Experts push decentralised Covid19 apps to gain trust

"Deciding on models that are not clear is not something we should do on policymaking," said on the deputy director of the commission's directorate-general for communications networks and technology, Khalil Rouhana, in a videoconference Friday (24 April).

Yet, there seems to be an international consensus in favour of the decentralised approach.

A group of privacy-minded academics recently developed a fully-decentralised solution (DP3T) for coronavirus contact-tracing apps that keeps data on the user's handset - instead of sending it to a centralised database run by, for example, public health authorities.

Google and Apple have also teamed up to develop a decentralised framework for contact-tracing to allow developers to build Covid-19 tracing apps.

"The Google-Apple framework, inspired by DP3T, offers the best privacy-preserving solution while, at the same time, it offers a lot of flexibility, because the app is built by member states and public health authorities," said the vice president for engineering at Google, Dave Burke.

Both systems have a very similar structure and use bluetooth to track who has been in contact with coronavirus patients since this technology does not reveal the user's identity or location data.

However, according to Michael Veale, co-developer of the DP3T solution, certain risks apply to all bluetooth contact-tracing solutions (decentralised or not).

For example, if the building where a person lives has a very thin wall the system could interpret that this person has been in contact with his or her neighbour when this has not happened.

"This is because bluetooth has not been designed by epidemiologists," said Veale, adding that his colleagues are still working on possible solutions to minimise these technical problems.

No trust?

Conversely, a group of academics and businesses have developed the PEPP-PT (Pan-European Privacy-Preserving Proximity Tracing) which seems to have opted for a centralised approach - and it is currently being implemented by German and Italian governments.

Also, the European People's Party (EPP) group recently mentioned this solution as one of "the technical possibilities to collect data anonymously and in accordance with existing EU data protection".

However, nearly 300 leading academics warned in an open letter that centralised contact-tracing apps can enable "unwarranted discrimination and surveillance", following the release of a report over PEPP-PT's concerns.

According to Gary Davis, who is the global director of privacy & law enforcement requests at Apple, "it is encouraging that a lot of academics support the DP3T model because it is support for the decentralised system which hopefully is the one that will encourage the user adoption, what it is required to make it [the apps] effective".

However, the fact that a centralised system can be misused is likely to undermine the uptake of the use of this technology, although its effectiveness is still not conclusive for many privacy advocates.

High contagion, many asymptomatic

"There is little evidence available today that would indicate that contact-tracing apps would help curve the spread of the virus. In the context of Covid-19, it is quite difficult to trace contact because this virus involves a high rate of contagion and many infected patients are asymptomatic," warned Estelle Mass, a senior policy analyst at NGO Access Now.

"We always must consider the long-term of any decision that is taken during this crisis. When some technologies are deployed is very difficult or, in some cases, impossible to go back," she added.

Liberal MEP Sophie in 't Veld, from the parliament's committee on civil liberties, has called on the commission to develop a clear legislative framework in addition to the guidelines already announced.

"This [issue] is not only about privacy and data protection, but it is also about harmonisation, interoperability and field of play for providers, among other things," she said.

Additionally, MEPs are expected to discuss the ethical and practical implications of coronavirus contact-tracing apps during the plenary in May.