Application-based contact tracing for COVID-19: the case for a common EU solution

Many were pleasantly surprised when Germany released its COVID-19 contact tracing app, Corona-Warn, on schedule and under budget. The app, designed as an open-source project by SAP in cooperation with Telekom, utilises a decentralised protocol and places a significant focus on privacy. Since its release in June, the app has been downloaded almost 17 million times. However, as countries open their borders and travel within Europe increases, there is a growing need for a European solution in order to effectively track cross-border coronavirus transmission. To do so, apps must either be interoperable – meaning that they work in every member state – or there should be an EU-wide application. The German Corona-Warn app could be the model for both ideas; the standard for interoperability, or the framework for  a common European contact tracing application.

Application-based contact-tracing is important and useful for a number of reasons. It is a much more effective form of breaking the infection chain than human-based contact-tracing, as it is much quicker, more efficient, and can make connections between people that would be otherwise hard to determine, for instance people sharing a train compartment. In a study from Oxford University, researchers modelled that if 60% of the population were to install such an application, the pandemic would be able to be kept under control, while lower install numbers can still significantly reduce the number of coronavirus cases and related deaths. This of course assumes other measures are concurrently initiated, but application based contact-tracing can clearly be a major contributor to fighting the COVID-19 pandemic.

Yet, such measures have their usefulness significantly reduced if they do not work across borders. As European borders open and travel between member states increases, cases are bound to rise as sick people take planes and trains across the continent. In order to enable effective contact tracing and reduce the spread of the coronavirus, national applications must either be made interoperable with each other, or a common EU app should be launched. Both are lofty goals, but the core idea is important. Without a common protocol or application, national apps may become ineffective.

Interoperability is a nice idea; someone with the German Corona-Warn app installed travelling through Italy would in theory be notified if they came in contact with an Italian using the Immuni app who later tests positive. This should be possible; both the German and Italian app rely on the Apple-Google decentralised standard, a prerequisite to making different apps communicate with each other. However, interoperability faces two significant challenges. For one, many countries have not yet launched an app, including Belgium, the Netherlands, and Slovakia, while others such as Greece and Bulgaria have no plans to develop one. The UK and Norway, though not member states, have encountered so many difficulties in the development of their applications that they have paused it entirely.  

Secondly, and more importantly, interoperability requires a standardised technological protocol. In order to use the Bluetooth-based Apple-Google protocol, apps must employ a decentralised protocol that cannot reveal the user’s identity. The French app, relying on a centralised protocol, can therefore not be interoperable with decentralised apps, such as those of Germany or Italy. So too is it the case with Hungary. This is because of technical limitations, but also because both tech companies have stated they will not lend their technology to states who could use it to breach human rights and the privacy of their citizens. This is not only a risk, but a reality; Amnesty International has identified a number of contact-tracing apps that indeed act as mass surveillance tools, providing identifiable data to governments in countries such as Bahrain, Kuwait, and Norway. Governments could use such detailed data for nefarious means, such as identifying the networks of regime-critical journalists or tracking political dissidents. This is a concern for the EU in these times of rule-of-law issues in certain member states. Amnesty further argues that apps which use a decentralised Bluetooth-based tracking system, such as Germany, are the ideal model, and have the least privacy concerns.

For these reasons, a decision must be made on a common protocol for EU member states. The benefits of a decentralised structure are many, and is favoured by the European Commission and various member states, including Germany. As the current President of the European Council, Germany could encourage hold-out states such as France to adopt such a model.

Yet, another option exists, one that is not dependent on the decisions of individual countries. The European Commission could develop its own application, one based on a decentralised protocol and the EU’s own strict privacy regulations. This could be quickly translated into all 24 official languages of the EU by the Commission’s army of translators, and the Commission’s strong social media presence could be used to effectively advertise the app to citizens in all member states, but especially in those states without an app (Greece and Bulgaria) or without an interoperable protocol (France and Hungary). Through the eHealth Network, the European Commission is well placed to facilitate this cross-border exchange of health data. Although this suggestion may be defeated by budgetary restrictions or the realities of European politics, it is clear from the rising COVID-19 case numbers that a solution is needed to better facilitate cross-border contact tracing.

The model for this EU-wide application could very well be the German Corona-Warn app. It fulfils all the necessary requirements, and is open-source, meaning it can be copied and edited by others. The app’s faults can be improved on, and the Commission should focus on making it work on as many phone models as possible. With this option, the Commission could quickly and cost-effectively develop an EU-wide contact tracing application, facilitating travel and enabling better cross-border contact tracing. In so doing, travel within Europe can be made even safer, providing greater economic assistance through tourism to states and reducing the burden on public health care systems. This is a necessary step, and the sooner we do it, the better. The Commission should act now.  

Image: CC TheAndrasBarta, Source: Pixabay