GM April 2 2020

Special Guest: Sean McDonald and Contact Tracing Apps

Today's special guest is Sean McDonald, CEO of FrontlineSMS and a trained lawyer. You can find him on the IFF Mattermost by @seanmacdonald. The FrontlineSMS project began when Sean began looking at contact tracing during the Ebola outbreak in 2014. That turned into a lot of work on data rights, governance, and mechanisms - as well as a bit on the geopolitics of pandemics. FrontlineSMS builds text messaging interfaces for humanitarian response and public services in a lot of remote places. Now, they are re-launching their desktop products, alongside some SMS-focused encryption tools. Frontline SMS's desktop and encryption tools are open source.

• What is Contact Tracing? Contact tracing is an output, so it doesn't refer to just one process. The goal is to identify, as quickly and clearly as possible, the spread of a pathogen.

• How it is done? Contact tracing was done through interviews and mapping, based on specific suspicion (for those who look at search warrants, a lot of the quality and law is similar) - so a person tests positive, then they are interviewed about everywhere they've been during the maximum period they could have been infectious, and everyone they've had contact with that could spread the disease. You'll notice that both require a clear understanding of the pathogen's characteristics and transmission behaviour - both of which are moving targets with COVID-19.

Contact Tracing and Technology

• When it comes to technology enabled approaches to contact tracing, there are some key differences - not only for how effective they are, but for how the implicate rights.

• One approach is to use technology to correct inevitably flawed interviews, so to use location history for people with known cases, to more perfectly identify everyone they may have given the disease to. This was done with Uber, recently.

• The other, more common approach, is to suggest that we can predict ambient risk based on "whole of population" surveillance using mobile records - essentially, trying to massively scale the previously very targeted approach.

• The main problem there, of course, is that the math and science simply aren't. We don't know enough about transmission, location is an extremely weak proxy (which we do know), and the gaps in the science are increasingly being filled by politics and violence aimed at social lockdown. Location is almost always a pretty weak indicator, so it would have to have a lot of other detail that requires a lot of personal surveillance capacity to deliver.

• One participant asked if there would be a way to trace COVID with tech means to become feasible if the pathogen's characteristics and transmission behaviour are more well understood. During the meet up, we agree with Sean that we would love to see a research-validated approach to transmission modelling for a huge number of reasons. In other hand, as Sean points out, when we make predictions in public - as we have about masks, about demographic risks, about regions of likely spread - people rely on them, and that's dangerous. Where there's specific suspicion of knowable transmission behaviour, then there are ways to use tech's ambient surveillance to amplify and augment the processes we know work.

• So, the conversation went to a series of key questions regarding the technology and privacy: what alternatives are feasible to make? Should we make privacy-enhanced tracking technologies of certain location data, if the collection of that location data is meaningless in the first place? are we able to asses which data is useful to collect in the first place, before we work on privacy-friendly alternatives?

• And we conclude that the answer is no. Or, if you do, in a lab under a lot of oversight. Sean let us know that he is pro research, but he thinks that we need more quality assurance checks before launching in unstable environments. Researchers are approaching this both ways (using the data to find the problem, the problem to find the data).

• When we look to the future, Sean makes a great point: we're missing the forest for the trees here - by focusing on technology and data systems, we're missing that now nearly every government in the world has declared/is declaring/should declare emergency. So, for Sean, it's focusing on limiting unchecked authorities, building in checks through advocacy and contracting, cataloguing the transition and issues happening now, mobilizing response resources and alternatives (a lot of which are made by this community)

This answers led us to talk about examples of a ways to use tech's ambient surveillance to amplify and augment the processes.

• The Uber data example: a person was suspected to have COVID based on testing and took a ride. The person didn't know they'd been exposed and it was during a phase where testing and facilities weren't over-run. So, the person was located via their Uber data, contacted, and referred to a medical facility to get tested.

• Sean agrees in the fact that it didn't went through any of the typical due process checks you normally would to get access to that data, as an example, it's relatively limited in harms. On the other hand, Uber then also decided, based on an abundance of caution, to ban two drivers and the 240 people who had come into contact with those drivers from the platform for 2 weeks. That is much more interesting - because Uber doesn't have any specific ideas about how the disease works, nor is restricting Uber access anything other than removing their specific liability.

• So we can conclude that Contact Tracing = epidemiological investigative reporting, mapping and identifying a health mystery.

Understanding Contact Tracing: The Ebola pandemic

• Going back to the Ebola pandemic in 2014, contact tracing involved using an automated SMS system for monitoring persons with the disease, and the potentially exposed. Did this involved all the telcos? Was this even effective in those regions? Understanding by effective if it even resulted in a clearer mapping, identification of the exposed, rather than through the older system of interviews - which we know now that it can be flawed.

• The quality of how people report is a counterweight to the quality of the data. There are very few technological roll-outs that don't have massive selection bias issues.

• Sean commented that it's really important to think about the upper limit of the value of information. For example, during the Ebola outbreak, one of the primary determinants of transmission was burial tradition. Ebola is super infectious and painful at the end - so you can't touch your loved ones as they're dying. How many text messages from a stranger would it take to convince you not to do that?

Specific Cases Data and Privacy

• At some point, as the general population, we know the actions we need to take. One of the participants is interested in getting people with complex conditions in touch with specialists when it's unclear whether they should take their medications as usual, or isolate strictly. As an example, rheumatologists are organizing around COVID-19, and anyone with autoimmune issues who gets infected is urged to contribute data - how do we help specialists and maintain privacy?

• From a privacy perspective, Sean comments that the most important things to do are give people choices about how they want to be communicated with that include channel, time of day, frequency, and level of specificity. He thinks that, for most people, the threat model is more social than technical.

• The overall message - if there is one - is to focus on the impact of the thing you're doing over the "quality" of the tech. A lot of exceptionally built tech is being used, right now, to elevate people's sense of risk in contexts where there is no treatment capacity and where their own agency is being limited under threat of violence - so in a lot of ways, getting the 'right' risk model really isn't the point.

• One of the participants shows us that many people with broken immune systems feel more comfortable around people who have similar issues, that means that they are keenly aware of the last time they touched a doorknob or their face.

• Sean puts a good example of where we're seeing really excellent work: interventions that are defined by response capacity - and, where most people aren't pathogen responders or contact tracers - but could do something very helpful, like run grocery routes or help produce PPE. These are, of course, not terribly interesting technical problems.

• One participant argues that contact tracing projects could benefit from the psychosocial practices of digital security trainers.

The impact of Contact Tracing

• At the end of the day, contact tracing is only most impactful when widespread testing is being implemented. Also, in healthcare systems with the capacity to treat the pathogen. Ultimately, knowing risk is really tied, value-wise, to response capacity.

• We keep in mind that contact tracing doesn't tell us about someone's hand hygiene, what they're wearing on their face. Or what their water and sanitation infrastructure looks like.

Contact Tracing, Surveillance and COVID-19

India

• India has one of the lowest testing and we are kind of playing with the Genuine Data that way. Mass testing has somehow helped lockdown avoidance in South Korea. It seems that testing is one of the key aspects. The measures that India's government is taking are a lockdown, police is confiscating vehicles and citizens are forced to do groceries on foot.

• We discuss the article that one participant shares about one epidemiologist that has an argument against extensive testing. We conclude that there are a lot of good reasons to extensive testing and that we can't trust the graphs, since India isn't testing enough.

• A participant adds that Indian government has an app for Bluetooth contact tracing. This app uploads data instead of holding it on your phone, and yet claims to be "secure". Also, the app results useless now since a lockdown is already in place. It seems that future data won't reveal exposure prior to lockdown. We have to keep in mind that India has only 25% smartphone penetration, so almost nobody you meet will have this app.

The Netherlands

• The government in The Netherlands is discussing using GSM data to detect where people are going and do contact-tracing. One participant offers three possible tactics to respond to this:

• • A. to oppose this, by all means
  • B. to aid it's implementation by working on more privacy-protection technologies to achieve this aim?
  • C. something else...?

• For Sean, and his advocacy stances, it is really important that we are able to say no to this measures. He explains that we have bad science, being rolled out at scale via technology, used in ways that - at least in Israel - doctors are saying is directly counterproductive. So the conclusion would be to oppose to it. Essentially, if you can't stop it, make it as harmless as possible.

Iceland

• There were a lot of articles lately about how Iceland's widespread testing showed that 50% of carriers are asymptomatic. In fact, the Head of Iceland's research company cleared this up by saying that “Fifty per cent of those that test positive in our screenings of the general population are symptom-free at the time. Many of them get symptoms later".

• Even this is very interesting and shows that widespread testing is very important, Sean points out that this fact is pointless focusing on tracking the disease.

Conclusion

For concluding this Glitter Meet up, Sean makes a final input: any attempt at contact tracing the disease, no matter the platform, should be able to answer these requirements/questions. How are they proving that their approach reliably tracks the pathogen under the following conditions:

• • (a) a substantial (even if not 50%) asymptomatic presentation - and an otherwise symptomatically common presentation; while
  • (b) 48% of the world lacks Internet infrastructure;
  • (c) we do not currently know transmission model and location data does not reflect transmission behaviours or reliable risk;
  • (d) health systems do not have capacity to test or treat; and
  • (e) error rates are, essentially, criminally or violently enforced.

Resources FrontlineSMS: https://www.frontlinesms.com/ Extensive Testing Article: https://scroll.in/pulse/957883/did-india-overreact-covid-19-outbreak-isnt-following-the-trajectory-of-europe-and-china-so-far Indian Contact Tracing App: https://twitter.com/PrinSciAdvGoI/status/1245701451722047489 Iceland Testing: https://www.icelandreview.com/sci-tech/icelands-coronavirus-testing-global-pandemic-response/

Community Self-care

• Look at these happy elephants with the live stream cam: https://explore.org/livecams/african-wildlife/tembe-elephant-park

Community Updates

* One participant released a new tool on Mac and Linux: https://kushaldas.in/posts/introducing-manualbox-project.html 

* Other member of the community distributed some air quality sensors. You can check them here: https://dataviz.muv2020.eu/

IFF Updates

• Here is a summary of the challenges shared by folks during the last glitter meetup regarding cultivating community online: https://internetfreedomfestival.org/feedback-community-cultivation/

• Share and support Myanmar's call for solidarity: https://twitter.com/InternetFF/status/1245428343689838593

• Upcoming virtual workshop:

• • April 8 - Silencing Across Borders: Digital Threats and Transnational Repression against Exiled Activists
  • Speaker: Marcus Michaelsen
  • RVSP as only 25 seats: https://internetfreedomfestival.formstack.com/forms/cks4