Mitch Leslie

Senior Technology Writer

In July and early August 2020, a total of 137 people in Ireland received warnings that they had potentially been exposed to the coronavirus that causes coronavirus disease 2019 (COVID-19) [1].The bad news came not from a doctor or public health worker,but from a cell phone app they had downloaded that tracks close contacts between individuals (Fig. 1).

Ireland is one of about 50 countries—including France,Germany, Brazil, Japan, and India—to have launched an app that alerts people who have potentially been infected by the virus [2].Although the United States does not have a national notification app, several states and at least one county have introduced their own [3,4]. In May 2020, Apple and Google unveiled software they jointly created that helps developers build these apps for the iOS and Android operating systems, which run most of the phones in the world [5].

Experts agree that the apps have the potential to help slow the pandemic, encouraging people who may be infected to get tested and possibly take other actions to keep from spreading the disease.Although the apps will not stop the virus alone, they could be‘‘a(chǎn)nother tool in the prevention toolbox,” said Jeffrey Klausner, a professor of infectious diseases at the David Geffen School of Medicine at the University of California, Los Angeles. However,technical,privacy,and security problems have hampered the apps[6], and whether they have made an impact on the COVID-19 pandemic remains unclear [7].

Fig. 1. Ireland’s COVID tracker, released on 7 July 2020, has been one of the most successful contract tracing apps. About 37% of Ireland’s population downloaded it;in its first month of operation,a total of 137 people received notifications that they may have been exposed to the coronavirus. Credit: Marco Vetch (CC BY 2.0).

Governments have turned to the apps to bolster a procedure known as contact tracing [8] that, as Klausner puts it, has been‘‘one of the pillars” of disease control for decades. When someone tests positive,public health workers interview them and document their movements and interactions during the period when they were contagious. The workers can then alert anyone who crossed paths with the infected person and may have contracted the illness from that exposure.

Traditional contact tracing is low-tech—notifications are usually made by phone—and suffers from some limitations.‘‘The process is laborious and time-consuming,” said Swarun Kumar, an assistant professor of electrical and computer engineering at Carnegie Mellon University in Pittsburgh, PA, USA. The procedure may also miss potential exposures,said Alain Labrique,a professor of global disease epidemiology and control at Johns Hopkins University in Baltimore, MD, USA. He notes that an infected person who rides a bus or train may be surrounded by strangers who cannot easily be identified and alerted. During the pandemic, other problems have hindered contact tracing in countries such as the United States, including lack of money for hiring and training tracers,mistrust of government, and reluctance to provide information on contacts [9].

Cell phone apps that automate the process could expedite notification and reach a larger number of at-risk people (Fig. 2).A study published in March 2020 by researchers from the University of Oxford in the United Kingdom calculated that an app that allowed instant notification and prompted self-isolation could dramatically reduce the number of cases or,if enough people downloaded it, stop the disease’s spread [10].

All tracking apps try to determine whether someone has been close to an infected person for long enough to contract the virus.However, the exact time and distance vary from app to app.According to Australia’s COVIDSafe,released in April 2020,remaining within 1.5 m of an infected person for at least 15 min is risky,whereas the cutoffs for the Irish app are 2 m and 15 min [11,12].

Fig. 2. This diagram shows a scheme for digital contact tracing via a cell phone app. (a) A healthy person can continue to work and commute; (b) when that person tests positive, her contacts receive cell phone alerts to get tested. Credit: Wikimedia Commons (CC BY 4.0).

The apps follow two procedures for handling data and pinpointing opportunities for transmission [13]. With centralized apps,including those implemented in Singapore, Iceland, Australia, and France, a government server collects user data and determines who may have been exposed and needs to be alerted. In contrast,decentralized apps, such as those deployed by Switzerland,Germany, and the US state of Virginia, rely on users’ phones to record the anonymized identities of cell phones that have come within a certain distance[13,14].The apps flag possible exposures by comparing that register to a list of users who have tested positive. Decentralized apps do not share personal information,although some allow governments to gather some data, such as the number of users who receive alerts[7].All apps developed with the Apple and Google software are decentralized.

Which type of app is more useful has been a matter of debate[14]. However, centralized apps are controversial in many countries because of fears that the data could be misused by governments, leaked, or stolen [15]. Privacy concerns drove Norway to shut down its centralized app [6] and have influenced choices by other countries, said Kumar. ‘‘There’s been a global trend towards more decentralized approaches to contact tracing instead of the centralized approaches that were first to roll out.”

To uncover close encounters that could allow viral transmission, the apps enlist Global Positioning System (GPS), Bluetooth,or a combination of the two [16]. Both mechanisms have downsides. GPS can pinpoint an individual’s location and reveal if anyone who tested positive for the disease was nearby. However,GPS is accurate outdoors only to within about 3 m, and its performance indoors is much worse, said Kumar.In addition, GPS-based apps raise more serious privacy concerns because they gather specific information about people’s movements, he said.

Most apps—including the ones incorporating the Apple and Google software—depend on Bluetooth. They do not determine users’ locations. Instead, a user’s phone assesses the strength of Bluetooth signals from other phones with the app to gauge how far away their owners are [17]. Overall, proximity estimates from Bluetooth ‘‘a(chǎn)re more robust” than with GPS-based apps, said Kumar. But objects in the environment can disrupt Bluetooth signals and produce misleading results [18,19]. Bluetooth can also yield false positives.For example,an app could warn that two people had been dangerously close even if they were in neighboring apartments, Kumar said.

The question now is whether contact tracing apps can reduce coronavirus transmission. A key factor, Labrique said, is uptake,or the fraction of the population that uses them. Hundreds of millions of people now have the apps on their phones—India’s Aarogya Setu has been downloaded more than 124 million times[20].What fraction of the population needs to use the apps to make them effective remains unclear, but the uptake rate in many countries is low[21].Although Qatar,where app use is mandatory,achieved more than 91%adoption[21], the highest level in countries where the apps are voluntary has been 40%in Iceland[22].In contrast,the uptake rate is around 20% in Germany [23] and about 7% in Italy[21]. Some potentially infected people will receive notifications even at low levels of adoption, but the number will be small[24].France’s StopCovid,released in June 2020,provides an example.During its first three weeks of operation,the app had an uptake rate of about 3%,and it caught only 14 instances of possible transmission [25].

Poor choices by designers and governments have led to technical flaws and security foul-ups that make the apps less powerful and may scare off potential users. Countries such as Australia that created centralized systems and did not have access to the Google and Apple software found that their apps often did not work properly while in the background or when the screen was locked—and thus may have missed potential exposures [25]. Privacy breaches have also divulged personal details. Without users’ permission, the Care19 app from the US state of North Dakota, one of the first released in the country,passed on information to Google and a company that provides location data to advertisers [26].

The apps also face other obstacles.Human behavior is one,said Labrique.For example,most apps rely on people who test positive to report their results to the tracking system.Yet many individuals may be reluctant because of embarrassment, fear of losing their job, and other reasons, he said. Scarcity of tests and delays in delivering the results—problems that have been rife in the United States [27]—have also undermined the apps, Kumar noted.

Despite the large numbers of downloads, the apps’ value for combating COVID-19 remains undetermined. No clinical trials have tested whether they reduce virus transmission[28],and their privacy protections mean that many countries lack the data to assess them [7]. Some skeptics dismiss them as worthless [11].Kumar disagrees.‘‘Digital contact tracing is still a very useful tool,”he said.But,he added,it will only have an impact on the disease if enough people have confidence in the apps’ security to download them and if test results are available promptly.