Regional Approaches to COVID-19 Contact Tracing
Jaymi Thibault, MPP Candidate 2021, Duke University Sanford School of Public Policy
As of February 2021, 22 states have developed mobile contact tracing apps. Many of these apps were not built to function across state lines. This lack of interoperability may seem insignificant, but mobility data reveals that it is cause for concern. A growing number of Americans are traveling out of state, and air travel during the pandemic recently hit a new high.
While Americans have generally been free to cross state lines during the pandemic, interstate travel presents challenges for contact tracing technology. In the absence of a national approach, contact tracing apps are rendered useless when users leave the state. Since a national contact tracing app appears unlikely for the US, developers must find ways to ensure that contact tracing apps can function across state lines.
One long-term solution is for states to connect their app data to a national key server developed by the Association of Public Health Laboratories. The server allows participating states to host their app data in one central location, rather than having to build and maintain their own individual servers. All 22 states with a digital contact tracing app are currently connected to the key server.
By hosting data from various apps, the cloud-based server ensures that “users can find out when they may have been exposed by users from other states.” The server is considered secure because the only data it hosts are anonymous Bluetooth “keys,” which are essentially random strings of numbers assigned to users. These keys are not tied to a user’s identity, and they change every 20 minutes for an added layer of protection.
However, before the national server saw widespread adoption, several states had already attempted to address the challenge of cross-state interoperability by implementing regional contact tracing strategies. These states fall into two geographic categories: the Great Plains and the Mid-Atlantic.
The Great Plains Approach
The Great Plains contact tracing approach has consisted of two mobile apps: a digital diary app to help users remember their recent locations (the “Care19 Diary”), and a second app to notify users of possible COVID-19 exposure (“Care19 Alert”). North Dakota, South Dakota, and Wyoming all use some combination of these two apps.
North Dakota and South Dakota first launched the Care19 Diary on April 7, just 25 days after President Trump declared a national emergency. The two states were well-poised to launch one of the first contact tracing apps in the nation because the Care19 Diary was “built on top of a program designed to follow the movements of North Dakota State University football fans.” The app was initially exclusive to iPhone users, but was later made available to Android users on April 21. ProudCrowd, the app’s developer, granted the North Dakota Department of Health a year-long license to use the Care19 Diary app for a fee not to exceed $9,500.
Despite these data sharing concerns, Wyoming announced that Care19 Diary would be made available on July 1st. In making this announcement, Governor Mark Gordon emphasized that “privacy is protected” within the app. ProudCrowd CEO Tim Brookin echoed this sentiment, stating that the app was built “with privacy as our primary design point.”
On August 13, North Dakota and Wyoming announced the launch of their second contact tracing app, Care19 Alert. South Dakota chose not to release the app for undisclosed reasons. Care19 Alert is meant to supplement the Care19 Diary by notifying users if they were within six feet of someone who tested positive for COVID-19. However, Care19 Alert does not require that users download Care19 Diary; both Care19 apps are capable of functioning on their own.
Care19 Alert was also developed by ProudCrowd, but unlike the Care19 Diary, it does not collect location data. Instead, the app uses the exposure notification system (ENS) application programming interface (API) created by Apple and Google. This API is considered a decentralized approach, meaning identifiable user data is not stored on a central server controlled by a government or health authority. Instead, limited user data is stored on the user’s own device.
The API allows the app to exchange random keys with other nearby devices through Bluetooth every 15 minutes. The device will periodically check for keys that match up with users who have tested positive for COVID-19. If a match is found, the app will notify the user with further instructions.
The Mid-Atlantic Approach
The Mid-Atlantic strategy is different from the Great Plains approach in that each state has its own app. Together, these state apps form a regional network. Delaware and Pennsylvania were the first states to launch their contact tracing apps in early September 2020. New York and New Jersey joined shortly after in October. Connecticut and Maryland also launched apps in November, but it remains unclear whether their apps have officially joined the network.
These apps, titled “COVID Alert” followed by each state’s abbreviation, function much like the Great Plains’ Care19 Alert app. They use the same API provided by Apple and Google, and they use Bluetooth rather than location data. Like Care19 Alert, the Mid-Atlantic apps exchange random keys with nearby devices every 15 minutes. If a user is found to have been in close proximity to someone who tested positive for COVID-19, the app will alert them and provide further guidance.
The Mid-Atlantic apps were created by Nearform, an Irish developer. Nearform had previously developed contact tracing apps for Ireland, Scotland, Gibraltar, and the island of Jersey. The Irish app – COVID Tracker Ireland – was considered a great success, as roughly 37 percent of the country’s adult population had downloaded the app within just one week. Nearform’s source code was initially made available through GitHub in the summer, which allowed other public health authorities and developers to use and customize the code. Delaware, New Jersey, and New York have not released the details of their contracts with Nearform, but Pennsylvania signed a $1.9 million deal requiring Nearform to deploy and maintain the app. This contract was funded through federal grant money.
Nearform is similar to ProudCrowd in that it has emphasized privacy when promoting its app. However, one may argue that Nearform has a more established record when it comes to demonstrating privacy. Before Nearform launched its original contact tracing app in Ireland, the developer built a team to ensure that “the issue of privacy was front and center” throughout the whole development process. The team consisted of members from Ireland’s Office of the Government Chief Information Officer, Economic and Social Research Institute, the Central Statistics Office, data protection officials, the national police service, the Irish Army, and Science Foundation Ireland. Nearform also designs its apps to follow the “Privacy by Design” framework developed by Ann Cavoukian, former Information and Privacy Commissioner of Ontario.
Comparing the Two Approaches
The Great Plains approach certainly beat the Mid-Atlantic approach in terms of timeliness. Care19 Diary was launched in early April, more than four months before Delaware and Pennsylvania launched their apps. But has this timeliness mattered, and are users satisfied with the apps? Did they adequately provide for privacy and security?
The Care19 Diary currently has a 3.2 rating on the Google Play store. Some reviewers complain that the app requires frequent maintenance, while others note that the list of recently visited locations is not accurate. Care19 Alert has a slightly higher rating, currently at 3.5. Many of Care19 Alert’s reviews are positive, but several mention a bug where users cannot get past the app’s initial screen. Others question the effectiveness of the app; one reviewer was notified of exposure by a manual contact tracer, but claimed she never received an app notification despite both parties using the app.
ProudCrowd personally responds to many reviews on the app store. It has adapted both apps over time in response to specific user requests and a handful of negative reviews in an effort to improve user satisfaction. For example, after several users requested the option to manually add locations on Care19 Diary, ProudCrowd updated the app to allow this.
The Mid-Atlantic states have higher ratings on the Google Play store. Delaware currently has the highest rating at 4.3, while New Jersey and New York both have ratings of 4.1. Pennsylvania has a slightly lower rating of 3.7.
Both approaches have one thing in common when it comes to user satisfaction: users are typically very pleased with the app, or very unhappy – few app users who have rated the products fall somewhere in the middle. Generally speaking, the majority of reviews for both the Great Plains apps as well as the Mid-Atlantic apps are either 5 stars or 1 star. Few users have rated the app between 2 and 4 stars.
Effectiveness is much harder to measure. App uptake has been slow in the Great Plains region. Out of 90 Care19 Alert users in North Dakota that tested positive for COVID-19 between April and October, only 29 chose to notify their close contacts about potential exposure. In North Dakota and Wyoming, less than three percent of the population are using the apps.
Adoption of contact tracing technology has been slow in the Mid-Atlantic as well. In these states, between 2.5 and 6 percent of the population have downloaded the apps. Pennsylvania’s app distributed potential exposure notifications to 22 people in its first month. Unfortunately, the New York Department of Health has declined to provide similar data, citing concerns about “user privacy and security.”
Despite New York’s lack of transparency, the Mid-Atlantic apps appear to be more trustworthy in terms of privacy. COVID19 App Tracker, a website that examines privacy concerns related to contact tracing apps, has identified two dangerous permissions associated with Care19 Diary. Unlike the Mid-Atlantic apps, Care19 Diary collects both approximate and precise location data, which are both considered to be highly sensitive information.
These regional strategies are clearly not a panacea for the pandemic. Still, they do have some advantages as a supplement to manual contact tracing. While each state likely has a different process, manual contact tracers in some states will not make out-of-state calls to potentially exposed individuals. In this aspect, the apps used by the Great Plains and the Mid-Atlantic are superior.
Despite this advantage, other states are unlikely to develop similar regional approaches in the future. The Association of Public Health Laboratories’ national key server is a more feasible long-term solution. With nearly half of the nation (22 states) now participating, the server has a much greater reach than the small regional networks. Further, the server is designed to keep personal data private and secure, since it only hosts de-identified data.
Although President Joe Biden has called for a more unified approach to contact tracing, regional strategies are unlikely to play a significant role in the coming months. Thanks to the national server, such approaches are no longer necessary. Still, by providing innovative short-term solutions for addressing interstate cases of COVID-19, the Mid-Atlantic and the Great Plains were the first regions to spark important dialogue about contact tracing across state lines.