The following was written by Melyssa Eigen, J.D. Candidate at Harvard Law School, under the guidance of Professor Urs Gasser. It is the first in a series of briefing documents on COVID apps in several countries around the world. Gasser and Eigen previously wrote about the SwissCovid App in the context of trust and digital contact tracing.
SwissCovid is an exposure notification app designed to complement other ongoing contact tracing efforts in Switzerland. The app, which launched nationally on June 25th, 2020 is a collaborative effort supported by the Swiss Federal Public Health Office. Downloading the app is voluntary and it's available on both iOS and Android platforms. The following provides some insight into the app’s technological, data, institutional and behavioral aspects as well as some other key points about the app.
An Overview
Technological:
SwissCovid, which uses APIs directly from Apple and Google, runs on Bluetooth Low Energy rather than GPS, meaning that user location is not tracked. When a user’s phone detects another phone within 1.5 meters for a period of 15 minutes or longer, the phones exchange encrypted IDs through the application and record the contact. If the user becomes infected and tests positive, they will be issued a 12-digit Covidcode by cantonal authorities that they can choose to enter in the app. Once entered, the code will be validated by a Federal Government server. If valid, all encrypted IDs that the user was in contact with during the period they were contagious will automatically be notified through the app about the exposure, and will be given additional information on next steps. They will not be told who the exposure was from, just a timeframe. Currently, the app only works in Switzerland.
Data:
The app uses a decentralized storage method that is based on a privacy preservation concept, DP3T. It exchanges the encrypted IDs via Bluetooth and stores them locally on the mobile device -- no personal or location data is sent or stored on a central server. The central server only stores encrypted data about the contact event, and the server cannot draw conclusions about app users based on this data. After two weeks, the encrypted contact is deleted from the list. While this method is supported as being safer than centralized storage, reidentification and third-party data sales are still potential concerns.
Institutional:
In mid-May 2020 the Federal Council enacted a temporary ordinance to allow for the testing of the app in compliance with Switzerland’s Data Protection Act. Further, the Council -- in response to a public and political debate -- proposed an amendment to the Epidemic Act to allow for wide-scale use of the application during the course of the pandemic, which was approved by the Swiss Parliament. The app was launched by the Federal Public Health Office on June 25, 2020 and was approved by both chambers of Parliament. Installing the app will be entirely voluntary.
Behavioral:
Initial polls showed that around 70% of residents supported SwissCovid and that an estimated 59% would download the app. What is particularly interesting is that the voluntariness of the app is a big reason for its support, given that 54% of survey respondents were against a mandatory contact tracing app. Respondents discussed data protection as an existing concern that may limit their support, in addition to worries about the effect the app will have on battery life. As of June 9th, 2020 however, reports show that only around 20% of the population had downloaded the app, which is much lower than initially predicted and probably less than what’s needed for the app to be truly effective. Recent polls reflect this reversal in support with 56% of respondents claiming that they will not download the app due to data protection issues.
What makes SwissCovid interesting?
Collaborative:
The diversity in collaborators who worked towards SwissCovid’s creation makes the effort particularly interesting. SwissCovid was a joint-effort by the Swiss federal institute of technology, EPFL and ETHZ, in Lausanne and Zurich as well as with Ubique, a Swiss technology company. The app was developed by the institutions on behalf of the government, demonstrating wide scale support and urgency between research, government and private sectors on this initiative. What makes the app even more collaborative is its use of APIs directly from Apple and Google, making it easy to integrate with these platforms. However as of June 25th, 2020 there were initial reports of issues with iOS that will hopefully be addressed in new software updates. The open source design also allows for public participation through transparency and provides an opportunity for feedback. The public security testing conducted during the testing phase also aimed at providing transparency.
Legal Basis:
Not only did the Federal Public Health Office support the initiative to build the app, but Parliament also amended its Epidemic Act to account for the special circumstances of COVID-19. This created a firm legal basis for widespread use of the app while still complying with Switzerland’s Data Protection Act. The Epidemic Act as it stood probably provided the regulatory basis for the app on its own since SwissCovid is not mandatory nor does it store sensitive data on a central server, but amending the Epidemic Act created an even clearer statutory basis for the app’s existence and use of data. Further, the involvement of the Federal Data Protection and Information Commissioner demonstrates a commitment to a strong legal foundation, which could help legitimize the app and reduce skepticism about potential data protection issues.
Public Support:
In Switzerland, trust in the government is the norm and not the exception, unlike in many other countries. Surveys even show that the public majority trusts the government to handle their COVID-19 response. As such, the initial public support for the SwissCovid was not surprising, with an estimated 59% of poll respondents claiming they would download the app. What is surprising though, are the lower than expected download rates during the app’s first and second weeks given the overall trust and initial support of the government. Although the voluntary aspect of the app was an initial reason for the support, it may also be one reason for the low download rates. Further, recent polls show that respondents don’t necessarily see the benefits of the app and are still skeptical about data protection. Perhaps the changing situation and recent uptick in cases will instill a greater urgency to use the app in an effort for people to protect themselves and others. Hopefully, SwissCovid can use its initial support and increase its download rates in the weeks to come in an effort to improve contact tracing.