What Ever Happened to Digital Contact Tracing?

In May of this year, Prime Minister Boris Johnson pledged the United Kingdom would develop a “world beating” track and trace system by June 1 to stop the spread of the novel coronavirus. But on June 18, the government quietly abandoned its coronavirus contact-tracing app, a key piece of the “world beating” strategy, and instead promised to switch to a model designed by Apple and Google. The delayed app will not be ready until winter, and the U.K.’s Junior Health Minister told reporters that “it isn’t a priority for us at the moment.” When Johnson came under fire in Parliament for the abrupt U-turn, he replied: “I wonder whether the right honorable and learned Gentleman can name a single country in the world that has a functional contact tracing app—there isn’t one.”

Johnson’s rebuttal is perhaps a bit reductive, but he’s not that far off.

You probably remember the idea of contact-tracing apps: the technological intervention that seemed to have the potential to save lives while enabling a hamstrung economy to safely inch back open; it was a fixation of many public health and privacy advocates; it was the thing that was going to help us get out of this mess if we could manage the risks.

Yet nearly three months after Google and Apple announced with great fanfare their partnership to build a contact-tracing API, contact-tracing apps have made an unceremonious exit from the front pages of American newspapers. Countries, states and localities continue to try to develop effective digital tracing strategies. But as Jonathan Zittrain puts it, the “bigger picture momentum appears to have waned.”

What’s behind contact-tracing apps’ departure from the spotlight? For one, there’s the onset of a larger pandemic apathy in the U.S; many politicians and Americans seem to have thrown up their hands or put all their hopes in the speedy development of a vaccine. Yet, the apps haven’t even made much of a splash in countries that have taken the pandemic more seriously. Anxieties about privacy persist. But technical shortcomings in the apps deserve the lion’s share of the blame. Countries have struggled to get bespoke apps developed by government technicians to work on Apple phones. The functionality of some Bluetooth-enabled models vary widely depending on small changes in phone positioning. And most countries have only convinced a small fraction of their populace to use national tracing apps.

Maybe it’s still possible that contact-tracing apps will make a miraculous comeback and approach the level of efficacy observers once anticipated.

But even if technical issues implausibly subside, the apps are operating in a world of unknowns.

Most centrally, researchers still have no real idea what level of adoption is required for the apps to actually serve their function. Some estimates suggest that 80 percent of current smartphone owners in a given area would need to use an app and follow its recommendations for digital contact tracing to be effective. But other researchers have noted that the apps could slow the rate of infections even if little more than 10 percent of a population used a tracing app. It will be an uphill battle even to hit the 10 percent mark in America, though. Survey data show that fewer than three in 10 Americans intend to use contact-tracing apps if they become available.

And given the rapid pace of reopenings in the United States—with caseloads spiking and no semblance of national test-and-trace infrastructure in sight—digital contact-tracing apps released later this year might simply come too late. Contact tracing is most productive when case counts are stable or declining and represent a small percentage of the population. In other words, the apps’ intended function may become less salient if the American pandemic continues to careen out of control. Plus, tracing will become all the more difficult if the recent surge in new cases continues to strain the country’s testing capacity. “Test and trace,” again, requires tests.

That’s to say nothing of all the epidemiological unknowns. If for example, the virus remains aerosolized and lingers in the air longer than originally thought—as some scientists have argued—an app that only logs person-to-person interactions will miss infections that occur when an infected person leaves a room and another enters sometime later.

Perhaps some contact-tracing app will prove Boris Johnson wrong. But nothing really has so far.

What follows is a detailed overview of how contact-tracing technology has fared in the U.S. and around the world.

The U.S. Landscape

Despite Apple and Google encouraging each country to build only a single contact-tracing app, the U.S. has developed a patchwork of apps. Like many aspects of the fractured American response to COVID-19, contact-tracing decisions are being made at the state level. This has raised concerns that the panoply of U.S. apps risks confusing users and could make it harder to track COVID-19 exposure when people travel across state lines. What’s more, it has produced an enormous variation in state efforts. While some states have developed apps that rely on GPS technology, others have opted to employ the Bluetooth protocols developed by the two tech giants. The majority of states, though, currently have no plans at all to develop a contact-tracing app.

North Dakota, South Dakota, Wyoming, Rhode Island and Utah have all launched apps relying on GPS, rather than the Apple-Google API, but none of the apps has been widely adopted.

On April 7, North Dakota Gov. Doug Burgum and the North Dakota Department of Health launched a free mobile app, called Care19, to trace the spread of the novel coronavirus in the state. A Microsoft engineer developed the app for free based on an app he had previously designed, BisonTracker, which allows North Dakota State University football fans to track each other on their annual trek to Texas for the national championship.

South Dakota became the second state to utilize Care19—which has been renamed Care19 Diary—and the state’s governor has urged residents to download the app in order to facilitate South Dakota’s contact-tracing program. But the app has received substantial negative attention on close scrutiny. Care19 was found to be sending location data and a unique user identifier to Foursquare and Google, despite claiming not to share any data with third parties. North Dakota residents, as well as a Wall Street Journal columnist, have also raised concerns about inaccurate records of their movements. And as of June 11, only about 34,600 people in North Dakota had downloaded the app—less than 5 percent of the state’s population. In fact, the Care19 app has yet to identify a single asymptomatic carrier, according to one report. But these difficulties haven’t eliminated all interest in the app. Wyoming announced on July 2 that it had entered into a partnership to offer the Care19 Diary app to its residents as well.

Utah announced the launch of a voluntary tracing app, called Healthy Together, on April 22. If an individual tests positive, public health officials could use the app to access a list of contacts and past locations. Healthy Together—which was designed by the social network startup Twenty—claims it relies on a combination of GPS, WiFi, IP address, cellular location data and Bluetooth to identify contacts. But Utah’s app has never been able to track device-to-device contacts—and now it doesn’t track anything at all. State leaders announced on July 9 that they will turn off the app’s location tracking function—its key feature—and instead use it as a wellness checker and source for public health information. “We’ve learned over the course of the past three months that location tracking isn’t popular,” said state epidemiologist Dr. Angela Dunn. Only 75,000 users, or less than 3 percent of the state’s population, have installed the app. And only about 200 users have agreed to hand over their location data to help with contact tracing. Meanwhile, state lawmakers have raised concerns about the app’s $2.75 million price tag, as well as the monthly maintenance fee of $300,000 that the state pays to Twenty. One state representative called the app “a really expensive WebMD.”

On May 19, Rhode Island launched the “Crush COVID RI” app, which collects 20 days worth of travel history. The app, developed in partnership with Infosys, uses GPS data to store the locations where users spent at least 10 minutes. If a person tests positive for COVID-19, a state contact tracer will ask for access to their “location diary.” On July 10 the state rolled out a new version of the app with increased functionality and new features. Close to 10,000 people downloaded the state’s app in the 24 hours after it was released, and it has since been downloaded around 60,000 times. Meanwhile, Salesforce has built software for the state—largely for free—that assists the Rhode Island Department of Health with contact tracing. The apps are part of a rare success story in Rhode Island, which was the first state to test 20 percent of its population. Politico writes that Gov. Gina “Raimondo copied the playbook of nations like South Korea and New Zealand that have fared much better than the United States in battling the virus—intensive testing, tracing and isolation plus wear-your-damn-mask policy and messaging—while adding innovative twists through uniquely American public-private partnerships.”

Perhaps most surprising: despite early hype about the Apple-Google API, only Oklahoma, Alabama, South Carolina and Virginia currently plan to use the Silicon Valley companies’ protocols. The Apple-Google system uses Bluetooth beacons to log the phones that a user’s cell has been near and anonymizes the data. The technology relies on a decentralized system—meaning that an individual’s data is stored locally on their phone rather than in a central database accessible to app developers or government officials. Virginia and Oklahoma have both finalized contracts with developers to build bluetooth-based contact-tracing apps. South Carolina’s bluetooth-based app will be developed by the Medical University of South Carolina. In Alabama, a Birmingham-based tech company is collaborating with the state public health department to develop an app based on the tech giants’ API, and they say its first use will likely be among students at the University of Alabama when they return to campus in the fall. None of the apps that rely on the Apple-Google API has yet been released.

Many states, though, have no plans at all to develop a contact-tracing app. For instance, New Jersey Governor Phil Murphy told reporters in early June, his state “is neither pursuing nor promoting exposure notification or digital alerting technology,” relying instead on human contact tracers who will call individuals directly. Other governors have taken the same approach: California, Colorado, Connecticut, Delaware, Georgia, Idaho, Indiana, Iowa, Louisiana, Maryland, Montana, New Hampshire, New Mexico, Tennessee, Texas, Vermont and Wyoming have all confirmed they aren’t currently developing digital contact-tracing apps.

Most of these states have instead prioritized human-led efforts to track the virus. As of June 17, the U.S. had over 37,000 contact-tracing workers, according to an NPR survey, including 2,500 staff in Massachusetts and 6,100 in New York state. Illinois is looking to hire at least 4,000 contact tracers by the end of June. Just like digital contact-tracing apps, though, traditional tracing methods have also faced difficulty. New York City, an early epicenter of the outbreak in America, has hired 3,000 contact tracers—but early results indicate that tracers have struggled to locate infected people or gather information from them. Only half of those who recently tested positive for COVID-19 provided information to the city’s team. Meanwhile, Massachusetts drastically scaled back its state contact-tracing effort—removing almost three-quarters of its staffers—after complaints from local health officials that it was unreliable. And across the U.S., the number of contact tracers is far short of what is likely required; On June 23, Centers for Disease Control and Prevention Director Robert Redfield told Congress that the U.S. will need 100,000 contact tracers to successfully track the spread of coronavirus. Only seven states have met the public health standard, which recommends that a state have at least 30 contact tracers for every 100,000 people.

In some states, there is ideological opposition to any form of contact tracing—which may contribute to governors’ hesitance to act. In Texas, for example, about 1,500 co-plaintiffs, including one current state representative and four former state representatives, filed suit on June 15 against Gov. Greg Abbott over the state’s $295 million contact-tracing program, alleging that the program violates provisions of the First, Fourth and Fourteenth Amendments.

Some municipalities and counties have stepped into the fray as well. For instance, Teton County, Wyoming—home to Yellowstone National Park—signed up for MIT’s PathCheck SafePlaces app. The MIT app, which uses both GPS and Bluetooth, allows users to compare a diary of their location data on their smartphones with “anonymized, redacted, and blurred location history of infected patients,” and allows them to check if they have crossed paths with someone who subsequently tested positive for the virus. But as tourists began to arrive for the summer, the app still wasn’t ready. It only became available for download on June 29.

In the coming months, the greatest uptake of COVID-19 contact-tracing apps in the U.S. may occur at an even more immediate level: on college campuses and at individual companies. Jonathan Zittrain has called this the “Company Town Model” of contact tracing, in which some big companies and institutions decide to implement their own test and trace regimes as employees return to workplaces and students come back to campus. The University of Alabama System said it will encourage students to download its contact-tracing app when students and staff return to campus in the fall. The University of Arizona likewise plans to ask students to use a bluetooth-based app during their fall semester. The Chicago-based technology firm AltumAI has rolled out an app that will include a “worker proximity feature” to help employers mitigate the risks of employee COVID-19 exposure. Professional services company PwC is likewise marketing a contact-tracing app to companies seeking to reopen their offices. And public health officials appear to be working to access location data gathered through other means; for example, Uber has launched a platform to give public health officials quick access to data on drivers and riders who may have interacted with someone infected with COVID-19.

Contact Tracing Abroad

Contact-Tracing Apps in Asia

China, first to witness a COVID-19 outbreak, was also the first recorded using contact-tracing apps—as early as February. China’s tracking services are locally managed and employ disparate techniques, but all incorporate a number of parallel data streams that only such a robust authoritarian system could collect. Such streams include national databases that are tightly integrated with the private sector in two ways. First, shops, workplaces and transit require that customers and employees display a QR code indicating a person’s health status or infection risk. Second, many utilize popular domestic “super apps”—indispensable for daily life—like Alipay, WeChat and QQ to generate and query these codes. Use of the apps is only possible after registration with a phone number, name and ID number to allow cross-referencing with surveillance data--sometimes including facial recognition databases. International press raised concerns that the surveillance behemoth may not have worked all that well, detailing a pattern of false negatives due to early reports of under-diagnosing and a shortage of tests, the latter of which continues to hinder contact-tracing efforts globally. Either way, the surveillance system played a mere accompanying role in China’s system: complete shutdowns of cities across the country were the main tool that helped to stamp out the virus.

Global interest in contact-tracing apps piqued after initial reports touted technology’s role in enabling South Korea to stifle its coronavirus outbreak. As New York hospitals scrambled to find ventilators, the Times ran a story representative of worldwide fixation with South Korea’s quashing of the virus: “How South Korea Flattened the Curve,” the Times headline read. “Lesson 3” from the South Korean experience? “Contact Tracing, Isolation and Surveillance.” Western countries were less eager to emulate China’s heavy-handed approach, but democratic South Korea at first seemed a more instructive model.

South Korea deployed an intricate location-tracking system to identify vectors of infection. Early on, the government “created a public database of coronavirus cases that provides extraordinarily detailed information about every infected individual, including their exact movements around the country.” Location data from credit card purchases, CCTV footage and standard cell phone location data fed into the database, offering a robust baseline of government-aggregated data. The government then supplemented this foundation with location tracking—not through government apps, but by siphoning location data from phone companies and privately-developed apps—that helped authorities map the exact whereabouts of infected persons and fed the database with personal information about an infected or potentially infected person.

The government fused these tracking tools together to create a system that not only monitors the whereabouts of infected individuals but publicizes anonymized information about where infected individuals have been. Public websites catalog the movements of those infected and the government pings the potentially exposed with a text alerting them of coronavirus cases nearby.

All the excitement for South Korea’s efforts felt warranted; its surveillance behemoth effectively contained the virus without nosediving its economy. The country went from nearly 1000 new cases per day at the end of February to 64 new cases per day a little more than three weeks later.

But South Korea’s success depended largely upon a confluence of idiosyncrasies. As Brian Kim has explained, the country has a bespoke legal regime—developed after its largely botched response to the 2015 MERS outbreak—that explicitly allows for aggressive public health surveillance. And more than half of the initial infections came from one, extremely controversial, cult-like Church in Daegu, increasing public support for an invasive government response and making tracking more straightforward. Plus, South Korea has an unusually high-rate of smartphone use—nine out of 10 South Koreans have a smartphone—facilitating near-ubiquitous tracking and notification. The real kicker: South Korea quickly developed an industrial-scale testing apparatus that worked in tandem with the tech; test and trace doesn’t work without the “test” part.

Singapore’s early roll-out of a Bluetooth-tracking app also attracted praise, particularly since its comparatively privacy-protective design seemed more likely to gain traction in surveillance-phobic countries. The government’s optional “TraceTogether” app launched on March 20 and as of late May had made its way onto the mobile phones of 1.4 million Singaporeans. The software uses Bluetooth chips to identify users who have spent 30 minutes or more within two meters (a bit more than six feet) of each other.

But early excitement about the app faded as TraceTogether struggled to navigate a series of technical hurdles. Researchers using a version of the app found the app’s functionality to vary depending on minor differences in positioning. As Science Magazine explains, the researchers “found that when people sat across a table from each other, signal strength was much lower if their phones were in their pockets than if they set the phones on the table. Sometimes, the strength of the signal increased as people moved farther apart—potentially because of reflection off of metal surfaces such as supermarket shelves.” And government officials have conceded that the app doesn’t work well with iOS devices because Apple phones suspend use of Bluetooth scanning if the app is only running in the background. Motivated by those snags, the government has pursued an alternative, introducing the standalone “TraceTogether Token.” This wearable tracker has no internet or GPS connectivity and works only by having infected people turn over their data to public health authorities upon a positive diagnosis.

And then there’s India. Aarogya Setu, the country’s contact-tracing app, got 100 million unique users (more than 20 percent of India’s smartphone owning population) in 41 days after its release. The impressive initial download numbers shouldn’t be taken as a sign of the app’s natural popularity; the government made the app a required download for those resuming work and using the Delhi metro (and effectively mandatory for those who want to use many other forms of public transit). The app tracks user data on two fronts: it uses both Bluetooth and location data to monitor users’ movements and it allows users to self-report symptoms and potential exposures. As Siddarth Sonkar, writing for India’s Centre for Internet & Society, explains, the app “collects real-time location data of users every fifteen minutes to facilitate digital contact tracing” and “color-codes users indicating the extent of risk they pose based on their health status and predicts hotspots which are more susceptible to COVID-19.” The government has touted the efficacy of the app, reporting that it predicted 650 transmission hotspots and flagged 300 other potential hotspots. But Sonkar notes that the government has thus far furnished little evidence to support claims about the app’s efficacy.

Countries all over the world have rushed to emulate the perceived successes of South Korea and Singapore, in particular. Different places have experimented with different technological architectures, although very few have achieved meaningful epidemiological results through their software. Broadly speaking, a couple of fissures have emerged among the technical frameworks countries have chosen to use. First, there’s a split between countries that have opted for location tracking and those that have opted for the more privacy-protective Bluetooth model, which records when a device is in close proximity to another device. On top of that, some countries use a centralized model of data collection where public health authorities can access the information collected by the apps, while others have gone with a decentralized version where data remains anonymized and is not shared with public health officials. There’s also a divide between countries that have adopted the Google-Apple API and those unwilling to accept the stringent conditions the Silicon Valley giants have placed on those wishing to use their protocols. But slowly these differences have eroded. More than three months into the global pandemic, countries have begun to coalesce around a single model: Google and Apple’s Bluetooth-based, decentralized API.

Europe encapsulates this trend.

Contact-Tracing Apps in Europe and Five Eyes Countries

At first, different European countries forged ahead with a range of different technical models. Norway developed a centralized model that relied on real-time GPS tracking data. By early June, the app had around 600,000 active users—about 14% of the country's population older than 16. Norway’s Scandanavian peer, Iceland, went with a similar framework. The Icelandic app launched in early April and is administered by teams of health officials who interview COVID-positive people about where they’ve recently been, and supplement that information (if the infected individual consents) with location data from the app. The app achieved a large penetration rate with nearly 40 percent of Icelanders downloading the app.

The United Kingdom’s National Health Service began to pilot its centralized, Bluetooth-reliant app on May 5 in the Isle of Wight, an island in the English Channel a couple of miles below the southern English coast. The government lauded the success of the pilot, boasting that more than 40 percent of the island’s 140,000 residents had downloaded the app.

And France released its Bluetooth-based, but centralized, StopCovid app on June 2. The app works slightly differently from other Bluetooth apps. As TechCrunch’s Romain Dillet explains, if “you’re diagnosed COVID-19-positive, your doctor, hospital or testing facility will hand you a QR code or a string of letters and numbers. You can choose to open the app and enter that code to share the list of [regularly generated, random] IDs of people you’ve interacted with over the past two weeks.” The release of the French app followed months of hand wringing between the French government and Apple. BBC described the nature of the dispute, reporting that the French government tried to push Apple to let the app work “in the background on iPhones without building in the privacy measures the US company wants.” Cédric O, France’s junior minister for digital affairs, expressed discontent with the California company: “It is highly abnormal that you are constrained as a democratic state in your technical choice because of the internal policies of two private companies,” O lamented.

Some countries in Europe opted for the Apple-Google API from the get-go. Baltic nation Latvia became the first country to launch an app with the Apple-Google tool when its “Apturi Covid” launched on May 29. Like all of its cousin apps that borrow from the Silicon Valley framework, Apturi Covid relies on a decentralized Bluetooth system. Likewise, the Swiss parliament approved use of an Apple-Google API-enabled app in early June, and SwissCovid launched on June 25 (after an extensive pilot test conducted among certain arms of the federal government). And big players in Europe have also sided with Silicon Valley: both Germany and Italy have launched Apple-Google API apps, with Germany borrowing some of Italy’s code for its app. Germany managed to get 6.5 million downloads on its “Corona-Warn-App” within 24 hours of launch. Italy resorted to the Apple-Google framework only after a failure in testing other trackers—Italy’s minister of technology, Paola Pisano told the Times that the country couldn’t manage to integrate a centralized model with the privacy-protective operating system that Apple uses on its phones. Italy’s Google-Apple app has achieved only modest traction—as of June 16, 2.7 million downloads out of the country’s population of 60 million—and the Times attributes part of the lag to “myriad layers of Italian bureaucracy and regional opposition,” which worsened delays in launching the app.

The Republic of Ireland also opted to use the Apple-Google API and appears to have produced one of the region’s most successful apps. The app launched on July 6 and was downloaded 1.3 million times in eight days, making it the fastest-downloaded app in Europe. The company that developed the tracing app plans to launch an interoperable app in Northern Ireland within the coming weeks—one of the first systems that can trace contacts across a border.

But things have not gone well for those seeking to avoid becoming enmeshed in Silicon Valley’s net. Amnesty International criticized Norway’s location-tracking app as among the world’s most invasive (a title it shared with Bahrain and Kuwait). And on June 15, the country’s own Data Protection Authority—an EU-mandated independent public authority which investigates and enforces domestic violations of European data protection laws—put the kibosh on the app. The watchdog took issue with inadequate anonymization procedures, the use of data for research purposes without user consent and the accuracy of the app in a country with very low rates of infection. And on July 7 the data watchdog formally banned all processing of personal data associated with the app. Likewise, Iceland’s location-tracking app has gotten lukewarm reviews from those involved with the program: “The technology is more or less … I wouldn’t say useless,” conceded Gestur Pálmason, a police detective inspector who is overseeing the contact-tracing effort.

The initial U.K. app found no more success than its Scandinavian counterparts. First came reports that the impressive trial adoption figures might have been overblown and then in a June 18 about-face, the government admitted that the centralized app had run into the same problems meshing with iPhones that had plagued other countries--the app only registered one in 25 contacts between users when downloaded on an iPhone. (Britain’s human contact-tracing effort has also been a dud). The government has now reached for an alternative, teaming up with Apple and Google to piggyback on their API.

France remains the only major holdout in Europe.

The French government has stuck with its bespoke app, despite the app’s largely unsuccessful initial rollout. In the app’s first week on the market, only about 2 percent of the French population downloaded it; two weeks into the app experiment, a researcher discovered that the app collected more personal information than it advertised; and after three weeks, the government reported dismal functionality stats: 68 people using the app have tested positive and only 14 people total have received notifications that they may have been within transmission distance of an infected user. EU Commission Vice President Margrethe Vestager scolded France for its recalcitrant stance toward shifting to the Apple-Google model; the EU has aspirations to make the apps on the continent interoperable in order to facilitate safe movement between countries and Vestager cautioned that France’s app will struggle to work in tandem with the Apple-Google apps popular among its neighbors.

Europe’s Apple-Google apps have had their own problems but have not yet fallen out of favor. In Germany, for example, users who haven’t recently updated their Apple operating systems can’t use the app. In Italy, politicians have bandied around misinformation of all types about the app: Matteo Salvini of the nationalist League party erroneously suggested that private sector partners involved with the app could pass private health data to business colleagues in China; the country’s foreign minister overhyped the app’s capabilities.

Other Five Eyes countries have made their own forays into contact-tracing apps.

Early on, Australia developed a centralized, Bluetooth-based app. The app launched in late April but has been hamstrung by technical issues since its release. In mid-May, after the app had been on the market for more than a month, the Guardian reported that no Australian state had made use of the app’s data because of technical problems. The app has struggled mightily to log encounters between phones when one user’s iPhone was locked; for some devices, the app worked only 25 percent of the time. The app managed to court more than six million users after more than two months on the market but has failed to detect a single coronavirus case that manual trackers hadn’t already found. The Australian government nonetheless remains committed to its app: the country’s Deputy Chief Medical Officer Nick Coatsworth commented that “there’s no way” Australia will move to the Apple-Google model.

Canada announced on June 18 that it will develop a national app to be released in July. It relies on the Bluetooth-based, decentralized Apple-Google API, and has been developed by the Canadian Digital Service and the Ontario Digital Service. The tracing app, called COVID Alert, was initially scheduled to be launched in the province of Ontario on July 2, but its rollout has been delayed and government officials have not announced a new release date. The province of Alberta has been using its own app, called ABTraceTogether, since May 1. Over 186,000 Albertans have downloaded the app—about 4 percent of the province’s population. But it has faced usability problems on both iPhone and Android devices, and the province’s privacy commissioner has claimed the app could be a “security risk” if used on an Apple device. And some experts are skeptical that the national contact-tracing app will help Canada combat COVID-19. Teresa Scassa, the Canada research chair in information law and policy at the University of Ottawa, told reporters: "I'm not convinced that this is going to be a success and I think the important thing to remember is that contact tracing apps have now been launched in many different countries and it's not clear that they've been a success anywhere that they've been launched.”

Contact-Tracing Apps in the Middle East and Africa

More diverse approaches exist outside of Europe and North America. In the Middle East and North Africa, Israel and the Gulf countries led the way with native solutions early in the pandemic. Most governments in the MENA region have tackled the problem with state-sponsored apps—some required, some voluntary. Israel has used two technical solutions and has a third on the way.

Israel’s cabinet passed an emergency law that first authorized the role of the Shin Bet, Israel’s security service, in an overnight session on March 16 that did not allow any time for the Knesset to discuss or approve the measure. Netanyahu's administration gave the spy agency the power to use technology for the pandemic that’s usually reserved for counter-terrorism. The Shin Bet system collected cell phone location data and stored it for 30 days. The security agency was also able to collect the previous two weeks of location information on confirmed positive cases. While the Shin Bet was not allowed to use the data for any purposes other than contact tracing, the emergency law authorized Israeli police to track the cellphones of confirmed or suspected positive cases.

The government’s approach was met with staunch opposition from lawmakers. When the government requested a renewal of the powers for six more weeks on May 5, opposition party leader Yair Lapid argued the need to discuss the proportional cost of the invasive tracking, wondering aloud, "In Israel there are many traffic accidents. If the Shin Bet could trace the speed of every car, would that justify tracking each and every driver?" The Knesset agreed to a three-week extension after data presented by the government showed that the Shin Bet was responsible for finding 3,835 of the 5,516 cases discovered with tracing.

Earlier on March 23 and as infections crossed the 1,000 case threshold, Israel’s Ministry of Health also launched a voluntary app, HaMagen, which automatically notifies users if they have come into contact with someone who has tested positive for the virus. Location data stays on the user’s device without being uploaded to a centralized server. This differs from the Shin Bet solution, which tracked location data remotely and stored it on centralized databases that telecom companies and Shin Bet could access. HaMagen has been downloaded more than 2 million times.

Israel’s Supreme Court ruled on April 26 that the Shin Bet’s monitoring of citizen phones could not continue without specific statutory authorization beyond the ISA law that gives the Shin Bet its general operating authority. After Shin Bet Chief Nadav Argaman requested that it not be involved in the tracking of civilians, the Knesset put on hold a bill that would have provided the necessary legal backing for Shin Bet tracking on June 8 and the organization announced that it had ceased its mass surveillance on June 9. But parliamentary negotiations over the security service's role nonetheless continued. After weeks of negotiations and despite the continued opposition by Argaman, the Knesset ultimately passed a temporary law that authorizes Shin Bet tracking until July 22 with no possible extensions. Meanwhile, the government continues work on a HaMagen 2 app along with Bluetooth tracking bracelets to be worn by those who do not have smartphones, namely the ultra-Orthodox, elderly and children.

The third contact-tracing technology out of Israel, Fleming, was developed by the controversial NSO Group and is being marketed to a range of governments, though it has not yet been released. The firm is best known as the creator of Pegasus, a piece of software used to hack and collect information from iOS and Android devices, which was allegedly used by the Saudi government to spy on Jamal Khashoggi and Jeff Bezos. Fleming employs artificial intelligence to enable governments to track the spread of the coronavirus within their borders, monitor quarantines and even estimate economic impacts. Most information about Fleming comes from security researcher Bob Diachenko’s discovery of an unprotected server containing a database that showed that Fleming was being tested in Israel, Saudi Arabia, the United Arab Emirates and Rwanda.

Shortly after Israel released HaMagen, Bahrain was the next Middle Eastern country to launch a contact-tracing smartphone application with the Information & eGovernment Authority’s (iGA) homegrown app BeAware on March 31. The app, which must be linked with a national ID number, uploads GPS and WiFi location data to a central server so the government can perform contact tracing and call in users for testing. It also links with an electronic bracelet over Bluetooth for quarantine enforcement. The app was not made mandatory but saw widespread adoption—more than 635,000 downloads, which exceeds 40 percent of the population.

The BeAware app met skepticism, however. Amnesty International called out the app, along with those of Norway and Kuwait, as being one of the worst for privacy because of the centralized and non-anonymous nature of location data collection. Claudio Guarnieri, Head of Amnesty International’s Security Lab, said, "They are essentially broadcasting the locations of users to a government database in real time - this is unlikely to be necessary and proportionate in the context of a public health response. Technology can play a useful role in contact tracing to contain Covid-19, but privacy must not be another casualty as governments rush to roll out apps." Amnesty specifically pointed to a government television program “Are you at home?” that distributed tens of thousands of dollars of prizes daily to random citizens who were staying at home through the holy month of Ramadan, a time during which families and friends traditionally have large gatherings in their homes. iGA later added an opt-out feature to the app, but it still uploads location data in realtime for all users unless they choose to revoke location permissions from the app.

Other countries on the Gulf soon followed Bahrain with their own apps. Kuwait, the UAE, Qatar and Oman all released apps that use a combination of location data and Bluetooth tools (whether to detect nearby users or to connect with electronic wristbands) to enforce quarantines, trace contacts and communicate with users. Kuwait’s app, Shlonik, constantly tracks user locations in the same way as BeAware Bahrain. Qatar’s EHTERAZ has the same functionality, although it has not yet been enabled and user tracking is only turned on presumably for some users. The more pressing problem with EHTERAZ was the potential data leak of all of its users, discovered by Amnesty International and patched by Qatari authorities the following day. The vulnerability was especially concerning because Qatar had made the app mandatory the previous week.

Saudi Arabia, the largest country in the Gulf region, notably waited until the Apple-Google Bluetooth API was available to develop a contact-tracing app in June. The kingdom’s response has been marked by a dizzying array of smartphone applications, including one for movement permits, three for booking health appointments (two of which precede the pandemic) and one for isolation enforcement and test results. It may be too early to judge the efficacy of the kingdom’s more privacy-preserving approach, but the app came much later than its neighbors’ and despite its population of over 30 million, the Google Play store only reports 100k+ downloads, indicating that the number of people using the app on Android is less than 500,000. No download count data is available from the Apple Store or official sources.

North Africa, Morocco, Algeria and Tunisia each have their own apps as well. Morocco’s Wiqayatna uses Bluetooth received signal strength indication (RSSI) in a manner compatible with Singapore’s BlueTrace protocol—the questionable necessity of a compatible app between the two countries on opposite ends of Afro-Eurasia notwithstanding. With more than one million downloads on Android alone, it appears to have the highest adoption count among contact-tracing apps for African countries. Algeria’s app tracks user location but only uploads the data if the user reports having symptoms of the coronavirus. Tunisia’s E7mi takes a different approach by performing Bluetooth scanning and uploading all contact between any two users of the app to a central server, keeping a record of all contact for 14 days. While E7mi is managed by Tunisia’s Observatory of Emerging Diseases, the stored personal data is under the control of the national data protection authority.

Subsaharan Africa has an even greater diversity of approaches with limited adoption, Android download counts numbering as low as under 500 for South Africa’s Covi-ID. What may unite the continent is the widespread use of human contact tracers, a practice honed in West Africa during the 2014-16 Ebola epidemic. Across the continent, Zimbabwe has adapted software used for tracking polio to help limit COVID-19’s spread.

A recognition of relatively lower smartphone penetration has led to the adoption of manual contact tracing along with the use of QR code alternatives, such as in South Africa and Botswana. Ghana developed an official app that accesses location information and includes a survey to check symptoms, although adoption seems low with fewer than 5,000 downloads on the Google Play Store. Some questioned the use of spending money on developing a solution that only a small portion of the population could use.

A number of African countries have also decided to partner with other governments in developing their solutions. Sierra Leone is using the Dimagi Commcare app along with US cities San Francisco and Santa Clara. The West African nation was also the subject of a recent study that highlighted the difficulty of using smartphone apps for Ebola contact tracing. Senegal is a member of the Coalition Network along with the French government, the City of Berkeley California and other private bodies. Coalition Network developed the Coalition App which is built on the Whisper Tracing Protocol. It works with a wearable called Nodle M1, a device designed for the workplace to “buzz” workers when they get too close to each other and slated for release in October 2020. Apart from being used as a testing ground for NSO Group’s Fleming app, Rwanda shares another similarity with Israel in using cell site location information for contact tracing.

Neighboring Uganda and Kenya may stand alone among African nations in having startup-made solutions with seemingly no publicly-available government application. Uganda’s Ministry of Health reports that it has an app, although it is not on the Google or Apple app stores and its privacy policy is unavailable, despite reports to the contrary. On the startup side, COVID Tracer is only available by an APK download and claims to use “blurred” location history along with Bluetooth history to equip public health officials with information for contact tracing. It is not clear how the blurring is being done or how it effectively traces contact history with blurred data. Kenya’s startup scene has produced a number of applications that have appeared in local news and are vying for government support. The only one accessible on the Google Play Store, MyRide Africa, is focused on helping government officials trace contacts over public transport. The app is integrated with the country’s M-Pesa money transfer service to encourage adoption. Another, Kovitrace, is built specifically to allow back-end government access if adopted by the government, but it, also, is not on the Google or Apple app stores.