State-Based Contact-Tracing Apps Are Courting Privacy Disaster

While governments around the world have launched nationwide Covid-19 contact-tracing smartphone apps over the last months, the United States has pointedly not. Instead, it seems like the apps designed to detect coronavirus exposure stateside will launch on a state-by-state basis—and they may be anything but united.

When Google and Apple officially launched their exposure notification API for Android and iOS last week, their announcement included statements from three states—North Dakota, Alabama, and South Carolina—that are already building apps that will integrate the company’s Bluetooth-based system.

But it increasingly seems that neither the Center for Disease Control, nor the Department of Health and Human Services, nor any other US federal agency will release a nationwide Covid-19 contact-tracing app. “There is no effort I know of at the national level to build anything” like a contact-tracing app, says someone familiar with the White House Covid-19 task force deliberations led by President Trump’s son-in-law Jared Kushner, speaking to WIRED under the condition of anonymity. “Just like you’ve seen with the plan on testing and reopening, it’s being pushed to the states.”

Another advisor to that task force, Andy Slavitt, who led medicare and medicaid policy in the Obama administration and reportedly offered recommendations to Kushner, tells WIRED that any contact-tracing smartphone apps are almost certain to be left to the states alone. “I don’t think the federal government wants the responsibility to figure out the best and most efficient way to execute a contact tracing app,” says Slavitt. “If it’s like everything else they’re doing, they’re going to want to make sure the states have the responsibility.” Neither the CDC nor the Department of Health and Human Services answered WIRED’s request for comment about any plans to launch a national Covid-19 tracking or notification app.

“If this is getting done on a state-by-state level or even a confederacy of states, like the Western Pact, the question is then around security and interoperability,” says Ashkan Soltani, the former lead technologist for the Federal Trade Commission, who has been analyzing Covid-19 tracing and notification apps. “If each state is trying to put this together you run the risk of commercial entities building this, the systems’ backends not being secure, and reliability issues.”

The potential for privacy disasters from contact-tracing apps have already been well demonstrated. North Dakota’s app was found to be sharing data with Foursquare and Google’s advertising system. India’s contact-tracing app made it possible to locate some Covid-19-infected users by spoofing GPS locations. And a flaw in Qatar’s contact-tracing system leaked hundreds of thousands of users’ personal data, including health status and locations.

Rather than auditing one national app for security and privacy issues, Soltani says, every state-level contact tracing or exposure notification system will have to be individually vetted for those sorts of issues. And for each one, the devil will be in the details of its implementation.

Read full story here…