Joe Fuller: Welcome to the Managing the Future of Work podcast from Harvard Business School. I’m Harvard Business School professor and visiting fellow at the American Enterprise Institute, Joe Fuller. This episode is one of the series of special dispatches on the sweeping effects of Covid-19 on our economy, society, and the future of work. In addition to our regular podcast episodes, we will be bringing you shorter and more frequent interviews with business leaders, policy makers, and leading scholars on the coronavirus. While the virulence of Covid-19 seems unprecedented, the tools that will ultimately bring it under control have a long history. Key among them is contact tracing—identifying individuals in the chain of transmission so they can be quarantined. The smartphone can be an effective contact-tracing platform, but how do you keep privacy from becoming collateral damage? In a white paper published by Harvard University’s Software Center for Ethics in mid-April 2020, a dozen technologists outline how contact tracing can be carried out without sacrificing privacy. Authorities will need to clearly communicate that these extraordinary measures are proportionate, justified, equitable, and finite. My guest today is a coauthor of that paper, Sham Kakade, a professor of computer science at the University of Washington and a collaborator with Microsoft. Welcome, Sham.

Sham Kakade: Thanks. Thanks for having me.

Fuller: Sham, I want to dive in on your paper from April 2020, “Outpacing the Virus: Digital Response to Containing the Spread of Covid-19 while Mitigating Privacy Risk.” We can tell that it’s a serious paper because it’s got a long title. You and 11 other technologists across a range of institutions from Microsoft to University of Washington authored this. Tell us about the thrust of the paper and what brought you all together to author it.

Kakade: Right. This is a great question, because it’s a pretty unique collaboration. So I think for me personally, I wanted to look back and say, “Hey, I tried to help in one of the greatest crises of my generation.” I think many of us felt the same. And given the positions we were in and our skillsets, we took a hard look at the problems, saw what types of solutions were out there, and kind of dug deep within our network of connections and expertise—brought in various cryptographers, medical health experts, programmers, designers—and tried to take a crack at generally helping out.

Fuller: Sham, your paper discusses contact tracing. That’s a term that’s beginning to show up in the media, but I’m sure most people don’t really know what it means. And you actually described three different approaches to contact tracing. Could you just let us know more about contact tracing and what distinguishes different approaches to it?

Kakade: Yeah, so why don’t we just start with the conventional approach. So contact tracing is an epidemiological approach to suppressing outbreaks of diseases. So think of Ebola or SARS or the HIV epidemic. What would occur there is, you’d have a team of contact tracers—so, this would be a team of public health officials—and when someone tests positive, they’ll either go to that person’s house or give them a call, and they’ll conduct a very detailed interview to try to see who this person contacted, and, in particular, try to figure out which people were at risk. And, depending on the type of disease, whether it’s HIV or Ebola or SARS—because there are different criteria for risks—and they’ll make a long list of people, or short, but they’re going to try to extract all of the possible people who’ve been exposed. And then they’re going to try to get to those people and make sure they aren’t exposing other people, because some of the time, like with HIV, the other people might not know they even have it. And then the contact tracer’s job is try to go around and, as quickly as possible, find those other people, get them tested, and make sure they don’t spread it. And if they’re fast enough, this is a way to suppress the disease.

Fuller: So that sounds like a very kind of shoe-leather, intensive manual process, almost like detective work.

Kakade: It basically is detective work and I think ... let me come back to that point about detective work … but there’s a sense in which—and some of the other countries right now, they’re truly treating it like detective work. And this is the type of thing, it was done on a relatively small scale. I mean, certainly HIV is pretty big, but the timescale in which you had to act with HIV is a much slower process. And what’s happened recently with the Covid pandemic is, we’ve had a few countries which have done contact tracing at both a scale and a speed which we just haven’t seen before anytime in history. If we look at China, South Korea, Singapore, and Taiwan, they were doing a mix of manual contact tracing and assisted contact tracing at a scale the world has really never seen. And they’ve suppressed outbreaks up to hundreds of thousands of people. In South Korea, they’ve done this with up to 20,000 cases. They stopped it, and they did this effectively while keeping the economy going. So there’s definitely a scale of doing this. And the reason it’s so successful is, particularly with Covid, is a lot of asymptomatic people are spreading it before they even know they’re getting infected. So how do you stop this? And this is why contact tracing is so successful. You can find those people and make sure they don’t spread it before they know they’re infected.

Fuller: So, you just used the phrase “assisted contact tracing.” Do you assist through technology like mobile phones?

Kakade: Yeah, so this is ... right, so now we’re going to get into the second method of contact tracing, because at first glance it looks like maybe China was largely doing with manual tracing, and that wasn’t really the case. It wasn’t entirely manual tracing. It’s assisted in those countries, it’s assisted through mobile phones, like where these people were. But to a large extent, the way it was assisted is these countries have access to people’s credit card records, and they have CCTV cameras. So they literally treated this like detective work. Once someone’s infected, they tried to figure out where this person has been. And they use the information that the government has collected to find their contacts. And things like credit card information, this is a pretty good trace of where they’ve been. They just look and see where they purchased things. They know they were at a particular location. And then they ask the person where they’ve been. So this really can be viewed as a mix of both a human team—and this would be one or two people doing the interview and looking at the data—and then maybe another five people or so that work together to contact the other people.

Fuller: Got it. So it’s kind of an augmented or a 21st-century version of the same type of detective work.

Kakade: Yeah. And it’s interesting to see how these countries did it. So China obviously has different levels of power and surveillance. But South Korea, they are a democracy, but after the SARS epidemic—actually in South Korea, it was the MERS epidemic—they actually passed laws in a public-health emergency. Their government can actually get telecom data. And while this is a big invasion of privacy, there is a sense in which their government has protected their citizens. It’s a democracy, the number of deaths there is under a 1,000, the economy is completely open, and there’s a trust in their government to do this. So it’s definitely assisted. And the way it’s assisted is because the government has passed emergency laws to access this data.

Fuller: Actually a democracy that held an election during the pandemic.

Kakade: Yup. And the support for the government is skyrocketing. So, it’s one of these things that ... I don’t see this happening in the USA, but in a place where they trust the government, they enacted some pretty serious surveillance laws, and they certainly have used it to suppress the disease.

Fuller: So, in these more-advanced instances of contact tracing, who had to get aligned? Was it all governments, or presumably they have to be working closely with telecoms providers, banks? Sounds like it’s really an effort that involves multiple constituencies.

Kakade: That’s right. And what’s interesting is that these constituencies, they all knew how to act, because interestingly enough, all those four countries had an outbreak of SARS and MERS. So they really learned how to get these constituencies to act together. It’s really part of a three-part process. So first you got the testing, so that needs to get into place very quickly and at scale. And all of these countries acted to scale up their testing abilities. Then you’ve got the tracing, and that’s a mix of the teams of tracers along with assistance from the telecom and governments and ways to get in touch with the people. And then the third part of this process is what I call “time outs.” And it’s when someone’s infected, the tracers will go to this person and make sure they stay inside until they’re tested before they spread it. And then they give them assistance if they have to be self-quarantined. And they make sure they stay at home and don’t go infect other people. So it’s quite a lot of coordination between different parties. But since these countries had an outbreak in the past, they had systems in place to deal with it.

Fuller: Right. You earlier suggested that you thought it was unlikely you’d see something like that in the United States. I think we can all imagine why. First of all, certainly no one’s made any mention of an integrated plan of the type that was inspired by the SARS and MERS outbreaks in the countries you mentioned earlier. And issues of privacy and personal data here and in Western Europe are treated differently than they are in some Asian economies. What do you think countries like the US are going to do, and how would you evaluate its efficacy?

Kakade: So this is a great question. And I think a lot of the technologists now have been thinking a fair bit as to what would both assisted and automated tracing look like. So I mentioned assisted tracing, and what people have been thinking about also is automated ways of doing tracing. And because we’re an open democracy, and we certainly do not want surveillance technology in place—particularly we don’t want surveillance technology in place if it can be avoided—and what we’re trying to do is come up with technologies that can both assist and automate the process and protect people’s privacy. And maybe I’ll start with the assisted way of doing the tracing, because this one, in a sense, might be the easiest way to protect people’s privacy. And if we do effectively suppress this, there might be different phases in which how we’re doing the suppression, because I think it’s entirely plausible we’re going to be in a precarious situation for the next year until we get a vaccine. But the situation I would like us to be in is, we keep tracing it and suppressing out these local outbreaks like South Korea, so our economy can be working. And every little outbreak that occurs in some region, we go and suppress it there. And we keep doing this for the next year. [crosstalk 00:13:03]The early days of this is almost certainly going to be large teams of manual contact tracers and ways in which mobile technologies can assist them. And the simplest way to assist them would be people just having their location information on their phones and using that to help out the contact tracers. So it’s like when I go for a run, I’ll often remember the locations I’ve been on that run because I map it out. And some people use like a Strava app. And think of an app, which for the last two weeks, remembers where I’ve been. And this is something that I’m never going to share this information to other people, because I don’t really want to broadcast my location trace. By that, I mean I don’t really want to broadcast where I’ve been for the last two weeks. But during the contact-tracing interview, the person might ask me, like, “Hey, Sham, where were you last Saturday afternoon?” And maybe I won’t remember, but then I can look at my phone and say, “Hey, oh, I was at a Trader Joe’s that afternoon.” And in the morning, I’ll see, like, “Oh, I was in Central Park.” And that’s something that we can view as assisting the tracer during the interview process. And privacy is pretty good here, because we just keep the data on the phone. And there’s a lot of other simple things, too. Like, we’ve been speaking to various manual teams and just transferring the information over—it’s difficult to take down a bunch of phone numbers, particularly if someone has an accent or the connection is bad. So there might be just a way an app can help you pull out the relevant contacts on your phone. You just click on buttons, ask which people you contacted, and that information would be sent over.

Fuller: So the notion would be traditional contact tracers in touch with someone they believe is at risk, and that person voluntarily transfers or surrenders that data? You see them as part of cooperating and trying to play their part in reducing the spread of the disease?

Kakade: Yeah. Well, the correction is, this would be a person who’s actually tested positive. So, then the [crosstalk 00:15:19] tracer contacts that person. And they don’t even actually have to volunteer, I wouldn’t necessarily volunteer even giving my location trace over, but just during the phone call, I can bring it up on my own phone and see where I’ve been. I don’t actually have to, like, literally, electronically send my information over because then it might have to be stored in some database, and I don’t really want my location stored in anything.

Fuller: Right. There’s some people who say that’s happening anyhow through commercial sources, depending on what filters you’ve used on various applications. Now, you mentioned a more-automated tracing approach. What would that be?

Kakade: In terms of automated tracing approaches, this has definitely been receiving a lot of scrutiny now. And you might’ve heard of Apple and Google are coming together to release something. So there’s a few parties now that have realized that there’s a very natural way to do proximity-based tracing through Bluetooth. So the way this works is, we don’t really need to know absolute information to do tracing. You don’t need to know where I’ve actually been physically. All I really need to know is who I’ve been around or near. Yeah, who they’re near. And we could say near, as like, within six feet for like 15 minutes. And now is there a way to somehow privately track which people have been around which other people? And it turns out, there is, in a pretty natural way. So the way Bluetooth works is, Bluetooth is pretty low powered. So if I can hear another phone’s Bluetooth signal, it must mean I’m pretty close by, say within six feet. So the idea now is, phones are just going to broadcast signals to each other, and if one phone can hear another phone, it means those two phones were within six feet of each other. So the idea now is, you can do this in kind of a privacy-preserving way, because my phone is going to ... suppose we were together one afternoon—maybe you were sitting on the bus beside me—and my phone is going to be broadcasting some signal. Suppose this is broadcasting random numbers which have nothing to do with me. I broadcast, maybe, the number 158. And you broadcast, maybe, the number 72. We’re both going to remember what we heard and what we broadcasted. Okay, so you heard me broadcast 158. Then suppose, two days later, I think I’m feeling sick, I go get tested, and I’m positive. Now, being a good citizen, I might want to alert other people who were nearby to me so they can see if they’re at risk, and they can go get tested. And now, how do we do this? Well, I don’t really want to announce that, “Hey, Sham was positive, and these are the locations he’s been for the last two weeks.” But what I can do is, through maybe the lab I’ve been tested, I could give them the numbers I’ve broadcast. So I could say to this lab, “I have been broadcasting 158 yesterday, and I broadcasted a different number the day before.” And what the lab can do is, they can just publicly post these numbers I broadcasted. So what this lab is going to do is, they’re going to have a list of all of these numbers from positive people, which they broadcast. And then, since you were sitting beside me, then you’re going to look at this list, and you’re going to see 158 on this list. Okay? But your phone remembers that it heard 158.

Fuller: Yeah, got it.

Kakade: The only way it heard 158 is because you had to be within six feet of me. And then you know you were within close proximity to an infected person, and you might want to take appropriate next steps, like go get tested, maybe self-quarantine until you determine if you’ve been exposed or not. And this is basically the way this protocol works. And through tricks of using these random number generators, these lists that are public don’t actually have to contain my identity. They just contain this list of random numbers that have been broadcast by the positive people.

Fuller: And how close are we to having that deployable right now?

Kakade: Very close. I mean, a bunch of different parties have basically built different protocols—there are little variants of each other, because each one is trying to be a little more secure than the rest. But with the University of Washington, we have developed something right now. There’s one European protocol that they’ve developed something. And what’s pretty nice—we’ll see how it actually looks when it pans out—but Apple and Google are also coordinating to develop something. And this has advantages just because of logistic details of when an Apple phone talks to an Android phone. So when Apple and Google release it, we might just adopt their protocols, because the most important thing is something that’s both secure and privacy preserving along with being interoperable.

Fuller: And how do we envision the role of the individual in this? Is this something which is going to be put on offer? Or do you imagine states saying that participating in this would give you maybe more forbearance in terms of going back to work or movement? Have we played out scenarios like that?

Kakade: Right. So this is the next phase that we’re thinking about is, what would adoption look like in an open democracy? Because we would rather not be in a situation where the government mandates things. And I think most people would have, depending on the nature of it, I think most people would have concerns with this. So it would be much better if we can find a way to get people to adopt and people to understand the various risks that are there with these technologies. So adoption is really the right question. And I could envision a situation where, you know, “Hey, if I’m using this app, maybe I can walk into Trader Joe’s without a mask on.” So you just kind of flash something that shows you’re using it. And as long as everything is voluntary with the app, I think this makes it okay, because I don’t—like, the way we’re adding the apps now is it’s voluntary, if someone’s willing to disclose this information. And all the data stays on their phone. So I think it’s important to understand what strategies we have for adoption. And the trickiest part of the second strategy—which is why it’s also what I would view as the next phase—is it’s not very effective until the adoption is very, very high. So, for example, suppose 10 percent of the people adopt this protocol. Then how effective is it? Well, you’re really only going to help with 1 percent of the cases, because it’s only effective if both parties have the app on. So that’s 10 percent of 10 percent which is 1 percent. So you really need pretty high penetration before this proximity-based tracing starts kicking in. While this manual one, if 10 percent have it, it helps with 10 percent of the cases. So adoption is definitely a real concern. The flip side, though, is I could easily envision a situation where companies, like maybe Amazon, would encourage their essential workers to use it to protect them while they’re doing deliveries and while they’re working in warehouses. So if there’s a way we can have businesses encourage people to voluntarily use it, and maybe if they did, it’d be, say, in lieu of wearing masks and things like that—certainly not in lieu of distancing—then this might be one way to encourage adoption.

Fuller: Well, Sham, thanks so much for sharing your thoughts and drawing on your research about how we’re going to emerge from the Covid-19 crisis and how technology can become integral part in allowing us to get the economy started again.

Kakade: Thank you.

Fuller: Thank you for listening to this special episode of the Managing the Future of Work podcast. To find out more about our project on the future of work and for more information on the coronavirus’s impact, visit our website at hbs.edu/managing-the-future-of-work and sign up for our newsletter.