Covid-tracing app may be ineffective and invasive of privacy

Flattening the curve may be frustratingly slow, but deploying ineffective or invasive tech won’t accelerate solutions for Ireland.

Minister for Health Sim on Harris3, said in the Dáil last week that the Covid Tracker Ireland App being developed by the Health Service Executive (HSE) will work only if there is maximum public buy-in.

To facilitate buy-in, a communications campaign is forming to make it as easy as possible for people to use the app. However, this approach puts the horse before the cart for an app which is very much under testing and development.

It is true that the public needs to further consider production of an app solution. Covid apps have many technical limitations which, together with their extremely invasive potential for generalised surveillance, demand more public consideration of their usefulness before release.

Global coronavirus cases surpass 3.5m as countries ease lockdowns

---

Millions of working poor in India exposed by pandemic

---

Holidays, flights, vouchers and refunds: Your questions answered

---

Something’s happening today? Here’s how the restrictions are changing

---

Accordingly, a group of civil societies, scientists and academics has written an open letter asking that HSE follow the European Data Protection Board recommendations by publishing the app’s draft specification and user requirements, data protection impact assessment (DPIA) and source code. This would allow expert input and wide public scrutiny.

We have written these requests openly precisely because of the few details the public has received from HSE. The 11-page Dáil statement and briefing for Mr Harris do not answer these asks.

However, what we do know raises concerns that the app may be neither effective nor rights respecting.

Bluetooth technology

We know that one possible function reported for the app is Bluetooth contact-tracing technology. This technology can be used to detect devices that are in close proximity with each other and to alert you if you have come into contact with someone with Covid-19.

But there are problems with Bluetooth accuracy. Its signals can cross walls and it doesn’t always run continuously on devices. It would not be helpful to alert you to a contact with an infected person on the other side of a wall whom you’ve never actually encountered. Nor would it be helpful to miss a contact alert because your app wasn’t running on your phone at a particular time.

To compensate for Bluetooth deficiencies, a second possible reported solution under consideration for the app is movement and location data tracking. When reliant on GPS, this tech also has accuracy problems. In certain conditions including poor weather, busy urban spaces or indoor environments it loses precision. This would not be helpful either on a busy Dublin street.

With all these accuracy issues, we have to question whether poorly-functioning tech is a useful solution. We also need to consider the potential interferences with our rights.

There is, for example, our right to health, which must be enjoyed without discrimination. Some people, including children, the elderly and the very poor, may not have access to mobile health apps or have the digital skills to use them. The Minister’s briefing says the Government is working hard to manage the digital divide but provides no details regarding how.

There are also our rights to privacy and data protection, which shouldn’t be sacrificed in the name of tech solutions. Trinity College Dublin academics recently said that while Bluetooth contact tracing can be more appealing than location tracking from these rights perspectives, we must be leery of Bluetooth apps engaging commercial services that can hold rough location data. The data held by these commercial interests potentiates the use for covert user tracking and deanonymisation.

Deanonymisation, a process which reidentifies an individual’s personal data, is a very real threat to location tracking. The Minister’s briefing does not appear to acknowledge this risk when it says it will use “voluntarily supplied small statistical area location information”. But who will hold this data and for how long? Who else will be able to access it and how exactly will it be used?

This kind of mission creep, away from an app’s originally intended function, and sometimes precisely detectable only if the code is released, demonstrates the potential for a Covid-tracing app to transform into a covert surveillance tool with linkages to commercial interests.

Transparency

To avoid unintended consequences, it’s important that the Government be thoroughly transparent with us – at the outset and in an ongoing way.

On Thursday, numerous TDs questioned Harris in the Dáil about the app. As they called for transparency, concerns were raised that, as Sinn Féin TD Louise O’Reilly put it, the Government “has not exactly covered itself in glory with respect to data protection, particularly when we consider the public services card”.

We are therefore encouraged to read that the Minister for Health is aware of the “vital importance of data protection and privacy” in relation to the Covid Tracker Ireland app. It’s also encouraging to read that it is being developed with European Commission recommendations in mind.

However, concerns about data protection and privacy will remain until the DPIA, design specifications and source code are published and made available for independent expert scrutiny.

Until then, a national communications plan aimed at deploying the app seems entirely premature.

Elizabeth Farries is the director of information rights at the Irish Council for Civil Liberties