Germany’s Angst Is Killing Its Coronavirus Tracing App

Germany has long been Europe’s cradle of techno-ambivalence. So when Berlin raced to embrace digital technologies to fight COVID-19, some observers took it as a new chapter in the country’s economic leadership.

If it seemed too good to be true, however, that’s because it was. Berlin’s efforts are floundering in a sudden, and telling, fashion. Even at a time of unprecedented crisis, Germany seems fated to slow down the continent’s technological advancement.

The early signs had been auspicious. In March, Berlin launched a nationwide hackathon, #WirVsVirus, drawing more than 28,000 participants and generating 1,500 crowdsourced ideas for combating COVID-19. The Robert Koch Institute (RKI), Germany’s equivalent of the U.S. Centers for Disease Control and Prevention, rolled out a symptom tracker app connected to fitness bracelets and smartwatches that racked up 400,000 users, providing RKI with swaths of heart rate, temperature, and activity data to monitor COVID-19 development patterns. Across German society, popular willingness surged to reevaluate the country’s stringent and popular data protection rules in favor of solutions to stop the virus in its tracks.

The tech euphoria culminated in the launch of the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) initiative, which would seek to use Bluetooth technology to trace human-to-human infection contact via smartphones while also adhering to European-level privacy regulations. The project was announced on April 1 with the support of the Fraunhofer Heinrich Hertz Institute, RKI, and 130 leading European computer scientists. Most importantly, it had the support of German Chancellor Angela Merkel’s government, which even announced it would test the app using troops from the German military. Fronted by Germany’s top artificial intelligence cheerleader Hans-Christian Boos, PEPP-PT began to gain momentum, with eight governments announcing support, including France and Italy.

But within weeks, it came crashing down. Government funding for hackathon projects has been slow to materialize. RKI’s symptom tracker app came under attack from Chaos Computer Club, Germany’s influential hacker association, which revealed that the app runs personal data through Big Tech intermediaries and allows German health authorities access to data even after the app is deleted.

But the biggest domino to fall was PEPP-PT. An open letter signed by some 300 tech experts viciously criticized the centralized data processing of contract tracing apps. The PEPP-PT app was designed to provide anonymized data to national health authorities with users’ consent. For the letter authors, this was “mission creep” toward greater surveillance. Other critics claimed that PEPP-PT lacked transparency because its founders were unwilling to openly publish their code. Still others questioned the claim that it was truly a pan-European initiative; despite some token additions from France and others, PEPP-PT was essentially a German project. Also, and not least, the cybersecurity proved shoddy; the Federal Office for Information Security, Germany’s cyber-authority, said the Android version was riddled with vulnerabilities.

The criticism led to an exodus among the app’s founding supporters. PEPP-PT’s death nail came from Apple, one half of the Big Tech duopoly that controls 99 percent of German smartphone operating systems. Unlike Google, Apple refused to unlock its operating system interface to allow central processing of Bluetooth data. Faced with increasing hurdles, the German government shifted its support away from the centralized PEPP-PT to an as-yet-undetermined decentralized option.

Out of the ashes, alternative app projects have taken center stage in the private sector. The latest standout, the Decentralized Privacy-Preserving Proximity Tracing (DP-3T)—developed by a Swiss-led consortium of techies and civil society—would store data on users’ phones, relying on decentralized data storage and processing rather than a central hub. DP-3T has won the support of privacy advocates, and a prototype has been available since April 17 for Android and iOS. But DP-3T’s fully decentralized approach is not without its critics—including from within the German government. Health Minister Jens Spahn exasperatedly questioned why tech civil society would prefer a decentralized option that locally processes data through U.S.-developed operating systems and thus privileges American Big Tech in controlling data rather than national health authorities.

He is not alone. The decentralized option has increased fears among German tech companies—start-ups and national champions alike—that the COVID-19 crisis will consolidate Germany’s dependence on U.S. tech giants. The country’s GesundZusammen (“Healthy Together”) coalition of start-ups criticized the government for not seizing contact tracing apps as an opportunity to emancipate European tech from Silicon Valley. Germany’s own legacy tech giants, Deutsche Telekom and SAP, have embraced similar arguments. The German government has tacitly endorsed their argument, informally tasking those companies with creating a decentralized Stopp Corona app at the end of April. But, even then, the operating systems for such decentralized apps will remain in the hands of the U.S. tech giants. (As one German parliament member dryly noted, SAP and Deutsche Telekom aren’t exactly known for their app development prowess, in any case.)

Germany’s app wars have resurrected familiar tech fault lines. The country’s resistance to centralized data storage and processing is a reflection of historical anxieties. Postwar West Germany reacted to the experience of totalitarianism by establishing the principle of “informational self-determination,” a strict notion of data protection as a human right. Eventually, Germany exported the principle at the European Union level through the General Data Protection Regulation, which, since 2018, has become a de facto global standard.

Germany continues to have one of the lowest cloud adoption rates in Europe, owing, in part, to a suspicion of potential data abuse by outsiders, a perception reinforced for many by the U.S. National Security Agency and Cambridge Analytica scandals. Many Germans—not just citizens but businesses and governments—prefer to keep their data physically close, be it in their phones, in on-site servers, or regulated through tough data localization laws.

The COVID-19 app wars have also confronted Germany with a vexing paradox of Big Tech. Opting for a decentralized system might be better for privacy in some sense, but it also means relying more heavily on Google or Apple, reinforcing the sense that Europe has sleepwalked through the tech boom of the past decade.

Strangely, the EU itself has played little role in Germany’s app debates. The European Parliament called for a decentralized option, but member states have split into two camps, with France, Italy, and Britain in favor of a centralized solution and Austria, Switzerland, and Spain backing a decentralized approach. The U-turn toward a decentralized option by the German government will likely prove decisive. But it remains unclear to what extent countries’ regulatory frameworks will allow apps developed in Berlin, Bordeaux, and Barcelona to work across the EU.

Germany’s intense debates about surveillance technology—and the trade-offs it brings in terms of autonomy, privacy, and dignity—may not really be about the current crisis at all but rather the next one. In some instances, contact tracing apps can become general purpose technologies and lead to new forms of discrimination. They could also become backdoors to a social scoring system and other deeper forms of surveillance. Some have called for a task force for coronavirus digital architecture to examine the implications not only of surveillance apps but also blockchain-based immunity passports, fitness symptom monitors, AI-powered triage systems, and social media disinformation monitoring. That might lead to more oversight from Germany’s parliament, which has largely been sidelined in the COVID-19 crisis thus far.

Largely left out of the discussion in Germany is whether a contact tracing app will work at all. Despite the political rancor and moral ambivalence around contact tracing apps, Germany’s political elite still continues to put a lot of faith—at least rhetorically—in them as the bridge to a post-vaccine future. But it isn’t even clear yet whether the technology will be effective. The testing that apps rely on abounds with false positive and false negative cases. Meanwhile, 60 to 70 percent of the population must use the nonmandatory apps in order to work, but the public opinion damage done by the polarizing debate around the apps might put that goal in question. A poll by the German broadcaster ZDF revealed that 47 percent of Germans surveyed would be willing to install a social tracing app—but 42 percent would not.

Taken together, the debate is bit of a Rorschach test for Germany in the global geotech age, one that reveals the country is obsessed, moralizing, and anxious about getting left behind. It remains to be seen whether Germany—and Europe with it—will do anything about it. Maybe there’s an app for that.