These days, governments across Europe are in a race to develop smartphone apps to track COVID-19 cases. All efforts to attain better and more data on the pandemic are to be applauded, but the fragmented approach of individual European countries is doomed to fail. Also, the complexity and the far-reaching consequences of such, in principle, simple contact tracing apps are highly underestimated by national authorities. Europe has the knowledge, power and means to address this, but only if it acts united. The EU must go beyond mere recommendations, take the leadership and quickly set up a public-private rapid development task force of decision makers from key EU governments and EU industries, argues EIT Digital CEO Willem Jonker.
The advantages of COVID-19 contact tracing apps are clear. In most of Europe, apart from a few countries, the initial reaction to quickly ascending infection rates were rather untargeted lockdowns of entire economies and societies. One reason for such extreme measure was the lack of adequate information on the virus, the way it spread, the levels of infection, and early stage ignorance about the most vulnerable groups in our population. Lockdowns do flatten the curve and reduce the fatalities; however, they also extend the period of time, which badly hurts the economy. As a result, total lockdowns that hurt the complete national economy are not sustainable since they cannot be afforded indefinitely. Countries therefore look for exit strategies and whilst effective vaccines or approved medications would be the best ones, neither of them is expected to be available in 2020. So, authorities need the best possible information and data for targeted and appropriate decisions in the cat-and-mouse game between alleviated restrictions and very targeted measures to immediately contain local outbreaks. Smartphone-based tracing apps can be the tool to collect and distribute such data on large scale, and to replace the ‘manual’ contact tracking that currently is applied.
So far, so good, however there are numerous obstacles before a flawless contact tracking app is up and running. Some of them are technical, and most likely can be addressed in reasonable time. However, there is one obvious hurdle that is less easy to overcome: the privacy of citizens. And that has everything to do with trust, which as we know is hard to gain but easy to lose.
Gaining trust of citizens in COVID-19 contract tracing apps is a multidimensional challenge, that requires a multidisciplinary approach. This is not new! In Europe we have built a lot of experience and successfully launched regulations like GDPR and PSD2. In addition, at the European level there is meanwhile a lot of multidisciplinary expertise around an even more profound issue: that of trust in artificial intelligence. With all this knowledge, it is surprising to see national governments so naively approaching this topic.
Of course, we are in a crisis situation, and in times of crisis, there is enormous pressure; and pressure makes everything fluid. The success of several Asian countries in containing COVID-19 outbreaks and the apparent role of contact tracing apps in their approaches gives rise to hope. However, Asia is not Europe, especially when it comes to privacy. Also, in Asian countries not everyone uses the apps. Singapore is considered successful in containing COVID-19 and has gained initial recognition for making the technology of its TraceTogether app freely available to developers worldwide. Nevertheless, only 20% of the population downloaded the app and its role is therefore not clear. Also, in the US we see, not surprisingly, big tech companies like Apple and Google taking up the challenge of contact tracing apps. But once again, the US is not Europe. The European relations with American, but also Asian, big tech companies are ambivalent at best. European awareness for digital sovereignty is growing, and it is thus not likely that Europe is inclined to give such a privacy sensitive application in the hands of non-European tech companies. We must not forget that tracing is a sort of surveillance and is important to ensure that such system is conducting surveillance in a fair and helpful way.
Currently, different actors come forward with solutions. The technical community focusses on how privacy is assured through anonymisation and encryption of data. However, even the best system cannot guarantee 100% security, as it only tries to hide information, that still is there. There will always be means to crack code and extract the data. And even being able to monitor the pure activity of such tracing app could allow for unwanted interpretation. Asian apps are more or less mandatory for users. Privacy concerns are traded off in the interest of public health. In the US, the two tech giants Apple and Google focus on developing a tracking mechanism that would be integrated into their operation systems iOS and Android. Academics in the US and Europe (most notably the Pan-European Privacy-Preserving Proximity Tracing initiative PEPP-PT) initiated several initiatives to build privacy preserving solutions, often with a strong focus on technological solutions. Academics working on ethics and social aspects of technology often also bring in the governance elements that consider what kind of data is collected, who develops the app, who has access to the data, who to app communications, and who determines the use and purpose of the application or for how long and where the collected data is stored.
The landscape is highly fragmented and results either in no deployment or a wide range of diverse solutions. For European countries and Europe as a whole either outcome would be bad. No solution would be bad, since an opportunity to improve epidemic and pandemic containment now and in the future with the embedding of digital technology would be lost, despite broad consensus that fast information and data sharing is key in containing virus outbreaks. Fragmented European solutions would also be bad, since they lack scale and will therefore be more expensive and less powerful. And European countries should meanwhile have learned a lesson from the platform economy, where the fragmented landscape of European social media platforms was completed wiped out by a single US platform, Facebook. When Europe does not take a concerted approach, the same could happen this time with Apple and Google jointly dominating this technology. This prospect already raises concerns of European policymakers. And this would not only affect the COVID-19 app. There is nothing more permanent than temporary measures. Apple and Google intend to embed their contact tracing solution in their respective operating systems, which will make their solution a De Facto standard for future applications that need contact tracing functionality. This technology is too important to be owned by a limited set of companies. We need a De Jure open standard available to everyone on RAND conditions (reasonable and non-discriminatory).
Now is the moment for leadership by the European Union. Europe cannot talk about Digital Sovereignty and at the same act once more in such uncoordinated manner. The EU has proven to be able to mobilize the needed expertise at European level and it has proven to be able to deliver on related topics such as GDPR and ethical AI. A lot of ingredients are available, it is a matter of leadership, fast and agile mobilization, focus, and timely delivery.
Europe should quickly join the forces of competent players in the European medical and digital industry to develop an open industry standard for tracking and tracing. In parallel EU institutions should agree on legislation that prevents apps from entering the EU market that do not respect European privacy rules. Therefore, a European and multidisciplinary approach is needed, bringing together, medical, technical, social, ethics, and legal experts together to develop not only the app itself but also the usage policy and legislation that should go along its deployment.
Usage policy, technology and legislation need to go hand in hand, because usage policies and legislation and without adequate technical solutions are toothless. And technology without appropriate usage policy and regulatory framework will hamper governments to guarantee the interest of citizens and technology suppliers in a balanced way.
The medical experts have to assure that the app is indeed integrated in a meaningful way into the overall virus containment approach. The technical experts have to assure that the digital technology does what it needs to do in terms of functionality, security, privacy, connectivity, acceptable error rates, and usability. The social and ethics experts have to assure the acceptance of the technology by citizens in order to guarantee broad acceptance and widespread use and derive a usage policy that defines how, where, when, and by whom the app and the data collected by the app will be used and under which conditions. The legal experts have to provide the regulatory framework as well as the legislation that should accompany the app in order to assure that the usage policy can be enforced.
After that the work should go on to develop a range of digital solutions for managing the lifecycle of epidemics and pandemics, since COVID-19 likely will not be the last epidemic the world will face that can turn into a pandemic. These solutions need to include tools covering early warning, fast response, curve management, targeted lockdown, containment support, and the availability and analysis of the right data at the right time.
Only such concerted European action by political decisionmakers and industry leaders can ensure that we are able to use a European tracking and tracing and epidemic lifecycle management technology that respects European values and truly serves our European citizens. In this way making the EU motto in varietate concordia truer than ever in this unprecedented COVID-19 crisis.
