With Google and Apple entering the fray this week, here’s our latest on contact tracing apps: contact tracing is important, and designing crisis-era tech needs extraordinary constraints. https://privacyinternational.org/long-read/3792/covid-contact-tracing-apps-are-complicated-mess-what-you-need-know

It’s a long read. Sorry. This topic deserves nuance rather than quick judgement. We all jump too quickly to a pandemic vs privacy choice which reminds me so much of the ‘clash of civilisations’ approach post 9/11 that didn’t help anybody.

Contact tracing is extremely helpful. And is quite invasive, based on everything you know and can share. And is necessary. These apps do both more and less. But they’ll never replace the manual process.

How you design the app to interact in your society matters. If you aren’t doing enough testing then you need a centralised app that can sort out false positives.

But don’t make an app mandatory. Or even soft-mandatory. The app just can’t work on all phones so those without phones or without the latest phones will be left behind, locked down, economically destitute.

Then there’s the question of whether it works at all. There’s location data from telcos which seems so vague to be pointless, unless you are doing a data grab. GPS isn’t overly helpful either. My colleagues have written helpful explainers for these here: https://privacyinternational.org/campaigns/fighting-global-covid-19-power-grab

If your government is using Bluetooth LE then this is already on the least invasive path.

Centralised vs decentralised is a fascinating fight of philosophy amongst smarter people than I. The answer depends on realities on the ground and where you need the intelligence to reside.

And now with Apple and Google supporting decentralised it means that the quality of the connection data will likely be higher. It’s still unclear if this is good enough to make it all work but it’s probably better than the hack some governments found.

On that note it’s shocking how little data governments have shared on the effectiveness of the connection data. Shocking. This was a moment for radical transparency, and they failed. It could be because they’re too busy. Or it could be because they’re hiding failure.

Now mission creep is one of the largest threats. Yes these apps may help. They may even work. I welcome them if they do. But they must be designed to limit this creep.

Let’s rewrite the book on emergency power enshrined in tech. Governments must have the courage to make this the one time they live up to their promise to use extraordinary powers with restraint, and to destroy those powers when the emergency is over.

Destroy doesn’t mean just delete. It doesn’t mean decommission. It doesn’t mean exploit for research. It means remove from our operating systems, data stores; from our arsenals and our imaginations.