Why Proximity and Contact Tracing Projects Need to Engage Behavioural Scientists Now

Many academic data science teams currently work on various proximity and contact tracing app solutions. Several notable projects include DP-3T, PEPP-PT, Apple-Google Contact Tracing. As usual, the proposed systems have a noble goal of protecting citizens from potential exposure to COVID19 by warning them of others they have been in contact with. As you can imagine, this information may be of value to healthcare organisations (trying to prevent the further spread of the pandemic), law enforcement (trying to enforce quarantine rules), etc. Yet, we do not live in idealistic world and the proposed solutions have many issues.

Technical Concerns

I am not going to spend much time on technical issues as there is already excellent analytics published on this - see, for example this blog by Ross Anderson. Nevertheless, I am going to mention several alarming problems:

Problem 1 Confidentiality and anonymity - none of the solutions I have seen so far are confidential or anonymous (if you have created one, do email me, I would like to see it!). If fact, the whole point of these solutions is that "authorised agents" will be able to trace who you are and who you have been in contact with. This is currently done "by hand" in many countries, where authorities often trace an infected person's contacts and warn them of potential risks of being infected.

Problem 2 Decentralised nature of solutions - all solutions, no matter how good they are, if decentralised, are ultimately not very practical. They heavily rely on a capable technical group of programmers making timely updates as most of us have many different devices, which we use regularly. At the same time, most of our IT infrastructures are rigid and not designed to deal with any kind of heterogeneity and flexibility.

Problem 3 Cryptography - there are many cryptographic issues. All information that is being collected by these solutions needs to be properly encrypted. While this is probably the easiest problem to solve, it still needs to be carefully thought-through considering that we are dealing with decentralised systems. What is worrisome is that all projects mentioned above mostly concern themselves with this problem, leaving big question marks agains all or most other issues mentioned in this blog.

Procedural Concerns

There are also two major procedural concerns related to proximity apps in my view.

Problem 4 Lack of COVID19 tests and the nature of the virus - in many countries around the globe people are facing the problem with low (on in fact no) availability of COVID19 tests. I have just read a heartbreaking story of a nurse from the private care home, who is having COVID19 symptoms, but is being refused testing in the UK because she is "not an NHS worker". My own child as well as many members of my household (myself included) experienced COVID19-like symptoms for a week, but were not tested because, apparently, we did not "know anyone, who was a confirmed case of COVID19". Under these circumstances, how effective will these solutions be if (a) one can be a source without exhibiting the symptoms and (b) even one exhibits the symptoms, the tests are being saved for the selected few?

Problem 5 Exclusive nature of development teams - most of the projects mentioned above are exclusive in a sense that they involve a handful of researchers and/or companies. For example, I tried to volunteer for PEPP-PT several weeks ago and still waiting for the reply. DP-3T also pretty much told me that they do not wish to collaborate. I appreciate that not everything should be open source, yet, at the same time, I am not sure that non-inclusivity is a good principle to run such projects. Especially, I am not sure how can these projects succeed without engaging any behavioural scientists (last time I looked, I have not seen any behavioural scientists being involved in any of the projects, if there are such projects - I would really welcome this move!). May be I am wrong there, but this is my personal and, perhaps, biased opinion. But this opinion is based on the reasons outlined below.

Psychological Concerns

Most important problems, in my view, are of psychological and behavioural nature.

Problem 6 Trust - any data collected by the proximity apps (even if we assume that anonymous solutions are developed) are shared with "authorised agents". One of the main issues is - do we trust these agents? Even when we talk about governments, there is a lot of heterogeneity in the way people in different countries trust public sector agents. For example, if you are British, it is hard to trust the NHS with your personal data, considering several cases, when various NHS trusts shared patient personal data with private sector companies without obtaining proper consent. The problem is that in the absence of trust, people will do anything to sabotage the apps.

Problem 7 Contract Cheating - this point is closely related to the previous one and also has to do with the fact that, unless people engage with the app/solution, it will be useless. And any self-administered solution opens the door for many manipulations (including leaving the device at home or giving it to another person, etc.). Many other cheating and even "trolling" opportunities do exist.

Problem 8 Big Brother - this is also a very important concern. How would you feel if you were getting messages about proximity to others? Especially, if a solution told you you are getting into close proximity to another person who recently had COVID (if a particular solution permit this)? Some people will be OK with this, but most will think this is "too Big Brother". Again, they will do everything in their power not to engage.

Problem 9 Psychological Effects for Anxiety and Wellbeing - we know very little about how such proximity solutions would impact on human psychology. Due to the quarantine measures, many people are already on the edge and getting constant proximity alerts will probably not help to reduce anxiety. At the moment, we have no data on the potential psychological effects and we do need to consider them before any solution is implemented.

Problem 10 Information Avoidance - in behavioural science, we have a phenomenon called "information avoidance". This is a very common behavioural regularity. For example, imagine that you have a family history of cancer and you can be tested to find out a probability or chance that you will develop cancer in the future given your family history. Would you want to take the test? Most people say "no" to such a test if they are given an opportunity. They simply try to avoid learning this information. Similarly, people will try to avoid learning more about other people they came into proximity with. My guess, most people just don't want to know.

Problem 11 Enforcement - there is even a talk about governments making some solutions compulsory. Since we are not talking about a house arrest-type of measures,

it would be interesting to know how such measures would be enforced. For example, what if I forget my phone at home when I go to work, will I be fined for forgetting it? Some solutions would imply that I need to unlock my iPhone screen to run the app, making my phone an easy target for any pickpockets in town not to mention the battery life issues (which in many airports is a big deal because people with switched off devices are not let on planes anymore). How would potential inequalities between iPhone and Android users be managed? What about people who are still using old-fashioned phones (not smartphones) - will everyone now be required to use a smartphone?

Take Aways

Currently, many proximity apps are being discussed as potential aid tools to prevent the further spread of COVID19. While such tools may be beneficial, it is clear that many issues need to be considered before the widespread deployment of these solutions. It also is obvious that without a careful consideration of human behaviour and human-technology interactions such solutions are unlikely to succeed.

#cybersecurity #proximityapp #cyberrisks #cyberthreats #datasecurity #cyberattack #contacttracing #risk #infosec #security #ransomware #COVID19 #dataprotection #informationsecurity

P.S. After this post was finished I also thought about a potential threat from cybercriminals, who might use these proximity apps for ransomware attacks - imagine someone hijacking your phone sending you thousands of proximity messages and demanding ransom in exchange for putting everything back on track? They might also threaten to send messages about you to other people. Not to give anyone any ideas - but this is really scary...

This post was originally written by Ganna Pogrebna for the CyberBits blog in 2020