How Israel’s COVID contact tracing app rollout went wildly astray

The late March pitch for HaMagen, or “the shield,” the Israeli health ministry’s coronavirus contact tracing app, was short and to the point.  “The app that protects you and updates you in real-time in case you are exposed to corona,” declared a 15-second YouTube advertisement.

As first-wave case numbers surged and Israel entered its first nationwide lockdown, the buzz around the government’s digital campaign against the pandemic was upbeat.

Privacy experts tested it and endorsed it. Coders volunteered tweaks to the open source code on GitHub. In the first few weeks after it became available, more than one million users downloaded HaMagen onto their smartphones. Newspapers crowned the app a success and reported that countries were looking into adapting it.

 A half year later, with Israel not yet fully reopened after a second lockdown that took effect in September, HaMagen seems to have been discarded both by the government and the public — even after a widely touted launch in late July of a second version, “HaMagen 2.”

While HaMagen has collected more than 2.5 million downloads in a country of 9 million, the installed base of people actually using the app has declined slightly since late March, according to government figures. And even though more than 350,000 users downloaded the upgrade of HaMagen, only about 22,000 kept the app on their phones.

Technical woes hamper contact tracing app

In the interim, public enthusiasm for the app has been sapped by technical glitches, including a tendency to send out false contact alerts, a battery-guzzling reliance on Bluetooth capacity, and a time-consuming registration procedure. The government’s inability to effectively scale up its own contact tracing operation denied the app the necessary data to send out timely and accurate alerts.

The Ministry of Health itself, meanwhile, has been ambivalent about HaMagen’s potential, apparently relying primarily on mobile phone data collected by General Security Service, the country’s domestic intelligence agency. Before the pandemic hit, the GSS covert data collection programme had not been used to regularly track masses of civilians.

Observers say that what ultimately doomed HaMagen’s adoption in Israel was a government that lacked strategic direction and decisiveness in managing the virus, and a frustrated public that lost faith in the credibility of Prime Minister Benjamin Netanyahu’s public health policy. Public confidence in his ability to handle the pandemic has dropped from 58% in April, at the time of the first lockdown, to 27% in September, on the eve of a second lockdown.

“People don’t really don’t download or use the app. That’s a shame, because Israel was one of the first nations to come out with this technology,” said Eran Toch, a computer science and privacy researcher in Tel Aviv University’s engineering department.  “It’s a real case study in how important trust is, and the price you pay when trust isn’t respected.”

Numerous governments across the globe have grappled with harnessing technology to help contact tracing to stop the spread of the coronavirus. While China, Singapore and South Korea have used technology to help control COVID-19, they’ve been faulted for solutions that compromise individual privacy. Just recently, the European Union launched a pilot to share contact tracing data with member states.

Public is wary of COVID apps worldwide 

Winning public buy-in for voluntary apps like HaMagen has proved to be a challenge because systems require a critical mass of adoption in order to be effective. Few countries have succeeded in gaining a high adoption rate. Assuaging user privacy concerns is a mandatory condition.

“Public acceptance of contact tracing apps can enable countries to solve contact tracing cheaply, quickly and at-scale,” said Ramesh Raskar, an associate professor at MIT and founder of the PatchCheck Foundation, a collaboration of public health and technology professions to develop digital solutions for COVID-19, at a US congressional hearing in July.

The failure of Israel’s government to win wider adoption of the contact tracing app runs counter to Israel’s reputation as a global technology heavyweight, highlighting the gap between the civilian government and the country’s high-tech private sector innovation ecosystem.

Avi Hein, a cybersecurity marketing strategist, said that he initially downloaded the first version of HaMagen but eventually removed it because the app wasn’t accurate enough and he didn’t want to be mistakenly compelled into a quarantine. He said that he is using version two, despite the critical reports.

The trajectory of the health ministry’s app parallels the arc of Israel’s government in dealing with the pandemic. Swift decisive action initially helped prompt an early curve-crushing victory; but that eventually gave way to a slipshod reopening that enabled a second virus outbreak and put Israel at the top of world for new cases and deaths per capita. In September, Israel became the first country to retreat into a second nationwide lockdown.

Initial testing of Israeli app was thorough

HaMagen got off on the right foot before it was released to the public, say observers. When quality assurance testers hesitated to download the app onto their phones out of concern about government surveillance, the health ministry realized that it needed to put to rest privacy concerns so it brought in an outside security adviser to test for privacy and security. It also took the advice of developers to make the app code open source and available for collaboration on the GitHub repository.

“Version one of the HaMagen app was pretty innovative,” said Omri Segev Moyal, who heads the cybersecurity firm Profero and was contracted to review the app. “The tracking data never left the phone.”

The app saved a mobile phone’s GPS tracking information going back two weeks. Instead of sending that information directly to a cloud-based database, the app cross-checked the phone’s GPS data with an anonymized database of location information of individuals with coronavirus compiled by the health ministry’s epidemiological interviews.

Encouraged by the initial buzz over HaMagen, droves of Israelis downloaded the app. Within the first few weeks, however, the bugs in the first version emerged. The app sent out push alerts about possible contacts at locations where users never visited. Others complained that the app hadn’t warned them when they crossed paths with a virus carrier.

Contact tracing operation was too small

App performance was hampered because it relied on an epidemiological contact tracing operation that was too small and too clunky to handle the nationwide effort. According to a report released in October on the contact tracing effort by the Israeli government comptroller’s office, contact tracers wrote down notes from interviews with coronavirus patients, which were then entered as unstructured data into the Ministry of Health system. That undermined the quality of the data sets.

Moreover, the health ministry’s epidemiological research data wasn’t properly integrated with government hospitals, labs, research institutes, or the database of HaMagen, critics have noted.

Another factor that undermined public confidence in HaMagen was the health ministry’s decision to also use the GSS surveillance system to do contact tracing. Dubbed “the instrument” in Hebrew, the covert GSS system was developed to track suspected terrorists and utilizes telecommunications network data to track owners of mobile phones.

That decision by the government, which put the GSS system under a public spotlight, kicked up fierce criticism from rights advocates about privacy violations and spurred debate in the parliament. At the same time, individuals began complaining that they had mistakenly received orders via their cellphones to quarantine.

Privacy concerns arise

In a legal response to a court petition against using the GSS technology, the government  conceded that HaMagen suffered from concern that the app would pass on users’ information to “big brother” and the Israeli surveillance services. “People didn’t easily make a distinction between the technology of the GSS and the HaMagen,” said Tel Aviv University’s Toch.

Defending the use of the secret service technology as “essential” in the fight against coronavirus, the government said that the GSS technology is able to locate contacts fast and allows for the coverage of a larger proportion of the  population compared to HaMagen.

But IT experts said that the GSS solution was not built to operate on such a large scale and could not effectively identify contacts inside of buildings.  According to the health ministry, nearly two-thirds of the appeals against the GSS-ordered quarantines were accepted. A state comptroller report, meanwhile, found that the intelligence agency’s technology wasn’t as effective as epidemiological investigations in identifying virus carriers.

“Even though we used what Netanyahu calls the most advanced technological tool in the world, we couldn’t cope with the pandemic,” said Tehila Atshuler Schwartz, a fellow at the Israel Democracy Institute and a critic of the government’s reliance on surveillance technology for contact tracing. “The government wants to continue the centralized surveillance of the population. It doesn’t trust the willingness of the citizens to download the [HamaGen] app, and report to the government that they have been exposed to COVID. This is symbolic.”

Israel rejects Google, Apple API

As a second wave of cases began to rise in the summer, Israel’s health ministry pushed to release HaMagen 2. However, officials made a controversial decision not to build the updated version using an API for contact tracing developed jointly by Google and Apple that utilizes solely Bluetooth signals to detect instances of proximity to phones owned by COVID carriers

Experts speculated that the health ministry preferred an app that could also utilize  location-based data gathered by its human contact tracers, like the first version of HaMagen. However, the result was a homegrown app with additional technical problems: the HaMagen 2 Bluetooth system used to determine proximity taxed phone batteries and didn’t operate on a continuous basis. And that upgrade was still dependent on a contact-tracing operation which had been overwhelmed by a new wave of cases, after the government neglected to scale it up.

When the updated version was released in late July, much fewer users downloaded it onto their phones compared to the first version in March. What’s more, the number of users removing the app was exceeding the numbers of people downloading it. At the same time, public frustration with the government’s handling of the second outbreak was on the rise. In August, the government froze its public information operation to encourage adoption.

Lack of faith in government looms large

“When a host of technical problems is overlaid by a lack of faith [in the government], users don’t have the patience or willingness for the technical problems,” said Haim Ravia, a lawyer specializing in digital privacy who reviewed the development failures in a paper submitted to the Israeli parliament. In the paper, Ravia criticized developers for not embracing the Google-Apple API and not adopting open-source code from other countries’ contact tracing apps. “The government effectively neglected HaMagen 2.”

Critics fault the government for losing focus on the pandemic, allowing geopolitics and internal coalition politics to distract it from sound public health policy. Those distractions prevented the government defining clear goals for the updated version of HaMagen.

“False positives are fixable. There’s no technical issue that you can point to and say that crashed the app on a massive scale. It’s not like people used an algorithm that didn’t work, or a software language that didn’t work,” said Sevev Moyal. “If the business doesn’t have a clear goal, the technology will never succeed.”

In its October court statement on contact tracing, the government conceded that the Israeli public had lost faith in a government contact tracing app “as a general expression of a lack in the government [in contact tracing] and a fear of being surveilled by ‘big brother,’ despite the efforts to ensure a design that protects user privacy.” 

The court statement said that while the government is trying to improve the app, it doesn’t believe that a voluntary contact-tracing app could serve as an alternative to the technology used by the intelligence services. The government argued that few countries have succeeded in getting more than 10 percent to use contact tracing apps.

That leaves Israel dependent primarily on centralized covert contact tracing technology that lacks public transparency.  

Even if the government decides to embrace the API standards developed by Google and Apple and works out the tech kinks, it will still face a trust deficit, says Toch. “We’re going to be in a bind.”