March 8, 2024
Another from the archives, this one takes me straight back to full-blown pandemic days. Originally published in September of 2020 (pre-vaccines!), I took some time to reflect on how the exposure notification app rollout went after having the wonderful opportunity to work with the TCN Coalition team through the thick of it. TL;DR: the way we communicate has to meet our target audience where they are. Enjoy.
---
As groups of scientists, technologist, lawyers, policy experts, and government employees convened earlier in 2020 to automate certain steps in the fight against COVID-19, it became clear to me that the way that the solutions were talked about was affecting the public opinion. In this instance, public trust is paramount — if technological solutions can help slow the spread of COVID-19, lives could be saved.
Trust as a Hurdle to App Adoption
One of the major hurdles for exposure notification (EN) apps continues to be public trust. We know that EN apps can complement manual contact tracing and aid in isolating COVID-19 cases, thus slowing the spread of the virus. Researchers have stated that the greater the adoption of the technology the more effective it can be in achieving this purpose but it’s important to note that the positive effects already set in at a much lower adoption rate than the often cited threshold of ~60% (see Oxford study and Linux Foundation Public Health’s blog post about it). In other words: every single adoption helps. However, increasing the adoption rate by citizens requires that they feel comfortable using the technology.
Where Vocabulary Comes In
The TCN Coalition (which has now merged in to Linux Foundation Public Health) was rooted in consumer privacy from day 1, acting as a forum for experts to collaborate on the best possible privacy-preserving solutions to digital exposure notification. Having the broad perspective from TCN, I have seen the great challenge that vocabulary and context can play in the public perception of these technologies.
One example that demonstrates how important context and precision are is the use of the word “surveillance”. Epidemiologists and researchers use this word to describe how they follow the spread of the virus in order to guide their research and advise decision making by governments and health institutions. Even though contact tracing plays a role in epidemiologists’ surveillance of disease spread, digital exposure notification apps are not surveillance technology.
To reiterate: in the context of virus research, “surveillance” is the accurate term and refers to tracking of the virus. In the context of public perception of technology, “surveillance” scares people; this fear is attributable to past experiences of privacy leakage in the tech sector and state-level surveillance of its own citizens.
Other examples include:
- “Tracing” and “tracking”
- Imprecise connotation: these words inherently communicate that a user’s privacy is not preserved.
- Reality: EN apps can aid in contact tracing but do not track users or collect personal information.
- “Identifiers” with regards to the Bluetooth beacon values
- Imprecise connotation: the values contain information about a user’s identity.
- Reality: the values beaconed are anonymous; the apps do not collect identifying information and do not include any such information in the Bluetooth beacon values.
Context and precision are important.
Clarifying the Privacy Characteristics of GAEN, the Most Broadly Deployed EN Framework
Because of the (often accidental) miscommunication of these technologies, here is a quick summary of the privacy-preserving characteristics of the Google/Apple Exposure Notification (GAEN) Framework which has been adopted by various states in the US and even countries such as Ireland. GAEN supports user privacy in the following ways:
- No GPS or other location data is used or collected.
- Users opt-in to exposure notification app usage.
- Phones exchange anonymous values via Bluetooth beacons to devices that are close enough to trigger an exposure and therefore also close enough to receive Bluetooth communication.
- Phones locally store the anonymous identifiers that are observed.
- When a user is diagnosed with COVID-19, an official health authority issues a one-time secret that enables that user to opt-in to sharing the anonymous values which were beaconed by their device. No personal information is shared. Anonymous beacon values cannot be traced back to the person whose device beaconed them.
- All participating devices download a list of anonymous values that were beaconed from devices belonging to those who tested positive. Locally, each device checks to see if the list of values from the list of positive cases contains values observed by them. This overlap calculation does not leave a person’s device.
- If an overlap is found, the app calculates a risk score and alerts the user. This alert is not shared with anyone and does not leave the device.
Defining Notable Terms
Linux Foundation Public Health hosts a terms glossary on their site with definitions of terms such as:
- Anonymous identifiers
- Proximity
- Contact Event
- Surveillance
- Tracking
The glossary includes a bit of context for each term so that readers are able to choose the accurate vocabulary to communicate their messages.
Final Thoughts
Public trust plays a massive role in the effectiveness of exposure notification apps complementing manual contact tracing. Therefore, being aware of how the public will react to certain vocabulary is critical; we must choose to be precise and provide context where necessary. It must be a priority.
Digital exposure notification has the ability to automate parts of manual contact tracing and can play a role in containing outbreaks of COVID-19, especially before an effective vaccine is ready for the public. We must make sure we communicate intentionally and accurately about the technology to enable public trust.
Acknowledgements to my friend and colleague Andreas Gebhard for his feedback and contributions.