On the "Heritage Explains" podcast, Tim Doescher and Klon Kitchen explain how contact tracing works and whether it could be used to stem the spread of the coronavirus in the United States.
TIM DOESCHER: Remember the early days of cell phones? Think back to the '80s. If you can't remember, or you weren't alive, don't worry, it sounded something like this.
COMMERCIAL 1: Those who think getting a car phone is not for them for whatever the reason, haven't kept up with the booming industry of cellular radio telephones.
COMMERCIAL 2: Now through this special TV offer, you can receive a Motorola flip phone with Cellular One service for just pennies day. Now everyone can enjoy the freedom of a personal cellular phone. You can make a call anywhere or get a call any time.
DOESCHER : It wasn't long before people were completely sold on the idea of having a cell phone. And the freedom experienced quickly turned into obsession. Remember this scene from the movie “Zoolander”?
MATILDA: Derek, I thought I told you to turn off your phone.
DEREK: Turn off my phone? Turn off my phone?
MATILDA: Yeah.
DEREK: Earth to Matilda. This phone is as much a part of me as-
MATILDA: You know what? Can we just cut it out with all the earth to's?
DOESCHER: But then 2007 happened, and things got way more interesting, changing the game forever.
COMMERCIAL 3: It's amazing what fits in your pocket these days, your favorite music, all your email, today's newspaper, endless entertainment. And of course, a phone.
DOESCHER: Now, since the smartphone has taken off, the sky's the limit. You can video chat, pay for goods, listen to music, watch movies, track a great workout, and now, trace COVID-19 encounters without even knowing it? Hmm.
REPORTER 1: A major announcement from Apple and Google today, they are teaming up to create voluntary Coronavirus tracing and tracking software for iPhones and Androids to tell people if they've been near an infected person, you essentially get an alert. It's a type of contact tracing, which experts say is key to stopping the spread.
COMMENTATOR 1: I think that a lot of big tech companies want to do the socially responsible thing, and they want to help out. I think everyone, all of us, want to do the best that we can with the tools that we've got, and they happen to be in the unique position of controlling the two operating systems that are on most of the world's phones.
DOESCHER: Seems simple enough and very socially responsible of them. I mean, come on. What could possibly go wrong?
COMMENTATOR 2: We don't know if these contact tracing technology ideas are going to work. If you do an experiment with them in real time, at the scale of a population, it could go horribly for a lot of different ways. It could also have extremely negative longterm effects on privacy
COMMENTATOR 3: How this information would be stored, whether it would be stored, and to whom it would be accessible, it's anyone's guess. We don't know any of this yet. In a perfect world, perhaps this would all work seamlessly, no abuses and no misuse of our medical data, but there are profound questions involved here, including the damage that would be done to America if we really can't even open this up until an army, as they call it, of tracers and technology was put in place. Is any of this even feasible?
DOESCHER: Okay, so these are really good questions, and I'm not sure one could have seen this coming back in the '80s when cell phones first came to the market, but nevertheless, we're here.
DOESCHER: So are we putting our privacy at risk if we take part in digital contact tracing? Is COVID-19 even worth the risk? Did you know that 99% of the U S smartphone market is owned by Apple and Google? That means if you have a smartphone, chances are, you'll be confronted with this issue in the near future.
KLON KITCHEN: But the important thing is that the entire process is voluntary. So a user has to actively opt in to first download the app, to share their diagnosis by themselves, and then even further, to see if that wants to be shared with others. So, there's like at least three levels where all of this has to be voluntarily participated in.
DOESCHER: Klon Kitchen is a friend of the show, and he's also the director of the brand new Heritage Foundation Center for Technology. He's written a substantive report that looks at every angle of the digital contact tracing effort by Google and Apple. And this week, he explains.
DOESCHER: Klon, thank you so much for coming back to be on Heritage Explains.
KITCHEN: It's my pleasure, love doing it.
DOESCHER: Okay. So, I'm seeing headlines, and I'm seeing threads on social media using terms like "surveillance state" and "1984 is here." A lot of these terms are fueled by a healthy skepticism of big tech or of big government. And the thing that we're talking about here is contact tracing, or digital contact tracing. So I'm going to start from the source there. Can you just give me a layman definition of contact tracing, something that we've been doing for a long time? What is a definition of that?
KITCHEN: Yeah. So contact tracing, as you mentioned, has been a standard practice for epidemiological response or pandemic response for decades. And essentially what it is, testing tells you where the disease has been. Contact tracing helps you understand where it's going.
KITCHEN: And the way it works, is you find someone who you know has the disease that you're concerned about or the sickness that you're concerned about. And you say, okay, who have you been in contact with during the period in which you could transmit the disease? And they tell you, well, on Tuesday I met Bob, and on Wednesday I met Sue, and so on and so forth. And then you go and you contact Bob and Sue, and you say, okay, Bob and Sue, you were in contact with someone who had this sickness, who were you in contact with over the last several weeks? And then they tell you. And you follow that network out as far as you need to, until you feel like, okay, we're now far enough away from the disease that we can understand one, where it's migrating to, but then two, we feel like we've got a good handle on who has this and who doesn't.
DOESCHER: And so Klon, let me just stop you right there. So with contact tracing, you're hiring people to go out and conduct all of this, essentially this research, this tracing that you're doing. It seems really labor intensive.
KITCHEN: It's incredibly labor intensive, especially when you have a disease like COVID-19 that transmits so quickly. So one of the things that's happened in the COVID context, or the coronavirus context, is that the speed of transmission is really outstripping our ability to do manual contact tracing.
KITCHEN: But then two, one thing that's really important, is those individuals who do contact tracing, they fill out a form. They sit down with you, they get your name, they get your address. They get who you've been in contact with. They get all of that information. That's a normal part of public health documentation. That's always been the case.
DOESCHER: And it's similar to the documentation that would happen if you walked into a hospital and said, Hey, I think I'm sick with COVID-19. What's the first thing they have you do? Fill out a form.
KITCHEN: Well, that information, whether it's from the hospital or from a contact tracer individual, all gets fed back to public health agencies. And they use that for understanding what's going on publicly with the disease, where it's being spread, and it's fed into models and all that. So all that to say, your question, what is contract tracing, it's a pretty standardized effort of going out and collecting data, and then using that data so that public health officials have an awareness of what's actually going on. And then that influences everything from health policy to public policy.
DOESCHER: Okay, Klon, so now we're at digital contact tracing. And now, Apple and Google are going to be the ones that are taking this on because several State-specific apps have failed. They haven't worked out the way States like, so Apple and Google step in and say, hey, we're going to develop something that's going to help us digitally contact trace. Now, walk us through a little bit of how that's going to go.
KITCHEN: They have built what's called an API, and that is just fancy language for something called an application programming interface. Bottom line, it's a batch of code that offers rules and tools for how app developers can build digital contract tracing apps.
KITCHEN: So here's what it would look like as it's being rolled out. Let's say on Monday, you've got John and Abigail standing at a bus stop. And while they're waiting, their phones exchange a unique, but anonymous identification code, like a little token, via technology called Bluetooth. So, no personally identifying information or location data is shared when that happens, just this anonymized number. A few days later, let's say Abigail is diagnosed with the coronavirus, and she then decides to share that diagnosis on an app that was developed by a public health agency. So with her consent then, Abigail's phone uploads all the other tokens that she's been in contact with over the last 14 days.
KITCHEN: Meanwhile, John's phone is regularly downloading a list of anonymous tokens that have been associated with people who've chosen to share their positive coronavirus diagnosis. So after Abigail chooses to share her diagnosis and allows that information to be shared with others, John gets a notification on his phone that says, hey, listen, you've been in contact with someone who's tested positive for the coronavirus. It doesn't tell him who. It doesn't tell him when. It doesn't tell him where. Just says, hey, you've been in contact and you might want to go get a test. And so, John then can follow up on that, and go get a coronavirus test, and make decisions about how he wants to proceed after that.
KITCHEN: But the important thing is that the entire process is voluntary. So a user has to actively opt in to first download the app, to share their diagnosis by themselves, and then even further, to see if that wants to be shared with others. So, there's like at least three levels where all of this has to be voluntarily participated in, and anybody who doesn't want to do it anymore, even if you signed up initially and you don't want to do it anymore, you stop. It's done. Your information is no longer being shared.
DOESCHER: Okay. I just wanted to cover that again. It's basically entirely voluntary to do this. And actually, it's funny because I saw a Washington Post poll. It found that only 40% of respondents were willing and able to use such an app. Half of the poll smartphone users, don't trust tech companies to protect the anonymity of users who test positive for COVID-19. So, you have to download the app and then opt in to share, KITCHEN, is this likely to catch on, can you assign a percentage to this? Is there a research reflecting this?
KITCHEN: No, there's no research yet. There's heavy skepticism in the US about this, but two quick points on it. And, for this to work, you do need, ideally you would have at least 40% of the population doing this. That seems like a stretch goal right now, but we'll see.
KITCHEN: But just on the concerns, one, I want to acknowledge the legitimacy of the general concerns, but I want to put them in the context of reality. So one, the information that people are concerned about these companies getting, things like their location, their contacts, their internet viewing habits, that kind of thing. These companies have that. So, not participating in digital contact chasing does not prevent these companies from having that information. In fact, because these companies already have that, because app developers already have this information, that's one of the conditions that's allowing them to be so narrowly focused and to prevent that information from being collected in exchange for the contact tracing apps.
KITCHEN: But, if you don't believe me, which I understand you may not, even the ACLU, which is pretty mindful on these things, put out a specific statement saying to their credit, Apple and Google have announced an approach that appears to mitigate the worst privacy and centralization risks. And as we've taken a look at this, as it regards contact tracing, you'll remember I said, look, all of this information is normally collected through manual contact tracing. Well, because it's using encryption, because it's decentralized, because it's using these anonymous tokens, the digital effort may actually be more private than the manual contact tracing capabilities.
DOESCHER: Wow. So tell me then, and this is a question I think that a lot of people's minds will wander to during this interview, well then, what is Apple and Google's motivation to do this? Is this pure altruism, or do they have the potential of gaining something from this?
KITCHEN: Well, one, they have an interest in getting the economy back up and running. They have an interest in their employees being able to work. They have an interest in people being able to buy iPhones and Android phones. They have an interest in the nation's economy not completely cratering and being able to get back to whatever the new normal, post-COVID-19 is going to be. So, they have a vested interest without a doubt.
KITCHEN: I do think as well that they see a need that the Federal Government can't meet particularly well, and a need that they perhaps feel more comfortable doing themselves rather than the Federal Government. So in a lot of ways, there may actually be an alignment from these companies with consumers who have concerns about the Federal Government doing this work. I would have those concerns.
KITCHEN: So, they have mixed motives. And the fact that those motives align with my economic concerns and my privacy concerns doesn't make me inherently skeptical of them. That being said, there's good reason to be skeptical about these companies. And one of the unfortunate realities of the way they've conducted themselves previously, is that even if they are doing something out of the goodness of their heart, which I'm not saying this is, that they're rightly going to be exposed to skepticism because of the way they've communicated and acted previously.
DOESCHER: Yeah. And one of the things, and really what I'm trying to do here, is I'm trying to clear up a lot of misinformation that's out there. And I wanted to ask you about this because I was doing a little reading and a little fact checking myself. And I saw that using digital contact tracing is a venue to take away or forcibly remove children from a home if they've been exposed by something, particularly within the state of California. I wanted to know if you had a comment on that and put that to rest a little bit.
KITCHEN: Well, okay. So two things, one, digital contract tracing doesn't eliminate potentially abusive government actions or policies. The state of California, digital contract tracing apps, aren't going to make the state of California more rational or less intrusive. What I'm saying is, the apps don't materially make that risk more or less because they don't collect information.
KITCHEN: So for example, if you were to be contacted by a person doing digital contact tracing, that information would be collected onto, literally, a sheet of paper that they would then turn in somewhere else. Now, if the government of California wanted to avail themselves of that information and took legal action to gain access to it, and then decided to abuse that by using it as a basis for taking an action of removing someone from a home, that, I guess, theoretically could happen.
KITCHEN: But if they tried to serve that same warrant on the information that's being collected by these platforms, there's nothing to collect. All of the information is anonymized. All of it is encrypted to the degree that it exists at all. And so, will the State and Federal governments still be able to serve warrants and other legal requirements for information? Yes. None of that changes, but again, all of that information would either already be collected through manual digital contract tracing, or it exists elsewhere, and they wouldn't need to go this route to get that information.
DOESCHER: Klon, you say, in the report, which I'm going to link to in the show notes, folks, it's very expansive. It's very helpful. And it clears a lot of, some of, the misconceptions up. So please log on to the show notes and read. And Klon, I'm going to quote from you here. You say, "Expanding the scale and speed of contact tracing will serve both individual and public health interests. Furthermore, private sector efforts to innovate and to service critical public needs should be lauded and encouraged."
DOESCHER: You go on to mention the distrust the public has in big tech companies, and we've addressed that. So I want to know, what is your proposal to quell this fear? Do we pass a law? What would you suggest?
KITCHEN: No, no, I don't think a law is necessary at this point. It's certainly not needed for these apps to go forward. They're legal. If I could put on my libertarian hat and just address one of the concerns, a libertarian response to some of this might be, listen, I've got a private company offering me a service that I want. They're offering me the ability to participate in this, and I think that that will be to my good. So what right does anyone else have to prevent me from willfully, voluntarily entering into this contract with them? Which, if we were to pass a law, making these types of capabilities illegal, we would be doing.
KITCHEN: So, I think there's some actually interesting principal issues at play here, but then more specifically, we have made a series of eight suggestions on how both government and industry should constrain this activity, things like minimizing the amount of information that's collected, making sure that information is encrypted, making sure that, for example, no companies are able to collect this information and use it for marketing or for advertising or for product development, making sure that the Federal Government, to the degree that it gets any of this information, cannot turn it over to law enforcement or the intelligence community, and a whole host of other things.
KITCHEN: Well, four days after we issued the paper that you're referencing with these recommendations, Google and Apple updated their policies around what they would and would not allow these apps to do. They incorporated five of our eight suggestions, and it includes all five of the ones that I've just mentioned to you. So, we've shaped this conversation immediately from the beginning, and we continue to stay engaged.
KITCHEN: Look, skepticism is real, and it's justified, but there are facts that would, I think, provide conservatives meaningful encouragement, and we hope that we can be helpful in sharing those.
DOESCHER: Man, Klon, thank you so much for clearing all of this up for me and for the audience of Heritage Explains. It's a big deal for us. So again, thank you so much for joining us this week.
KITCHEN: No, it's my pleasure.
