Digital sovereignty: the case of contact tracing apps

As far as the news cycle goes, TikTok has moved on from dance crazes to national security. Last month, the UK joined the EU, US and Canada in banning the Chinese-owned platform from government-issued devices.

TikTok is one example of a political tug of war being fought among and between governments and big tech, with citizens often caught in the middle. Underneath the noise, what most of these arguments come down to is the issue of digital sovereignty.

What is digital sovereignty?

The past two decades have witnessed the development of companies with unprecedented global reach over both government business and our daily lives. These giants - Amazon, Apple, Google, Huawei, Alibaba, and others - have delivered convenience and value for billions of people. However, the benefits have come with consequences.

The success of technology firms has translated into market dominance on a global scale, sometimes towards the point of monopoly power. Our ability as citizens and individuals to choose has been eroded.

Yet increasingly, this is not just a challenge for individuals. The power and behaviour of technology companies is profoundly challenging governments’ ability to choose freely too. Aligning the interests of the state, the personal agency of individual citizens, and the global technology market, is one of the biggest governance questions of our age.

National governments are coming to realise that in many areas of state activity, their freedom to act is constrained by the choices of these private companies, from their decisions on telecommunications infrastructure to public service design to data storage. Powerful companies creating these constraints are often based outside their borders.

Responding to this means intentionally deciding what level of sovereignty a national government wants to assert over the digital domain, and working out how - or whether - it can do so.

So while there is no single agreed definition, digital sovereignty is generally taken to mean the power and authority of a national government to make free choices about decisions affecting citizens and businesses within the digital domain.

Digitally sovereign governments are those that are able to make technology choices which follow the legal and political frameworks of their own jurisdiction. The nature of the debate around digital sovereignty is the extent and type of interventions a government chooses to make in order to protect (or win back) this sovereignty from global technology companies.

The case of government contact tracing apps during the pandemic brought the debate around digital sovereignty into sharp reality.

Contact tracing: the question of user privacy

As part of their responses to Covid-19, many governments elected to build smartphone apps to support their contact tracing efforts and control the spread of the disease. The development involved working with Google and Apple to devise an app which used Bluetooth technology to alert users if they had been in close contact with a confirmed case of Covid-19.

Contact-tracing apps were seen as an important tool for containing localised outbreaks, and easing countries out of lockdown measures. However, a major drawback of the apps was their implications for privacy.

These apps were deliberately designed as a means to collect and analyse detailed data about the spread of the infection through a population, individual by individual. Collection of so much personal data by a government represented a huge privacy challenge.

Faced with government pressure, Google and Apple had a difficult choice. To protect their commercial interests, they needed to maintain the trust of their users. They did not wish to be complicit in the potential misuse of citizens’ personal data using these apps, nor did they wish to be the arbiter of which governments had sufficiently ‘clean’ human rights records to be trusted with this data.

The new muscle of tech giants

Google and Apple, normally fierce competitors, met behind closed doors to agree on a united position. Both companies decided that no government would be allowed access to sensitive contact information, and no personal data would be allowed to reach government servers. They allowed governments to each build just one contact-tracing app, which could make use of a new Google and Apple feature (an API) that would itself alert others who might be at risk, without routing the information through government servers or allowing them to be stored in a single database.

This amounted to a decentralised approach, designed primarily to protect the privacy of individual users. However, it meant that governments would struggle to align the alerts triggered by their app with their wider manual contact-tracing and testing services.

The tech companies also retained the ability to disable the system at a time of their own choosing.

Attempts at government resistance

Some governments launched contact-tracing apps that adhered to the approach mandated by the two tech giants.

However, others believed that this decentralised position would prevent them from building an app that delivered the functionality they needed. The UK was one of the governments which tried to circumvent Google and Apple's strict controls to develop their own centralised NHS England Covid-19 app.

But by June 2020, after numerous delays to the roll-out and an estimated £4.8 million pounds spent on its development, the UK government had U-turned. They had ditched their decentralised app and reverted to a solution compatible with the position mandated by Google and Apple.

The result was millions of pounds wasted and precious months lost in developing the technology to protect users from the spread of Covid-19.

The emerging perspective: commercial versus democratic

The story of England's contact tracing app represents a significant milestone in the debate over digital sovereignty because it demonstrated the new ability of technology companies to flex real power over choices that have long been the domain of elected politicians. The UK example - and similar stories in Italy and Germany - proved that, in this case, it was impractical and ultimately futile for governments to try and exert digital sovereignty over big tech.

By mandating specific rules on data access and use for contact tracing apps, Google and Apple effectively made a global public health policy decision that significantly constrained the implementation options open to national governments.

Whether or not it was the ‘correct’ decision - either in terms of public health or privacy policy - is a separate debate. The point is that this decision was made from a commercial perspective, driven by a need to retain the trust of consumers. That’s different from making a decision from a democratic perspective, to retain the trust of citizens.

The power of the technology giants in emerging markets also represents a new and potentially insidious form of colonisation. Many governments are rushing to counteract this by imposing social media regulations or digital taxes, but these can inadvertently damage domestic digital entrepreneurship. Recognising these geopolitical pressures, governments are increasingly alive to the idea that they will have a better long term shot at digital sovereignty if they can strengthen their local digital ecosystems.

Who decides

These patterns are visible in the recent TikTok story, the UK’s Online Harms Bill, and many other big news stories. The more power big tech companies acquire through their vast customer bases, the more inevitable it becomes that they will leverage that power politically. And many governments are struggling to keep pace.

At the most basic level, politics is about deciding who decides. In democracies, we have elected representatives to do that. But in digital democracies, we as citizens now also select decision-makers by buying their technology.

The question of who decides between those two groups doesn’t have an easy answer. Developing a strategy for sovereignty means defining a position on geopolitical alignment, deciding where to cede or establish national digital sovereignty, and pulling levers to make that happen. Governments will need to be on the front foot, or risk being carried along by the tide. We would love to speak to others who are wrestling with these challenges.

To hear more from us on internet-era ways of working in public and private organisations, subscribe to Public Digital's fortnightly newsletter.