Tracking the Tracking Apps: COVID-19 in SEE+: Action Items for Future Pandemics

The COVID-19 pandemic has disrupted nearly every aspect of public life. Virtually unprecedented, the public health crisis required an emergency response. That response, however, has brought with it a new set of concerns that might have a lasting impact well beyond the pandemic. Privacy is under serious threat. Governments rushed to deploy tracking apps in an effort to curb the spread of the virus by facilitating contact tracing and monitoring for compliance with self-isolation regimes. In many cases however, questions remain as to how much of the personal data these apps collect is truly necessary to their functioning, and what would happen to that data once the pandemic is over. 

While contract tracing and compliance monitoring are important tasks during a pandemic, the use of new smartphone tracking apps by governments to perform these tasks also raised several human rights concerns, especially in regard to privacy. Would governments collect personal identifying information in ways that respect human rights? Was there a risk that some of this information would be used for purposes other than combatting the COVID-19 pandemic?

My research has focused on the COVID-19 tracking apps in five countries in Southeastern Europe and the neighboring area (SEE+): Armenia, Croatia, North Macedonia, Serbia, and Ukraine. While the pandemic is not over yet, it has now been more than a year since the COVID-19 outbreak in the region. Thus, enough time has passed to effectively assess the impact of these tracking apps as they’ve been deployed by these five countries. The lessons learned from these governmental forays with health apps will provide us with important knowledge for future epidemics and pandemics, as well as insight on how governments can best effectively harness technology to solve social problems. 

Initial excitement over deployment of tracking apps

As the COVID-19 outbreak turned into a pandemic, governments in SEE+ announced their determination to resort to various tracking apps to flatten the curve of COVID-19 virus. All governments justified these measures with the unprecedented nature of the virus and its fast spread. 

*Was not deployed

Understanding the sensitivity of governments collecting this type of data from citizens, several organizations published guidelines and recommendations for the adoption of COVID-19 tracking apps. In a joint statement on digital contact tracing, the chair of the Committee of Convention 108 and the data protection commissioner of the Council of Europe highlighted several guiding principles, such as transparency of data collection, use, and storage; oversight and audit; anonymization; and impact assessment, among others. Moreover, the Southeastern European Dialogue on Internet Governance (SEEDIG) Intersessional Project on COVID-19 tracking apps in SEE+ adopted a number of recommendations addressed to the governments and app developers. As we will see, governments often did not follow these recommendations. 

Armenia was the first of the countries to roll out a COVID-19 tracking app when it launched COVID-19 Armenia in March 2020. Ultimately, Armenia adopted two measures to curb the spread of the COVID-19 virus: 1) tracking the cellphone data for contact tracing, that entailed receiving this data from mobile service providers, and 2) offering COVID-19 Armenia app to the public for providing pandemic related information as well as conducting COVID symptoms self-assessment tests. 

The legal amendments allowing for tracking people’s movements with mobile phone data were received with wide civil society criticism, primarily focusing on excessive collection of potential personal data. Moreover, Cyberhub, an IT support hub and a threat lab for Armenian civil society, conducted a detailed assessment of AC19.am, the initial version of the app, warning that it was requesting access to information on users’ phones that was not required for the app’s primary functionality. This initial version of the app was based on AC19, an Iranian app that collected excessive personal data while claiming to be able to determine the likelihood a user was infected with COVID. These findings are, at the very least, concerning, and at worst indicate that the app might be used for broader citizen surveillance. 

Both North Macedonia and Croatia opted for less invasive, Bluetooth-based contact tracing apps. They opted for contact tracing apps that use Bluetooth to help notify when the user’s cell phone came into close proximity with someone else’s cell phone who tested positive for COVID-19 virus. The apps use Bluetooth technology to exchange random keys between users' smart devices that are in a close contact, which allows efficient tracking without sharing any other personal details. There is one significant difference between the two apps: while North Macedonia uses a centralized Ministry of Health server to store app users’ data, Croatia opted for a decentralized system where the user keys remain on user phones, allowing for minimal data collection. North Macedonia’s approach sparked public debate around the need for more transparency and higher data protection, especially as the source code was not public, which meant that there was limited ability for societal oversight. 

Serbia has not yet launched a COVID-19 tracking app. According to Bogdan Banjac, executive committee member of SEEDIG, as of August 2020, Serbia was planning to deploy a contact tracing app. However, in  October 2020, the Serbian government rescinded the deployment of the ready-to-go app, citing the associated potential risks of disproportionately restricting such rights as right to dignity and right to work.

All these developments took place within a matter of two or three months and generated significant public debate on the human rights impact of the deployment of these measures. However, despite the rush to develop and deploy these apps, questions remain as to their efficacy and impact on human rights. 

Insufficient data to assess effectiveness

After the initial deployment of the apps, some governments rushed to announce the efficiency of the measures. For example, as early as April 2020, the Armenian government claimed positive results of fighting further dissemination of COVID-19 through mobile location tracking. This was based on its analysis of the telephone data from 3,029 people. At the same time, a number of Armenian civil society organizations published a statement calling for more transparency and raising alarm with regards to privacy risks. As of June 2021, the government has not published any human rights impact assessment of the adopted measures. It is unclear how many people were included in the mobile location tracking and whether this yielded any helpful outcomes to curb the spread of COVID-19 in Armenia.

As of June 2020, the North Macedonian app StopKorona had not helped to detect a single case of COVID-19, raising concerns of its overall effectiveness. As Bojan Stojkovski, a Balkans-based freelance journalist covering technology and science, noted in an interview for this research, based on the latest reports the app had around 67,000 downloads, which seem to be too low for it to have any material impact against the COVID-19 pandemic in a country with a population of over two million. This falls far short of the 200,000 downloads the government expected. Moreover, in May 2020, more than 1,500 users falsely claimed to be infected on North Macedonian StopKorona app, which was considered to be a result of low digital literacy among general population. Consequently, the app was updated to prevent instances of such false claims.

In November 2020, Croatia published a data protection impact assessment, that confirmed that the use of the app was still voluntary, personal or health data was not processed, and that the app adhered to such principles as data minimization and data security. As of June 2021, the Croatian app has almost 97,000 downloads, which can be considered low in comparison to 4 million population in Croatia. 

In the meantime, the user base for Ukraine’s centralized tracking app continues to grow. Olga Kyryliuk, chair of SEEDIG Executive Committee, noted that the use of the app is mandatory for everyone living or visiting Ukraine. As of March 2021, the app had 720,000 downloads, compared to 420,000 in September 2020. Following widespread reports of bugs and malfunctioning of various app features, in September and December 2020, the Ukrainian authorities introduced a number of updates, including new functionalities like receiving lab test results in the app, the ability to register with a non-Ukrainian mobile number, increased time for verification of location and photo submission, and an option to notify the contact person from close circles. Overall, the app has been declared a success and even other countries, such as Georgia, expressed their willingness to purchase the app for domestic use. 

It is evident that while some apps are on the way to reach a nationwide deployment, others did not live up to the expectations to reach the required level to make an impact. The lack of relevant data on the usage and impact of the apps invites the argument that the hype around the introduction of such measures subsided too soon, and the governments did not pursue the initial goals of deployment, even though the pandemic is still ongoing. Moreover, it is concerning that during the last year neither of the researched countries conducted any efficiency or impact assessment studies to analyze the effects of these invasive measures, against the backdrop of various human rights concerns. 

Action items for the future 

While governments all around the world, including in SEE+, were nowhere near ready to tackle COVID-19 pandemic, the unprecedented situation they were faced with was not a wild card to deploy invasive measures. Hence, with all its challenges, COVID-19 pandemic was a stress test to our systems. And now, more than one year after the pandemic’s start, when life is slowly trying to flow into the new normal, it is high time to start drawing lessons for the future. Based on this research, governments should focus on the following priority areas: 

1. Conduct impact assessment studies—It is crucial to take stock and learn the extent to which the deployment of tracking apps compare to the regional practices. This includes assessing the actual usage rate, the impact of this rate on contact tracing efforts. Furthermore, it is imperative to assess the impact of the apps on human rights, such as right to privacy, as well as evaluate the government’s communication strategy during the app promotion. 
2. Bolster digital literacy among citizens—Recalling the instances from North Macedonia when people accidentally flagged themselves as having tested positive, governments should invest in long term digital literacy capacity building. This would likely also boost the levels of app deployment as the apps would not be seen as a black box and citizens would understand better how to use them.
3. Incorporate human rights by design—Even when dealing with emergency situations, government measures should comply with principles such as transparency, proportionality, necessity, and prohibition of discrimination. For instance, this includes minimizing any unnecessary or disproportionate restrictions of human rights and ensuring that the adopting measures do not discriminate against any societal groups. This means that these human rights principles should be the default for any government measure, serving as a restraint from unjustified government interventions into the domain of fundamental rights. 

While we all hope that the COVID-19 pandemic was the last one in our lifetime, there are many lessons learned for the future. It appears that the discussed countries in the SEE+ placed too much hope in the technology, neglecting their own role in the proper development, promotion, and deployment of the contact tracing apps. 

The absence of any impact assessment studies invites the conclusion that the governments simply followed the global trend of deploying such apps, without determining whether their deployment would be effective in helping curb the spread of the COVID-19 virus in their countries. Moreover, the fact that there were no reports of major human rights violations, does not necessarily mean that the apps were compliant with human rights standards. In fact, the absence of any human rights impact assessments on these apps shows that the governments have not taken into account the concerns raised by members of the public and civil society organization about the apps’ human rights implications. 

Overall, the fate of the vast majority of the discussed COVID-19 apps remains uncertain. Their hasty deployment, coupled with the near-complete lack of follow-up to raise awareness and build trust around these apps can be considered potential reasons for low usage rates. Moreover, although the pandemic is still ongoing, it is unclear when exactly these apps will be discontinued, and what would happen to the collected data. This will result in more distrust towards technological solutions, diminishing their potential to serve the public good. 

In short, technologies offer exceptional opportunities for managing various goals of public importance. However, the development and deployment of technological solutions are not a panacea in and of themselves. Therefore, it is crucial to be intentional when resorting to technological solutions, especially when those may impact fundamental rights