A list of issues that make contact tracing an impractical solution in the real world, from trolling others to cheating to insufficient adoption
but it doesn't have to be creepy Vass Bednar / regs to riches : #6 — This is a newsletter about regulatory hacking featuring (mostly) Canadian startups. Xinmei Shen / Abacus : From QR codes to social media, four ways China tracks Covid-19 Chenxi Wang / Forbes : Privacy In The Time Of COVID — Founder & General Partner of Rain Capital Benjamin Powers / CoinDesk : Europe Debates COVID-19 Contact Tracing That Respects Privacy Khari Johnson / VentureBeat : What privacy-preserving coronavirus tracing apps need to succeed Memex 1.1 : Suppression may be working — At least estimates from the … Pierluigi Paganini / Security Affairs : Apple and Google join forces to develop Contact Tracing app against Coronavirus Bruce Schneier / Schneier on Security : Contact Tracing COVID-19 Infections via Smartphone Apps MacDailyNews : What's wrong with the Apple-Google COVID-19 contact tracing scheme David Pierce / Protocol : Tech loves Google and Apple's unholy alliance Tweets: @themarkup : New: Apple and Google are building a system to let you use your phone to alert people who were recently near you that you have been diagnosed with COVID-19. In our latest Ask The Markup, @JuliaAngwin breaks down the privacy pros and cons of the plan. https://themarkup.org/... James Crabtree / @jamescrabtree : This is persuasive on the limitations of contact tracing apps - not least the bit on whether people will actually trust the information the app provides, especially if it involves another 14 days at home https://twitter.com/... Shashank Joshi / @shashj : Contact-tracing apps: “The performance art people will tie a phone to a dog and let it run around the park; the Russians will use the app to run service-denial attacks .... little Johnny will self-report symptoms to get the whole school sent home.” https://www.lightbluetouchpaper.org/ ... Shashank Joshi / @shashj : “Bluetooth also goes through plasterboard ... The bluetooth app will flag up not just the others in the room but people in the next room too.” https://www.lightbluetouchpaper.org/ ... Shashank Joshi / @shashj : “If the app's voluntary, nobody has an incentive to use it, except tinkerers and people who religiously comply with whatever the government asks. If uptake remains at 10-15% as in Singapore, it won't be much use and we'll need to hire more contact tracers” https://www.lightbluetouchpaper.org/ ... @fukami : Great piece by @rossjanderson about tracing apps and what's likely to work and what not “We must call out bullshit when we see it, and must not give policymakers the false hope that techno-magic might let them avoid the hard decisions” https://www.lightbluetouchpaper.org/ ... Stefano Zanero / @raistolo : Unsurprisingly, @rossjanderson hits a lot of things I also worry about in this blog post. The only thing I marginally disagree with him on is that we do not need CT for the current epidemic wave. True, but we will need it in a short while. https://www.lightbluetouchpaper.org/ ... Javier de la Torre / @jatorre : I am getting scared of all these cryptographers now saving the world with contact tracing without privacy issues... This is going to delay solutions a lot by adding noise to decision makers. This blog post summarizes it great https://www.lightbluetouchpaper.org/ ... Alex Stamos / @alexstamos : Combined with the fact that we are approaching 30 days with most corporate laptops not talking to a domain controller (or on-prem config management), this will be a fun couple of months for malware. John S. Wilson / @johnwilson : The premises in this are flawed. I think many people will use the Apple/Google contact tracing app bc they want to know if they've come in contact with someone who has tested positive. Also this isn't about a perfect solution—none exists. This is about an arsenal that can help. https://twitter.com/... @chaosupdates : Ross Anderson crystal-clear on intrusive systems like Contact Tracing Apps: What we need is a radical redistribution of resources from the surveillance-industrial complex to public health https://www.lightbluetouchpaper.org/ ... #Covid19 Phil Booth / @einsteinsattic : Seriously folks, if you've not read @rossjanderson's piece yet, pour yourself a stiff drink and do so: https://www.lightbluetouchpaper.org/ ... In these times more than ever, we need his #calm, #considered & well-#informed #clarity. Toby Walsh / @tobywalsh : We must call out bullshit when we see it, and must not give policymakers the false hope that techno-magic might let them avoid the hard decisions https://www.lightbluetouchpaper.org/ ...
Context & Ripple Effects
This piece lands mid-arc in the April 2020 debate over smartphone contact tracing. Three days earlier, The Verge catalogued the limits of Bluetooth-based voluntary tracing — adoption hurdles and potentially large numbers of false positive pings — and Apple responded with a spec tweak letting apps weigh duration of proximity when classifying a contact. Light Blue Touchpaper's list widens the critique from technical accuracy to human behavior: trolling, false reports, cheating, and simply not enough people installing the apps.
The stakes became clearer within weeks: Apple and Google pushed the Exposure Notification API to the public in iOS and Android updates, dozens of tracking apps went live or into development despite security and privacy concerns, and the US fragmented into a state-by-state approach that Wired flagged for interoperability and privacy problems. The Cambridge critique matters because it attacks the assumption underneath all of that engineering — that a voluntary, decentralized system can reach the adoption levels epidemiology requires.
First-order effects
- Public health authorities building apps on the Apple/Google Exposure Notification design inherit its failure modes directly: low voluntary adoption, Bluetooth proximity inaccuracies, and users who can game the system by trolling or filing false exposure reports.
- Apple and Google face pressure to keep adjusting the API spec — the duration-of-proximity option shows them patching the false-positive problem their Bluetooth-based design creates.
Second-order effects
- The adoption problem forces governments toward either integration with manual tracing workforces or coercive alternatives — China's QR-code and social media tracking, covered in the same roundup, is the contrasting model that trades privacy for compliance.
- Fragmented national and state deployments, as in the US state-by-state approach, multiply the security and privacy review burden and break interoperability, weakening the network effect the apps depend on.
Third-order effects
- If voluntary, privacy-preserving tracing keeps falling short of adoption thresholds, the durable lesson is that epidemic-scale apps are network-effect products — useful only near saturation — which pushes democracies toward hybrid human-digital tracing and autocracies toward mandatory surveillance infrastructure.
- The episode sets a template for crisis-driven platform policy: Apple and Google's OS-level API became the chokepoint through which health authorities worldwide had to route their tracing ambitions, prefiguring platform governance of public-health data.
The trend: Pandemic-era contact tracing is demonstrating that voluntary, privacy-preserving apps cannot reliably reach the adoption thresholds their effectiveness math requires, splitting the world between platform-mediated opt-in systems and mandatory state surveillance.