Canada’s Digital Contact-Tracing Experiment

Paris Marx: Bianca, welcome back to tech won’t save us for this special series on tech issues in Canada!

Bianca Wylie: Super nice to be here, Paris, thank you.

PM: I’m really excited to chat with you again. Obviously, you’ve been on the show before to talk about Sidewalk Toronto and that whole situation where Google tried to plant its footprint down in the city of Toronto, and was eventually scared away by residents and activists like yourself. A very hopeful event, and one I think that many listeners of the show were following, and certainly, were happy to see. But now we want to talk about a different issue today. For the past two and a half years, we’ve been in this pandemic, it has certainly evolved over the course of that timeline. The government in Canada, and many governments around the world, have taken different actions over the course of that period to try to protect the public from this health crisis that we all faced, and that came out of nowhere, that was a surprise to us, and that has really changed so much about the ways that we live. One of those actions that they took in Canada was to launch an app called the COVID Alert app, which was a digital contact tracing app.

Many people will be familiar with the idea of these apps, even if they weren’t in their own countries. And certainly Canadians will know what the COVID Alert app was. It was launched in most provinces and territories, but not all, but most Canadians would have had some kind of interaction with it. Now, this was launched in July of 2020, rolled out to most of those provinces and territories by October, and just recently, June 17 of 2022, the government and Health Canada, which oversaw the app, finally shut it down and decommissioned it. So what did you make of that moment when the government finally came out and said, “Okay, it’s time to shut down this app. It’s done.” Do you think that happened at the right time? Or was it too late?

BW: It is significant that it happened, because they could have got away with not decommissioning it. The government could have got away with that. So I do want to start by saying it’s significant that that happened. And seeing a government move through that cycle of launching something, maintaining it, and then shutting it down, means that there is a lot to learn from that. So it’s great that it happened. In terms of timing, it was late. There’s different points, which we can look at, where it likely could have been decommissioned. So it could have been done sooner. We can talk about that. But I think that not only is it great that it happened, it’s great for a government to be held accountable, and you know, to hold itself accountable to do it. And also to understand that that’s a step in learning in the future, you can do that. That’s part of a trust building exercise. So I think it’s really significant that it happened, we can talk about the details of it. But I want to really stress that it’s significant happened. And it’s great that it happened.

PM: Absolutely. You’ve been writing about this app since it was initially announced identifying potential issues with it, but one of the things that you were writing about recently was how the app came back to your attention when a friend of yours mentioned it to you, that it had still stuck around and was not really right for the context, and I guess we can question whether it was ever right for the context. But what did you realize in that moment, and how did it return to your attention?

BW: Yeah, so when this friend of mine said that they and their young family had contracted COVID, they wanted to report that somewhere. And I think that was an important piece of this story, because we’ve stopped collecting data about COVID, which opens a whole other set of questions and issues. They were trying to report it through the COVID Alert app, and then they realized that they didn’t have a PCR test result, which was required for them to report or log their case, and then realizing, wait, they can’t even get PCR tests anymore, because the testing capacity had been reduced. The general public could no longer get a PCR test as of January or February of 2022.

And so that struck me because when he shared that, and I thought, if you can’t get a PCR test anymore, that is the one core requirement of that app. So how is the app still up? Because we can talk about the app and how it wasn’t working before we had testing capacity, which is true. But if there would be one item that at the beginning of launching something like this, where you would say, “if this part breaks, we’re done,” I think it would have been reasonable to have had that as something that would have caused the government to shut it down right there. You know what, the core requirement is not available to the public.

So we have hit an issue and it would have been easy to understand this from the beginning, if you don’t have that, you have to shut it down. Because what happens after that is this availability of an app, and there’s no clear story around the status of it. But that’s what tipped me off was when I realized, wait a second, you can’t even use this anymore as it was designed. If that wasn’t a trigger for the government to pull it down of its own accord, that should not have required any public flagging of the issue. That should have been something that in a good policy framework, you would say, “Oh, this event has occurred. Now we have to take it down, because it’s not functioning as it was designed.” That’s very basic product management.

PM: I wonder if this gets into the point about the advisory council that you’ve written about as well, how there was an advisory council established to oversee this app to make sure that it was functioning properly, that it was being held to account as it was unleashed on the public in the middle of this public health crisis. But then about a year afterward, as you’ve written in your work, its term expired and then there was not that accountability, and the app still continued. What is the concern with something like that where this app is out in the public, people are trusting it to deliver a certain function during this crisis that we’re all facing, and then the body that is supposed to be holding it accountable is no longer doing that?

BW: This is a really important point because when we think about trust — which we see come up again and again, and it’s happening right now with law that is being tabled around the use of technologies in Canada around privacy and artificial intelligence and consumer protection. There’s this constant narrative about trust, so let’s think about trust in a public health crisis. We need to think for a minute here.

Health Canada is the one that has launched this app and is accountable for it. And if we go back to the beginning, not only was Health Canada launching this app, which in a pandemic, we have to trust very deeply what Health Canada tells us to do. We also had Privacy Commissioner at the federal level, Information and Privacy Commissioner at the provincial level, and an advisory council all stood up, all watching over and saying, “Okay, we are the oversight, and we know that this has to be effective from a public health perspective in order for this experiment to make sense.” And we need to use the right language here: This was an experiment done within Canada during a public health crisis. That is also something to pin for a moment, and we’ll return to it because this was experimental, there was no information other than information that these apps didn’t work about how this was or wasn’t going to work. And that’s very important.

Let’s go back to July of 2020 when you have a government, you have the prime minister, you have the premier, you have public health, telling people, “download this app, to protect yourself, protect the people you love.” And when people are scared, and you were told by the public health authorities to do this to protect people you care for, it is reasonable that people would listen to that message. What we need to understand is that when that message was shared, there was zero evidence of what was being said being true. But when you start something like this, you can understand good intentions and a public health authority saying, “Do this, protect, because if this works, this is something we should try.” Okay, so let’s extend a little bit of that trust and faith at the beginning. By the fall of the same year, it was clear that not only did we not know what this app was doing, but there were significant issues within Ontario, which is where the bulk of the activity happened, with basic function around getting notifications into the app. And I don’t want to get mired in it. But what I want to say is that by the fall of 2020, we had government still saying to use the app, when it was clear at that point in time, we’re not in the same rush as we were at launch, that they did not have information to say that it was working or not working.

Because when we say working or not working, that doesn’t mean, “did you download it successfully?” That doesn’t mean, “did you upload a one time key?,” which was part of the workflow. What it means is, “what is it doing to impact the pandemic? What is it doing to protect people from coronavirus?” That was not information that the government’s had and from the fall until just now they were continuing to tell people to download this app even when it was at a very new level and a deep level of being broken in 2022.

The language I was using around this was that this was misinformation. Because I think it’s very dangerous for Public Health and Health Canada to be telling people to download this app when its efficacy was unknown. But also, what does it mean for people to think it’s working? What does it mean for people who have downloaded this app to say, “Okay, well, I’ve got this app, it’ll notify me if there’s an issue.”” The government did not describe the change in behavior of this app, particularly in 2022, when the testing capacity was gone. So we had months. Now, have we done research into whether or not people had a false sense of protection from using the app? Not that I see in any of the reports so far. So I think this shows us not only was there a confidence in the government to assert something that they did not have information about at the beginning. And as the information grew, they still didn’t come out and explain with public numbers, what the efficacy was. I’m not saying it’s zero. But what I am saying is we didn’t have information at all.

Just now at the end of this post-when it’s been decommissioned, is there a little bit more data available. So I think from a narrative and trust perspective this stuff is really dangerous for democracy, because it’s not about the tech or did it work or did it not, that the public health agency, during a pandemic in crisis can continue to encourage and repeat a message that does not line up with what was happening in reality and the information they had. That’s deeply disturbing. And that, to me, has not been addressed in any of what I’ve seen in the final reporting so far. So long answer, but that’s sort of where this all is, in terms of trust and messaging issues.

PM: You lay out so many serious concerns in that answer and in describing what actually happened with this app. I want to return to what we’ve been hearing as this app is decommissioned in just a second. But before I get to that, I want to extend what you’re saying with that question. Because what people were told was, you download this app, and it will notify you if you’ve been in contact or if you’ve had an exposure with someone with COVID 19. So that then you can get tested and you can know whether you might have the virus so then you won’t spread it or you can take the health measures that are necessary in order to try to protect yourself. I wonder, did this app then, in promoting it in this way, distract from the real work that needed to be done? Placing a technology and an app in the place of the real work of human contact tracers in the public health system that actually needed to be done in that moment. And then what is the implication of seeing apps and these technologies as a solution without examining that other side of it?

BW: Paris, this question is so important. Let’s imagine that we put the same energy into N95 mask communications. Imagine multimillion dollar launch, comms, endorsements, people out saying, “do this.” If you hold these two things beside each other, in terms of efficacy, impact, all of it, it is deeply, deeply disturbing. Because what we did — and this is why we have to keep thinking about the word experiment — we know, and we knew, throughout the course of this as our knowledge grew, what worked. What we have to do as a society with public health is we have to invest in the things that work as a priority.

If we go back to the beginning — it’s part of why some of this app was so misaligned with the truth on the ground — we had spreads happening in long term care homes, we had them happening in prison, we had them happening at work sites, which by definition, helped us understand, what supports do people need? They need to be able to stay home, they need to be able to be supported in having personal protective equipment, all of these pieces. Those were not prioritized. And instead, there was this technology introduced. And I think the reason this is devastating is because the public health communications, it’s difficult. And what we need to know is that we need to be able to have repeatable messages, we need to be clear: What is it? What works? It’s not just one thing. I think we can also agree that the vaccine discourse really got binary in terms of you know, not helping us understand the breadth of what we could be doing to support and help each other. And so to take all those measures that we could have been teaching and learning about together and to fail to assign importance to them and to communications.

To hold that up against the idea that we prioritized or introduced the concept of this app, as something that was so important for us to all do for each other. I mean, that messaging really belonged with a whole bunch of other interventions. And I think what’s really difficult about that is that the governments know to say, “we never said it was a silver bullet. It’s one thing amongst others. It’s not a panacea.” Of course, it was framed that way. But really, it’s distracting when we know we shouldn’t be experimenting — and I know people want to, I understand the idea, maybe there’s something here that might work. And this gets into ethics questions that we don’t have good public capacity to get into, you get into some really difficult discussions that I don’t think we’re particularly well positioned to have about these things. But when you work with policy, you have to understand trade offs, you really have to understand there’s only so many things you can do so many messages you can hold at once.

So putting this up to this level, the timeline, you know, you think about what we could have done and should have done differently. It really had an impact on how we understood what was happening. Not everybody and a lot of people knew right away, I think the public has a pretty solid instinct on some of this where the lessons that the government saying they learned from this or different from what I think the public might say they’ve learned from seeing this app happen. But yeah, those are some things that come to mind when you raise this because we need to open up to that level of conversation, which is to say, you know, what if we have a number of priority messages that we should be sharing, where does this fit in that scheme, and what are the harms of maybe going down this road when we haven’t put full investment into the other pieces? So it’s really important point really important.

PM: I completely agree. We’ve had this decommissioning now on June 17th. As we record this, it’s just the day after, so there hasn’t been too much processing time. But what are you seeing in the statements from Health Canada and in the final Advisory Council report that is standing out to you in terms of how the app is being framed, and how they are trying to have us think about the impact of it?

BW: The framing of the Advisory Council’s final report is really that this is a good idea. It’s good we did it, and then here are the minor tweaks and adjustments. I think that’s, just as a starting point, an incredibly incorrect read because now that we have efficacy information, which was also available prior to the pandemic. I mean, there were other applications that have been used in other countries and other situations. To me, this high level frame, you come out of this, and you own it, and you say, “this didn’t work.” So you can see that the capacity for the government to decommission it is there, but on terms that actually tell a different story than the one that we really should be talking about, which is, this didn’t work, these are some of the reasons why. So let’s look at those.

It’s important that we make space for all opinions here around like, let’s say someone really feels this is something that we should do in the future. Let’s look at the pieces of it that on a technical level didn’t work. But it’s just as important for us in our society and our culture, to hold space for the idea that these types of things don’t belong in our public health responses in the future. And I think given what we have needed to learn about public health, it is a collective undertaking. If there is one message you hear over and over from across the board in public health, this is a collective undertaking. And if we hold that truth, which is very important, against the kind of technology that this is, which is an individualistic on-your-phone app, I think it’s reasonable that we should say: this kind of tech does not align with the general precepts of public health. It just doesn’t. It doesn’t mean that we don’t look at different technologies. But it is reasonable to me in 2022, to say, “these types of things do not work, here are a lot of reasons why.” If we want to consider mitigating them and thinking about how we might look at this discussion, the next time it rolls around, that’s fine. But I just want to say as a general frame, this report does not say, “this doesn’t work. We are not going to proceed with more of these in the future,” which if I would see that high level lessons learned, that’s when my trust starts to increase in government.

What this report is, is a backfilling, it’s a way to tell a story that makes it okay that this was done. It points out bits and pieces that enable it to be done again in the future and strengthened. But it does not put on the table that this is not what we should be doing. So we can get mired in a lot of the details, but I think the fundamental frame is we as a society and a culture need to be at a point in time where not doing technology is an option. It really is, and that’s not an anti-technology stance or feeling that way doesn’t mean you’re against technology. I think what it really does is it respects the idea of context. So what this means is: this is context, this was a crisis, we have limited resources, how are we going to use them? That’s a very democratic policy understanding.

I just have one more thing I want to say about what I’ve noted in this report, and this points us back to British Columbia and Alberta, both were provinces that did not pick up on this app. Alberta went its own way and did an app that was different, but British Columbia didn’t. Part of the rationale that came out over time was they didn’t want to burden their public health teams with this additional work, and this is noted in these reports. It struck me that I wanted to say that I am happy, the public health care sort of communities within say, the province of Ontario, even though it was against doing what was supposed to happen to support the app, that they prioritized the work that they knew they had to do first and foremost. And I think that helps us remember who really is at the heart of making things work or not. It’s us; it’s us as workers, and it’s us as residents and people who are in this crisis together. And that stuck out to me too, was that this was burdening a set of workers in public health with something that wasn’t functioning. And I think that’s important, and I don’t want us to miss it. Because there’s a lot of other stuff going on in these reports, as we do this debrief and think about it for lessons learned.

But it really stood out to me that there was a province that knew “no, we have enough going on, we’re not adding this.” And I think that’s interesting that there was that authority to say “no, we’re not participating,” and that’s functioning in Canada. That’s interesting to me. But also that the public health workers, they should be the ones, if they don’t feel vested in making this function, which was happening from the fall of 2020; they were not fully vested in solving some of the technical problems. That’s a major flag. They know. So I think that was sticking out to me as I was reading the report. It’s easy to get mired in the numbers and the downloads, and what did we do? And what happened? And is it our fault, because not enough people participated, which is a little bit of the narrative that gets pushed, when it says, “oh, we should enhance communications next time around.” But let’s never forget the people at the heart of the crisis response and their relationship to these technologies. And I think there’s a big message in that one, too.

PM: Absolutely. You won’t find any debate on this podcast that there might be times when we shouldn’t be looking to tech solutions when human solutions work better. And just to pick up on what you’re saying there by contrasting the provinces. One of the things that stood out to me as I think about my experience during the pandemic, is that I was in Newfoundland and Labrador, which was part of a group of provinces that took a different approach in that, yes, we did have the COVID Alert app, but we shut down our borders for much of the early part of the pandemic in order to stop the virus from being able to come in.

I don’t know what the media was like and what the discussion was like so much in the media in Ontario and Quebec on like a more local level, I only followed the national part of that. But over here, it was very well recognized that the human contract tracers were essential to keeping us safe, and to finding and identifying those cases that did breach the border restrictions, and then ensuring those people isolated so that we continue to have very few cases in the community. So when I was thinking about the app and the COVID Alert messaging, what always came back to me is even though the provincial government said, “we have this app” and it’s signed on with the federal government, the messaging was that the human contact tracers were just so essential to our ability to keep the virus from infecting very many people. Up until the Delta wave, we really had very few cases in the province. I think it was important that that recognition was there and I don’t know if it existed the same way outside of the few provinces in the Atlantic part of the country.

BW: So I’m in Toronto; Ontario was the first province to launch the app. In Ontario, there was a conversation at the beginning around, what does it mean to receive a notification on your phone, instead of getting a phone call from a person? It’s important for us to think about the efficacy, firstly, as you’ve been mentioning here, in terms manual contact tracing, and this being something that couldn’t perform the same because of the privacy and all of the safeguards that were built into this app. It also made it so you couldn’t replicate what this was based on, which is people knowing who they were in contact with, and being able to get in touch with them.

But when we think about beyond the efficacy and this being less so, what it means to get those notifications when you’re by yourself in a crisis. And I keep coming back to this, of this emotional place that we’ve been in, continue to be in — exhausted, grieving, so many things — and the idea that we should be supplanting or switching how we work together and support each other in a really hard moment. That was the piece of this looking at prior process, and then looking at what we’re trying to be pointed toward. So not just the reduction in the labor and the quality, but the experience of that, and what it means to have no one hold your hand when you’re getting scary news that may then have these knock on effects where you need a wraparound of someone to tell you “okay, here’s what you do on this front. Here’s the kind of supports you can have over here. Oh, there’s children in your home. Here’s the thing about this.” You think about what it means to be supported by another person who’s trained to do that work. It’s so important.

So I think losing that piece of it, which is different and related to efficacy, is really dangerous, and I think the lack of what happened in Ontario at least, understanding — when we talked about research that wasn’t done — how many people stressed our testing capacity because they got those notifications, when this testing capacity was a requirement at the beginning. What did it mean to flood the province of Ontario with people who were getting these notifications, which were based on science that had already evolved from the time it was understood what distancing, vaccines masks, transmissions… like, there were so many things that had shifted, and it’s sending these notifications out.

Firstly, there’s a human impact when you get that notification. But on a systems level, what did it mean that you had people who were taking those tests that for the most part might not have needed to take those tests? And who are those people that we’re getting that notification, versus there’s a large population, we know the history of what’s happened in Ontario and across Canada. We know this is not an equitable situation of who’s suffering the most from COVID. So you see how every time you open a little door, and look at this shift, or addition, or evolution of how we provide services, it just has myriad negative impacts for those that were already previously not in a position of strength to get good community support.

Maybe the story that’s difficult to tell here is what isn’t written down, what wasn’t researched, what is unknown, because when the government frames everything from how contact tracing would now be, I think they would try to say, “Oh, we’re not trying to change it entirely. We’re just trying to supplement it.” So when they say things like that, it’s like, “no, hold on, wait,” there’s a whole bunch of questions we’re not asking because now we’re following down that road.

The last thing I want to say on this is something about the influence and impact of industry of Innovation, Science and Economic Development Canada. The people involved in pushing this were really pushing it from an economic development perspective. And so while we know our whole response to the pandemic has been trying to keep the economy going, no matter the costs, we also need to add this into that frame, which is this appeared on the scene because Google and Apple had an interest in showing up and saying, “Hey, we’re in a lot of people’s phones. What do we have to do here? How do we participate?” That didn’t come from any of us. That didn’t come from a history of working.

Then you’ve got an Economic Development Council, that’s who oversaw our advisory council. It’s, again, an easy thing for the government to skip over because you’ve got Health Canada talking, but whose acting? Where did this come from? What does it mean that Shopify is they’re saying, “Hey, want some code?” What does that mean for procurement? We just have people donate things, and then because they’re free, we’re going to use them for an experiment in a middle of a pandemic? Honestly, some of these pieces they don’t snap into each other very easily, but it doesn’t feel right not to acknowledge that the pressure to do this, and the ongoing pressure to do this, again, is coming from industry.

Of course, those within public health and others have an open mind to everything. It’s not to say good things don’t come out of industry, that’s not the message. But really, we need to go back to foundational basics here on public health response. And make sure we’re starting from there, including how we do testing, what our capacity is, how we manage it, how we’re doing contact tracing. Paris, we don’t have data anymore about what’s going on, just at all, if we think about what we’ve wiped out. Now we’re saying, but let’s do more of this anonymous, electronic notification alerts? It’s really difficult to hold these things together in any way that’s coherent.

PM: There are so many good points there, but what you’re saying about this app, and this approach, being driven by industry is really important because it plays into a larger question that is beyond this conversation about how technology and tech solutions in healthcare were pushed a lot during the pandemic. And I think that is going to have repercussions that we’re going to have to deal with post-pandemic, that our governments certainly are not ready to seriously grapple with, especially as there are issues with health care funding, and there are pressures to privatize, and all of these kinds of things that we’re dealing with. But those go beyond this conversation, so I don’t want us to get wrapped up in those even though I know we could talk about it for ages.

We’ve been talking about how Health Canada and how the Advisory Council have framed the app now as it’s being decommissioned. In your work, you’ve been saying that what we really need is a public post-mortem of the app that really dives into the impacts that it has had. What should the focus of that post-mortem look like? And what is the risk if it doesn’t happen?

BW: We could think about a policy framework that is based on a lifecycle of a technology. It would be so helpful for us to think about this framework well beyond this public health intervention in technology, and just generally in government technology, in public technology, because it helps us look at what happens with the product, which is: you think about it, you design it, you launch it, you have to maintain it, and often you decommission or sunset it. This is very normal. So you cannot just set a policy to launch something. Because once it’s launched, you got a whole lot of other operational things that you need to keep on top of.

I’m introducing that as the concept that if we think about policy as a lifecycle, because technology does not just go away, we know this, right? It’s important to stop and say that good intentions of, “well, let’s just try,” needs to also have, “let’s just try and plan for if it doesn’t work.” So, at a very high level, thinking about a lifecycle and thinking about those public benchmarks, which are important. There are probably two or three really critical components of what the framework you need to have in place looks like before you launch an app like this.

The first thing has a lot to do with, do we do this or not? I know it was going fast. I know people wanted to try something I know they were hopeful. That’s all fine. But you still cannot be ahistorical. You have to say, “okay, hold on. What’s happened so far? These are the potential risks. Let’s look at the trade offs.” And have a very clear way to have that conversation. Because instead of that, what happened with this app was “as long as it’s privacy preserving, let’s go.” That cannot be repeated. Because efficacy was not discussed. And efficacy absolutely has to be there. Efficacy and privacy have a relationship to each other, particularly if we’re going to talk about public health, where, and I need to be very clear in this: I don’t believe this type of an approach in any circumstance is a good idea, these personalized apps. That’s me; one person; really, who cares about that.

So then let’s say, if you’re gonna get into the conversations about these apps, you have to say, “well look, for this to actually work, your privacy approach may not be the one that you would do again, you may need to have more information.” Then when you start to get into the realities of how this may or may not work, you can have a proper trade-offs discussion. So let’s just say, step one here, you have to have a, “Do we do it? Do we not?” And that includes, “Do we build it? Do we buy it? How do we manage the procurement?” Because we need to hold on to accountability. We cannot just ingest technologies because they were donated to us. We completely skipped a gating step of procurement, which in an emergency, gets worse. We’ve seen a lot of stories about what happens in an emergency for tendering.

So step one — big box around it — is the “Do we do this? Do we not?” analysis. Not, “If it’s privacy preserving, we’re fine.” So let’s never replicate that, “if it’s privacy preserving, we’re fine.” It’s a factor in a bigger matrix, right? So that is step one of this lifecycle. Then, before you get out of there, you say, “under what conditions would we pull it down? How do we know it’s working? And how do we…” — and this is critical, this is sort of the “what’s the plan for post launch?” — you have to publish your benchmarks for when you will shut it down, or change it or adapt it before you launch it. Because if you don’t do it before you launch it, you will always have a story to tell as to why you should just keep trying or changing or evolving or adapting. This is called path dependency.

It’s very difficult if you don’t set that up at the beginning to stick to it. So that’s a really important part of the first thing, which is establishing — and I know it is hard, please don’t think I’m saying it’s easy to say — the numbers. You have to though. What does it mean when it’s working? What do we do if it’s not? How do we pull it down? How do we adapt it? What we saw with this — and this is all before we’ve launched; I’ve got two more shorter pieces.

Another thing that we’ve seen in these reports, there were two adaptations the government’s wanted to do: One of them was to add QR codes, which we saw in other countries, which would say, if you go to a cafe or you go to a restaurant, rather than people copying your information down, that you could scan a QR code. That was something that was on the table. That didn’t happen, but they were trying to do it. The question there would have been well, what if it’s only voluntary? So that would have made it difficult. The other thing they were looking into was wearables, which was to say, “how can we hand out lanyards, bracelets, low cost options? If people don’t have a cell phone.” And there’s examples of it. They talked about using notification lanyards, Air Canada did a pilot, and all of this was happening. So they were really taking this down another track, which even gets into different hardware, like there’s a whole other market with wearables. I share those two examples, because there was no path to figure out if those were reasonable things to be adjusting toward. There was no governance documentation for that.

So that’s the big chunk of it is the work you do before you launch something, it has to say, “do we do this? Do we not? What are the trade offs?” It cannot be only focused on privacy, and it has to lay out that lifecycle of, how do we make decisions about shutting it down and maintaining it? What do we do when the public health guidance changes? What happens when people are vaccinated? What happens when masks are introduced? There was no governance around any of those changes. So a big chunk of the work has to happen before it’s launched.

Following launch, should the decision be made to launch something, you get into maintenance mode, and tracking. This is where it is so critical to have this be public: public benchmarks, public publishing of all of the things. Not the data that confused us, which is what happened this time. The numbers we were given were how many people downloaded the app and how many people uploaded a one time key. Neither of those numbers tell us what the app did for our COVID response. They just say whether people downloaded tech. I feel silly looking back at it that I didn’t pop to the like, “wait a second, this doesn’t even tell us anything.” So, just to say, it’s very easy for us to be given data and to feel like we’re following along. But what we were given didn’t help us at all understand efficacy.

So, in maintenance mode, critical that we know what those benchmarks were before launch so that we can follow along and then say, “hey, it’s not working. Hey, all of us are in this together: government, public health. We see we wanted to try it. We see it’s not working. Pull it down.” That has to be public. We have these privacy commissioners, advisory councils. They were supposedly looking at information we weren’t seeing, then there was an audit done that’s still not public from Health Canada on if it was working or not. So in the middle there is critical publishing benchmarks, holding accountable on whether it’s working or not, paths for adaptation if there’s gonna be changes — how do you engage people? How do you have a consent form model for that?

And then this real third chunk around the shutdown process, and really messaging that clearly so that the government knows it’s okay to shut it down. I’m glad to end on that note, because that did happen here. We have very capable people working in technology in the government. This was a difficult thing to watch, knowing that there were really good people who — as technologists — would know, this thing should not be here anymore. So at least it’s this proof, “hey, we can decommission something.” It can happen. The world doesn’t fall apart, because we said we’d try something and it failed, no problem. And technically, we can support that. But politically, that’s where we need to have the expectation that that can happen. And I think that held up this being decommissioned for a very long time: the political consequence, which is so different than the technical.

Those are some key components of what we would need as a framework, from before we would do anything next time. And people will have a good thing to say back here, which is we were going fast. That’s fine. But this is important enough that let’s spend the time on that in between, not on ratcheting up how to do the same thing again. So that’s what we need for next time as a starting point. There’s lots of other things I’m sure people can add and expand.

The only other thing which is separate is to do a proper post-mortem because, just at a glance, a day after seeing what I’ve seen so far, this story is not getting at what actually happened in the ways that we need to think about efficacy and taking this stuff seriously. The government is sticking with his story from the beginning right to the end. And that is not helpful for us to work in real terms in public health with real information. So this so far looks like a political undertaking of a lessons learned. I would suggest we do a proper public post-mortem, driven by the public, and sharing lessons from other places in the world, because some of these things in here are true: Yes, the provinces needed to be held accountable. Yes, there were problems there. But you could have known those things without an app. We know the provinces are in charge of health care delivery. There’s no surprises in here that we shouldn’t be working on always anyway.

So that’s the crux of what should we try to have in place, but also a real public post-mortem, because what we’re gonna get from the government is not going to be expansive, and it’s not going to get into those issues that we touched on, which aren’t anywhere. They’re not written down, because they don’t track with what the rhetoric is here: that this is a good thing, we just need to try a bit harder next time. Absolutely not. I’m not saying that it shouldn’t be on the table. But if we want to have a proper conversation about it, we have to be able to say, “this didn’t work.” So one track is not doing these kinds of technologies again. And if you want to say,” we want to try it again,” then that’s when we go down that road of, well, what do we put in front? What’s the framework? What’s the maintenance? And what’s the shutdown plan?

PM: Those are such essential points that you’ve laid out for us to actually get an understanding of how these technologies and these technological experiments, especially when coming from government, should be approached and should be understood. Your final point about the politics of it leads me into my final question that broadens us out from the COVID Alert discussion to a broader look at how the government approaches technology. What does this whole experiment, this whole saga, tell us about tech governance in Canada, and how the government approaches technology?

BW: A couple of things. Firstly, what we know is that government accountability in Canada — we have Westminster accountability — which means you have to find someone who’s in charge of the decisions, so that they can be held accountable. And what we also know, from talking to different public servants over the course of the COVID Alert experience, but more broadly, is that we don’t have a comfort in saying something didn’t work politically, which is why it’s such a big deal that this app was decommissioned.

Because in long historical terms, what you need to do with technology is fundamentally misaligned with Westminster accountabilities, which is really deep and complicated. And I don’t mean it like philosophically deep and complicated. I mean, in some really gnarly public administration terms, what we know about technology and what we know about democratic accountability. They do not map to each other; they don’t. We have to be honest about that. Because I had some public servants say, in the last few months “of course, they’re not going to pull it down. They can’t admit failure; like they’re not incentivized to acknowledge what has happened.” And yet they did. So that’s encouraging. But also there’s an entire public administration, democracy, and government situation here, which is when you launch something, you plan one way, all the accountabilities go a certain way, there’s a federal-provincial piece to it.

What this says about our government to me with technology stuff is ideologically it is pro-technology, it is pro-technology as an economy. It is a way that it wants to be seen. I think this entire app, you could look at it as a public relations campaign to say, “Hey, look at us, we’re doing new, innovative things,” which captures imaginations around the world. This is a long, big problem. But I think the way that it intersects with actually holding governments accountable is something that we need to like hive off and get out of the technical privacy conversation and get into the like, “no, there’s actually a misalignment here.” If you’re going to be pro-technology, you’re never going to be able to align with what good technology standards look like. So we have to pick what we’re doing there.

Secondly, just more broadly, the idea that you can perform with technology, where you can say, “well, we’re doing this app, and it’s good for you and to protect you and your family,” or we’ve got ArriveCAN, which is this mandatory app, which is a big problem and different than the COVID Alert one, which was voluntary, which was a good part of what was happening with COVID Alert. A mandatory app at the border, and that we are somehow trying to normalize the idea that major events like travel or entry and exit to a country, much like public health response in a pandemic, that engaging with an app on your phone is an appropriate way to manage such an interaction. We have to keep an eye on that, because this is the normalization, and creating norms around things that are not actually beneficial to us. They’re not, they’re not. If we don’t challenge that, you can see how the ratchet happens.

We can see the enthusiasm for technology, we can see it being applied in different ways and trying just to keep ratcheting it up and normalizing. If we think about how we don’t have a place to challenge these things in terms other than go with it, or you’re against the technology. It’s like no, no, no, we have ways to invest in people, and we have ways to invest in our services to pull off the same outcomes, in terms of like coming in and out of a country or supporting people during a public health crisis. They do not require apps, they just don’t.

If I think about this too long, it’s pretty dark, this stuff isn’t good. It’s just not good technology, even if it’s deployed properly or accurately, or it functions. We need to figure out how to move the priority investments into what we know works. But that’s a long fight. People have been trying to fight for that in so many different ways for so long, and we just have to realize that we need the shared language to challenge this without getting mired in the privacy or efficacy or whatever else.

Even if you think these things are good and they work, that’s not the only approach to our society and culture. It’s like, how do we protect the space to say — even if they do work — “we don’t want that to be the way that this country operates. We just don’t want it.” It’s a choice. And we need to figure out how we continually engage both sides of it, because I just feel like with a lot of the tech stuff, if you’re not into it, it’s almost like, “Well, it’s a normative good, how could you not want to do X, Y, Z?” So many of us experience this, but closing that gap continues to be the long work. But I think that’s it.

PM: I’m happy that you closed with that point, because I think it really gets to something that this podcast is all about and that this series is about and looking at technology in Canada, and how we approach technology and how the government thinks about technology. It’s a really essential point, and I’m really happy that you made it. Bianca, great to talk to you as always, and to discuss such an important issue that didn’t get the attention that it deserves because we were in this public health crisis where we just needed to take on whatever might work. Now we have the opportunity to at least look back at that and learn the lessons, and I think the work that you’re doing in making us focus on the COVID Alert app and what happened is really key for that, so thank you so much for taking the time.

BW: Thank you for that. Thanks so much for having me by. It’s great to talk to you as always.