Tracking coronavirus: Should you install the CoronApp?

Countries around the world are grappling with the technological and privacy issues generated by coronavirus tracking applications – and Colombia’s CoronApp is unlikely to win any prizes.

It’s been a bumpy ride for Colombia’s CoronApp. Launched on March 7, the mobile application was initially meant to allow the government to track COVID-19 outbreaks, as well as educating the public on the virus. But it’s faced a number of false starts and criticism from public watchdogs around its data policies. Here’s what you need to know. 

The state messaging was coming from seemingly everywhere: “Download CoronApp, save lives.” It found us through television broadcasts, interruptions on YouTube, graphics on social media. Bogotá musician Juan Camilo Ruiz Gonzalez, 23, first heard it on his own cell phone soon after the lockdown began in March. But like 40 million other residents of Colombia, he has not downloaded the app. For many, it may be a matter of access. But for Gonzalez it’s a question of trust. “The truth is I never trusted this type of government app, because I feel they have other intentions apart from what they stipulate, and the terms and conditions always end up being vague,” he said.

In a large marketing campaign through April, Colombians were promised that using the CoronApp would help the government build an accurate map of the behaviour of coronavirus in the country. Colombian president Ivan Duque told the public that by downloading the app, the government would be able to “geo-reference and follow-up” cases of COVID-19. 

Three months after the app’s launch, and the software has been plagued with issues. The public is confused about what CoronApp actually does. As of today, it is unclear whether the government is able to either geo-reference or follow-up cases of coronavirus. And now Colombian tech leaders are saying the app was poorly thought out and developed on the fly without proper privacy protections for its citizens. 

Who created the CoronApp?

CoronApp has roots in an app designed by the National Institute of Health ahead of Pope Francis’ visit to Colombia in 2017. Fearing an illness outbreak caused by the high numbers who gathered to pay respects to the pope, the institute developed ‘Health Guardians’ for people to report if they felt ill. 

Fast-forward three years and Colombia, in the midst of a pandemic, quickly reinvents the Health Guardians’ source code with four clear goals: educate the public about coronavirus, offer a self-diagnosis test, provide a QR code mobility passport and implement a digital contact tracking system. According to El Espectador, as of June 7, the National Digital Agency had invested COP$510,318,794 in the development and maintenance of the application. The agency did not respond to The Bogotá Post’s question about how much it has spent on marketing and promotion of the app.

Log onto CoronApp today and — after accepting the terms and conditions — you’ll be able to access the latest government messaging and information on COVID-19. Users are also asked to enter their names, ages, identification numbers, symptoms, prior medical history and previous movements, as well as providing the app access to track their location through bluetooth.

Read our latest coverage on the coronavirus in Colombia

Nobody argues that the educational aspect of the app is important. Victor Cortés, CEO and co-founder of technology website Contxto, says every citizen should have this information easily available to them. “Misinformation or the lack of information is definitely an important factor for increasing not only contagions but deaths worldwide. In a region where education is a luxury, such as Latin America, many people ignore or are sceptical about the potential harm of the virus — or even question its existence. So, in that respect, I do believe it is fulfilling its goal.”

However, the contact tracking aspect, which was meant to give both users and the government geo-located information about where the virus was spreading, has not lived up to its promise.

Contact tracing fail?

The initial idea of the app was that users would self-report if they weren’t feeling well, along with their symptoms. CoronApp would exchange bluetooth signals with nearby phones that run the same application. With that data provided en masse, the government would be able to build a map that showed — and potentially stemmed — outbreaks in certain areas. “By collecting the data of your symptoms we can locate the sources of contagion, help stop the virus and save lives,” the app says. 

But there were problems. First of all, any sort of worthwhile tracking requires the buy-in of a large proportion of the population. Only 9.6 million of the population of 50 million have downloaded the app, as of June 7, of which 5.8 million are active users, according to El Espectador.

And barriers lie in Colombia’s internet penetration. According to the latest MinTic report, only 61.3 % of the population has mobile Internet access. “Access to the internet is still a latent problem in Colombia,” Cortés says. Compared to Chile’s 82% and Argentina’s 93%, Colombia is still lagging behind its regional peers, he said. While 72% of the population own a smartphone — a trackable device — if a large proportion of the population can’t be tracked due to connectivity issues, that raises concerns about the effectiveness of the app.

Plus, there’s always a degree of uncertainty surrounding the validity of crowdsourced data. And bluetooth may throw up ‘false positives’ from people who may live in the same building but have no contact. To date, it does not appear that the government has been able to use the contact tracing feature in any way. El Espectador reports that the INS is using the CoronApp bluetooth functionality to track down contacts that a COVID-19 confirmed person may have had.

If a person is exposed to a high risk of COVID-19 or has severe symptoms, they should be notified through the application and asked to activate a button called “Commuter history”, which is disabled by default. However, whether they activate it is their choice — another barrier to effective contact tracing.

The app has gone through a number of iterations since launch using different models, and different partners. But public watchdogs warn that each iteration comes with a varying degree of data security that the public needs to know about.

Data insecurity

After the tide of advertising pushing users to download CoronApp came the backlash from public watchdogs analysing the government’s data policies. According to analytics company Cifras & Conceptos, the imprecise wording of CoronApp’s terms and conditions could allow any authority to request the data held by the app.

It points out that any use of technology needs to respect citizen data so as not to open the door to abusive surveillance systems. “Are we willing to give our sensitive data to the government to make the fight against coronavirus more effective?” it asks. The organisation notes that the pandemic could normalise the use of mass surveillance instruments like government access to geolocation and bluetooth signals from citizens’ cell phones — where we’ve been and who we’ve interacted with.

For Gonzalez, it’s hard to see any benefit to giving the government his data. “I understand that they are trying to control people so that they do not leave home when they have symptoms, but the truth is that I don’t see any positive reason in my life to use it. I have no guarantee that they will help me, and that lack of transparency in their policy security gives me zero desire to enroll. Instead, he fears that his sensitive information could be given away, or even sold on. 

The government’s access to the population data has pros and cons, Cortés says. On one side, he can see the advantage of understanding the danger zones with accuracy, so real and effective countermeasures can be implemented. “Yet the fact that security of the data doesn’t seem to be a priority for the app developers/government (either deliberately or by negligence), sends a clear message to the population.” 

Cortés points out that we’ve seen a couple of huge data breaches in the past years from Latin American governments including Mexico, Ecuador, and Brazil. “If security isn’t a top priority for governments, it should be left to the citizens to decide whether they’re willing to risk their data (though most of them never actually stop and ponder that).”

The questioning is not limited to Colombia. All over the world — from Israel to Singapore and Australia to South Korea — governments are developing technology-based solutions to the pandemic and citizens are questioning what they are giving away for public safety. In China, the government is fighting the pandemic with a QR code, a feature in the CoronApp that has been a recent source of controversy in Colombia.

So, do I have to download the CoronApp?

While CoronApp is not currently mandatory, as the country begins to reopen, some municipalities are saying that citizens will only be able to move around if they install it. The app includes a feature that allows a 24-hour mobility QR code ‘passport’ to be generated for those reporting no symptoms and no contact with those at risk of COVID-19. 

In Bogotá, an order that would have cops to give those without CoronApp authorisation a COP$1 million fine was quickly repealed after it was met with a fiery backlash over data insecurity two weeks ago. However, in Medellin, authorities are piloting a system that requires shoppers to download and use CoronApp in three malls. 

It remains to be seen whether CoronApp becomes a failed experiment, or a useful tool in the fight against the pandemic. What is clear is that the government has a long way to go before it can convince enough people to use the app. Whether it achieves this by gaining the public’s trust, or by forcing them to use it, remains to be seen.