Next up on the “how to get life back to normal” checklist: contact tracing. But it’s not going to be easy.

Experts already say states need to wait until coronavirus cases actually start to decline over several weeks before they begin reopening businesses and sending people back to school and work. The US also needs to dramatically ramp up its capacity to conduct tests for Covid-19. It would help, too, if there were accurate antibody tests that would show if somebody has already been infected and is now immune.

But once people start resuming their normal routines, contact tracing will be essential to containing emerging clusters of coronavirus infections. Without those efforts, new infections could silently spread before we realize what’s happening, leaving more lockdowns as the only option to guard against an out-of-control outbreak and more deaths.

If lockdowns are a sledgehammer to clamp down on new clusters, contact tracing would be the more preferable scalpel.

Traditionally, contact tracing is the work of public health staff. When somebody tests positive for an infection, field workers interview them, find out people the infected person has been in close physical contact with, and then notify those people about their exposure. Ideally, the potentially exposed people would either get tested themselves or, at the minimum, self-quarantine until symptoms show up or the incubation period has passed.

In the United States and across the world, smartphone applications are seen as a promising option to automate some of the work that health workers have traditionally been asked to do. Namely, they could silently track which people we’ve been in contact with, and if one of those people tests positive for Covid-19, our phone would send us a notification letting us know about our potential exposure. Apple and Google have modified their operating systems to allow our phones’ Bluetooth functions to do this work.

This diagram from Google helpfully explains how this would work in practice:

But you can probably imagine all the practical challenges and privacy concerns such a program could raise. That’s why the Center for American Progress, one of the leading left-leaning think tanks in Washington, DC, is releasing a list of recommendations for states to utilize digital contact tracing, which it shared exclusively with Vox.

Their approach seeks to maximize privacy protection while encouraging the most effective application of these tech tools. To summarize CAP’s advice for states:

States should accept a decentralized approach. Data can be stored locally on people’s phones, and any government storing of information should be anonymized. Given the steps Apple and Google have already taken, with their enormous market share, states that follow their standards should be able to build an app that can reach nearly 100 percent of smartphone users anyway. Any digital contact tracing system should be voluntary. Earned trust is more valuable than compulsion, especially given the legitimate concerns Americans will have about government surveillance. For these systems to be effective, upward of 60 percent of people with smartphones would need to opt in. To encourage trust, states should put in place limits on how long data will be stored, both locally and in anonymized state databases. If Bluetooth is sufficient to contact trace, there is also no need to collect GPS or wifi information that more precisely tracks people’s movements. States should establish legally binding guidelines about what information will be collected and how it will be used. Specifically, local and federal law enforcement agencies should be barred from accessing this information. Transparency — achieved by putting app software in the public domain or operating under an open source license — is essential. That will make it easier to build apps faster and coordinate across states too. Public health agencies must also contract with conscientious companies in developing or administering any software for contact tracing. Work with patients and public health workers in developing the software and processes for deploying and acting on it. It sounds obvious, but any digital contact tracing will be better served if it’s produced with input from the people who will actually use it. States should set up independent advisory boards focused on privacy and civil rights; those panels should be empowered to hold hearings and collect information, from documents and witnesses, to provide this oversight. Ideally, there would be regional collaboration and national standards for these digital tracing efforts — perhaps coordinated through an existing group like the Association of State and Territorial Health Officials.

“Digital contact tracing apps may allow all of us to better fight this virus and return to more open ways of life,” CAP tech policy experts Erin Simpson and Adam Conner wrote. “We come to the recommendation of distributed digital contact tracing reluctantly and only in the context of exploring the range of other recommendations. However, we find hope in the idea that new approaches make it possible to build this in a maximally privacy-protective way.”

But even the best-intentioned plans are going to raise questions and be at risk of privacy violations. As Shirin Ghaffary wrote for Recode over the weekend:

The contact tracing system Google and Apple are working on is notably more privacy-centric than the methods we’re seeing in China or South Korea, but it still poses concerns. The two companies have now committed to shutting down the tool once the pandemic is over — which was a key issue for many privacy experts — but other concerns abound. There are still ways that even the randomly generated Bluetooth keys meant to anonymize users could be linked back to real identities. Apple and Google are also leaving it up to public health authorities to develop and manage the apps that will use their contact tracing tool. It’s conceivable that those authorities could introduce their own ways to circumvent privacy protections if their governments so desire.

You can see how the CAP recommendations aim to assuage these concerns (by, for example, prohibiting law enforcement access), but state governments will have to actually commit to those principles for them to be effective.

And people will have to be willing to give the government even limited access to their phones for these plans to work, and, as Shirin notes in her story, that is no small challenge in a post-Edward Snowden world. Reuters reported on Tuesday that only one in five people in Singapore, which has rolled out an app similar to what experts are envisioning in the US, have signed up for the digital tracing app. That is nowhere near the 60 percent adoption rate experts think is necessary for digital tracing to have a measurable impact on containing the coronavirus.

And all of this is why, according to the CAP experts and Shirin’s reporting and really anybody you could ask, digital contact tracing can only be part of a bigger solution. The ideal plan includes the traditional kind of tracing that we discussed at the top.

The problem is the US is woefully understaffed for the kind of contact tracing that is necessary for a highly infectious pathogen like the coronavirus. Public workforces have seen their federal funding cut by 28 percent over the past 15 years, and about 50,000 jobs in this now-essential field have been lost.

According to the Johns Hopkins Center for Health Security, the US needs at least 100,000 more public health staffers to conduct contact tracing, many of whom will need to be trained. Politico reported that before the coronavirus pandemic, states had fewer than 2,000 workers capable of performing these duties.

So a lot more investment may be needed. The Johns Hopkins researchers, led by Crystal Watson, put the price tag for hiring and training the necessary contact tracing workforce at $3.6 billion. The new coronavirus stimulus bill passed by Congress this week included $11 billion for states and cities to ramp up their testing capabilities, laboratory capacity, and contact tracing. We’ll see if that is enough.

Between the CAP recommendations, the work of other experts, and the examples of other countries that have already pursued these initiatives, we know what good contact tracing — of both the digital and traditional variety — might look like. But it will take the resources and commitment to certain ideals to make it happen.

This story appears in VoxCare, a newsletter from Vox on the latest twists and turns in America’s health care debate. Sign up to get VoxCare in your inbox along with more health care stats and news.

vox-mark Sign up for the newsletter VoxCare Get our newsletter in your inbox once a week. Email (required) By signing up, you agree to our Privacy Notice and European users agree to the data transfer policy. For more newsletters, check out our newsletters page Subscribe

Support Vox’s explanatory journalism

Every day at Vox, we aim to answer your most important questions and provide you, and our audience around the world, with information that has the power to save lives. Our mission has never been more vital than it is in this moment: to empower you through understanding. Vox’s work is reaching more people than ever, but our distinctive brand of explanatory journalism takes resources — particularly during a pandemic and an economic downturn. Your financial contribution will not constitute a donation, but it will enable our staff to continue to offer free articles, videos, and podcasts at the quality and volume that this moment requires. Please consider making a contribution to Vox today.