Timothy Sung, a recent LSE graduate, looks at concerns around contact tracing apps during the COVID-19 pandemic and their implications for relations between technology companies and governments. This is the fourth in a series of posts by former MSc students of LSE’s Department of Media and Communications, looking at various issues in media governance around the world.

Digital contact tracing is a key part of a government’s armoury during the ongoing COVID-19 pandemic. Whilst it represents an opportunity for technology to help mankind, privacy concerns have been raised, and there are implications from governments’ deepening dependency on big tech corporations. Many countries have attempted to build their own contact-tracing apps and failed, because Apple and Google have restrictions for Bluetooth use on iOS and Android — their operating systems — that outside developers can’t bypass. The UK abandoned its plan to develop their own system in June, and Germany switched to the Apple/Google API even earlier after an initial attempt to build a centralized system. This MIT Technology Review tracker shows what services/apps countries use. This post considers the Apple-Google contact tracing method app, highlighting that privacy isn’t the only concern.

What is contact tracing?

Traditional contact tracing is a labour-intensive practice often involving multiple government agencies, central and local, identifying the people who have been in close contact with an infected individual and taking steps to prevent further spread. In Germany, for example, contact tracing falls on local health authorities with guidance from the Robert Koch Institute, the country’s central public health institute.

Companies and governments have attempted to leverage technology to aid in contact tracing, most notably by developing various mobile contact tracing measures, often in the form of mobile apps. Broadly speaking, there are two ways to do this: a centralized system, or a decentralized one. Israel authorizes its domestic intelligence agency to track the cellphones of infected individuals. Taiwan takes a similar approach — albeit to a lesser degree by not using GPS signals — by setting up an electronic fence to monitor the mobile signal of those ordered into quarantine. This centralized approach is said to grant health authorities more control as well as a bird’s-eye view of domestic cases.

A decentralized approach, on the other hand, appeals more to privacy-sensitive populations and is epitomized by the Exposure Notification System built by Apple and Google, two of the biggest technology companies in the world. The system uses Bluetooth technology to allow mobile phones to detect proximity and exchange digital keys; the keys are then uploaded to a database, and if an individual tests positive for COVID-19, their keys are flagged in the database, which notifies the users whose digital keys have been logged together with those of the infected individual.

The privacy dilemma

One of the major debates between the two approaches concerns privacy. In some parts of Asia, for example, governments use measures that would seem extremely privacy-invasive in the West: Korean Immediate Response Teams carry out thorough epidemiological investigations of each infected individual; the Singaporean Ministry of Health publishes “the age, sex, and occupation of each person who has tested positive for the virus” on its website; and China’s QR code quarantine app actively collects location data. In many western countries such as Germany, the UK or the US, however, protests lay bare people’s fundamental suspicion towards controlling measures, sometimes even common sense ones such as mask-wearing mandates.

The Apple-Google system

The Apple-Google system is an example of a privacy-preserving digital contact tracing system which represents a non-intrusive yet effective way to assist in epidemiological control. The decentralized nature of the system is an attempt to alleviate concerns that contact tracing apps could infringe upon individual privacy by exposing the user’s personal details or even location. The Apple-Google system does not transmit any individually identifiable information to the companies or the authorities, and no location or phone-specific data are collected.

If individual privacy is not a concern in the Apple-Google framework, then what is? Academics and regulators alike are beginning to worry about the significant economic power that such private corporations have amassed, and the implications this has for society. Can private power coexist with state power? During the ongoing COVID-19 pandemic, few national governments have been able to quickly roll out a phone-based contact tracing method, not to mention one that can apply beyond borders. Of those who have, like Singapore and Germany, privacy is a huge debate — in Singapore, for example, one needs to provide their national ID and phone number to use the app — and the services are often strictly national, incapable of wide international adoption. The UK attempted to develop its own centralized NHS app, but had to switch to the Apple-Google model because of technical difficulties that prevented the app from detecting some iPhones.

Apple and Google operate the largest mobile operating systems in the world — iOS and Android, respectively — and are therefore perfectly placed to develop methods that apply to millions of mobile phone users all at once. Although their contact tracing method is generally supported by privacy advocacy groups, it is worrying that governments and individuals rely heavily on their benevolence and that an indispensable infrastructure of hardware and software is now controlled in so few hands. Google, for one, has been in trouble with the EU over antitrust lawsuits, and Apple has frustrated companies over its tight control of the Apple Store, on which all Apple users depend to download apps. On one hand, Apple and Google joining forces in this way can be seen as an effort to “save the world”, but the initiative also highlights the immense economic power they now wield.

While both governments and private corporations like Apple and Google play an active role in contact tracing efforts, one fundamental difference sets the two apart: the latter are profit-driven — companies are accountable to shareholders and not the public good. Although Apple and Google explicitly state that their contact tracing is strictly not-for-profit, it deepens their control, making it harder for dependent users and governments to choose otherwise. Through building ecosystems of hardware and software, providing necessary services that few others can (Amazon deliveries during lockdowns come to mind), and buying up challengers, tech giants have been cementing their power like never before. COVID-19 will pass, but will our dependence on Big Tech?

This article represents the views of the author and not the position of the Media@LSE blog, nor of the London School of Economics and Political Science.