How to create an excellent process to deliver a worthless contact-tracing app

As it became clear that Covid-19 would not spare Europe, contact-tracing apps quickly surfaced across the continent as the tech-solutionist quick fix. While the European institutions worked on coordinating an interoperable, privacy-centric and decentralised joint effort, member states stubbornly set off on their own paths. Many countries jumped on the bandwagon like France, Germany and others for their shot at contact tracing fame. The Netherlands was no exception.

In April, the Dutch Ministry of Health announced that it would explore the possibility of deploying a contact tracing app. Many feared that the Netherlands would continue its longstanding tradition of asking consulting giants to deliver a buggy app. To our dismay, the Ministry instead organised a cringe-worthy game show on YouTube where “7 teams battle to develop an app to break the chain of infections”. This predictably received tremendous backlash from civil society, academia, the technical community as well as mainstream media. After weeks of intense pressure from Bits of Freedom and the rest of civil society, the Dutch government finally buckled and kickstarted a radically different process.

No multi-million dollar tenders or ready-made ‘solutions’, but rather an open, interdisciplinary process to deliver a privacy-centric and inclusive app. Government developers joined forces with open-source communities and brought in talent from the Dutch tech scene. Most deliberations in the early stages could be followed on their open Slack channel. After further attempts by civil society and politicians, the underlying app requirements and architecture were also published alongside the first code and user interface (UI) designs. We then saw extensive User Experience (UX) and accessibility testing, implementation of a framework by Google and Apple that was relatively privacy-centric as well as far-reaching security features. A notary provided escrow services to ensure that the code in the Github code-repository and the live code matched. Top government officials even hosted Jitsi (a free, privacy centered video conferencing tool) rooms for AMA’s (Ask Me Anything) where critics, experts and laymen could ask questions. We have not seen such an open, vulnerable, inclusive and interdisciplinary process implemented in any government project, let alone in a politically sensitive one where the stakes are so high.

But our story does not end there. A day after the initial announcement that the Ministry would explore the use of a contact-tracing app, Bits of Freedom led a coalition asking for 10 demands that these kinds of apps should adhere to. These demands were signed by over 40 experts in the fields of human rights, technology and privacy. In short, we demanded that if a contact tracing app was proven necessary, it should be “temporary, transparent, completely anonymous, voluntary and user-friendly, free of commercial interests, and it should be brought under the control of independent experts.” Slowly but surely, the ministry moved closer towards these demands and the Health Minister reassured the public that these demands would lead the development of the app. Legislation has even been passed to ensure that the app will remain voluntary and temporary. This is a huge win for Bits of Freedom, civil society and society at large.

However, Bits of Freedom has also advocated early on at a round-table with the Dutch parliament that technology does not exist in a vacuum. It is moulded by existing structures and systems.

This brings us to the center of the paradox of the Dutch app. From the start, the public health authority has had problems with its test-trace-isolate strategy and contact-tracing efforts, rendering contact-tracing apps nearly useless. As both the flu season and signs of a second wave of infections approaches, these problems are only intensifying. The test capacity is currently not nearly enough to accommodate people with clear symptoms, let alone people who get an app-notification. As a result, app-users can’t get tested, but rather must self-quarantine for ten days.

Behavioral studies in the Netherlands has already shown that 90% of persons with symptoms leave the house, despite clear directions from the government not to. And this is just one example that the app’s connections and expectations in society at large, has received far too little attention.

This brings us to the painful conclusion that the app, which in technical terms is ‘as good as it gets’, might prove to be yet another completely unnecessary surveillance infrastructure.

Another cautionary tale that technology might, at best, be part of a solution but cannot be expected to fix complex broader societal issues like a global pandemic.