Over the summer, as Kansas was seeing a rise in COVID-19 cases, its state university was plotting a way to keep transmission down on campus. While the majority of the University of Kansas was still locked down, its administrators decided to open up labs and research buildings, the contents of which could not be accessed online, to 1,000 staff and researchers.
To open these buildings safely, the university worked with a nonprofit called CVKey Project to pilot a symptom-checking app among a small group of staff that needed to access research archives and laboratories. The app would review symptoms and either clear users to go into school or direct them to stay home and contact a health professional for further guidance. Now, the University of Kansas is preparing to roll out the CVKey app to its student population of nearly 30,000 for entry into 266 buildings across campus.
Unlike many symptom-checking apps, CVKey has roots in Silicon Valley. It was founded by Brian McClendon, the cocreator of the technology that would become Google Earth. While a VP at Google, he worked on Google Maps, Google Earth, and Google Street View for nearly 11 years before leaving to become Uber’s VP of Maps in 2015. When the coronavirus hit, McClendon launched CVKey Project to build technology for curbing COVID-19 transmission.
“I’m deeply concerned about the economic impact of COVID, and ‘reopening responsibly’ is a critical part of that,” McClendon says. “What can I do [in software] to help reopening be more successful?”
He’s now implementing that technology at his alma mater, the University of Kansas, where he holds a teaching position. But in designing and launching his first public health product, he’s had to contend with Silicon Valley’s history of data siphoning that has fostered a public paranoia about surveillance technology.
The app, created with input from a brain trust that includes former Health and Human Services Secretary Kathleen Sebelius, asks the user if they’ve recently tested positive for COVID-19, come into contact with someone who has, or been in proximity to a COVID-19 outbreak. It then offers up a list of symptoms and asks if the user has experienced any of them. If a person says yes to even one of those symptoms—such as a headache—the app tells them to see a healthcare provider and does not generate the QR code that would give them entry to school buildings.
To clear their health status and get a new QR code, students and teachers will have to visit the school’s Watkins Health Center. Still, the app is largely an honor system. The school is requiring students to use it in some form. If they don’t want to use their phone, they can use a paper checklist of symptoms and get a printed QR code from the school’s healthcare staff.
In the pilot phase, users had to scan their code with an attendant at the door to the building they were trying to enter. But paying a person to stand at the door for every building all day was expensive, so CVKey has since installed kiosks. However, the attendant provided an added layer of pressure because they could stop people and remind them to scan their code. By comparison, the kiosks cannot stop a person from entering or even catch a person who forgot to scan. In addition, most of the CVKey kiosks are actually located inside buildings, and the school employs a separate key card system that lets student swipe into buildings. McClendon is hoping that students themselves will act as enforcement and speak up when they see someone glide by without checking in.
“Peers help you do the right thing, because you have to scan in and your peers are scanning in themselves and will know when you’re not doing that,” says McClendon. He adds that the purpose of the app is really to get people to self-evaluate every day. There are also protections in place to guard against people who try to use an old QR code or one generated for someone else. The codes expire and are replaced with new ones at a frequent rate, McClendon says.
Since this app is largely a symptom checker, it will not catch asymptomatic cases, which the CDC estimates are 40% of COVID-19 infections. For that reason, the University of Kansas is requiring students to wear masks, asking them to remain six feet apart, and putting hand sanitizer dispensers in hallways. Students must get tested before arriving on campus. The Watkins Health Center will also offer ongoing COVID-19 testing services. For contact tracing new cases, the center is working with the local public health department.
In order for this program to work, it needs students and teachers to use it. But how many students will actively participate is an open question. Students at other universities have rejected similar mandated programs. Many Americans, students included, are concerned about how these apps work and what kind of data they’re collecting and transmitting. Pew surveys from last year reveal that 72% of Americans believe that much of what they do online is being tracked by companies, and 79% are concerned about how the government and corporations use their data. Now, as companies and communities are working to track COVID-19 cases, there is skepticism from the general public over how effective any of these efforts will be. A more recent Pew study showed that six in 10 Americans think cellphone data won’t help curb COVID-19 transmission, and half of the respondents aren’t even sure if using such data is ethical.
McClendon is keenly aware of this attitude. He says he thinks it’s okay for companies, such as his former employer Google, to provide services in exchange for personal data, so long as they keep that data secure. “Why everybody’s legitimately paranoid is that a bunch of companies share your data,” he says. “They claim they anonymize it, they claim that you can’t be identified, but it’s been proven again and again, that when one company shares their user data with another company, that company can do all sorts of nefarious things with it, and you can’t stop them.” He also thinks the Equifax hack, in which 143 million people’s most personal details were stolen, has added to people’s cynicism.
To build trust with users, the CVKey app does not collect any data. The app doesn’t store symptom information, only a health status. The app cannot be used for contact tracing. It doesn’t access a phone’s GPS information or use Bluetooth to share information between devices. The kiosks also don’t store data. At the Health Center, administrators are able to send out safety plans through the app and other communications responding to a developing situation, such as a new case or outbreak. They can also see the number of scans performed daily at each building.
McClendon says when he spoke to the University of Kansas’s student body president, all of his questions were around privacy and security. He says the app is designed specifically to defuse these concerns, but he is also being transparent about how it works. Gaining student trust will be important especially as the app evolves to incorporate other functions. For example, McClendon’s team is working on giving kiosks the ability to scan faces and check for masks.
“I think in general for all campuses, KU included, to be able to go back and stay open, the spread of the disease needs to be kept low,” he says. Getting students to slowly trust an app enough to engage with it every day to check for symptoms can pave the way for even more robust public health efforts at schools, he says.
“This combined with masks, combined with contact tracing, combined with more testing—if you do all of it, I think there’s a hope that we can reopen responsibly.”