Some musings on the differences between (assisted) contact tracing and exposure notification.

…

Apple and Google recently updated their terminology to use the term “Exposure Notification” to describe what they’re offering through their jointly-developed APIs, rather than the broader term “Contact Tracing”. I thought I’d dive a little into what the difference is between contact tracing and exposure notification, and what that means for the trust relationship that the user has with the contact tracer.

Contact tracing was traditionally carried out by health authorities to track the spread of a disease by getting in touch with infected patients and the people they have been in contact with. As you can imagine, this is a labor-intensive effort - you would need to build an army of contact tracers to be effective across a large population (say, the state of New York). The seductive power of techno-solutionism is easy to grok - we carry supercomputers around in our pockets every second of every day, why not offload yet another job role to an app? Why do manual contact tracing at all when we can rely on our phones to inform us if we’ve been in touch with an infected person?

The issue is that the latter (i.e. informing people about potential exposure to the virus) is only part of what contact tracers do. Contact tracers have to be empathetic and responsive to the people they’re advising. The advice given also varies person-to-person: for example, if who they’re calling is elderly and/or already showing symptoms, the contact tracer might recommend getting a test done ASAP, as opposed to just quarantining. Above all else, the role of a contact tracer is to be humane (much like a doctor or a nurse) as they speak to someone who has just been given a piece of life-altering (at least in the short-term) news. These are the parts of contact tracing that are difficult to automate.

This is not to say that technology does not have a role to play. Privacy-preserving exposure notification (as being built by Apple and Google, inspired by the DP-3T proposal) has the potential to scale this particular aspect of contact tracing to billions of people. But it’s important to keep in mind that it is not a complete solution. It also seems to me that augmenting existing manual contact tracing processes with technology would seem preferable to health authorities over wholesale adoption of an entirely new exposure notification ecosystem.

It’s also worth noting that there are several ways of using technology to help manual contact tracers. State and national governments have been partnering with several tech companies to automate case management. You could also imagine an app serving as a location memory aid - it could track the places you’ve visited for the last 14 days securely on your phone (not uploading to the cloud), and if you are diagnosed with the virus, these locations could be shared with a manual contact tracer who would then work with you to reconstruct where all you went and who all might need to be followed up with (this is in fact what V1 of the PrivateKit: Safe Paths app does).

So digital contact tracing can be split into two different classes of solutions: assisted (manual) contact tracing, and automated exposure notification (for more words about the difference between the two, check out Harper Reed’s post). Both have their own set of privacy and civil liberties challenges, but it’s important to note that tools that enhance existing manual contact tracing systems (for instance, by recording location data and releasing them to a manual tracer on diagnosis) have a different trust relationship with the user than a fully automated contact tracing system that identifies risk of infection based on proximity or location. A user might feel comfortable releasing information to a qualified healthcare professional, but feel significantly less comfortable being informed by their smartphone that they might have been in contact with an infected person.

Who would you rather be informed by that you might have a life-threatening disease, a qualified health professional or an app notification? (Not a rhetorical question.)