 Welcome everyone. I'm Sharon Bradford Franklin. I'm policy director for New America's Open Technology Institute. We are an organization that focus on providing equitable access to digital technologies and internet that are both open and secure. Thank you for joining us for today's event. What role can tech play in pandemic response plans, the potential and the risks posed by contact tracing apps. As our country works to combat the coronavirus epidemic, many pandemic response plans are proposing a combination of ramped up coronavirus testing, contact tracing and supported isolation to detect the people who need to be isolated and permit others to return to life as normal. With regard to contact tracing in this age of big data, these proposals seek to combine traditional public health contact tracing with digital tools. Traditionally, contact tracing involves trained public health personnel meeting in person with individuals who have been exposed to and identified by an infected person. To identify those people who have been exposed to someone infected with a contagious disease so that they may get tested and isolate themselves if needed. With our current pandemic, many people now urge that smartphone applications based on Bluetooth technology may assist public health officials to conduct contact tracing at scale. But these plans have also raised a number of concerns from public health experts and privacy experts alike. This event will explore what role contact tracing apps can play in the fight against the pandemic, as well as the public health, efficacy, equity, privacy and civil liberties concerns involved. We will first hear keynote marks from Dr. Michael Oosterholm, followed by a brief question and answer session with him. We will then move to our panel discussion, which will include a longer question and answer session. I will introduce introduce our panelists following our keynote presentation. So I would now like to welcome Dr. Michael Oosterholm, who is director of the Center for Infectious Disease Research and Policy at the University of Minnesota. He is an expert in infectious diseases and the author of the 2017 book Deadliest Enemy, Our War Against Killer Germs. He has been speaking and writing widely about our nation's response to the coronavirus pandemic, and we are pleased to have him with us today to share his views on the role of contact tracing, including both traditional and digital approaches in fighting this pandemic. As I noted, after Dr. Oosterholm's opening remarks, we will move to a short question and answer session with him. Dr. Oosterholm. Thank you very much. Thank you, Sharon, for having me here with you today. First of all, we all recognize that we are in uncharted territories with respect to public health. When you think back about where we've been over the last hundred years, it was that in 1918 that we last saw a pandemic of this nature sweep around the world. A very sobering statistic that helps remind us where we're at today was just some 75 days ago, COVID-19 was not in the top 100 causes of death in this country. Over the past month, it has been the number one cause of death in this country. No other condition has done that in any way at all since the 1918 influenza pandemic. So we know we're confronted with a very serious challenge. But where are we going from here? What are we doing? Well, first to understand where we're going, we have to understand where we've been. To date, between 5 to 20% of the US population has been infected with this virus. Most of the country is closer to that 5% level with some isolated areas like the New York City metropolitan area that may be closer to 20%. To in fact stop this virus transmission, we either need to eliminate the human to human mode of transmission, which means in essence a complete lockdown. Something that all of us would agree from a societal standpoint can't be done in a country like ours or for that matter most of the world for 18 or more months. The other thing that we can do and must consider in that context then is if we can't stop it, how do we in the sense keep it from getting to what would be its point of what we call herd immunity, where anywhere from 60 to 70% of people have been infected and hopefully developing durable immunity. Or we can be rescued by a vaccine and we all know that that would be the miracle that we can only hope for. But we recognize it's also not going to happen anytime soon, meaning that the prospects for a vaccine this calendar year are really beyond anything optimistic and that even the following year would be in fact a great step forward. So what can we do to get there as opposed to having the 60 or 70% of people develop herd immunity, which by the way just means the virus transmission slows down it doesn't mean that it stops. And given all the pain suffering death and economic disruption we've had to date. What does that mean. Well we have to throw whatever we can at this reasonably that doesn't do more harm than good and look at all options on the table. Surely from a mitigation standpoint where we're talking about trying to reduce its impact or things we can do. And I think at this point, where the pandemic is at suppression or the ability to stop any transmission short of a complete lockdown is not likely. So one of the areas has come up has been testing and contact tracing. I've been in this business for 45 years. I can tell you I've had a lot of experience with both testing and surveillance as well as contact tracing. Our group at the Minnesota Department of Health in 1985 actually started the very first program in the world for HIV contact tracing. And we've learned a lot over the years how to do that. So today what I'll cover some very brief comments about contact tracing to get us into the panel and for more discussion. First of all, when we look at the issue of contact tracing in terms of from an epidemiologic perspective. What do we mean by traditional contact tracing. What it means is finding an infected individual who may have exposed others through whatever means whether it's sexual contact respiratory transmission, and then offering those individuals who are contacts, the opportunity to know that they have been exposed. Number one, number two, if needing screening to find out if they themselves have been infected off of that. And third, in almost every case we offer them some form of treatment, even with HIV in the early days, our efforts were to bring people to detection so that we could get them on early So there's been an incentive there. It's always been done with professional trained public health workers and it's been done in person, meaning that rather than doing phone calls which are fraught with any kinds of communication challenges, including even verification, it's been a personal issue. Then in terms of what we could do today, the message has been, well, we can find these same contacts because that's what's work in countries such as in Asia, including New Zealand. And I think we have to be very careful about making assumptions at what point can contact tracing work in terms of the actual incidence of disease in a community, and the number of contacts that might need to be followed. And I think as we get into this discussion today, this is an important consideration because in fact, I believe the contact tracing as a potential weapon against this virus actually begins to disintegrate in terms of its capabilities as you get into high incidence settings and what we can do with that. In addition, we recognize it today because of the infectious disease risk that having contact with individuals might mean that we are doing much of our contact tracing in terms of follow up as either one of two ways. One is the individual public health person who now has been brought into this scene is making phone calls to individuals, and what they're recommending is not treatment. They do recommend if you have clinical signs and symptoms to be tested, but they're also then saying shelter in place for 14 days, which has many challenges associated with it, particularly if you're someone who already has a job. You're in an industry where you don't have the time off and that you then have to stay at home and may lose salary. This adds to a another part of the challenge with contact tracing is in fact, will people be tested and provide contacts. If they know that their contacts, they're going to ultimately end up in some kind of shelter in place or quarantine situation, which may in fact threaten their current work employment status, or for that matter mean that they're going to now be sheltering in place with others who they have not been exposed and we don't have any alternative location to take these people to. These are all different situations that we saw in Asia. I'm very familiar with but then done in China, Taiwan, Singapore, even Korea. And there there's been much more efforts by the governments to actually provide alternative locations to live, quarantine buildings, mandated movements of people from homes, something that we haven't even considered here in this country. Unfortunately, I fear that far too many people have looked at contact tracing is just a simple thing, just merely hire people have them contact people and follow up as such. Everything else will work out. I think we're far from that. One additional issue that has come up is the idea of using electronic tracing, where in fact, if someone has Bluetooth capability, and they are found to be positive that they then through certain kinds of high level technology apps are able to then notify someone anonymously that you have been exposed to someone with the coronavirus and you too need to take these steps to limit your transmission to others. We're yet challenged to know how many people will actually comply with that kind of a model. I can tell you our own initial survey data says that people may be very reluctant to do that. And that they in sense wouldn't take information that came anonymously over their iPhone or their other device Android device to actually at that point do shelter in a place. These are all important considerations because again we're on a course right now what I call virus time what we're able to do in the next 12 to 14 months to try to limit transmission and hopefully get as many people as possible, not infected to an ultimate vaccine and achieve that herd immunity through that prospect as opposed to natural disease. So it's important that we consider contact tracing it's important that we understand its strengths its limitations. And we understand what it might mean in terms of what we can do with this virus over the course of the months ahead. With that, I will close and be happy to entertain questions and considerations about how and what we might do to to respond to this situation. So Sharon I'll turn it back over to you. Thank you. Thank you. And I will note that you have questions should use the Q&A feature on if you are on the zoom or the chat feature if you're on the YouTube to ask your questions, but I will start out with moderators privilege and ask Dr. Osterholm a couple of questions myself. So thank you so much for setting the stage for us. Maybe you could share with our audience. What would you cite as some of the biggest misconceptions or inaccuracies circulating in the public regarding contact tracing that concern you. Well I think frankly one of the challenges we have is is that it has been labeled as something that would be effective against the transmission of this virus. We have challenges in a virus that is with substantial transmission before onset of symptoms where people would not even know who their contacts are unnecessarily yet exposed them. In the cases where they do know they may only be a minority of the people that have potentially exposed via the respiratory route, both as an asymptomatic or symptomatic individual. I think the second thing is that there's this automatic that somehow by doing contact tracing and even testing for that matter. We'll have a big impact on this pandemic. And I think that those are real issues for discussion in the study. Now we don't have time to do a traditional kind of academic based study but what I mean by study is just even consider what are the ramifications. What are we talking about here. When I hear hiring thousands and thousands of contact tracers taking people without any previous training or qualifications, trying to do this where we're providing information to people who were contacting them to tell them may have been exposed to a virus. That could be one causing serious health conditions. I think we have an obligation as a government or as a private sector company which is now being discussed in some states is taking this burden on. I think we have some real challenges here. It's not a panacea. I worry that what I see happening right now both with testing and with contact tracing. And I would add the testing issue is a very critical one we need testing badly, but how we use it we need smart testing not the kind of nondiscriminate just get the numbers up testing. And with these we have to ask ourselves what are we trying to do. And if in the situation where we're not certain it'll be positive or not, I would say go for it, but at the very heart of the theory is this going to really make a difference. And after 911 we found that in many locations in this country, having your bottle of Ciprofloxacin was the equivalent of in Cipro we trust because of the impact concern. And I worry today that contact tracing has taken on a certain element of in contact tracing we trust. And yet we don't have the information that would support that these massive programs are going to have any fundamental or any significant difference in what's going to happen with this virus. Taking a step back for a second to actually really look at this and not just go steaming full steam ahead without understanding the implications is going to be a very important part we're going to be in this for a while. This is not something that's going to be done even likely in the next year to 18 months. We've got to get this right now. And this is the time to do that. Thank you. So I'm going to ask one more question myself and then I will turn to some that are coming in from the audience. What recommendations would you make to policymakers to govern the operation of contact tracing both to make it more effective and to regulate any of the risks that you see from the traditional methods and from any digital tools. Well I think the key message here right now is that one, this is a very serious public health situation and we have to all agree that this is the situation. Number two, that doesn't give us an excuse to act without responsible authority and information about what we can do about it. What happens when we actually begin to have scammers who are calling homes with this information about you've now been exposed where they actually have a number on the phone ID that says they're from a health department. If you call back you get a number that says it from the health department and watch how quickly that will spread across the country as this is what's happening. No one really thought about I think the issue of telephone contact with contacts prior to, you know, embarking on some of these huge programs. And yet I have never in 45 years of contact tracing been involved with anything where it wasn't personal contact with appropriate ID available. Now in this case we don't have the time to maybe do that or the risk issue for infection, but there is an example of we need to think about then what are we doing are we actually going to shoot ourselves in the foot and make it more detrimental. If we don't have a drug or we don't have something we can offer people who are being tested and who then will give names of context we'd actually create a major disincentive for people even get tested. Don't worry about that we have some preliminary data suggesting that if somebody thought they had to turn over their contacts that they would actually not get tested, which would be unfortunate to. We haven't talked about how to really help the individual who is test positive how they can help do contact tracing were under those conditions they may very well be much more likely to help and what we're trying to do. Are we going to do if people just refused to do any kind of sheltering in place or quarantining or reducing contacts if they know that they've been exposed. Are we going to take that on like the Asian countries have with an authoritarian and even legalistic approach, we haven't had that discussion so I, my message is, you know, we have to be responsible that doesn't mean we can't act with urgency. And, and I think that at this point, I don't see us having many of the discussions that we should be having about what contact tracing means what it can do what its limitations are and how we're going to address those. Thank you, and thank you for highlighting the challenges that we have in this pandemic, even with the traditional methods from not being able to do that in person and having to go by phone. So, turning to the audience, we have a question about what are your thoughts on Georgia and Florida, not having an uptick even while being open in terms of the epidemiology involved. Well, first of all, be very careful about that conclusion. I can't tell you how many times throughout this pandemic I've had people say to me see look at it's not happening. We had a document that we put out from our center on January 20th indicating that we fully expected this to be causing a worldwide pandemic. And in the process of doing that, we actually said it would take at least five or six weeks of activity. In terms of transmission around the world, before we would actually see cases because of the incubation period to four, eight, 1632 cases, it would take time to build up. And throughout the month of February, I kept hearing from people saying see it's not happening. It's not happening. It's not happening. And then the last week of February and the first week of March we saw what had been happening just unrecognizable to the communities. So I think that we have the same situation here. I would be very careful about concluding that it's not happening in those states right now and I said from for the past weeks that I wouldn't think that these data would really give us any sense of what's happened or not happening until sometime probably in mid June. The final piece I just want to add, which is a piece that may be very hard for people to hear is one that, and I'm surely can be accused potentially of saying things that seem very counterintuitive productive is what scares me right now more than anything is that these cases suddenly do start to disappear. I don't want anyone to get sick. I don't want anyone to be seriously or die, but I don't want to see an influenza like model pandemic, where after the first wave there are periods of several months where activity becomes minimal. And then all of a sudden we have one incredible peak of cases that overwhelms everything else that had previously happened. And to me, I think there were any number of scenarios how we might get from the fifth five to 20% current level of infection previous infection to the 60 to 70, and the one I want to avoid more than any is a large peak a post secondary peak that would occur and that would likely be a big reduction in cases. So either way we're looking at this one you can't interpret the numbers now number two is don't assume that if we start to see a substantial drop in cases one is something we've done to make it happen. And number two, that in fact it is necessarily good news. Thank you. Okay, another audience question. How quickly do you think public health agencies can hire and train traditional contact tracers to be effective manual contact tracing seems like an art as much as it is a science. So training training seems like a significant element. And I will add on to that question if public health authorities are also offering the digital tools. Are there any additional components of training that you would like to see in place there for them operating those. Yes. Well, first of all, whoever asked that question obviously has some familiarity with contact tracing because they're absolutely right it is an art and a science. And you want to have the right people do it because there's a great deal of sensitivity that goes into this understanding how to get information how to share information, what information that you know and don't know how do you share that challenges where people may have crisis moments in some of this news. And what do you do about that. So I have a long been challenged by how we're going to hire thousands of people who come at this from totally different experiences in life. And I've already seen that tax collectors, engineers and a number of people who don't have experience in this area who have actually volunteered to do this. I commend them. I thank them for their willingness to try to buy public service. I think we have to be very careful about the kind of information that we're sharing and how we do that when I say careful. I don't mean that it's just from a legal standpoint which is critical, but it's also from having the skill sets to interface with people that are being told information being suggested stay home for two more weeks that means your job you can't go to even though you're now back at work. And so I think we have some challenges ahead trying to provide that training in a timely way and bring people through the system. One of the problems we have is we don't have that many trainers to train the trainers who are going to train the trainers who then train the workforce, and that very limited situation right there is one of a challenge. So again, I know contact tracing can be incredibly helpful as it has been for other diseases. I think we just have to look carefully at this one by the nature of how the virus is transmitted. The issue of how many are asymptomatic infections, how many infections occur in the community. How will we follow up if we have thousands and thousands of contacts every day and just how prepared are we to mandate the kinds of things that we're recommending to these people that they do and if they don't want to do them. You know we're only going to be as good as their willingness to participate in this kind of a program. Thank you. Okay, another question from the audience. How long is it necessary for medical purposes for data obtained through contact tracing to be retained. Are there any medical reasons not to delete data obtained from contact tracing for an individual beyond the period, the potential time for infection. Well one of the issues we have with that is that each of the states have their own data practice laws and they vary. I can tell you a certainty in Minnesota you could not delete that information under the current Minnesota data practice of law that requires that it be retained. So each state is going to be different. That's going to be another issue that we have to deal with is that how do you deal with that kind of information and also not just whether you collect it but what are the legal protections around it. We're fortunate in our state to also have a substantial body of law and of policy that does protect that information so it's not public. But at the same time, each state is on their own and again they're going to have to determine not only how that information is obtained, how it is retained, and then how will it one day be disposed of if it will be. Thank you. So you've already alluded to some of the more authoritarian approaches that some other countries have taken and so I'm going to give a preface to this audience question of assuming that we don't want to move to a fully authoritarian regime. Are there any lessons that we can learn from how other countries have handled pandemic response? You know, I think we have to be very careful here about the conclusions. I was asked the question earlier for example about, you know, history and states, what's happening there. You know, I hear this all the time with other country models. You know, we all have used China as a model for how they responded in terms of suppressing this epidemic in the Wuhan and Hubei province area, but also at the same time acknowledging the dramatic steps they took that some have described as draconian in terms of what they could do for population movement restriction, how they can actually require facial or otherwise personal identifying information for everywhere they move in the community. Are we going to be able to do that? Do we want to do that? Could we if we had to do that actually accomplish that? And I think that's the challenge. And even still with all of the Chinese have done, as you now know, we've seen cases emerge again in Wuhan, and they're now in the process of mandating testing for all 11 million residents of Wuhan this week. Now, are we prepared to be able to do that? How would we do that? First of all, we don't have the testing capacity. Second of all, what would be the challenges to requiring people to be tested. And again, knowing that testing is a one time issue, I could be negative today and positive tomorrow. And so I think that there are many issues that come up about how foreign governments have approached this. And each one has found that this is a leaky bucket virus, meaning if you have a bucket full of this virus, if there is the most micro leak somewhere, it will find it and it will leak out. Ask Singapore about the transmission as migrant workers. Ask the people in Korea about transmission in the community, particularly in the nightclub area. And if you go through each of these areas, you'll see that, in fact, it's not a forever containment of the virus is going to constantly challenge us. And so I think that we have to ask ourselves here, how prepared are we to try to deal with the virus at the same level, the same authoritarian approach that some of these other countries have taken. And I think that there would be a real challenge. By the very nature, contact tracing is a voluntary process. You cannot extract the names from someone of the context. Even if you're looking at the electronic data issue, you have to have people who are willing to use the app and who are willing to have that information shared even if it's anonymous. So what is by the very nature of this is all the willingness of the public. And if we appear to be forcing something down their throats, I promise you there won't be cooperation there won't be an understanding of why we're doing this. And so I think that discussion has to be had right now what is the message what is the tenor. And please do not just tell me if I hire a thousand additional contact creatures I'm going to change the course of this pandemic. We don't have any reason to think that we're going to change the course of the pandemic beyond limiting some transmission, shaving off the peaks of some of what could be devastating peaks in terms of healthcare resources. But in the end this virus is a control I've said it many times, we are not driving this tiger we are writing it. And what we have to figure out is what can we do as public health professionals as communities to actually try to hold on as we ride this tiger, and not fall off. Dr. Osterholm. Thank you so much. I know you have a hard stop at noon. Do you have any final thoughts you'd like to share with us before you. Well, I just want to thank you Sharon for doing this. I think this is the exactly the kind of dialogue we need to have. This is not about somebody's right or somebody's wrong. We're all trying to feel our way through this we all sense the urgency. We all sense that we are talking about a catastrophic event that's unfolding before our eyes. So, again, as I said I'll throw the kitchen sink at this thing if I think that it would help and not harm people. But that doesn't then give me license to say I can throw anything at it, whatever I want to and use it as somehow this will make a difference. We owe it to society, particularly if they're going to be cooperating cooperating with us to do this we owe them the honesty and the understanding of what they're getting involved with that's how we will have cooperation. So thank you for this dialogue. I think it is by itself very very important and and and I think we need more of these so congratulations. Thank you so much. We really appreciate your joining us. And for the audience members we're going to move on to our panel portion so I would like to invite our panelists to turn their cameras on and join me on screen. And just to set the stage for our conversation. Now that Dr. Osterholm has set the stage for us with an epidemiological perspective will turn to our panel for perspectives from civil society, Congress and the tech industry. As most of our audience members are certainly aware with the current pandemic various countries public health authorities researchers and app developers have designed digital tools to assist in contact tracing efforts. Proponents of these digital tools aimed to expand the reach of traditional contact tracing methods. Yet there are many open questions regarding the efficacy of such digital tools and it is critical to recognize that digital tools can complement but not replace traditional manual public health contact tracing. Our panelists will discuss how best to design a contact tracing system, the concerns that digital contact tracing tools present from an equity privacy and civil liberties perspective, as well as what safeguards are needed to mitigate these concerns. Before this conversation, I'm pleased to welcome Bennett Butler, who is legislative assistant at the Office of Senator Ed Markey, Ali Lang, who's public policy manager at Google, and my colleague Lauren Sarkasian who is senior policy council at New America's Open Technology Institute. So to start this conversation. I'm going to turn first to Ali. And Ali, Google and Apple have jointly announced that your companies are offering an interoperable API to support the operation of exposure notification apps. To start us out, if you could please describe for our audience, many of whom are not techies, what Google and Apple are actually offering. And for the first, this first question, if you could please outline how it will work, what data it will collect, and who will have access to this data. Thanks so much, Erin. I want to echo Dr. Osilos. Thank you for bringing folks together to discuss this in a timely, certainly a timely moment. Happy to discuss a little bit more about what Google and Apple are working on. But I want to also begin by echoing both you and Dr. Osilom that the technology solutions are not necessarily a silver bullet. I think that's a widely understood kind of fact of the situation, but rather sort of one tool that we think can help scale under these exceptional circumstances. And one of the things that I would note has sort of changed between the time Google and Apple first made the announcement of our partnership to today is we've switched from describing what we're building as a contact tracing solution to a exposure notification technology. And we've done that to sort of help more accurately describe what it is that we've done. So I just wanted to give a quick background on sort of how we came here and then maybe run through a couple of scenarios to help build some information around how this technology will work. So the four months years time is kind of strange these days but for quite a while public health authorities and as we heard from Dr. Osilos have sort of talked about the role contact tracing can play in containing the pandemic in general. And a lot of folks around the world have been thinking about what role mobile phones and mobile devices can play in supporting that process. So there's a couple of ideas around location data. We at Google had sort of explored the location data we have and concluded that it wouldn't be useful for this purpose. And then at some point in the sort of public or like the global discussion around this issue the idea of using Bluetooth came up around the world here in different places here in the US also in Europe and in Singapore as a possible alternative. The benefits of using mobile phones as part of a contact tracing solution really kind of played two roles. One is you could use your mobile phone to help you understand when you're giving a history and the kind of context that the doctor was describing. And it also helped solve the idea of exposure of exposure to strangers. Right. So even in a world in which you had the army of contact tracers that was described and you were doing all this manually. You would still have a problem of not being able to contact or sort of have awareness of some of the people that you spend time around throughout the day. And this is one of the things that mobile phone technology can offer right to the overall solution that would be hard to replicate in a manual way. And Bluetooth using Bluetooth data is actually one of the most effective ways to do that. And it has a great benefit as well of providing some really good technical privacy preserving qualities that can be used to sort of leverage this technology in a more safe way. I think we would all agree that there is kind of no success successful path forward without the trust of the public and the folks who will use the technology. So obviously the privacy protections are going to be a big part of that both technical and then the sort of decisions around the app itself. So with all of that background, we had sort of looked at some of the technologies that were being developed on Bluetooth. And we saw that for the most part, the intuition made sense the idea that the Bluetooth can recognize two phones that are close to each other. And that that is a useful thing for contact tracing purposes is a strong intuition. It sort of makes more sense in a lot of ways than figuring out where you were because where is a much bigger place than sort of who you are around in a in a more granular sense. So we're seeing that there were some challenges that folks were facing around interoperability between Apple and Android platforms. And there were some other issues like the battery was really getting run down because of the way Bluetooth scanning had worked previously. So the partnership between Google and Apple was really born out of a desire to address those issues and to come together to create a more reliable functionality while simultaneously trying to help address fragmentation among the various apps that we're developing around the world. And also to create common privacy and security standards for these protocols and really set a strong kind of privacy and security practice around this this technology that was that would run on our platforms. So we really approached this this question from the perspective of a platform and a service provider. We see our roles providing a technology solution to provide like very strong guidance and to sort of bring in the perspective of our users. I think it's been really interesting. All the survey data that Dr. Osterloh referenced and from other places as people try to puzzle through what makes sense for them. One of the things that technology companies can bring to bear in addition to technical expertise is really an understanding of how people process and understand things that are happening on their phone and how people are making these decisions. And even we are in a bit of a tricky situation with that right now because this is a different scenario it's sort of unprecedented times. But certainly as far as privacy and security expectations we feel we have a pretty good sense of what people prefer what they expect and what kinds of assurances can help create confidence in that technology. So with all of that said I just wanted to run through a quick sort of explanation of how it works and then Sharon also to your point on the data and what's what's actually being generated and where it's stored. The technologies is going to be an opt-in solution. Users will download an app from a public health authority they'll have to opt into using the exposure notification technology. And so once this technology is enabled on your phone your device will regularly send out a beacon via your Bluetooth that has a random identifier in it. A random identifier just being basically this random string of numbers that aren't tied to your identity as a user. And the identifier also changes you know every 10 20 minutes or so to sort of help reduce reidentifiability of those of those numbers. At that point other phones are also listening for their beacons and they're also broadcasting their beacons. So phones are kind of saying here's who I am and you're hearing the your phone is hearing those and your phone is also exchanging that information. In order for this to take place your phones have to be within a certain proximity of each other so the Bluetooth has low range relative to sort of other signals on your phone. You have to spend a certain amount of time together for it to register as a potential exposure that parameter is set by the public health authority. And then it's only relevant for a certain period of time right so the current guidance I think is 14 days after which it's no longer relevant that you were near someone. For this purpose so as these phones are sort of exchanging these beacons at least once a day your phone will also reach up to a server. And it will say okay well are there any beacons that have been confirmed to be tested positive and I want to see if my beacons that I'm storing on my device match any of those. So periodically your phone will sort of reach up and it will check and download a list of beacons that have been verified by a public health authority as belonging to somebody who's been confirmed to have a positive diagnosis. And each device will then check their list that they've stored on device of the beacons that they encountered against that list. And if there is a match then that will be what triggers the notification to the user and will give them any next steps. So it could be called a public health authority or your medical professional or refer to the app for any next steps. So the matching actually happens on the device of the phone. The information that goes up to the server is from the positive diagnosis keys. There's also a moment at which a person who's confirmed to be positive has an option to share that data up. And then the information on the phone is sort of cycled through a number of days relevant to like the guidance from public health authorities. So that's how the API works. Now, keeping in mind that the API is not an entire app. There are other pieces of the app that might be relevant that might collect different information. They're in order to use the API in an application developers have to agree to the terms of service that Apple and Google have written for each respective store. Those terms of service also provide guidance on what types of data can be collected under what conditions what can be done with that data. So for example, I heard Dr. Osterloh reference the idea of collecting contact information from phones. And if you were using this API and you're a contact tracing app, you would not be allowed to request permission to the contact book or the location permission on the phone. So just a quick clarification that you would still be able to ask a person for their phone number, you would still be able to ask a person for their zip code or their location. You would have to call those things technically from the phone so you can't have background access to location. If you have an app today that's operating on location data to do contact tracing you would have to sort of swap out and use the API instead. And you can request contacts as part of the use of the API. There's other pieces of the app that I think we'll have a chance to get into later, but it was just a clarification that there's some questions around data shared and collected as part of the API and how to make the actual API work. And then there's other questions around the application itself and who makes those decisions which is a somewhat separate set of questions. Sharon, would it be helpful to go through like a scenario for the Bluetooth or is there a different thing that you think would be helpful in terms of just clarifying how the technology works itself. I want to ask you as a follow up to flag some of the privacy safeguards you Google and Apple have announced we built. Yeah, you've already talked about how it will collect proximity information and not actual location information which is obviously safeguard. But if the best way you think is to give a scenario to illustrate that that would be great and then we'll move on to the other panelists. So in this scenario, I think there's a deck online that I can help send to you to circulate to your audience as well that has some little figures and explains it so I think I'll give you the deck because the scenario with the visuals works a little better, and I'm zoom feels fragile to me. So I don't risk it, but in terms of the privacy protections yeah thank you for the reminder so obviously the matching on device is a pretty significant privacy protection. Not only for us to sort of feel more confident right that your your information is not going up to the server, except for under a condition where you have tested positive confirmed diagnosis and you've agreed to send your keys up to the server. But it also allows for a technical kind of retention policy enforcement, which if all of the information we're being stored on a central server would be harder to agree to right so if it's on your phone there's a technical way to sort of guarantee the deletion over time. Other privacy protections include just the fact that it's often to begin with right like users will have to download an app. There's the conditions under the terms of service around consent and sort of voluntariness around the use of the technology. As I mentioned their restrictions on what other technical permissions apps can request if they're using this API, including location which is a pretty significant one as well as contacts which we think also is a pretty significant protection. Ultimately the terms provide additional protections around what types of data you can be requested to share and how that data can be used. So for example, an app developer or the public health authority as the sort of publisher of the app can ask you for information like your name your contact information they could even ask you for demographic information but they can't condition under the terms they can't condition the provision of the exposure notification on you providing that information. They're also restricted under the terms to only using that data for purposes of covert 19 response and explicitly prohibited from using for law enforcement or other punitive purposes the data that they collect as part of the broader application. That is using the exposure notification technology. Other privacy protections on the technical side include the fact that the Bluetooth identifier rotates periodically to prevent sort of like, or to sort of restrict the ability to follow people. That way. And the, there's sort of one big protection that I think is going to be really interesting to see how it unfolds, which is that as part of the process of this or the part of the intent of this only being used for covert 19 response Google and Apple have the ability to basically turn off the API regionally. So I think that Dr actually made a couple of good points about the cyclical nature of what we might see. I am obviously not an epidemiologist and I will not pretend to be one. But I think it's an interesting concept because if we had to make a global decision about whether this was on or off, it would be more likely to stay on. And in fact there's actually regional toggles right so there's an ability to make decisions per geography about whether or not this technology is still relevant. If it is still part of the broader kind of need to to respond to the situation to this pandemic. I should clarify too when I say it's used for covert 19 response the intent of the technologies to be used for this pandemic. So again not being an epidemiologist or any kind of medical professional I don't want to get out of my lane but it's my understanding that sometimes things can morph and get a new name. And the name is not the thing we're sort of hinging this on right or like the specific viral strain it's sort of this situation that we're in. And so like that's just a clarifying kind of point on on what we intend when we say this this pandemic. I think Sharon Sharon those are the sort of major privacy protections and then if we wanted to go into any more detail on any of them I'm happy to Thank you. I'm going to turn next to Lauren Lauren you have actually written about concerns regarding proposals for contact tracing or exposure notification apps based on equity privacy and civil liberties. I'd like you to start first with the equity issues. You've noted that these are closely tied to concerns about whether contact tracing systems can even be effective. Can you outline those concerns for us please. Sure. Thank you. So Dr. Osterholm really laid them out very well already but these equity issues are really more than just equity issues or civil liberties concerns even the really issues of the apps effectiveness the two are very deeply intertwined here. And that's because the biggest hurdle will be adoption of the apps and it's important that we discuss and account for who these apps are leaving out. So epidemiologists have estimated that at least 60% of the country would need to participate in any digital contact tracing effort for it to make any impact. We at OTI do a lot of work of course on the what we call the digital divide or in other words sort of expanding access to technology. At current, about 81% of Americans own smartphones, but the population without smartphones is largely made up of lower income people and seniors who are of course the same populations who are at the greatest risk here in the coronavirus spread. And similarly digital literacy is lowest among those populations. So off the bat, the populations that are the most in need are less likely to have Bluetooth enabled smartphones and less likely to know how to download and install those. And to add another layer to that phones over five years old likely wouldn't be able to run these apps as they require low energy Bluetooth chips and the latest operating systems. Now compounding those digital divide issues, misinformation and distrust, especially rooted in political divisions have already really played a major role in the spread of coronavirus. And we'll likely have a role in these contact tracing apps as well. This is a moment when of course we need to be able to trust our institutions more than ever but unfortunately and understandably Americans kind of don't know who to trust. Many Americans are deeply skeptical of government surveillance, potentially a big tech, or maybe both. And, you know, lower income individuals and racial minorities are are likely to be the most distrustful of, you know, potential surveillance given that they are already heavily surveilled and overpoliced. So, you know, whether they are likely to voluntarily download and install an app that, you know, they may perceive as being a government, you know, pushed tracking effort. You know, there's a lot of questions, whether they would be willing to. So the voluntary nature of these apps, you know, while commendable really presents sort of a catch 22. We obviously wouldn't want our government to mandatorily require that all Americans download an app nor nor could we really because you know, can the government require all Americans to have a smartphone that's up to date with Bluetooth technology. But at the same time, the more people that participate the more effective these apps are. It's, it's worth noting here also that in Singapore, only about 20% of the population participated in the trace together app which is the app that's driven a lot of this conversation in the states. And now we're seeing that they're having a second wave unfortunately of the coronavirus, which you know some of sourced back to the population of migrant workers who are of course, you know, lower income living in closer quarters, etc. Additionally, it's also worth discussing that there are many open questions related to just the accuracy of the Bluetooth technology. And as others have pointed out, you know, his issues have equity implications as well. As everyone who's tried to pair their smartphone or their phone with a speaker knows, you know, Bluetooth signals aren't always the most consistent aren't always the most reliable sometimes they work from, or sometimes they don't work from just a few feet away. And sometimes they're they work, you know, maybe 20 feet away or through a wall through through a ceiling. So all of this is really crucial in terms of the accuracy, as it can lead to both false positives say if somebody's in the next apartment from me, or false negatives if somebody's just a few feet away but maybe the app isn't running in the foreground of their phone. So, the most likely to be impacted by, especially those false positives are individuals living in closer quarters, like apartment buildings, and, you know, that's obviously likely to include the lowest income among us, those income folks among us. And so these as others have pointed out these false positives could have a real impact on folks lives. You know, people could lose or people could, you know, have to stay home from work for extended periods could potentially lose jobs, etc. And as Dr. Osterholm so you know aptly pointed out, all this can create sort of a disincentive to, you know, participate in the apps but also maybe to even get tested. So that's sort of a broad overview of some of the equity concerns. Thank you. And before I bring Bennett into the conversation I just wanted to ask one follow up question to you Lauren, which is if you can turn also to some of the privacy concerns on allies outline some of the privacy safeguards that Google Apple have attempted to build into their API. But of course, app developers are also part of the equation. And Apple and Google can't control everything even if they do have robust safeguards in place. So, can you talk for us a bit about what some of the privacy concerns are with these apps. Sure. So, from a privacy perspective, the Bluetooth app model, you know, if opt in if decentralized and with with a number of other caveats that I'll get into in a second, you know, the model is quite promising. So there's an interesting alternative to sort of the more draconian approaches that we were just talking about a few minutes ago, related to, you know, governments like China and South Korea sort of scooping up troves of location data to help data facial recognition data, even credit card records things like this that they've done in contract tech contact tracing. So Apple and Google have really set up kind of a solid infrastructure from a privacy perspective, but we need to ensure that, you know, sufficient safeguards are still in place to prevent sort of plausible next step scenarios. We'd want to ensure that the government doesn't down the road begin to amass the data from these apps, and that they, you know, continue to remain decentralized. We want to ensure that the apps are voluntary and that you know they don't become in effect mandatory due to say employers beginning to require employees to have the apps to gain or to come to work, or for individuals to have the apps as a necessity for entering public places. You know, want to ensure that data in these apps is not able to be sold or used for commercial purposes or advertising purposes, you know, down the road. Obviously many tech companies models rely on the sale of user data so so this will be crucial. And again the the Apple Google infrastructure sets up that many of these things but we need to ensure that this sort of stays in place and that we are adamant about that. Additionally, stigmas are an issue in all disease outbreaks probably, and I've already begun to be an issue in the coronavirus, we want to ensure that notifications don't contain any personally identifiable information and obviously with sort of what seems to be sort of a patchwork of different apps floating around and potentially pushed out by different state and local governments. We want to ensure that there's some standards across the board that again across the board there should be, you know, minimal or actually no personally identifiable information but minimal information generally. And relatedly personal data of course often fuels discrimination so we'd want to ensure that data can't be used for any discriminatory purposes. So those are just some of the top level privacy concerns. And again the more privacy protective these apps are the more effective they'll really be because or maybe more to the point the more people believe them to be privacy protective, the more they're likely to download those apps and partake, leading to greater effectiveness. Thank you. So Bennett I'd like to bring you into the conversation now please. Back on April 22nd, your boss Senator Markey wrote a letter to Vice President Pence who is heading up the Task Force, proposing a set of principles to govern contact tracing. Could you please provide us with a brief outline of those principles and how they might address some of the concerns that Lauren has just outlined. Sure, well thank you, Sharon. Thank you for having me. Yes, last month Senator Markey sent a letter to the White House urging this administration to develop a contact tracing plan and he set out a number of principles to guide that plan and ensure that it doesn't infringe on civil liberties and privacy among them. I won't go through all of them but I've been happy to outline a few just for the sake of time. First, Senator Markey thinks that contact tracing should be just one component part of a much more, a much larger plan to combat this pandemic. He's adamant that we need increased access to equipment for folks on the front lines. We need much more investment in testing and supported isolation. We need a comprehensive plan here, contact tracing in and of itself isn't going to solve all of our problems. Second, Senator Markey communicated that he thinks these these exposure notification tools should be crystal clear with their users about what data they're collecting and how they're processing that data and that any participation should really take place on a voluntary opt-in basis. Third, I'd highlight that Senator Markey thinks that these tools should be collecting the minimum amount of data that they need to achieve specific predetermined science-based public health objectives that are related to this pandemic. And they shouldn't be using our information for any purposes outside of that scope so use limitations are critical. Third, Senator Markey is also something that Senator Markey thinks should be at the forefront here. These tools should be taking every step necessary to ensure that any aggregated or anonymized data can be relinked to individuals. If you think about it, a breach of data about your physical location, your health status, who you're coming in contact with, that can have real serious consequences for members of the public. So these tools have to be deployed in ways that are consistent with cybersecurity best practices. And lastly, I would echo Lauren's comments about these equity concerns. And Senator Markey is cognizant that particular populations are experiencing disproportionate suffering during this pandemic. Unfortunately, a lot of those populations, among them low income communities and elderly communities might fall into these categories of folks who perhaps they have a cell phone, but it's likely it might not be a smartphone that can facilitate the type of digital contact and exposure notification we're talking about. He thinks that we need a plan that doesn't systematically exclude any subpopulations from the benefits of contact tracing, particularly these communities that again are disproportionately experiencing suffering. That's a couple of the principles that he outlined in his letter. Thank you. So I'd like to ask you to hone in a little bit on two of the principles in particular. First, the one regarding data security. Because we're particularly concerned that there not be secondary uses by private companies that may operate these apps and any kind of mission creep by government entities that might be trying to access the data. What restrictions do you think are needed to address those concerns? And then the second principle I'd like to just highlight in particular is you've, Senator Markey has called for transparency and if you could speak as well to any particular transparency elements that are critical to have in place. Again, you know, I think that, you know, it's imperative that there are no surprises to individuals regarding what is being collected and how their information is being processed. Senator Markey thinks that that level of notice is really critical here. I think that transparency and also these questions of cyber security go to a point that Lauren brought up earlier, which is in order for these contact tracing and exposure notification tools to be effective, there's going to need to be a pretty high level of adoption that requires public trust. And in order to cultivate that level of public trust, you know, Senator Markey would say that we as individuals and users need to believe that we truly know the scope of these tools and what they're doing with their information. And we also have to really believe that our data or sensitive information isn't going to be left vulnerable if we do participate. All right, I'd like to turn back to Ali. Ali, I wanted to ask you a bit about what kind of oversight or vetting Google and Apple will be in a position to do for these apps that operate using the interface that you're setting up. I note that in the FAQ that the companies have put out, it states that the particular apps will need to be offered by public health authorities. So that seems like a way to ensure that the public health authorities believe that digital contact tracing can play a productive role in their communities. And you also mentioned that your terms of service would include things like you could only use the data for notification purposes and not for law enforcement purposes, for example. But, you know, public health authorities don't necessarily have expertise in app design or privacy or data security. And, you know, you are operating the API, not the apps themselves. If you could talk a little bit about what controls you're really able to put in place. And also what key factors of the system will simply need to be decisions made by the public health authorities who are offering these apps. Thanks so much, Sharon. I mean, you described a lot of the key points off the bat. As Sharon mentioned, the API will only be available to apps that are sponsored by or sort of endorsed by a public health authority. And on top of that, one of the goals between Apple and Google is to sort of limit the number of these apps, partly to sort of create greater clarity around authoritative app sources, but also because consolidating users into fewer applications is more likely to address some of the issues that both Lauren and Bennett referenced in terms of adoption and sort of concentration of population and people interacting in the same ecosystem. So some of the terms require the sort of step we've taken to require that the app is used by public health authorities is in part to create a confidence among the public that this is an authoritative source of health information that this is part of the broader response to COVID-19, and partly because it sort of consolidates the concept of government apps under a single agency or a single sort of type of agency, and ensures or has a higher probability of ensuring that users are using the same app, and they're sort of interacting within the same ecosystem. So it has a dual benefit there both for privacy and for sort of efficacy. So in order to sort of have an app on the store, not only do you have to have this sort of endorsement or statement from a public health authority that uses, you know, the app for your region. But you also have to agree to the terms of service which as we've mentioned, include a number of conditions you have to agree to. So some of the things that I've referenced as part of the terms of service can be technically enforced. So for example, a restriction against what permissions you can request is something that we have the ability to centrally technically control. And some of them are policy decisions, right? So decisions around what other purposes to which you might put this data that you're collecting through your end of the app, how you would use that information. Some of those are policy things and so they're not technically enforceable. The terms of service are public today. They're currently available for the public. We're expecting to have sort of a broader conversation as public health authorities make decisions about the nature of their apps and how it works. But the terms of service are public and have been I think for about a week already for folks to sort of see and understand the signals that Google and Apple are setting in terms of how we would expect these apps to work. So the technical protections built into the system design, both through the actual sort of construction of the API and then also the technical terms that can be enforced, as well as sort of the broader policy standards provide a pretty high privacy bar in terms of what apps are allowed to do. But to your point, there are still additional decisions that have to be made and for a lot of places, governments will still have to actually build the rest of the app. In that sense, Google and Apple have published a number of technical specs and documentation. We've actually published them on a pretty consistent cadence since we made the announcement about a month ago. I'm trying to help app developers kind of understand how things would be built into the API. It was another reason that we published the terms publicly and in advance of anybody actually agreeing to them right because the apps are not currently published on the store was to help app developers understand what would and would not be allowed to sort of build their apps accordingly. So in terms of the role that we're playing in the actual development of the apps. Those those guidance that we've put together are pretty significant in terms of the information they provide to developers and in terms of the support they give and understanding the technical specifications that need to be addressed. I wanted to take a quick step back and address some of the equity issues as well and broadly acknowledge you know the challenges around folks not having phones and some phones not being appropriate for this purpose. Lauren had mentioned at one point that you need the latest software to sort of run this application. Both Google and Apple engineers have spent a lot of time trying to make this work for as far back in the software updates as possible. So on Apple I think it goes back to Apple 6 although obviously I'm not the authoritative source necessarily for Apple and then on Google it goes back to Marshmallow. So it's a pretty significant number of phones even if they're not operating on the most recent Android update that can run the software. We've also been looking pretty closely at what's going on in Singapore in terms of the adoption rates there and I think one of the challenges that Singapore has faced are the issues that I raised in the beginning around the interoperability between the two platforms and the battery issues that have arisen as a result of the kind of engineering of the system. So I think those are really helpful examples in terms of we definitely need to draw conclusions and lessons from cases in the world that are already in motion. But I do think there's probably some kind of caveats to some of those examples given that the technology that Apple and Google will provide will address some of the functionality issues. And particularly battery is a really big issue for users if your battery is being worn down. And so I think it will be interesting to see if we do see a better adoption rate for a system that is more effective once the technology is in place. So I think those are the sort of the basic parameters of what we're hoping to achieve right in terms of offering the app but as you mentioned the governments will still have a lot of decisions to make for their own kind of work. And I think to the points that we've discussed on public trust, a big piece of that is going to be the public health authorities ability to communicate to their constituencies and to their users. Sorry, they're the individuals who fall under their purview how this will work what to expect and what to expect from the government as well. And certainly Google and Apple will be alongside them in terms of trying to explain what to expect technically what to expect on your phone, the sort of the significance of various pieces of information you'll get in that context. Sorry, just one last thing that reminded me, Lauren had also mentioned around personal information being available in the notifications and it reminded me that I hadn't clarified. If you get a notification that you've been exposed the information that will be contained in that notification is roughly the day under which the keys matched how much time you had spent around this person. And some other signals to give you a sense of kind of what the what context was for this notification so it doesn't appear totally disembodied I think Dr. Osterholm and made a good point around just totally disembodied information being hard to grasp, but at the same time it still provides a pretty significant degree of anonymity and protection to to Bennett's point about not being able to re identify folks or have additional information around people's health status. So, yeah, those just wanted to step back on those couple of points. Thank you. Okay, turning back to Lauren. Lauren, in the beginning I asked you to outline a lot of the concerns that you have from equity, privacy and civil liberties perspective. If you could now talk about what kinds of things you want policymakers and tech companies to do to address those concerns. Sure. So first to start with the recommendations for policymakers. Contact tracing really needs to rely on tried and true methods. So manual contact tracing. Obviously, Dr. Osterholm pointed out that this is not going to be easy either. We, you know, have a severe shortages as many public health experts have pointed out manual tracers and, you know, like something like hundreds of thousands. We need to hire up in order to have the amount necessary right now. But as he said, you know, it is, it requires expertise that requires some talent and so we need to, you know, I'll leave it to the public health experts to work on those problems. But, but either way, you know, we don't think that digital contact tracing is really ready for, you know, prime time, quite yet, or in terms of at least replacing, you know, it might be able to somehow supplement manual tracing. Again, if public health authorities deem that it will be helpful and necessary. But notably, Jason Bay, the senior director of the Singapore's app, trace together, you know, has also put out that same sort of concern and has said that no Bluetooth contact tracing system in the world could really replace human blood measures. So that's the first thing. Next, and probably the biggest thing is that Congress really needs to pass some legislation to address the data related threats. So the threats of COVID related data collection. We've, you know, there's been an outcry from advocates for years now for commercial privacy legislation to have some control over data. You know, we're seeing now more than ever that it's very urgently necessary. And, you know, while it's probably not realistic that in the near term, we get that privacy, that comprehensive privacy legislation that's so desperately needed. A narrower bill that's aimed at specifically these, or I guess pandemic related data collection is, you know, very urgent need. And then to address sort of the equity and and try to increase reach and participation. There's a number of policies, policy measures that that, you know, Congress and other policymakers could take. We could, you know, insist that any funding is can any funding going to health authorities is contingent upon their working with sort of community organizations and ensuring equitable and accessible testing things like that. You know, that we could put in requirements that that public health authorities are sort of focusing manual tracing on those communities that are left out that we sort of outlined earlier the lower income folks the seniors. And potentially sort of public education campaigns could could go alongside the deployment of any digital tracing methods to inform people, you know, that they're not intended for tracking they're not and really intended to be allowing the government to amass our data in any way, and that these are, you know, sort of decentralized and to stop the spread of the virus. In the long run, of course, you know, there are policies that that OTI consistently advocates for that could help to close the digital divide, you know, things like lifeline, bring broadband to more folks, etc. And then to address the other the other question that you raise of what recommendations we have for app providers and designers, because this these should really go in through system design. You know, there's a number and I will recognize that Ali, you know, has has informed us all that, you know, Google and Apple have a number of these already in place the other API. But I think it's just important that we, you know, there's nothing requiring Google and Apple to do these things. Again, these are, we need to be consistently sort of ensuring, you know, oversight and ensuring that these things stay in place so things like, you know, the decentralized nature that that Ali laid out the anonymization that they are, you know, randomized and constantly changing identifiers so that we can't, you know, work backwards to figure out who's who. The notification info must be limited and anonymous. And then app designers could work with community representatives to figure out how best to reach effective communities and again work on sort of the equity and expanding participation. So I think that's the broad overview. Thank you. I'm coming back to you. So, as you know, there are a whole lot of companies that are trying to get into this game. And I shouldn't call it a game, but your boss senator Markey has also an addition to right and vice president has written to clear view AI and audience members I'm sure will recognize clear view AI as the facial recognition company that has been widely in the news for its assertions that it has scraped billions of facial recognition images from social media sites. Senator Markey wrote to clear view about their claims that it is talking to unnamed government agencies about providing contact tracing systems. Can you talk a little bit about those concerns, whether your office has learned any new information that you can share and what additional concerns such activities by clear view might raise. Sure. So, over the past several months, Senator Markey has written a series of letters to the company clear view AI expressing concerns about their privacy practices. And unfortunately, the responses we've received have failed to convince Senator Markey that this company is doing enough to protect its users privacy and the public's privacy. I think Senator Markey has concerns that that company's tools could limit if not eliminate individuals ability to move freely and anonymously in public. And they today haven't demonstrated to Senator Markey that their technology is free of really concerning accuracy and bias issues. So Senator Markey has a lot of skepticism that that this company's tools should be involved in processing sensitive data related to this pandemic and should be partnering with government entities, state or federal. Thank you. Okay, so I want to move now to questions from the audience we've already had a couple coming in but for audience members just to remind you if you're participating on the zoom you can use the q&a feature to submit a question and if you're watching on YouTube you can use the chat feature to submit a question. But turning to questions that have already come in. First of all, we have a question about the opt in criteria every all the panelists and Dr. Osterholm as well have talked about how important it is that contact tracing ops, excuse me contact tracing apps be opt in only, but is that sufficient. There's talk of linking app participation with things like expedited test results or exemptions from shelter in place orders. So how concerned should we be that people could be coerced into using these apps. Anyone want to take that one. Sure. Yeah, I think we should be very concerned about that as I was laying out earlier. You know, I think we're already starting to see the scenario that employers are requiring. Again, even though these apps are meant to be opt in per all the things that Ali said, you know employers are starting to require to come back to work or whatever that their employees have the apps. So, again, this points back to, you know, why we need legislation, why we need proper oversight. We really don't have the ability to stop employers from doing that kind of thing right now so we do need to be concerned. And so thanks for the question. Ali or Bennett like to comment on that one or I can move on to the next question. All right, I'm going to take that as an. Oh, go ahead. I just like one little bit of context I think it's a really interesting question and I think obviously there's a lot to be determined like I don't think we have a perfect sense of how this will unfold and I'm suspecting that it will change a lot as time goes on. I personally was kind of shocked to hear the timelines. And Dr. Osterholm was casually referencing of several years, but it did obviously he's the expert. So that was a really, you know, good reminder for all of us that this is not a short term kind of situation that we're in. I think that yeah to know sort of echo Lauren's point, obviously the opt in pieces that have been built into the technology themselves are really important. There's sort of a broader cultural and political question that I think we'll have a chance to discuss as the society is apps start to become available to the citizens. But I do think there's other kind of considerations around what's possible on your phone. They're relevant right so having an app on your phone at a moment that's requested right it's different than sort of like deleting or disabling that app there's other settings that can be toggled to sort of amend the functionality of the app at various moments. Some folks can some folks don't have the phone to Lawrence points and folks don't have the right phone. So I think there's a lot of other questions that will need to be answered and a lot of other. I think there's there's sort of more nuance to the question and the basic opt in opt out provides. And I think as we're going through this period of time of adjustment and deciding what we think is reasonable and what we think is responsible. And how we use this technology there'll be more nuance to that to that discussion as it unfolds both as a technology is terms of what's available in the technology itself and in terms of what norms and behaviors we think are appropriate to incentivize. I would just quickly add that, you know, Senator Markey and his letter to the administration communicated that, you know, voluntary. Not only that I can't be forced to download an app but also that access to public benefits and services should not be conditioned on my participation in a program like this and of course. Okay, thank you. So the next question I think is principally for Ali, although others may want to weigh in on it as well and it's about data security with these contact tracing apps to what extent can that be safeguarded to what extent are we creating a whole new set of privacy risks by setting up these kinds of systems. That's it's an interesting question and definitely one that's been discussed, you know, among researchers in the public as this as this technology has been explored around the world. I think that's a lot of the design decisions that have been made have been made to mitigate that risk. Obviously, anytime you take any steps you're not going to be able to mitigate risk to zero. So the remaining risks around data kind of privacy and security issues fall I would say kind of into a couple of categories that there's, you know, continued opportunity to mitigate. One is around the rest of the data stored from from the app itself right the data from the API being stored on devices obviously a significant security benefit. So there's other sort of questions around keeping the rest of the data secure that I think will be solved as folks work with app developers to create the apps and meet the standards that the companies have put forward for their stores in general right all of these apps will have to comply with the store policies. For example at the Google Play Store level they'll have to comply with all of the policies that would apply to any app on the store which include a lot of baseline privacy and security expectations for apps in general. I think that's one kind of avenue that will need to be finalized. The other is around some of the sort of attack scenarios and various kind of vulnerabilities of the broadcast system. A lot of the situation, a lot of the scenarios that have been described require a pretty significant investment of time and effort to sort of like make vulnerable something that is pretty secure. So the teams are continuing to explore other ways that they can address those concerns and actually researchers around the world are continuing to explore it. Those are not unique to the Google and Apple solution they're they're unique to sort of like the situation in general so I think there's a pretty strong community of cryptographers privacy researchers who are all working together to try to mitigate those concerns and try to do the best they can to get the risk as low as possible while acknowledging that at some point there are certain trade-offs that are made in terms of what avenues you would choose and how you would decide to design the system. So I think it's been a pretty effective scenario so far there's some continued work to be done and obviously you'll have to sort of keep an eye on things once these technologies are more widely used or hopefully more widely used and continue to monitor and make sure that folks are being responsive. But I would like to just call it again to the broad community of researchers around the world who are really working together on this. I think there's been a pretty incredible effort actually from folks, experts everywhere who are really investing a lot of time and energy in thinking about how this can be done safely, securely and privately. And all of those efforts are not to be kind of swept under the rug just because Google and Apple's name is in the conversation. I think all those efforts are really important and really significant. And so I just want to sort of broadly acknowledge that community of people who are who are thinking hard about this and really putting a lot of smart brains on the problem. Thank you. And Lauren and Bennett, do either of you want to address this from a policy perspective the data security question and in terms of policy considerations or whether this is something that legislation maybe should address. Yeah, I was just going to say, not to be a broken record but again this is something that should be included in legislation and again points back to why we need legislation. You know, on that point I would say, Senator Markey for years and years has been advocating for privacy legislation and firmly believes that data security and privacy will hand in hand. I think that point is really well taken. And while I don't have any news to announce, I think it's safe to say that Senator Markey is always looking for opportunities legislative and otherwise to improve on existing privacy and cybersecurity safeguards and this context of contact tracing and exposure notifications, certainly no exception. Okay, we have another audience question. It says the questioner is a team at MIT and Cornell has researched Americans perceptions of contact tracing apps and find that there's a lot of misunderstanding of Bluetooth proximity tracing. So the questioner wants to know to what extent can we educate the public. This also would tie in on some of the conversation earlier about adoption rates and making these apps more effective if we have wider adoption. So question goes to really public education efforts. How can we do those what should those look like. I'm having to take a first pass, although I'd be curious to hear from other panelists as well certainly. This is a great question. I think one of the things that we've spent a lot of time thinking about for folks in my role at Google right now is sort of in the guts of it is how do you help people build an intuition around how this works, particularly since it's coming across as quite a technical feature. One of the challenges is that there isn't a strong sort of mental model or comparison to something similar. So we've seen a lot of conversations and Lauren referenced earlier the idea of your Bluetooth speaker kind of pairing. And this is a slightly different sort of operating principle. And so one of the challenges is because the phones are basically being reengineered to make this possible right so this is possible in some capacity today as trace together is showing. But really what Apple and Google are doing is sort of making the phones create a functionality that it doesn't exist in this current state today right thus the nature and the need for the partnership. And so because of that it's a little bit challenging because it's something that people don't necessarily have a strong intuition around. One comparison we might think of as maybe airdrop technology. So like the idea that your phone can communicate directly with other phones without sharing other information necessarily about your location airdrop technology isn't anonymous so it's not a perfect comparison but sort of trying to build what we would call like a mental model right like how do you help people understand based on things they're more familiar with. Can you develop comparisons that are more kind of familiar that kind of draw on people's understanding of how their phones work today. So this is something that folks at Google are trying to think about how to help with because that's something we do have a background in right it's building some intuition around how technologies work. But I do think again a lot of this will come down to the public health authorities as as really the most trusted entity like I've seen a couple of surveys that that show pretty significantly that public health authorities are going to be the most kind of source of information on this technology. I do think a lot of it will require a partnership and a conversation with folks like the people who are on this panel or in this call to try and help the public kind of develop this intuition and so from for our part. I think you know we have definitely encountered this is a challenge that I think will be really interesting to try and solve and we're looking forward to working with a number of partners as we try and sort out the best way to help people build an intuition and help make decisions that make sense for them. You know I would just add I think that there's there's a, there's a public understanding gap, but I think there's a related public trust gap. There's, you know, recent bowling that you know around half of Americans are not keen to download these types of apps to me that gets back to this question of use limitations which is so important to Senator Markey. You know, if, if we're going to, if, if folks are going to start adopting these tools at a high scale, they will need to know that their data isn't going to be sold to data brokers and they're going to find out pages of newspapers and websites that, and they need to know that their information isn't going to be leveraged for discriminatory purposes. So I think addressing this, these questions of public understanding have to go and addressing questions of public trust. And I would just add to that by saying, you know, it, it's really interesting and telling that, you know, sort of, even in the face of what we're all experiencing which is a huge civil liberties infraction are our need to just stay home at all times. People are still as Bennett referenced people are still somewhat unwilling to or sort of split on whether they're willing to, you know, download and use an app, I think it's kind of early surveying but yeah around 50% of folks were are willing. And so, yeah, so it's a great question. And, you know, I think, you know, as I said earlier obviously some public education would need to be done sort to sort of accompany the roll out of any apps and you know I think that any education campaigns would have to sort of be collaborative between the whatever relevant local government community organizations as I said should be brought into the conversation, and the tech companies who have of course the sort of technical understanding of those apps. And then sort of on the other end, I do think another concern is that we need to be aware that once these are rolled out that there could be some sort of false sense of security out there. And, you know, if they're sort of widely deployed. They're sort of a different sort of trust issue or sort of the other side of the trust issue is that like, we all tend to, you know, we have this automation bias we we all people tend to believe that technology is more accurate than sort of human decision making. And, you know, as I outlined earlier, there are going to be issues with the false positives and the false negatives that could affect the accuracy. And, you know, so that's kind of another issue once these are widely deployed. Okay, so one final question from the audience before I'll come back to you to ask you for any concluding thoughts. If I'm understanding the question correctly from audience member is what is their role for the manual contact tracers the traditional public health contact tracers to play in addition to collecting data to serve as kind of cultural brokers to reach out data security and integrity information and providing that to underserved communities so it's sort of an interface of the of these two approaches, can they play a role in this regard. Well, I think, you know, I would highlight that Senator Markey has introduced legislation, providing resources for coordination between FEMA, AmeriCorps, involving evacuated Peace Corps volunteers to become involved in the type of human to human contact tracing that could be really beneficial here. And so, you know, I think Senator Markey's focus on concerns around the digital tools should not be construed as ignoring the very real role that human to human what traditional contact tracing can can provide here. I think we really need to listen to the public health authorities on this, this kind of question of what role digital tools could even play. As I said earlier. So, I think we are getting, you know, we're having some some of the app developers and everybody are getting a little bit excited about these apps and offering tech solutions, where we don't even know that the health authorities, you know, would be willing or able or to use them or find them and they're really the ones who need to be driving that conversation. So, which is that that. Okay, so I want to go, we're coming up on the end of our time here so I just want to give each of the panelists a chance to either comment back on something that one of your fellow panelists said or highlight any concluding remarks or issues that you'd like our audience to have as takeaways from this conversation. I think we can go in the order I started out with if Ali if you're ready to go first. Yeah, I'm happy to and thanks again Jen for bringing folks together and thanks to my fellow panelists for all of your excellent points I think there's definitely a lot to be determined and I'm excited that there's conversations happening bringing different experts together and thinking in a multi-faceted way. I did just want to take one second to step back to a point that Dr. Osterholm made which was really around not assuming ill will of anyone's motivations as part of participating in this system. There's a lot that we don't know that nobody knows I think that there's reason to sort of ask good questions around efficacy ask good questions around data protection. I think there are answers to some of those questions and some of them will require people figuring out along the way, but at least in my observation is, as you know having talked to people all over the world about this process, I think there's not. This is not being seen as an opportunity to sort of exercise any ill will. And I think a lot of various entities are participating in a real sense of community responsibility. The API that Apple and Google are making can't be monetized like we're not monetizing it and in the terms of service, there are prohibitions on monetizing on advertising but I think there's really some real sense here that this is for the greater kind of process and in contribution to solving the pandemic and not out of negative motivation. So I think that is a good kind of fundamental attitude to have and participating even as we're remaining thoughtful and cognizant of some of the risks that are kind of present in the world. I think Warren and Bennett have done a great job of describing those and they're not to be certainly not to be dismissed and definitely to be discussed further and continue to be addressed. I think that it's been really interesting kind of relatedly these questions from what role can legislation player Congress play. One of the challenges is as we've all referenced several times the public health authorities themselves are playing a pretty significant role. So as Lauren referenced, like, you know, Google has been supportive or in sort of agreement to Lauren that Google has been supportive of comprehensive legislation seems like maybe that won't be moving quickly. But if there's other legislation that addresses COVID related uses of data, certainly some of these issues can be addressed in that in that context. But from from my point of view, one of the things that's most needed is, even though we do need guardrails and we do need a clear sense of like, kind of what what is okay and what protections are afforded and who's accountable for what. There's also just a real need for guidance and a real sense of like people just really wanting to do the right thing and needing greater clarity on what that is. Because in a lot of cases the information that's being presented is not between, you know, privacy and violating privacy, it's between privacy and stronger epidemiological data, or, or security or providing sort of like a more comprehensive response, or individual liberty or sort of like kind of creating a greater incentive for people to participate. So there's a real interesting stake on both sides and I think there are probably solutions that will respond to the great majority of everybody's values and preferences. And legislation is one way where you can sort of signal these things and create spaces and sort of encourage people to provide information and share share resources and sort of work together. So I think that's, you know, we think a lot about legislation as an accountability mechanism or something that's kind of quite strict, but it can play roles in terms of helping people be collaborative, creating safety and security around that type of work as well that I think could be really important for this process. So I guess I, in conclusion Sharon, I'll send you some of the resources to circulate out to your kind of network of folks on including the graphs I sent earlier or I mentioned earlier with the scenarios and the terms. And I'm always happy to chat further and thanks again to you and the panelists for this really great discussion. Thank you. Okay, sticking with my same order, Lauren your next for any concluding remarks. Sure. So I'll go back to a point I was trying to convey earlier but I don't think I made so clearly. So, per doctor also home we could be in this situation for quite a while. And while Apple and Google have set up. I think, as I said, a fairly strong infrastructure on from a privacy perspective. We need to ensure that that doesn't change over time. You know, as this pandemic potentially persists who knows how it how it develops. Apple Google developers could be getting pressure from the government or just the general public to do more with whatever data or potentially use different types of data or you know incorporate more concerning or more invasive types of data for instance location data. So, again, this just brings me back to the point that we need legislation and well we need two things we need, hopefully, Apple and Google to conduct, you know responsible oversight, and, you know, really follow through with their sort of privacy protections that Ali laid out in there that are already built into their API. But then we also need Congress to pass this legislation and, you know, I think Bennett more specifically laid out some of the items that legislation should include but just to echo them, you know, obviously they should require that any apps be voluntary. There should be a strict ban on collection of location data sort of, but all the data that we've been talking about has mostly been proximity data through the Bluetooth apps, but but location data from you know cell site location information from GPS should not be required and there should be sort of an explicit ban on that. There should be minimization. This should be pinned to end with any or the apps should be pinned and the data collection should be pinned to end with any with the end of this pandemic which is somewhat of a tricky question. Again, the data security, the measures should be in that use limitations to ensure that this is used that data is used for public health purposes but not shared with law enforcement for law enforcement purposes. There are obviously a requirement that none of this data can be used for advertising or commercial purposes, and then sort of robust enforcement mechanisms. And to the extent that Congress is unable to come to a consensus on these things state states should certainly jump in and pass this kind of legislation. So thank you I think I'll just conclude with that. Thanks on Bennett. Yeah, well, thank you again, Sharon. Thank you. Yeah, I think in an effort to channel Senator Markey, I think he would close by saying that we covered a lot of really important, you know, technical considerations here at the end of the day though, you know, we're talking about a massive public health crisis that is devastating communities in Massachusetts and across the country and causing immense economic hardship and loss of life. And so we do need a really all hands on deck, innovative, urgent approach to solving these problems. We should be taking bold action. And there's a way to do it that doesn't encourage on important values that we hold among them direct to privacy. Thank you. So I'd like to thank all of our panelists and thank our audience members for joining us today. I can't ask everybody to clap because that doesn't work in this format, but really appreciate everyone participating in this conversation. Thank you.