print PRINT


Glitches and design flaws limit value of Japan’s COVID-19 tracing app

  • February 1, 2021
  • , The Japan Times
  • English Press



Digital contact tracing is becoming increasingly crucial in Japan, where the third wave of COVID-19 infections is overwhelming contact tracers at public health centers and testing their capacity to the limits.


Some of these facilities are now marshaling their contact-tracing workforce toward a tiny pool of patients deemed particularly high risk, leaving the vast majority of cases at the mercy of a state-developed tracing app known as the Contact-Confirming Application (COCOA).


One case in point is Kanagawa Prefecture, where — like in Tokyo — numbers of new cases spiked in January. Amid the surge, all of the prefecture’s public health centers are currently encouraged to focus contact tracing almost exclusively on a demographic considered most prone to complications from the virus, including individuals in medical institutions and nursing homes. As such, Kanagawa in principle no longer manually investigates the contact history of most other patients, the rationale being that either their cohabitants or those alerted by COCOA will automatically be recognized as close contacts.


“What is exemplified by Kanagawa is the reality of how digital power is being relied on more and more now that human contact tracers have been stretched thin,” said Keio University law professor Tatsuhiko Yamamoto, a member of a panel of experts tasked with scrutinizing the app. “The importance of the app is growing, for sure.”


The smartphone program, which debuted in June last year, arguably forms the linchpin of Japan’s digital battle against the pandemic.

While the app is becoming more important than ever for containing the virus, figures suggest willingness among the public to download and use COCOA has been lukewarm at best — likely stalled by factors such as poor messaging by the government and reports of technical glitches.


Touted as minimally intrusive and with its use remaining voluntary, COCOA has also added to Japan’s reputation as one of the most privacy-savvy nations in Asia, where economies such as China, India, South Korea and Taiwan have deployed digital surveillance more aggressively in a bid to flatten the curve.


Months after its release, however, that very emphasis COCOA has placed on privacy is now attracting fresh scrutiny, with some critics saying protections in the app prevent the government from collecting data essential to gauging its effectiveness.


Prizing privacy

Japan’s contact-tracing app has been both lauded and criticized for the extraordinary lengths to which it goes to prioritize privacy protection.

Similar to Germany’s Corona-Warn-App, COCOA is based on what is known as an “exposure notification system” codeveloped by tech giants Google and Apple, in which smartphones equipped with the app use Bluetooth signals to automatically exchange and log one another’s randomly generated codes whenever they are within a proximity of one meter for 15 minutes or longer.


Later, if one user tests positive for COVID-19 and agrees to confirm their infection status via COCOA, other users whose smartphones swapped codes with theirs in the preceding days will be identified as possible close contacts, and notified by the app. Those who receive such notifications are then instructed to self-quarantine and consult nearby public health authorities, where it may be possible to arrange a polymerase chain reaction (PCR) test for free.


The nature of how the app works suggests that the more people use it, the more effective it becomes.


But downloading the app is strictly optional. Unlike some of its more authoritarian peers, adopted in countries including China and India, Japan’s app does not allow the government to centralize data, use GPS to track people, or harvest information such as phone numbers and names.


Across the world, fears over invasions of privacy are dogging novel coronavirus tracing apps.


Singapore, for example, admitted at the beginning of the year that data recorded by its app could be used for “the purpose of criminal investigations,” flip-flopping from its initial assertions that data use would be strictly limited to virus tracking. In the city state, nearly 80% of residents are said to have signed up for its TraceTogether platform.


Such an abuse of personal information by law enforcement is almost inconceivable in Japan, said Takanori Fujita, another member of the panel studying the app who is also a project leader in charge of health care and data policies at the World Economic Forum’s Centre for the Fourth Industrial Revolution Japan.


“In Japan’s case, the amount of information to be obtained from the tracing app is so little that it is actually considered of no use to investigative authorities,” Fujita said.


Tepid penetration

The privacy-first ethos, however, has its downside, too. Officials say the way encryption has been used makes it all but impossible for the government to grasp the actual number of notifications sent via the app. That has prompted criticism from some that the extent to which the app is helping to control the virus is unverifiable.


“I get the importance of privacy, but without knowing how many people received notifications the effectiveness of this exposure notification system can’t be measured,” opposition lawmaker Yuichiro Tamaki, head of the Democratic Party for the People, pointed out to a Lower House committee in January.


Complicating the picture is the fact that despite the promise of minimal data collection, the tracing program is struggling to gain traction among the public.


According to the health ministry, COCOA has logged about 24 million downloads so far. That suggests roughly 20% of the entire population in Japan now have it installed on their devices.


But the figure falls far short of the 60% uptake that — based on past University of Oxford research — is often cited as a benchmark and target.


“What I suspect is happening is something called a ‘privacy technology paradox,’ where the more multilayered the app’s technology becomes in a bid to strengthen privacy protection, the less transparent the whole thing looks to the public — hence the distrust,” law professor Yamamoto said.


To assuage their skepticism, “the government, I think, shouldn’t focus on explaining granular details of the privacy protection system it has in place, but rather try to appeal to the public with a simpler message of accountability and governance, as in ‘I will take responsibility if any problem occurs,’” he said.


But Atsushi Suzuki, a health ministry official, counters the widely held notion that without the 60% penetration rate, COCOA can’t contribute to curbing the spread of the virus, citing other studies.


A separate, non peer-reviewed Oxford study published in September, for example, concluded that digital contact training based on an exposure notification system can help “meaningfully reduce the number of coronavirus cases, hospitalizations and deaths” even at low levels of app uptake. In the U.S. state of Washington, for example, even a 15% adoption rate of such a notification system, when combined with “a well-staffed manual contact tracing workforce,” is estimated to have diminished infections by 15% and deaths by 11%, the study said.


“If the narrative that ‘this app is useless if it doesn’t achieve the 60% uptake’ spreads and becomes the common understanding, people might see no point in having it and start deleting it, which is something we definitely don’t want,” ministry official Suzuki said.


“So we’re not setting a specific target to achieve, but simply asking as many people as possible to download it,” he said.


Arduous process

Instead, perhaps more deserving of scrutiny is the abysmally low number of people who have ever used the app to register their infection status. As of Friday the total was 9,736 — a mere 3% of the 380,000 positive cases tallied at home so far.


Reasons for their reluctance may vary. But Etsuko Tsugihara, president of Tokyo-based public relations firm Sunny Side Up who recently tested positive for the novel coronavirus, says she can certainly relate to those who didn’t register their status on the app — or couldn’t be bothered to.


To alert fellow COCOA users, those who tested positive can’t simply tap on the screen and be done with it. Those willing to register COVID-19 positive status must ask public health authorities to issue a multi-digit number, which they then need to type into the app as a form of authentication.


Tsugihara, who tested positive at the beginning of the year when cases were soaring in the capital, says she really had to go out of her way to get the number.


“I could see officials were quite busy dealing with other patients, and that issuing an identification number for a COCOA user wasn’t much of a priority. I was bounced from person to person and had to be patient throughout my calls. It wasn’t very smooth,” she recalled in a recent interview.


“Not to mention, there are a whole bunch of things you have to sort out if you test positive. Arranging PCR tests for my family, making calls to people I know that I exposed to the virus — the list goes on. It’s really hectic,” Tsugihara said. “So I wouldn’t be surprised if there were many patients who are just too busy to think about doing anything on COCOA.”


Not foolproof?

During the course of her weekslong ordeal, the businesswoman drew attention to the challenges she faced as a COVID-19 patient with candid posts on social media, including some depicting the apparent unreliability of COCOA.


Complaints about errors are nothing new for the program. It has been plagued by reports of technical glitches from the get-go, the latest example being an issue in which the app is reset to its newly installed state.


Tsugihara discussed at length her own experience of what she understood to be an app malfunction in a series of tweets that went viral.

When she tested positive for the novel coronavirus on Jan. 2, the Tokyo resident soon set about to confirm her infection status on the app and completed the process the following day. By doing so, she hoped to alert fellow COCOA users who may have come into proximity with her during the so-called contagious period dating back to two days before she first developed symptoms, including a sudden loss of taste.


In her case, it was anyone who had been in her vicinity since Dec. 28, including family members who she was confident had been within a one-meter radius of her for longer than 15 minutes routinely. She naturally assumed her son, the only other long-term COCOA user in her family, would receive a notification — but he didn’t.


According to the health ministry, when those considered close contacts don’t get a notification there are usually two explanations; either Bluetooth signals have been turned off, or smartphones have been placed at a distance from users — therefore failing to exchange codes even if the humans themselves were close to each other.


Tsugihara dismisses both possibilities as unlikely, adamant she and her son were using the app correctly. The exact cause of the possible glitch she experienced remains unknown.


“The app is touted heavily by the health ministry but, after all, it’s a product of human efforts. Experiences like mine, however rare, could happen to others, so I think it would be very dangerous to put too much trust in the app,” she warned.


While isolating herself at a Tokyo hotel where she was sent to convalesce, Tsugihara says she became acquainted with younger patients at the facility who told her, through online chat, that they had let their guard down after taking comfort in the fact that COCOA had sent them no notifications.


“Some people give the app too much credit, and mistakenly think they’re virus-free as long as they don’t get a notification,” she said. “I think the app should be taken with a grain of salt — not at face value.”

  • Ambassador
  • Ukraine
  • COVID-19
  • Trending Japan