European governments are racing to develop apps that can track the spread of the coronavirus to prevent a second wave of infections when the economy reopens.
Germany is further along than most, and hopes to have an app ready to download within a few weeks. But details are scarce, and if the app is to succeed, Germans will have to overcome a widespread reluctance to share data with authorities that is rooted deep in the country’s history during the Nazi period and under Communist rule in East Germany.
“The skepticism of Germans in terms of data protection is remarkable when it comes to sharing data [with the government],” said University of Mannheim Professor Sebastian Siegloch, who has studied German attitudes toward surveillance and privacy.s
The tracing apps use Bluetooth technology to track who you’ve been around for an extended period of time, alerting you if you’ve spent time near an infected person so you can get tested and self-isolate.
French officials have said they hope to have their own contact-tracing app ready by mid-May. The United Kingdom’s version is currently undergoing tests, UK Health Secretary Matt Hancock told parliament this week.
They can be highly effective in stopping mass infections, according to Christophe Fraser, an infectious diseases expert at Oxford University, who is helping to develop the UK app and has extensively investigated outbreaks of SARS, H1N1 and Ebola. He told reporters last week that one infection can be prevented for every one to two people who use a tracing app effectively.
But to really be effective at stemming the virus, at least 60% of the population would need to download and use the app, Fraser said. That level of adoption could be challenging to achieve in Germany.
“Germans are very sensitive about [privacy and government surveillance] so it could be that they are also skeptical to use this tracing app once its ready,” said Ulrich Baumgartner, head of Allen & Overy’s German Data Protection Practice.
Germans have readily given up other fundamental rights in the wake of the virus, like going to work, traveling, and attending religious services, but sacrificing their privacy for a government-run app makes them far more wary, Baumgartner said.
“I think if the government continues to make the app a condition for being able to lift the lockdown there will be a lot of social pressure as well. My guess is a lot of people will use it but I’m not sure everyone will be happy with it,” he added.
Strict data protection legislation in Germany prevents academics from merging personal data sets such as taxes and social security, leading to a “substantial disadvantage” compared to researchers in other countries, Siegloch said.
And a proposal to use more intrusive mobile phone location data to track the virus failed to pass in the German parliament last month after protests from civil libertarians.
The privacy debate
One of the major concerns potential users have is where the data will be stored — on central servers hosted by the government or in a decentralized manner on everyone’s phones.
Privacy advocates and academics from around the world are staunchly opposed to storing the data centrally. Hundreds of them warned in an open letter that “bad actors” could use such a centralized server to “spy on citizens” and map out their social network.
Technology being developed jointly by Apple (AAPL)and Google (GOOGL) doesn’t allow data to be stored centrally. On Friday, the tech giants announced further privacy protections for their app framework, including making it optional to share a positive diagnosis, adding Bluetooth encryption and a time limit on how long a phone will record being in proximity to another.
A group of researchers, developers and scientific experts calling themselves the Pan-European Privacy Preserving Proximity Tracing (PEPP-PT), have developed the backbone of another app which has been criticized by cybersecurity experts for being too centralized. A spokesperson for the group told CNN Business their model will be able to support both a centralized or decentralized model.
Both systems work the same way for the user, alerting them when they’ve been around someone who has tested positive.
German officials have yet to confirm which system their app will use. In guidance issued last week, the European Commission recommended a decentralized approach, in which the information lives on individual phones, reducing the privacy risk.
But hosting the data centrally would allow governments to better track and study the spread of the infection in the population. And experts at Harvard University have warned of significant challenges to a decentralized system. Devices could be strained by the “massive lists of numbers” that would have to be checked by every person’s phone, and they could be more vulnerable to hackers.
Safe, anonymous and smart?
Baumgartner said Germans would download the app, especially if officials hammer home its privacy features while pushing the idea that the mass voluntary adoption would help them return to a more normal way of life.
Chancellor Angela Merkel tried to reassure Germans earlier this month, when she told reporters that the app is being developed in conjunction with the country’s data privacy minister and is undergoing tests by Germany’s national cybersecurity agency.
“A precondition for the success of the app is that it has to be safe and anonymous, and state-of-the-art in terms of the technology,” Siegloch said. “With regard to the latter I am only mildly optimistic as Germany is lagging behind in terms of digitization compared to other countries.”