This post by Varvara Boboc is part of our series “Global Digital Cultures in times of COVID-19”, written by students of the research master Media Studies at the University of Amsterdam.
Contact tracing apps seem to be a worldwide solution to tackle the pandemic. However, they also increase public institutions’ dependency on private infrastructures. Is there an alternative?
Initially considered the swiss army knife of the pandemic, contact tracing apps have sparked controversy. Not only do they trigger privacy considerations and generate debate on their overall efficacy, but their implementation also raises questions about the role of big tech as essential service providers. On April 10, 2020, Google and Apple,which provide the dominant mobile operating systems, joined forces to enable the development of digital contact tracing apps. The companies claimed that they aim to support the efforts of health authorities to contain the spread of the COVID-19 pandemic. Given their infrastructural capacity, Google and Apple could set the standards on which such apps were to be developed. Are tech companies controlling a digital public infrastructure?
This is certainly a concern within the European Union (EU). A Europe fit for the digital age is one of the main priorities for the years to come. This translates to investments of over €7 billion to establish the Digital Europe Programme, looking to develop digital technologies, supercomputing, and data platforms especially in the health, environment, and security sectors. European public institutions plan to achieve digital sovereignty and create a more balanced digital environment. Yet, the pandemic hit long before these bullet points had a chance to become pillars. This has resulted in a growing dependency on corporate infrastructures. Over the past two decades, Big Tech companies have developed an extensive digital infrastructure and can implement any solution at a faster pace than any public entity. These circumstances led to the EU creating a powerful framework to ensure smooth collaboration between companies and health authorities when developing contact tracing apps. Therefore, the EU’s toolbox and multiple guidelines translated into the basis for a public-private partnership which is meant to provide a facile response to the crisis.
How can we understand the power relation between public institutions and private tech companies in the context of crisis? Indeed, national contact tracing apps are developed by public health authorities, but the facilitators and distributors are Google and Apple. What they call the Exposure Notification System (GAEN) works through APIs that enable interoperability between Android and iOS devices using apps from public health authorities. This approach is the most widespread within the European Union, but it was not exactly how the EU tried to develop a contact tracing infrastructure. In fact, the first documents released by the European Commission point towards both the need for interoperability, as well as common usage of data among member states. If these sound like clashing principles, it is because they are. Interoperability requires some sort of centralization, whereas privacy implies steering clear from that or implementing extra security steps such as encryption mechanisms.
The first step in developing a contact tracing infrastructure is settling on a protocol. The European responses to the competing open protocol options resulted in centralized and decentralized open protocols – respectively the Decentralized Privacy-Preserving Proximity Tracing (DP-3T), and the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT/PEPP). These protocols work by generating arbitrary ephemeral identifiers to track and log encounters between users’ phones. However, their reporting mechanism is one of the core differences between the protocols which fed into the privacy debates. For PEPP-PT, a centralized reporting server is operated by national public health authorities to process contact logs and decide which users to inform about the potential contact with an infected patient. DP-3T advocates raise the issue of the potential discovery of users’ identities, as the backend server can link the past or future identifier with the permanent one using data from CCTV footage, travel data or social graphs.
The centralized versus decentralized debate ended with the EU stating its preference for decentralized systems. And, as one can expect, GAEN presented itself as a decentralized system guarding the privacy and security of the users. GAEN is trying to repackage their services so that it responds to a public need in such a way that it “exploits vulnerabilities in institutions and society”, according to Shoshanna Zuboff. Linett Taylor and Fran Meissner refer to this context as a market opportunity, which enables technology firms to offer quick solutions by rebranding services according to risk perception. Michael Veale posits that once GAEN entered the scene and offered an alternative to the previous options, “all state-sponsored COVID-19 apps” became de facto public-private partnerships between a government, Apple, and Google”. Indeed, looking at the EU, 18 member states opted for a variation of GAEN to build a national contact tracing app, while only 5 countries have no such app.
The French alternative
While most EU countries gravitate to GAEN, there are several member states which opted to create their version of the app – Bulgaria, Cyprus, France and Hungary. Out of these countries, France received the most attention for this choice. France opting for a centralized system was a clear stance against the tech giants’ solution and towards a “sovereign European health solution that will be tied to our health system”, according to Digital Minister Cedric O. But their GAEN independence was not an easy task as France had to negotiate with Apple to overcome Apple’s Bluetooth policy which hindered the development of the app.
Eventually, Inria put out the first app named StopCovid on June 2. It was later updated to the TousAntiCovid app on October 22, which was enriched with an “information centre”. Both app launches were sprinkled with technical difficulties, ranging from few notifications being sent to not enough people downloading it. While the latest app has been downloaded more than 10 million times, this is still below the minimum of 20% of the population which is needed for the app to be effective.
Another major issue in developing an alternative to the GAEN family of apps is the inability to comply with the much-desired European guideline of interoperability. Indeed, French and Hungarian apps – developed on the basis of the Bluetooth Low Energy protocol within a centralized system – are not interoperable with those of other member states. This means that unless the decentralized GAEN option is employed, alternative apps cannot be part of the so-called “gateway” – or at least not without considerable effort. The gateway is a means to exchange information about COVID-19 across borders so that warnings can be sent to users when travelling among member states with working contact tracing apps.
Although the French app still complies with the EU regulations in terms of data handling and privacy, interoperability is difficult to attain. The main argument for France’s path was preserving national sovereignty and being in charge of their data and methods of handling it. Implicitly, this results in a centralized system, which is difficult to develop, implement and – most importantly – argue for.
Public needs, private platforms
Long story short, the contact tracing apps context has proven that public institutions are still highly dependent on commercial digital infrastructures. In the pandemic, Google and Apple have achieved the status of essential service providers within the health industry by offering a fast solution that is easy to implement by governments.
The danger is, thus, that platforms become resilience actors within the pandemic according to Kenney and Zysman. This debate shaped by the contact tracing industry shows many potential dangers; one of them is the difficulty for policymakers to come up with guidelines and alternatives in real-time, while also assessing the options offered by the private companies. As the development of the French contact tracing apps has shown, governments are faced with a complicated set of roles: they are users, regulators as well as developers of platforms, according to José van Dijck, Thomas Poell and Martijn de Waal. Performing these roles in supra-national harmony is not a given, and alternative solutions to global problems become a conflicting scene. The problem arises when private companies have more to say in these issues than public actors, luxury granted by their infrastructural capacity and quick service rebranding strategies.
Creating a service that is readily available for most users is one of Big Tech’s main advantages, and the contact tracing apps case has reconfirmed this ability. Do public institutions need to develop their alternative infrastructural support systems, or further develop ways to regulate corporate giants? The EU seems to target both by building a digital public infrastructure and associated framework in the search for stronger digital sovereignty. It is yet to be seen how national governments deal with this process, to which extent they will integrate it and how the risks will be perceived and discussed.
Roxana Varvara Boboc is a research master’s student in Media Studies at the University of Amsterdam (UvA). Her research interests range from platform and infrastructure studies, platform and gig labour, surveillance capitalism, to digital memes and digital cultures. She is interested in a critical exploration of public-private power structures. She became preoccupied with these topics due to her experience in the research department of a public institution, her previous degrees in communication and marketing, as well as her recent teaching experience at the UvA in Digital Methods. (Twitter: @roxana_varvara)
