The adoption of contact tracing applications of COVID-19 by European governments

Abstract

Contact tracing can be defined as the identification and the monitoring of each person who has been in contact with an infected person. However, the effectiveness of manual contact tracing is hindered by low responsiveness, limited data processing, respondent omissions or the inability to identify individuals in a crowd. Faced with these limitations, research on digital contact tracing has been carried out. Digital contact tracing, especially smartphone contact tracing apps, has progressively appeared as a solution to slow the spread of the SARS-CoV-2 pandemic. Such a technological solution allows to track, in real-time, a massive number of (potentially) infected individuals within a given population. Despite high acceptability rates among the population and positive evaluations regarding its effectiveness, the implementation of these digital tracing applications has raised many technological and political questions. By conducting a thematic analysis, this research identifies the technological and policy issues with regard to digital tracing in three European countries.

Keywords:

• Contact tracing
• Covid-19
• Belgium
• France
• UK

1. Introduction

Contact tracing can be defined as the identification and the monitoring of each person who has been in contact with an infected person (Perscheid et al. 2018). Originally developed to curb syphilis at the end of the 1930s, manual contact tracing is crucial to slow the spread of an epidemic (McLachlan et al. 2020). Identification relies on public health workers’ interviews with patients and the individuals these patients have been in contact with. However, the effectiveness of traditional contact tracing is hindered by (1) low responsiveness (i.e. the time lag due to the manual tracing process), (2) limited data processing, (3) respondent oversights or omissions, and (4) the inability to identify individuals in a crowd (Alsdurf et al. 2020; Watts 2020). Faced with these limitations, research on digital contact tracing has been carried out, leading to the administration of preliminary tests in 2014 during the Ebola epidemic in West Africa (Chen et al. 2017; Perscheid et al. 2018; Weiss et al. 2019).

Digital contact tracing, especially smartphone contact tracing apps, has progressively appeared as a solution to slow the spread of the SARS-CoV-2 (Covid-19) pandemic by breaking the chains of contamination (Kleinman and Merkel 2020; Oswald and Grace 2020; Watts 2020). Such a technological solution allows to track, in real-time, a massive number of (potentially) infected individuals within a given population (Kretzschmar et al. 2020) to isolate cases of Covid-19 and reduce the basic reproduction number¹ (Vaithianathan et al. 2020).

Despite the technological and health advantages provided by digital contact tracing, public decision-makers must take into consideration its impacts on privacy (Bengio et al. 2020). Several researchers argue that the adoption of digital contact tracing application could lead to the economic exploitation of private data and may also create a mass electronic surveillance system (Martinez-Martin et al. 2020; Vaithianathan et al. 2020). In contrast with “technologists,” technoskeptics denounce “State Solutionism” which consists of systematically conceiving technology as a means to solve public problems (Morozov 2020).

Despite high acceptability rates among the population (74.8% of the participants within the sample are in favor of voluntary digital tracing and 68.8% are in favor of automatic applications) (Altmann et al. 2020) and positive evaluations regarding its effectiveness (Alsdurf et al. 2020; Kretzschmar et al. 2020), the implementation of these digital tracing applications has raised many technological and political questions. Faced with these challenges, European governments have taken various positions on the use of this technological tool to manage the ongoing pandemic. Consequently, the main objective of this article is to identify the technological and policy issues surrounding digital tracing through the analysis of three European applications (StopCovid in France, NHS Covid-19 in the UK, and Coronalert in Belgium).

This publication is divided into four sections. The first section presents the features of smartphone contact tracing apps used in the field of infectious diseases. The second section describes the methodology used to identify the issues raised when adopting such an application. The third section provides details about each of the applications studied and presents the main public issues encountered by developers and public decision-makers. The fourth section discusses the results and highlights of each case and presents the limitations of this research.

2. Exposure notification and contact tracing apps in the field of infectious diseases

In the case of both the Ebola and SARS-CoV-2 (Covid-19) epidemics, digital contact tracing is conducted through an application installed on individual smartphones (Armstrong 2020; Perscheid et al. 2018). Through wireless communication mechanisms (i.e. Bluetooth), a user’s smartphone can automatically detect interactions occurring within a certain proximity and duration and can subsequently exchange a digital key with other users (Armstrong 2020; Beskorovajnov et al. 2020; Oswald and Grace 2020). When a user is tested positive with Covid-19, a notification is automatically sent to all the individuals who may have been potentially infected by the user (Alsdurf et al. 2020). Digital tracing is therefore particularly pertinent when the number of cases is high or when there are multiple transmission channels (Kojaku, Hébert-Dufresne, and Ahn 2020; Kretzschmar et al. 2020).

By implementing TraceTogether on March 20 2020, Singapore was one of the first states to use such a tool to monitor Covid-19 (Abbas and Michael 2020). Nowadays, more than fifty states have implemented or are planning to launch a COVID-19 Exposure Notification and Contact Tracing App (Global Pandemic App Watch 2020). Despite its growing use, the effectiveness of such apps remains to be proven. A systematic review of the literature notes that no evidence has been found on the effectiveness of automated tracing apps to reduce infected cases or the number of infected contacts identified (Braithwaite et al. 2020). Other researchers have, however, concluded that when the utilization rate is above 60%, contact tracing and notification apps significantly reduce the rate of infection among the population studied (Alsdurf et al. 2020). The utilization rate, therefore, appears as a crucial independent variable for the effectiveness of digital tracing. In this perspective, research determines that to be effective the utilization rate of a digital tracing app should be greater than 60% (Ferretti et al. 2020). In practice, the highest uptake rates are 91% for Ehteraz (Qatar, non-voluntary installation), 62% for BeAware (Bahrain, voluntary installation), and 40% for Covid Tracker (Ireland, voluntary installation). Three-quarters of the applications have an uptake rate of less than 25% (Global Pandemic App Watch 2020).

The operation and success of any digital contact tracing app are conditioned by several technical specifications, namely: (1) the proximity measurement mechanism used (i.e. the wireless communication mechanism used), (2) the data storage method, (3) the data collected through the application, (4) the notification mode (i.e. the content of the alerts sent to users), (5) how the application is installed, (6) the use of artificial intelligence (AI) and (7) its relationship with regards to manual tracing (i.e. how the application is used with manual tracing) (Alsdurf et al. 2020; Beskorovajnov et al. 2020; Dar et al. 2020). Table 1 summarizes the potential options for each of the specifications.

Table 1. Digital contact tracing application specifications.

Specifications	Potential options
Proximity measurement mechanisms	Bluetooth Local GPS
Data storage	Centralized storage (data is automatically stored on a central server) Partially centralized (only data from infected individuals is transferred to a central server) Decentralized (data is stored solely on smartphones)
Data collected	Information exclusively related to interactions (e.g. location, duration, date, numerical key) Ability to encode demographic and medical data (age, gender, diseases, medications, etc.)
Notification mode	Binary notification (information on whether or not the user has been exposed to an infected individual) Graduated notification (information regarding the potential level of risk to which the user is exposed based on his/her interactions)
Method of installation	Manual installation (the user takes care of installing the application) Default installation (installation is automatically carried out by the manufacturer)
AI module	Integration of an AI module to measure the level of risk to which a user may have been exposed Exclusion of an AI module to measure the level of risk to which a user may have been exposed
Relationship with regards to manual tracing	Application is used in conjunction with manual tracing Alternative to manual tracing

3. Methodology

3.1. Case selection

The decisions taken by three European governments with regards to exposure notification and contact tracing apps were studied. In this study, three cases are analyzed: StopCovid (France), NHS Covid-19 (UK), and Coronalert (Belgium). The selection of these cases is based on three criteria. The first criterion restricted cases to European states that had developed a government strategy on artificial intelligence by January 2020 (25 states). The second criterion used was the selection of cases where political, administrative, and media documents were available in English or French (five States²). The selection of three case studies was based on the need for real-time data collection and the analysis of a large amount of information in a short period. We thus used the political regime as the third selection criterion. Consequently, we opted to study three different political regimes: a parliamentary system (Belgium), a presidential system (France), and a Westminster-style parliamentary system (UK). The choice between Ireland/UK and Belgium/Switzerland was based on the seriousness of the Covid-19 epidemic in the respective countries.

3.2. Data collection

For each case study, two types of data were collected: (1) legislative and executive documents relating to the development of the tracking application/tracking system and (2) articles in national print media (March 1 2020 to September 30 2020) relating to the application/system.

First, we collected data on the applications themselves. To do this, we exclusively used the databases of legislative and government sites (e.g. the National Assembly in France, the British Parliament in the UK, the The Chamber of Representatives in Belgium). On these databases, all adopted texts, bills, or reports related to the applications studied (StopCovid, Contact-tracing apps, Coronalert) and published between March 1 2020, and September 30 2020 were collected.

Secondly, we collected articles from print media that had been published between March 1 2020, and September 30 2020, and that touched on the topic of digital contact tracing applications. The articles were collected on the Eureka database. To retain pertinent sources, the following keywords were used: the name of each application (SopCovid, NHS Covid-19, Coronalert) and “tracing.” To refine the relevance of the collected articles, two filters were applied: the presence of keywords in the title, and the selection of articles that were published exclusively in print media form. For the last filter, we collected articles published by national outlets. In total, 122³ articles were collected for France, 142⁴ for the UK, and 87⁵ for Belgium.

3.3. Data analysis

We conducted a thematic analysis of the collected data. In practice, patterns of meaning across data were analyzed through a process of data coding and theme development. Data were coded and themes were developed based on the content of the data (inductive coding) and to reflect the explicit content of the data (semantic coding).

The first step of the analysis comprised of segmenting the data. The segmentation strategy used was the “beginning and endpoint method” where an analyst delimits the start and end of an idea in a text (Guest, MacQueen, and Namey 2011). A code must capture a whole thought, and not just a brief evocation. Three reviewers were involved in the analysis process. In this thematic analysis, we used an inductive approach. Code and themes were created or modified by reviewers during the coding process itself (Denzin and Lincoln 2008). Each code referred to a specific challenge met by developers (technical challenge) or decision-makers (political challenge) during the adoption process of a contact tracing app. For each code and theme identified, we specified three components: a code label, a code definition, and when to use the code (DeCuir-Gunby, Marshall, and McCulloch 2011; Guest, MacQueen, and Namey 2011). All codes and themes used during the coding process were listed in a codebook.

The second step of thematic analysis involved classifying the codes into relevant units of meaning (themes and sub-themes). We started by reading the excerpts for the three case studies. Then, we brainstormed to define the different major categories and coded all the data collected for each case. Finally, we audited the attribution of the codes. During weekly meetings, the team members compared codes, examined disagreements, and assessed the relationships between codes and themes. To reach the saturation point, we used a model combining an inductive thematic saturation (focus on the emergence of new codes or themes) with a data saturation method (related to data collection) (Saunders et al. 2018). We reached the saturation point when the data saturation and the thematic saturation points met.

4. Results

In this section, we first present how the three exposure notification and contact tracing apps studied work. Secondly, we list the issues encountered by developers and public decision-makers during the development of the digital contact tracing application.

4.1. Functioning of exposure notification and contact tracing apps

4.1.1. StopCovid app

Launched on June 2 2020, the StopCovid digital contact tracing application aims to enable a user who tests positive for Covid-19 to automatically notify, via a code transmitted by the health authorities, users with whom an interaction at less than one meter and for at least fifteen minutes had taken place over the last fourteen days. The development of the StopCovid application was led by the National Institute for Research in Digital Science and Technology (Inria). Intended for smartphones, this application is available and free of charge on the Appstore (Apple) and Playstore (Google).

The French authorities opted for a manual and voluntary installation of StopCovid. The application uses Bluetooth to measure the proximity between two users. The proximity between two users is measured via an algorithm developed for the application. The data storage mechanism is based on the Robert (Robust and privacy-presERving proximity Tracing) protocol developed by The National Institute for Research in Digital Science and Technology (Inria – France) and the Fraunhofer Institute for Applied and Integrated Security (Germany). This protocol adopts a centralized data storage system based on a federated server infrastructure and temporary anonymous identifiers (Castelluccia et al. 2020). The data collected and recorded are, therefore, systematically encrypted at random. Only data relating to the proximity and duration of interactions are captured. No individual, demographic or medical data are collected by the application. Thus, when voluntarily installing the application, the user only authorizes access to their device’s Bluetooth and camera (to scan the QR codes received in the case of a positive test). In terms of notification alerts, the application does not include a risk indicator based on user characteristics. The application sends an alert asking the user to contact his or her doctor and undergo a test. In practice, when a “contact case” is notified via StopCovid, he or she is treated as a contact case identified by the health authorities and can access a test via his or her doctor.

4.1.2. NHS Covid-19 app

On April 12 2020, UK authorities announced that the development of a digital contact tracing application had been awarded to the NHSX, the digital innovation unit of the National Health Service (NHS). However, during the two-week test on the Isle of Wight, the effectiveness of the application was questioned. Indeed, the NHSX application was only able to detect 25% of devices running Android and 4% of iPhones (Wise 2020). This failure, coupled with an analysis revealing the app’s potential flaws (Armstrong 2020), prompted the British government to abandon the initial NHSX application on June 19 2020. The British government mandated the NHS to develop another application, NHS Covid-19, based on the decentralized model developed by Apple and Google.

Launched in England and Wales on September 24 2020, NHS Covid-19 is one of the tools of the Test and Trace Service developed by the NHS. It aims to alert users who come into contact with an individual infected or experiencing symptoms of Covid-19. Available in several languages (e.g. English, Arabic, Bengali, Chinese) and free of charge on the Play Store and App Store platforms, NHS Covid-19 can only be installed on smartphones with users over the age of sixteen. When installing the application, the user only authorizes access to their device’s Bluetooth and camera. In addition, the user must also encode his or her postcode. NHS Covid-19 includes the following features: a perimeter risk alert system to warn about the level of risk around one’s home; a QR code scan function available at the entrance of shops and public buildings so that a positive case can be notified; a tool for checking symptoms; a countdown timer for quarantine.

To measure the proximity between individuals, the application uses Bluetooth Low Energy technology. In practice, all interactions taking place within two meters and lasting more than 15 minutes are recorded in the form of a randomly encrypted code. The data is stored on the user’s smartphone for 14 days. However, when a user tests positive, NHS Covid-19 requests permission to share the codes generated for each close interaction. When the request is accepted, all codes are uploaded to a central system hosted by Amazon Web Service UK and Microsoft Azure Cloud Service (UK). The central system then transmits the downloaded codes to all users to check for matches. NHS Covid-19 was tested during the last two weeks of August on the Isle of Wight and at the London Borough of Newman. However, the results of the tests were not made public.

4.1.3. Coronalert app

The Belgian authorities codified the practice of digital tracing in the “Contact Tracing” cooperation agreement which took place on June 26 2020. According to this cooperation agreement between the Federal State and the federated entities, the Belgian digital tracing application “Coronalert” was made available, and functional, across the entire Belgian territory. The objective of Coronalert is to enable the identification of individuals who have had contact for more than 15 minutes in the last 14 days with a confirmed carrier of the coronavirus. Furthermore, Coronalert is an adapted version of the German application, Corona Warn. Following a public contract, the company Devside, in collaboration with a Belgian consortium of experts and academics, was commissioned to adapt the Belgian version. The Belgian version has been available since September 30 2020 on Play Store and App Store.

The Belgian authorities have opted for an application featuring a voluntary and manual installation mode. Based on the source code of Corona Warn, the Coronalert application uses Bluetooth as a proximity measurement mechanism. Like many European states (e.g. Finland, Austria, Estonia, or Switzerland), Belgium has opted to use the DP3T Protocol (Moniteur Belge - Belgisch Staatsblad 2020). By opting for this protocol, Coronalert is interoperable with similar applications in other European states (e.g. the Netherlands, Germany, Switzerland). Before the application was put into service, two tests were carried out: a first test involving 90 people using fictitious scenarios and a second test in a real-life setting involving almost 10,000 people.

Since the adopted protocol opted for a decentralized storage system, Coronalert stores data on the users’ smartphone. Only data relating to the proximity and duration of the contact is collected and recorded by the application. The code is in the form of a 15-digit crypto-identifier (regenerated every 15 minutes) and is stored for 14 days on the smartphone (Moniteur Belge - Belgisch Staatsblad 2020). The notification mode is binary. When an individual tests positive, the notification process is as follows: firstly, the individual asks the application to generate a 17-digit random code before undergoing the test and presents said code to the doctor; secondly, the doctor indicates the random code, the national registry number and the patient’s telephone number on the form; thirdly, if the test is positive, Sciensano asks the user for permission to access their crypto-identifiers to inform other users. Finally, the Coronalert application is used to support, not replace, manual tracing (Table 2).

Table 2. Studied digital contact tracing application specifications.

Specifications	Coronalert	NHS Covid-19	StopCovid
Proximity measurement mechanisms	Bluetooth	Bluetooth	Bluetooth
Data storage	Decentralized	Decentralized	Centralized
Data collected	Information exclusively related to interactions	Information related to interactions and postcode	Information exclusively related to interactions
Notification mode	Binary notification	Binary notification	Binary notification
Method of installation	Manual installation	Manual installation	Manual installation
AI module	Not used to compute the risk level	Use to compute the risk level based on the user’s address	Not used to compute the risk level
Relationship with regards to manual tracing	Use with manual tracing	Use with manual tracing	Use with manual tracing

4.2. Issues concerning the adoption of exposure notification and contact tracing apps

4.2.1. Issues concerning the adoption of StopCovid

The thematic analysis of the collected data identified issues that policymakers and developers have been confronted with. These issues relate to:

How the application works. In terms of operability, three technical dimensions have posed problems during the development of StopCovid. Firstly, the use of Bluetooth to measure the proximity between two smartphones required adapting a technology initially intended for exchanging data over short distances and standardizing the technology for all smartphone models. Secondly, the activation of Bluetooth on iPhones (i.e. 20% of smartphones in France) was necessary to bypass the automatic Bluetooth sleep mode for non-active applications. Thirdly, the implementation of centralized data storage required the development of a specific protocol (the Robert Protocol).

Security and data protection (data encryption, collected data, and risks of hacking). With regards to data collection, the uploading of all recorded interactions rather than exclusively risky interactions into the central database was the subject of media coverage a few days after the launch of the application (Médiapart, 15 June 2020). Finally, in terms of piracy, three sources of risk have been identified: (1) the hacking of the central database, (2) the reporting of fictitious or unverified cases of infection, and (3) the increased vulnerability of the smartphones themselves caused by the activation of Bluetooth. For the first two, authorities used ethical hacking to identify flaws in the database and the encoding of a verification code when a test was ruled as positive.

The efficiency of digital tracing. The effectiveness of StopCovid on the epidemic depends on a minimum utilization rate by individuals. For StopCovid, the rate at which the application is used remains well below this threshold (1.8 million activations as of June 23 2020, or 3% of the population). The usage rate is all the more problematic when we consider the high number of de-installations (460,000 as of June 23 2020). The detection rate for high-risk interactions is also crucial for effectiveness. In the case of StopCovid, this rate is between 75 and 80% of smartphones in the vicinity. Finally, the impact of StopCovid on suspicious case notification is relatively low (as of June 24 2020, 68 individuals reported being infected and 14 at-risk individuals were informed).

The relevance of digital tracking was raised because 23% of French citizens do not own smartphones and the rate of individuals over the age of 70 with a smartphone is low (44%).

Acceptability of digital tracing. Although three out of four French citizens are in favor of digital tracing, only 45% of these individuals have declared themselves ready to use it (June 2 2020).

The short timeframe to develop StopCovid forced developers to move quickly. With so many tasks to be accomplished, the launch date of the application was pushed back (the initial target was May 11 2020). Moreover, on the day of launch (June 2 2020), a delay of several hours caused confusion between the French application and the Catalan application, resulting in a significant download rate of the latter.

Lack of interoperability. Initially promoting a European approach, StopCovid uses a protocol (Robert Protocol) that is different from other European states, most of whom use the DP3T (Decentralized Privacy-Preserving Proximity Tracing) protocol. In practice, data exchange with other applications is not currently possible. Thus, the development of an alternative data exchange protocol (Protocole Désiré) is presented as a technological compromise between the French centralized approach and the decentralized approaches adopted by the other European States.

4.2.2. Issues concerning the NHSX and NHS covid-19 tracing applications

The specificity of the English case was the Government’s abandonment of NHSX Tracing App and the adoption of another one, NHS Covid-19, three months later. This section presents issues faced during both the development of NHSX Covid-19 and the adoption of NHS Covid-19. These issues relate to:

How the application works. For NHSX Tracing App, the main operational challenge encountered by developers involved the activation of Bluetooth, mainly when the application is inactive on iPhones. In addition to these activation issues, the accuracy of proximity measurements was also raised. As of June 20 2020, the NHSX Tracing App could not accurately measure the distance between two devices. Under certain conditions, the application could not differentiate between two devices, one located at 1.3 meters and the other at 3 meters. For NHS Covid-19, the application requires the smartphone to run Android 6.0 (2015) or iOS 13.5 (2020). In addition, any device prior to the iPhone 7 is not compatible with NHS Covid-19. Finally, several problems related to downloading and installing the application were raised at the outset.

Security and data protection (data encryption, collected data, and risks of hacking). For NHSX Tracing App, the adoption of a centralized data storage system impacted relations between NHSX’s developers and other potential partners such as Google and Apple. Adopting an academic approach (Ferretti et al. 2020), the selection of a centralized data storage system initially aimed to provide health services with a critical mass of data required to monitor the epidemic. However, Google and Apple were firmly opposed to centralized data storage. The two multinational companies advocated for a decentralized storage model in which data was to be exclusively stored on smartphones. In the absence of collaboration between these three players, the NHSX Tracing App was unable to capture a significant portion of the smartphones running Android and iOs.

The efficiency of digital tracing. For NHSX Tracing App, the low effectiveness of NHSX Tracing App was largely caused by the difficulty of accurately measuring distance and the inability to activate the application on smartphones using Android and iOS. In practice, the application located only 25% of devices operating with Android and 4% of iPhones. An additional factor reducing the effectiveness of the NHSX Tracing App was the fact that the minimal threshold of use (estimated between 50 and 60% of the population) was not reached. During the test conducted on the Isle of Wight, 35% of the population installed the application. For NHS Covid-19, the effectiveness of the proximity measurement was raised during laboratory tests. Although the NHS worked with Google and Apple, they were unwilling to share the raw data from the Bluetooth signal, thereby making it more difficult to identify the devices. In practice, almost one in three (31%) cases of risky interactions were missing and 45% of cases were misidentified as risky.

The relevance of digital tracing. For NHSX Tracing App, the inability of elderly or disabled people to use the application diminished its relevance. A study conducted by Ofcom (the regulator of communication services) concluded that 21% of British adults do not use smartphones. The existence of a “digital divide” therefore tends to dwindle the relevance of such an application. For NHS Covid-19, the relevance of using such a tool was questioned by the time lag (i.e. the period between the test and the reception of the results). While the major advantage of such tracking tools is responsiveness, only six out of ten individuals received their results within 5 days.

4.2.3. Issues concerning the adoption of Coronalert

Based on the thematic analysis of the collected data, we identified issues that developers and policymakers have faced during the adoption of Coronalert. These issues are related to:

Political Power. Under the Belgian federal system, complications arose when it came time to institutionalize collaboration between the different levels of power (federal and the Regions). Taking the form of a cooperation agreement, the document provides a framework for manual and digital tracing. Unlike a piece of legislation, a cooperation agreement is negotiated and signed by the various governments. The legislative branch is solely responsible for approving the agreement.

Security and data protection (data encryption, collected data, and risks of hacking). The centralization of three of the five databases (one for the general monitoring of the epidemic, one per manual tracing center, and one for the application) within Sciensano was criticized. Firstly, Sciensano’s ability to provide security and to protect itself from hacking was questioned. Secondly, the database hosted by Sciensano includes 13 pieces of personal data (e.g. surname, first name, gender, address, telephone number, test results, etc.) among which some were deemed irrelevant by the Data Protection Authority and the League for Human Rights. In addition, Sciensano stores in a single database individual information such as random code, national registry number, and telephone number. This means that users could not be guaranteed that the data was de-anonymized. Thirdly, by assigning an identical key (i.e. the national registry number) for the five databases, the risk of piracy and access to private data were significant.

The relevance of the Coronalert application is called into question. Indeed, the Deloitte Global Mobile Consumer Survey published in 2019 estimated that 22% of the Belgian citizens do not own a smartphone (Table 3).

Table 3. Issues concerning the adoption of the exposure notification and contact tracing app.

Issue	StopCovid	NHS Covid-19	Coronalert
App Functioning	Bluetooth activation and proximity measure.	Bluetooth Activation and proximity measure, prior to the iPhone 7 is not compatible with NHS Covid-19.	Adaptation of an application developed in another European State.
Security and Data Protection	Opposition to centralized data storage, collection of private data, and risks of piracy.	Opposition to centralized data storage.	Collection of 13 different pieces of private data, no guarantee of de-anonymization, and low protection of the Sciensano database.
Effectiveness	Detection rate (between 75% and 80%) and utilization rate (3.6 % of the population).	Detection rate (31% of risky cases were missing and 45% were misidentified as risky) and utilization rate (22.5 % of the population).	Utilization rate (15 % of the population).
Relevance	23% of French citizens do not own smartphones.	21% of British adults do not own smartphones.	22 % of Belgian citizens do not own smartphones.
Acceptability	45% of French citizens are ready to use the app.	–	–
Time	Several postponements of the launch date.	Postponement of the launch date from June to September.	–
Interoperability	Absence of interoperability between the French app and the European ones.	–	–
Political Power	–	–	Institutionalized collaboration between regional and federal levels.

5. Discussion and conclusion

This publication studied the issues encountered by developers and public decision-makers during the adoption of a technological solution to monitor and slow the spread of Covid-19. In this study, we have identified the political and technical challenges met during the implementation of public contact tracing apps on smartphone devices. Three tracing applications were analyzed: StopCovid (France), NHS Covid-19 (UK), and Coronalert (Belgium).

In the three cases, the exposure notification and contact tracing app is part of a global public health strategy, including the use of manual tracing. The main aim of these digital tracing applications is to increase the responsiveness of tracing by notifying individuals at risk as quickly as possible. Although its effectiveness has not been explicitly demonstrated in terms of the number of infections detected or in reducing the number of infections, digital tracing is presented by public authorities as a means of reducing the costs and constraints resulting from the lockdown.

Due to its innovative nature, the development and implementation of the exposure notification and contact tracing app have generated several public challenges. Through the thematic analysis, eight issues relating to the adoption of digital contact tracing apps were identified: (1) the operability (i.e. how the application works), (2) the interoperability (i.e. the exchanges and synergies between the different digital contact tracing applications), (3) the relevance (i.e. the coherence between the problem to be solved and the instrument used), (4) the acceptability (i.e. a favorable opinion of the target population with regards to the use of a digital contact tracing application), (5) the security and data protection (i.e. protection of the user, the application and the smartphone), (6) the effectiveness (i.e. the direct effects produced by the application on the management of the epidemic), (7) the temporality (i.e. the time constraints for the development of the application) and (8) the political competition in multiple governance contexts (i.e. difficulties in reaching cooperation agreement between Federal State and the federated entities in Belgium).

In the three cases, security and data protection, as well as the relevance of digital tracing were the most salient. First, in terms of security and data protection, five political challenges were highlighted: to ensure the anonymization of privacy data, to limit data collection exclusively to information related to interactions (i.e. proximity and duration), to select the mode of data storage, to develop safe and sure storage infrastructures and to protect users from false alerts and hacking. Secondly, in terms of relevance, the main pitfall lies in the exclusion of a significant part of the target population due to the non-possession of smartphones and, more generally, the “digital divide.” The development of alternative tools to digital contact tracing (e.g. cell broadcast,) should be also adopted by the States. Also, in the cases of StopCovid and NHS Covid-19, two major issues were identified in terms of operability: the use of Bluetooth to measure proximity and the activation of Bluetooth for inactive applications on devices using Android or iOS.

Although digital tracing apps have not led to a reduction in lockdown constraints, the adoption of a new public health instrument by several European States represents a double opportunity for them. Firstly, between the cholera epidemic that struck Europe in the 19th century and the Covid-19 pandemic, the lockdown remains a key method for containing the virus (Pouget 2020). As such, in terms of public health policy, the use of contact tracing and notification applications consists of a novel tool in the management of epidemics, particularly in the context of globalization. Digital tracing is, at least theoretically, relevant when the number of cases is high or when there are multiple transmission channels (Kojaku, Hébert-Dufresne, and Ahn 2020; Kretzschmar et al. 2020). By targeting and notifying the individual at risk instead of a population, the exposure notification and contact tracing app could reduce the negative impacts of lockdown (Alsdurf et al. 2020). However, to be effective, the digital tracing requires a minimum utilization rate (around 60%) (Ferretti et al. 2020), a notification of the test result within 24 hours, and the self-isolation of each (potentially) infected individual.

Secondly, at the political level, the development of a new national instrument tends to affirm the role of the European States in public health to the detriment of the European Union. In this perspective, France has based its application on the principle of digital sovereignty, which is one of the foundations of France’s national AI strategy (Villani et al. 2018). This principle of digital sovereignty grants power to the French government to make decisions regarding algorithms and to control the data necessary to carry out its policies. Moreover, the lack of coordination at the European level limits the interoperability of applications and results in a schism between, on the one hand, States that have implemented an application using centralized data storage systems (France, Northern Ireland) and, on the other hand, those with decentralized storage systems (Belgium, Germany, UK).

Several limits have been identified in this research. The first limitation is the small number of official documents available for the cases studied, especially in the case of Belgium. Given these limitations, the results should be considered exploratory. Secondly, this research focused on identifying the issues resulting from the adoption of digital tracing in three European States. The cases studied were therefore not selected according to a comparative approach, but as singular cases allowing for the identification of potential problems. For further research, the analysis of other digital contact tracing apps could corroborate the presence of the challenges described above and potentially identify additional ones.

Acknowledgments

The authors thank the reviewers for their time and their helpful comments. Special thanks to Ashley Rhéaume who kindly agreed to review the publication. Finally, the authors thank Anik Dupuis and Jean-Simon Trudel for their involvement in this research project. All these research assistants are members of the Center for Public Policy Analysis at Laval University (CAPP).

Disclosure statement

The authors declare that they have no affiliation with an organization having a direct or indirect financial interest in the subject matter discussed in the manuscript.

Additional information

Funding

Funding for this research was provided by the Fonds de recherche du Québec – Société et culture [FRQ-SC/Grant n^o 268938] and the International Observatory on the Societal Impact of AI and Digital Technology (OBVIA).

Notes

1 “The basic reproduction number (R0) is the average number of people to whom an infected person will transmit the infection”. Vaithianathan, R., Ryan, M., Anchugina, N., Selvey, L., Dare, T., & Brown, A. (2020). Digital Contact Tracing for COVID-19: A Primer for Policymakers.

2 These five states are Belgium (Coronalert), France (StopCovid), Ireland (Covid Tracker), the United Kingdom (NHS Covid-19) and Switzerland (SwissCovid). As of July 7, 2020, Luxembourg didn’t consider the use of a digital contact tracing application.

3 To study StoCovid, eight daily and weekly newspapers were included in our search: Courrier International, Les Échos, L'Express, Le Figaro, L'Humanité, Le Monde, Le Parisien and, Libération.

4 To study NHSX Contact Tracing App, four daily and weekly newspapers were included in our research: BBC News, Daily Mail, The Guardian and, The Telegraph.

5 To study Coronalert, four daily and weekly newspapers were included in our research: La Libre Belgique, Le Soir, Le Vif and, Sud Presse.