Can tech trace the spread of coronavirus? Maybe. Maybe not.

One way to control the spread of viruses is contact tracing. That’s when public health officials track down everyone that an infected person has been in contact with and isolate them. Tech companies believe they can make that process easier and faster. Apple and Google have partnered on an app that will constantly ping other phones around you using Bluetooth technology. If you test positive for COVID-19, you notify the app, and then everyone who’s been near you will get a notification.

It sounds like a clever tech solution, but some experts say it’s too much tech and not enough solution. I spoke with Ross Anderson, a professor of security engineering at University of Cambridge, about this. The following is an edited transcript of our conversation.

Ross Anderson: The idea is that people would have an app on their phones, and the app would then use Bluetooth to determine whether other people had been nearby. Typically, they’re looking for people who have been within 6 feet of you for five minutes or more. That means that if somebody tests positive or calls in sick, they can look at your phone and they can identify all the other phones that have been nearby. That’s at least the theory.

Molly Wood: Let’s talk about the technology first and then the behavior. How would that technology work and, frankly, what are its limitations?

Anderson: Bluetooth has a number of limitations, because it wasn’t designed as a radio ranging technology. If you set your Bluetooth signal strength so that you’re reasonably confident that you will identify people who have been within 2 meters of you, you will also have a fair amount of probability [to] find people who are 4 meters or 5 meters away. You will also make false contacts with people who are standing normally 4 or 5 or 6 meters away from you in a supermarket line, or people who are in the apartments above you or the apartment below you. So you end up getting a whole lot of false positives.

Offering false hope from an app that is unlikely to work is not, I think, something that’s helpful in the circumstances.

Ross Anderson, professor of security engineering at University of Cambridge

Wood: That would mean that potentially your phone can be pinging all the time saying you were in contact with a person who has tested positive for coronavirus, when really you might have driven past each other at the same stoplight or been at the grocery store together?

Anderson: This has been a serious problem with the app that Alibaba has deployed in China. People’s apps have been turning yellow or red because they were in a train that went through a town that had a whole lot of coronavirus patients.

Wood: On top of that, the system that’s being proposed in the U.S., by tech companies at least, is entirely opt-in. Presumably, that could also make it less effective, right?

Anderson: The system being proposed by tech companies in the U.S. and elsewhere is usually based on an app that they had in Singapore called TraceTogether. However, once you go through an opt-in model where people have to run the app on their phone, you find that only a few people do it. In Singapore, they got something like 12% of the population running this app. The implication of that is that if only 12% are running at each end, then the likelihood that you’ll pick up an event of interest is 12% squared. This means that 98% of the events of interest aren’t going to be picked up. In addition to the big false alarm rate, you’re getting a huge missed alarm rate. You’re getting very little signal and an awful lot of noise.

Wood: There was 12% use in Singapore, where I would imagine people are not quite as — certainly in the U.S. at least — people are distrusting of these tech companies.

Anderson: Yes, I think that Singapore is quite different from America, because there everybody at least has to pretend that they love the government. Whereas in America, people are more individualistic. If you can get 12% in Singapore, then good luck getting 5% in America. Americans living in a market economy are also going to figure out “What’s in this for me?” If I run an app like this on my phone, then the chances are the only effect it is going to have on me is that sometime in the future, the phone will ping because of a false alarm and say, “Hey, Ross, you’ve got to go into self-isolation for 14 days because you were standing next to somebody yesterday who has since reported that he’s got a new cough.”

Wood: It is inevitable that we are also thinking, we American consumers, “What’s in it for these tech companies?”

Anderson: I think one shouldn’t worry about that too much, because the proposal from Google and Apple takes the Singaporean proposal and makes it even more anonymous, in that what they propose to do is build into their operating systems the facility whereby it will do this Bluetooth pinging, but it will change the phone’s identity every quarter of an hour or so. This means that it’s very, very hard for governments even in authoritarian countries, like, say, Hungary or Egypt, to abuse the Apple phones or Android phones to increase surveillance further. That’s something that the tech companies care about. On the other hand, changing the phone’s ID every 15 minutes is going to make it much less useful to the epidemiologists. In the United Kingdom, we’ve had an attempt to do some kind of middle ground, whereby the idea is that the phone IDs will change only once a day and there will be a means of linking the successive phone IDs up together. This means that the epidemiologists can do much more fine-grained contact tracing. They can distinguish between a phone that calls in sick when it’s never been near any other phone that called in sick, and another phone which has 20 times in the last two days been near someone who actually had a positive diagnosis. They can run the system in a much more nuanced and potentially effective way. Even with the British proposal, there are such growing concerns about privacy and also growing concerns about effectiveness, because again, how many people in Britain will run this? Probably not enough. This strikes me as likely to be a non-starter.

Wood: Why is there such a rush to come up with a tech solution? Is it just techno-chauvinism? Is it our instinct toward any port in a storm?

Anderson: It’s natural for everybody to try and work out “how can I possibly help?” If you’re a businessman, “How can I make some money out of this?” If you’re a government bureaucrat, “How can I build an empire out of this?” There’s a big risk in this, because if you’re a national leader, then you may be tempted to make wrong decisions or to duck hard decisions if somebody waves at you some wizzy app that promises to enable you to avoid the pain. Offering false hope from an app that is unlikely to work is not, I think, something that’s helpful in the circumstances.

Related links: More insight from Molly Wood

Anderson wrote a long paper about this that goes into a lot of detail about this idea of tech-based contact tracing. Whether it works or not, the idea is spreading fast, and not just as a free tool like Apple and Google are offering.

The big tax and consulting firm PwC, also known as PricewaterhouseCoopers, just released a contact-tracing product for businesses, promising it will help them build confidence and trust with their workforce. Told you somebody was going to make us use this.

I don’t want to neglect the other hugely important aspect that needs to be in place before any conversation about contact tracing can even begin, which is testing. Although the United States has ramped up its testing capabilities, it’s still far below what it would need to be to even identify enough infected people to make contact tracing notifications effective. In fact, Politico reports that the number of commercial tests being analyzed in the U.S. fell by more than 30% over this past week. The reasons seem to range from shortages of testing swabs to narrow testing criteria. According to the Wall Street Journal, even the task force of business leaders that President Donald Trump convened to talk about ways to reopen the economy had basically one message in their first phone call: Without a massive increase in testing, you can open anything you want, but people aren’t going to feel safe going there.

Here’s what else we’re watching

A Defense Department inquiry found that the government’s $10 billion cloud computing deal with Microsoft was fairly awarded and wasn’t tainted by pressure from Trump. The President publicly complained when Amazon was the front-runner for the JEDI contract because he hates Jeff Bezos. The DOD’s inspector general said it didn’t find any evidence of improper interference, although it also said that the White House basically refused to cooperate with its investigation and told officials not to answer any questions about the deal.

Facebook and Instagram have been trying to come up with ways to help small businesses. On Wednesday, Instagram announced features to make it easier for businesses to include links to gift cards, purchase options, and fundraisers in their profiles. CNBC notes that small businesses are a crucial aspect of Facebook’s and Instagram’s business, too. They’re active users, provide content and resources people really want, and a lot of them are advertisers. Think of this move as a virtuous cycle for everyone involved.