This spring, as the U.S. government spun its wheels on an official covid-19 response, countries around the world were rolling out national contact tracing apps. Starting with Singapore in mid-March, more than 40 countries have launched digital exposure notification systems, with varying degrees of success.
Our Covid tracking tracker records each country’s application and technologies used, noting privacy considerations and giving each a transparency rating. We regularly update the tracking tool to document changes, for example after discovery that several countries have rolled back privacy protections. Other changes include countries whose apps have been suspended, relaunched or replaced.
The Iranian AC19 app, which claimed to detect covid-19 infections but was in fact spying on users, has been banned from the Google Play Store and no longer appears to be in use. During this time, the Japanese app has been suspended at least twice because of problems. The country plans to allow entry to overseas travelers for the delayed Tokyo Olympics as long as they show negative covid-19 tests and download tracing apps.
Some other countries initially developed their own systems, but switched to the Google / Apple notification system once it became available. Norway has just relaunched a new app with the same name as the original, after fixing privacy concerns and switching to the Google / Apple framework. The Finnish pilot application at the start of the year has also been replaced by an application using this technology. Similarly in the UK, an initial trial application was discarded after discovering problems detecting iPhones nearby; it was replaced by a Google / Apple system in September. (The new system also encountered issues: in November, it was reported that the app did not notify users to be isolated after coming into contact with infected people.)
For each application, we document who produces it and where it is available. We also ask five questions, guided by principles offered by the American Civil Liberties Union.
- Is it voluntary? In some cases apps are opt-in, but in other places many or all citizens are forced to download and use them.
- Are there any limits on how the data is used? The data can sometimes be used for purposes other than public health, such as law enforcement – and those uses can outlast covid-19.
- Will the data be destroyed after a while? The data collected by apps shouldn’t last forever. If it is automatically deleted within a reasonable period of time (usually a maximum of around 30 days) or if the app allows users to manually delete their own data, we will assign a star.
- Is data collection minimized? Does the app only collect the information it needs to do what it says?
- Is the effort transparent? Transparency can take the form of clear and publicly accessible policies and designs, an open source codebase, or all of these.
For each question, if we can answer yes, the app gets a star. If we cannot answer yes – either because the answer is no or because it is unknown – the note is left blank. There is also a field for notes which can help put things in context.
Additionally, we document the basic technology behind the application. Here is an explanation of key terms.
- Location: Some apps identify a person’s contacts by tracking the movements of the phone (for example, using GPS or triangulating nearby cell towers) and finding other phones that have spent time at the phone. same place.
- Bluetooth: Some systems use “proximity tracking”, in which phones exchange encrypted tokens with other nearby phones via Bluetooth. This information is easier to anonymize and generally considered to be better for privacy than location tracking.
- Google / Apple: Many applications are based on a system jointly developed by Google and Apple. It allows iOS and Android phones to communicate with each other over Bluetooth, allowing developers to create a contact tracing app that will work for both. The exposure notification function is now integrated directly into some smartphone operating systems.
- DP-3T: This means decentralized proximity tracing preserving confidentiality. This is an open source protocol for Bluetooth based tracking in which an individual phone’s contact logs are only stored locally, so no central authority can know who has been exposed.
A public version of the underlying data is kept in a tab of this read-only worksheet. If you have a update, correction or addition to the tracker, please email us the relevant information at CTT@technologyreview.com.
This story is part of the Pandemic Technology Project, supported by the Rockefeller Foundation.