if the Shin Bet wishes to continue the practice, it will need to be explicitly permitted in legislation.

It was a weirdly rare reminder that, while so much of the pandemic response has focused on technology — on testing and tracing — lawmakers have a role to play, too.