North Dakota is one of the most sparsely populated US states, an expanse of small towns and plains populated by wandering prairie moose, traversed by long straight highways. Despite the rural backdrop, Governor Doug Burgum, a former Microsoft executive, saw digital contact-tracing as key to the state’s coronavirus recovery. With help from an old colleague, Tim Brookins, the state launched Care19, the United States’ first official contact-tracing app.
Just three days later, Google and Apple announced they would develop their own technology “to assist in enabling contact-tracing”. But there was a catch.
To benefit from Google’s and Apple’s operating systems and global reach, all official apps must adhere to the companies’ specifications. If governments wanted to develop an app according to their own rules, they were subject to restrictions.
Speaking over the phone from Fargo, Brookins said he was “annoyed” because the announcement had serious ramifications for Care19. His team always envisioned intertwining two types of technology – GPS and Bluetooth – into one app. But Google and Apple restricted apps that collected GPS or other location data.
When governments clash with Silicon Valley’s vision, most have little option but to comply
In one of their regular meetings with the companies’ representatives, Brookins pointed out how their decision clashed with local strategy: “We had one meeting where we [said] ... the states of South Dakota and North Dakota would like to have location in an app, is it even worth arguing about? And they said: No, these decisions were made at the highest level, we’re not going to change.”
Most contact-tracing apps rely on Bluetooth to work effectively. If Bluetooth is unrestricted, phone users make use of their devices as normal, while their encounters are tracked in the background. Google and Apple have restricted apps’ use of Bluetooth since 2014, when the technology was misused by advertisers. Now, Google and Apple say they will waive these restrictions for official apps – but only for countries that meet their new conditions.
North Dakota is just one small US state, but its frustrations have been echoed around the world. The UK, France and Canada have also alluded to discussions over terms set by Google and Apple for contact-tracing, when the companies refused to relax their rules.
The Correspondent’s Track(ed) Together project is following how countries are heavily reliant on smartphones to track the pandemic. Setting the technical terms for contact-tracing apps has put governments’ dependency on big-tech in the spotlight. When governments clash with Silicon Valley’s vision, most have little option but to comply.
This clash is a result of competing visions over the role smartphones should play in contact tracing. Many governments want to digitise the contact-tracing process via smartphone apps while harvesting data that will allow health authorities to see how the virus is spreading. But Google and Apple prefer their model known as “exposure notification” technology, which offers enhanced protection of users’ privacy. Crucially, under this model, no data about users can be sent to a centralised database. Instead, only users are notified when they may have been exposed to the virus.
New technical limitations signal the extent of a loss of control by governments in the response to this global pandemic
Forcing governments to adhere to a “decentralised” model is controversial. “Even people who are very much in favour of a decentralised model recognise that while it might help individuals to understand whether they’ve been exposed to the virus, it doesn’t really help the epidemiology,” says Emily Taylor, CEO of UK cyber intelligence company, Oxford Information Labs. “States, whether they like Google [and Apple] or not, are going to have to work with them, in order to make sure that the app actually works when a phone has gone to sleep, or it doesn’t completely drain the battery.”
The criteria set by Google and Apple are much more than a mere nuisance for official app developers. At a time when epidemiologists are trying to gather as much data as possible about the spread of the virus, the new technical limitations signal the extent of a loss of control by governments in the response to this global pandemic.
Last month, five European governments signed an open-letter calling for technology companies to allow greater flexibility in the design of national contact-tracing apps.
Their complaints were echoed in a report from about 30 researchers at Johns Hopkins University, which criticised Google and Apple’s "minimalist approach" to data collection. "Too much emphasis on privacy could severely limit the ability to gather information that is critical for effective and efficient contact tracing to help beat the pandemic,” argued Jeffrey Kahn, director of the university’s Berman Institute.
Given the high stakes for public health, technical specifications for contact tracing are now also a matter of sovereignty. Why should big tech companies, with no prior experience in epidemiology or fighting pandemics, set the rules without any consultation or other mechanisms for democratic accountability? And who says the Google-Apple prescription is the best one to be adopted all over the world?
Technology on whose terms?
North Dakota responded to the Google-Apple system by creating two apps. Brookins says that North Dakota’s original will be called “Care 19 diary” and will continue to operate while his team work on a second Bluetooth app, “Care 19 Exposure”, which adheres to the companies’ specifications. “By [Google’s and Apple’s] policy we can’t have one app. We must have two, which we don’t like but that’s their decision and we’re living with it,” he said.
For months the UK has also worked on two apps, while ministers remained undecided on whether its official contact tracing app would be centralised or decentralised. But last week, the country announced it would comply with tech companies’ rules – an acknowledgement that developers are yet to prove they can create an effective Bluetooth app outside the Google-Apple system.
In Singapore, iPhone owners reported that the country’s contact-tracing app, TraceTogether, drained battery power and was impossible to use at the same time as Bluetooth headphones. In response, the country’s foreign minister announced a wearable token system that is not “dependent” on smartphones. In Norway, the government was forced to pull its Smittestopp contact-tracing app, which collected data to a centralised database, after the country’s privacy watchdog decided it was not a proportionate intervention.
Other countries are pursuing homegrown models in spite of privacy concerns and compatibility issues. France launched its centralised StopCovid app in the Google PlayStore at the start of June, following weeks of intense debate. Developers behind Tunisia’s official contact-tracing app, E7mi, say they have been able to work-around the restrictions from Google and Apple by using GPS to detect encounters between iPhones: “The solution proposed by Google and Apple can work fine but in the practical way, it’s not adapted to the Tunisian environment,” said Akil Nagati, CEO of software company Wizz Labs, whose team developed E7mi. The Tunis government wanted to connect data from the app to the national health system and did not believe app users would self-isolate in response to an automatic notification, he added.
Similar concerns have been raised in Latvia. Writing in the Guardian, Ieva Ilves, a digital policy adviser to the country’s president, asked: “Will anyone seriously quarantine themselves for two weeks based on an app notification?” Underlying this question was a deeper, systemic concern about tech governance: “Do Google or Apple get to tell democratically elected governments or its public health institutions what they may or may not have on an app?”
‘In an interesting twist, the tech giants came to be portrayed as greater champions of privacy than some European governments’
Tamar Sharon, associate professor at Radboud University’s Interdisciplinary Hub for Security, Privacy and Data Governance (iHub), is surprised at the reactions: “When Apple and Google launched their contact-tracing API, some of the world’s leading privacy experts applauded this initiative for its privacy-preserving technical specifications. In an interesting twist, the tech giants came to be portrayed as greater champions of privacy than some European governments.”
Sharon sees potentially bigger issues at stake for the outsourcing of public services to the private sector and the translation of digital expertise into political power. “‘The focus on privacy tends to blind us to these issues, and may unwittingly pave the way for these powerful corporations to become indispensable actors in pandemic response management at a global scale,” she said. These trends are creating new dependencies on non-democratically elected actors for the provision of essential public goods.
Under the Google-Apple rules, collection and storage of "bluetooth handshakes" between devices is processed by the operating system and not on the level of the app. Jaap-Henk Hoepman, a cryptographer and privacy expert, also at Radboud university, is a proponent of a decentralised system, who nevertheless sees the stance adopted by Google and Apple as “a power grab”. It means only Google and Apple control how the system works and who will have access to it. “We should demand access to the raw Bluetooth stack to implement contact tracing entirely within the app – based on open designs, based on our own values, on our own terms,” said Hoepman.
Governance issues are part and parcel of evolving tech ethics. Michele Loi, data ethics researcher at the University of Zurich, sees the tension between governments and big-tech as a system of checks and balances that is not yet effectively enshrined in national data protection laws. He cites the San Bernardino case to explain how large tech corporations have evolved to protect their users’ privacy against government overreach: “It’s far from an ideal system. But suppose we could get rid of the power of Google and Apple so now governments get to decide on all these questions; how our phones work, what data is recorded. That would leave governments, even democratically elected governments, with so much power and no balance ... Do we really want to trust them so much?”
The debate about control over contact tracing is just one consequence of the growing role of big tech – Google, Amazon, Facebook, Apple and Microsoft – in critical infrastructure and essential services.
Under lockdown, schools and workplaces have turned to Google Classroom, Microsoft Teams and Zoom. Big Tech are making inroads into the healthcare industry, a lucrative market but long-considered controversial. Big Tech companies are funding medical research and supplying healthcare providers with artificial intelligence to diagnose new Covid-19 cases, and enable analysis of hospital and patient data to guide allocation of resources. In Canada, Amazon has been distributing medical supplies. And can governments even contemplate a communication strategy without Facebook or Twitter?
It’s no surprise that despite current uncertainty, the market value of big tech is at an all-time high
It’s no surprise then that, despite current uncertainty, the market value of big tech is at an all-time high.
Big questions remain. As Big Tech moves into new markets for diagnostics, epidemiology and healthcare, what will it cost us? What are the implications of Big Tech companies playing a bigger role in basic public services across the world? And at what price? Is that a welcome opportunity to digitalise services that, for now, remain substantially analogue? Or should we be worried and resist the growing power of these companies?
In the coming months, we will try to find answers to these questions. We’ll look at the activity of Big Tech outside their original fields of expertise, whether in search, advertising, retail, personal computing or communications.
If you have helpful information on sources or data, please let us know.
Design and illustration by Luka van Diepen, Afonso Gonsalves and Leon de Korte. Coding by Heleen Emanuel.