An epidemic's electronic eyes

Around 3180 BCE during Egypt's First Dynasty, "a great pestilence occurred," an epidemic considered the first recorded in human history. Yet little else is known about the undetermined plague that likely killed thousands. Centuries later, as other contagions struck Egypt and elsewhere, record keepers started identifying possible factors leading to outbreaks, such as widespread drought.

In fits and starts, the recording, tracking, analysis, and use of data to chronicle devastating epidemics—the Plague of Justinian starting in 541 CE, the Black Death in the 14th century, and the 1918 influenza pandemic, to name a few—have fostered an artful science known as public health surveillance. How else would we know that more than 150 million people died during those three major scourges, or that the influenza virus strain in 1918 traveled via U.S. military personnel between camps and over the Atlantic?

Technological tools, from rudimentary to advanced, have helped humans track these outbreaks and try to halt transmission. During the Great Plague of London in the mid-1660s, church parish clerks recorded and posted weekly Bills of Mortality, listing causes of death for a fearful and fascinated public. In later centuries, disease detecting evolved, from cards filled out by physicians in the 1800s to report cases of smallpox, to computer databases and integrated online repositories for Ebola, SARS, and several deadly strains of influenza.

Today, a potentially powerful tool to track a pandemic rests in your grasp—the smartphone.

Since the last major pandemic struck the United States—the 2009 H1N1 influenza—the ability to collect and synthesize data has exploded via our ubiquitous phones. (The first iPhone was sold in 2007, and by 2019 Apple had sold 2.2 billion.) In just a decade, a firehose of mobile applications, predictive algorithms, and shared social media platforms has altered societies, allowing the wider world to learn how humans move about and think via our posts, buying habits, and GPS locations.

In 2020, as the COVID-19 pandemic grips the world, various digital tools for public health surveillance have exploded Cambrian-like, creating new disease control opportunities and ethical challenges, all played out on an uncharted battlefield. The ancient specter of a plague has met the app. And now, on top of breaking news alerts and Instagram likes, your phone could ping when you come near an infectious disease carrier.

So far, this digital contact tracing tech is far from perfect and has not been widely adopted by users. Glitches and quality issues abound, and in an era when concerns about big data are already high, the use of digital technologies has also sparked concerns about privacy, medical confidentiality, and possible violations of civil liberties, including the "mission creep" of long-term government surveillance.

"Digital contact tracing wasn't a technology that's been widely used for public health response to epidemics before COVID-19," says Crystal Watson, a senior scholar at the Johns Hopkins Center for Health Security and lead author of a robust national plan on comprehensive contact tracing in the U.S. "We're so early in this phase that it's hard to understand what impact [these apps are] going to have, both good or bad. But I do think it's worth taking the time to develop, investigate, and fine-tune because they'll hopefully be of use, not just during COVID-19 but also for future epidemics and pandemics."

Short of a widely available vaccine, contact tracing and testing—and prevention measures such as physical distancing, stay-at-home orders, and wearing masks—remain the best bets to get the pandemic under control. Yet rolling out in front of us is a wave of digital tools created to possibly stem the COVID-19 tide. A natural experiment is unfolding, a real-time test to determine whether such tools are effective, legal, or ethical.

The premise is simple. Digital contact tracing apps use GPS or Bluetooth technologies to notify smartphone owners of possible exposure to someone who has tested positive for COVID-19. In an unprecedented move, Apple and Google in late spring teamed up to launch a system that would allow iOS and Android users to download Bluetooth-based digital contact tracing apps, also offering location privacy measures, such as anonymous or rotating phone identifiers. So, if a smartphone owner has the phone app, also known as a proximity app, they would be notified if someone within 6 feet of them, say at a Starbucks or a family gathering, has shared (also via an app) that they've tested positive. Nobody has to point to Uncle Bob as the carrier, or that teen buying the almond milk latte. The apps could possibly also send the data to public health departments, or advise the person to call their doctor, get tested, or isolate at home.

Such technologies are currently evolving worldwide, with a patchwork of government-, university-, and business-created apps being deployed with names like TraceTogether, Stanford University's COVID-19 Watch, and MIT's Private Kit: Safe Paths. The European Union is pursuing, albeit more slowly, a standardized platform with the elongated moniker: Pan-European Privacy-Preserving Proximity Tracing. These apps could prove effective at preventing the spread of COVID-19 only if more people download and use them, experts say. With such reliance on widespread adoption, the tech likely has a questionable future, especially in the U.S. In a recent poll, more than seven in 10 Americans said they would not download the apps owing in part to privacy concerns. Even so, by mid-August, some states such as North Dakota, Wyoming, and Alabama, had launched exposure apps for their residents. More than 316,000 people have already downloaded Virginia's app, COVIDWISE.

Apple and Google recently also teamed up to create a digital exposure notification tool so that authorities won't necessarily need to create their own apps. The upgrade, called Exposure Notifications Express, might help streamline the digital contact tracing process. Yet some basic questions also persist as to their effectiveness, such as whether being close to someone translates as a virus exposure. For example, Bluetooth sometimes can make "contact" through thin walls. The person in the apartment next to yours might have tested positive for COVID-19, but that doesn't mean you've been exposed.

Meanwhile, there's a plethora of other pandemic-born digital interventions on the way. Private companies are promoting not-yet-proven virus screening tech, including "immunity passports," a digital certificate (perhaps via a QR code) that would identify whether a person has tested positive for antibodies to the virus and might be clear to, say, enter a building (though the accuracy of antibody tests, and level of immunity, remains unclear). Estonian tech firms are testing an immunity passport system, and the nation of Chile has been planning one. But some experts also worry about creating a so-called antibody elite class that could travel anywhere. Meanwhile, companies such as software firm Salesforce, which launched Work.com, offer a palette of digital options including mapping office locations visited by COVID-19-infected employees to identify possible points of transmission. Others, such as ReturnSafe, tout physical distancing apps or bracelets that beep or vibrate alerts if someone violates 6-foot physical distancing rules.

Yet does this mean algorithms or AI will decide who is allowed to go to work, enter a restaurant, or attend school? Building owners in Midtown Manhattan have been developing an app for office tenants to monitor and "score" fellow workers' compliance with physical distancing, as reported by The Wall Street Journal in a May article titled "Welcome Back to the Office. Your Every Move Will Be Watched."

Resistance to various pandemic-related tech has started cropping up. Oakland University, in Rochester, Michigan, backed off requiring students who will live in dorms this fall to wear a health-tracking device, after students launched a petition. Called BioButton, the device would monitor a wearer's vitals, such as heart rate.

In many ways, COVID-19 has created a testing ground for a digitalized public health tableau. It's unclear how well such efforts would reduce the spread or impact of COVID-19, though some nations more open to new technology interventions are among those with the best outcomes, according to a recent viewpoint article in The Lancet. For example, Germany has employed various digital tech in its pandemic response, including a voluntary smartwatch app, translated as Corona Digital Donation, that can collect data such as a person's pulse, temperature, and sleep patterns to "screen for signs of viral illness." Germany, which has followed stringent lockdowns and testing and tracing protocols, has maintained "a low per capita mortality rate, relative to other countries, despite a high prevalence of cases," notes the June 29 Lancet article.

In other scenarios, technologies might not be ready for pandemic prime time. Thermal cameras being used at airports and elsewhere, including to test patrons and workers for fevers at restaurants, might prove less helpful since people infected with COVID-19 can experience no symptoms, and the readings are often inaccurate.

Jeffrey Kahn, director of the Johns Hopkins Berman Institute of Bioethics, says the American public might simply not have the stomach for versions of an intrusive, even if well-intentioned, Big Brother. "We have a cultural expectation that we won't be spied upon," Kahn says. "We like our privacy and expect to be asked."

Kahn says there's a balance to be struck between the values of the public and the goals of public health. "There's the performance of the technology: Does it work? Does it provide information to public health to support contact tracing? Will people use it and will it be pushed onto people's phones?" he says. "The public cares about the use of that data that's collected, which may be serving public health goals, but there's also concern that it could be used for surveillance by the state. All of those pieces are part of the answer of what is ethically challenging."

To provide guidance, Kahn led the creation of an in-depth report offering recommendations for governments, tech developers, business owners, education leaders, and the public: Digital Contact Tracing for Pandemic Response. The downloadable book—which includes input from public health experts at the Center for Health Security and worldwide—explores ethical, legal, and policy issues. Among primary recommendations: Privacy, while important, shouldn't outweigh public health goals; technologies should adapt based on new evidence and public priorities; and big tech companies "should not unilaterally set terms when such broad public interests are at stake."

Some tech developers are aggressively marketing potential products. New York–based Clearview AI announced it was negotiating with federal and state agencies to deploy its controversial facial recognition technology to identify and trace people who test positive for COVID-19, possibly to enforce quarantines. Details on how that would work have not yet been determined, though Clearview has built a biometric database of more than 3 billion images, many "scraped" from social media. The company's claim drew the attention of the U.S. Congress, where various bills now address personal privacy protections in this new digital realm. Sen. Edward Markey, a Democrat from Massachusetts, in a letter to the CEO of Clearview AI questioned the company's lack of disclosure on "error rates for false matches and people of color," as well as proof the technology is free of "technological flaws." In a later tweet, Markey wrote: "We can't let the need for COVID contact tracing be used as cover by companies like Clearview to build shadowy surveillance networks."

In the past, contact tracing itself has met with occasional privacy concerns, especially for those diagnosed with highly infectious diseases, such as tuberculosis or sexually transmitted diseases, such as syphilis or HIV. "Disease provokes enormous fear. Dread of sickness and death is often matched by anxiety about the loss of privacy, which can place one's reputation, resources, and even autonomy and liberty at risk," notes Amy L. Fairchild, former Columbia University faculty member and now dean at Ohio State University's College of Public Health, in Searching Eyes: Privacy, the State, and Disease Surveillance in America (University of California Press, 2007). "These two deeply rooted apprehensions come together as the state seeks to monitor diseases in the name of the public's health."

Even with the advent of digital tools, experts say that human-based contact tracing will remain necessary. To understand how to improve new technologies, it's best to understand how the practice evolved as the gold-standard public health strategy to prevent the spread of infectious diseases. In the 1920s, public health representatives started reaching out to people who tested positive for a communicable disease, at first mostly tuberculosis and syphilis. During a telephone call or visit, a public health representative informs the individual of a positive test result, checks in on health symptoms, discusses the availability of resources, and asks for the names and phone numbers for people they visited or spent time with. Contact tracers then reach out to those people to suggest they quarantine themselves, get tested, access treatments, or otherwise change their behaviors to cut off new branches of infections. A contact tracer is part social worker, investigator, and empathetic listener—often checking in on cases over days and even weeks. Overall, it's a time-consuming process, and delays in testing results and public resistance have impeded recent efforts during the COVID-19 pandemic.

New digital tools could help tracers reach a wider range of people more quickly. Over the past few months, public health experts have met with tech representatives to communicate their needs and priorities. In a virtual panel discussion hosted in May by the Open Technology Institute at the think tank New America, Ali Lange, a public policy manager at Google, acknowledged the hurdles. "Technology solutions are not necessarily a silver bullet, I think that's widely understood, but rather one tool we think can help scale-up under these exceptional circumstances," Lange says. "COVID-19 can be addressed, but we do need guardrails; there's a real sense of a need for guidance and sense of doing the right thing, and knowing what that is."

Some of this depends on cultural priorities. In some countries, such as South Korea and China, existing centralized government systems have access to individuals' personal digital data, such as ID numbers, phone GPS data, and credit card records, which can be used to keep tabs on disease cases and send push notifications to possible contacts. In democratic South Korea, which has recorded only a few hundred COVID-19 deaths, infected people who violate quarantine are required to wear location-tracking bracelets.

Some digital tech is less controversial, such as personal symptom survey apps and health department text notifications to arrange phone calls with people who have tested positive for COVID-19, as outlined by the Centers for Disease Control and Prevention. Emily Gurley, associate scientist in epidemiology and international health at Hopkins' Bloomberg School, led the development of a free Coursera contact tracing course that launched in May with more than 500,000 enrollments by midsummer. She notes simple phone texts can gently remind people to stay quarantined or list food delivery services. Infected people could report daily fever readings via their phone. "Recording a fever can be done in an automated fashion, and that saves time and allows contact tracers to spend time finding new contacts," Gurley says in a course lesson. "Some people also find that less invasive than receiving a phone call every day. And if symptoms are worsening and they want to talk to somebody, that can be integrated into the system. We have to look for all the possible ways we can do this better. Contact tracing is such an important activity for slowing the spread."

Recent public focus on still-developing apps can also prove a distraction at a critical time, when more than 100,000 human contact tracers have been needed amid a spiraling pandemic. "I'm not convinced the [contact tracing] apps are quite there yet. Whenever we are adapting a new tool we need to be clear on the problem we are trying to solve and just make sure the solution to that problem doesn't cause other problems," Gurley points out. "Making decisions is a bad idea if you have no data to show how effective something is."

For individuals, even successful digital tools would prove helpful only to those who have digital devices, as well as updated Bluetooth and other tech, raising questions about equitable access. "More people in wealthier communities have smartphones and are connected. These areas could receive more monitoring and, potentially, resources—placing rural and poverty areas in jeopardy," says Stacey B. Lee, associate professor in the Johns Hopkins Carey Business School and a faculty member in Health Policy and Management at the Bloomberg School. "This could not only perpetuate a type of bias but sabotage the effectiveness of interventions."

Among equity efforts, public health experts are pressing localities to support wider access to WiFi and digital devices in lower-income neighborhoods, and health departments are working to expand human-based contact tracing and disease prevention education efforts in those communities.

Meanwhile, privacy parameters and legal concerns continue to be hashed out. Among the concerns, for example: Should a digital contact tracing app disclose an infected person's location data, and if so, how? Apple and Google have resisted location identifiers, citing privacy protections for users. Yet knowing where someone has gone and with whom allows contact tracers to know who else might have been exposed. Either way, experts say, any identifying data should be limited to public health practitioners. Notes Watson: "Public health is very practiced at keeping people's information private, and they're working for the community."

With new COVID-19 mitigation tools cropping up in the private sector, as businesses and institutions try to protect their employees and students, some approaches might be legal, but are they feasible or ethical? "Private employers are within their rights to require employees to download contact tracing apps as a condition of employment," says Lee, who specializes in law and ethics at Carey. "Practical challenges include whether employees would actively review health data, install updates, or act on information provided by the app. [And] employees would need to consent to give their employer either access to the information gathered by the app or to inform their employer when there is an alert."

Other questions have been raised about sharing one's private health data with an employer, who might consider the worker a health insurance risk down the road. An app called Check-In, created by consulting powerhouse PricewaterhouseCoopers, would request health data from employees. PwC also promotes its tech as a way to "keep high-risk employees and contractors away from your workplace."

Then there's what happens after one leaves the office. "While an employer could require installing an app, and surveil an employee while at work, the right to conduct off-duty tracing is questionable. Monitoring off-duty conduct may be prohibited by state GPS tracking and off-duty conduct and privacy laws," Lee adds, posing a scenario: Consider a registered nurse who goes to a crowded bar in another state, violating safety guidelines. Would they be tracked there via location data? What would be the repercussions?

"We are perhaps looking for an easy tech fix to a problem that requires PPE, making sure tests are available, making sure people can care for the elderly and children who may have been affected, and other changes in behavior," Lee says. An app or tool "designed by Apple and Google can't accomplish these necessary things."

Overall, public health experts say that people don't necessarily need to give up their individual rights for the common good. Safeguards can be put into place, as noted in the Digital Contact Tracing for Pandemic Response report. For example: Such technologies should be voluntary, not mandatory, with opt-ins allowing people to share data with public health authorities.

"We do care a lot about privacy in our country, but we also, I think, at this point are realizing there are other values at stake than our privacy, which are about getting us out of our sheltering in place," including back to workplaces, classrooms, and our daily lives, Kahn recently said in a Bloomberg School Public Health on Call podcast. "Especially when people can't work from home, there is a very strong value in being able to earn an income and feed your family and pay for your rent."

The ACLU, Electronic Frontier Foundation, Amnesty International, and Human Rights Watch, which support pandemic-fighting efforts, have also called for governance principles to protect human rights, including being transparent as to how health data is used and stored, ensuring any apps are voluntary, limiting data collection to public health authorities, and ending access to such data via a "sunset clause," among other guidelines.

In the end, with the central role digital tech already plays in our lives, especially for new generations, public health might have to adapt and help guide such technologies. Says Gurley: "Just because you have one pandemic doesn't change the risk profile for any future pandemics unless we actually learn some of the lessons and really invest in getting better."

Editor's note: The print version of this article was published before Apple and Google released Exposure Notifications Express. This version has been updated to include the news. This version also updates a related reference in statements made by Stacey B. Lee.