A practical guide for COVID-19 app-makers

Stuck at home, perhaps out of work, and confronted by the magnitude of the novel coronavirus pandemic, technologists and programmers around the world desperately want to do something to help get through the crisis.

The result has been a glut of Covid-19 related apps: everything from obscure contact tracing tools, to a huge variety of dashboards tracking the outbreak, to assistants for finding coveted rolls of toilet paper. Though they’re usually well-intentioned, the quality of these apps have been uneven. Some apps that have gotten a lot of press have been the result of mere hours of work—and it shows.

So what’s a programmer to do? There are a lot of people like you, and a lot of you are working on Covid-19-related apps. Some will succeed; others won’t. You’re working during a public health crisis, and your first goal is to improve the situation. Unless you’re doing this to learn new skills, you aren’t merely working on an app, you’re working toward building something that is responsible in its design and ethical in its contribution to the crisis response.

What follows is a practical guide to responsible application design in a time of public health crisis.

It has to be effective

In a time of crisis, there’s a natural human tendency to fall into the trap of: Something must be done; this is something; therefore, we must do it.

If your app isn’t effective, there’s no reason to make it. As the designer, you have to understand not only what you’re doing and why. You also have to understand how the user would know the app is working.

The user of the app needs to be able to use the app to do something meaningful. This is the most important user experience decision you’ll make. Put yourself in the position of the app’s user and ask, “Now what?” and “So what?” a lot. This will help you focus on what it needs.

As a technologist, you have to approach the problem with sufficient humility to consider that the most significant contribution you can make to the public health crisis is nothing at all. If your application is hoovering up the health information of users and doing it in an insecure way, your contribution is a net negative. The first step to success is to have enough humility and understanding of what you are making in order to accurately assess whether your product is useful or perhaps downright harmful.

There’s nothing wrong with writing an app that’s a learning experience, but if you’re going to release it to the world, it should do something meaningful.

Is this for you, or other people?

Before we go into details, let’s consider what to think about before you write a line of code or a requirements document.

Many people are making apps as learning experiences for themselves, which is great. Suppose you want to learn to do data visualization: The Johns Hopkins COVID-19 data is updated every day and is an evocative data set to use.

But if this is an app for a broader public, different considerations apply. The urgency of our crisis forces us to let some things that would be important slide by. Application design comes down to balancing requirements and urgency. In the interest of getting your app to market, your design requirements will not be the same as they would be in a non-emergency. If you’re making an app designed to improve the well-being of individuals trying to survive a pandemic, your chief concerns are the effectiveness of the app and its security.

What kind of app is this?

Is it a dashboard app that displays information? One that helps model information for people’s understanding? An app that provides personal benefit or community benefit? Is it a contact–tracing app? Is it something else entirely?

Deciding this is part of knowing what you are building and defining its scope. A well-defined scope at the outset provides the touchstone for knowing what to do and what not to do. Knowing what not to do, or perhaps more charitably, what you’re going to do later, helps you decide what your app is.

It has to be secure and private

Security and privacy issues are the nastiest quality problems there are. If your app is being used by a lot of people and it is exploitable, then all those people will be exploited. The jokes about being infected write themselves.

Beyond the code security of your app, your security model needs to include the fact that people will abuse the app or protocols for disinformation, political ends, or to troll other users.

Privacy considerations are also important, because this crisis will eventually end. And when it does the data released to combat the crisis can’t be recalled. Places people have been, who they’ve met, and their COVID-19 infection status can have consequences later for people, neighborhoods, and groups. Privacy guidelines from civil society groups, the American Civil Liberties Union, and the Chaos Computing Club can help developers think through these issues.

That this is an emergency is not a reason to cut corners. Keep in mind that there are bad actors out there as well. Privacy and security failures are the kind that could get your app cited by future historians as examples of what happens when people don’t think ahead.

Different types of apps have different ethical considerations. Dashboards don’t have the privacy concerns that an interactive app has. Yet how they organize data has effects. Organizing data by state leads to imbalances by comparing California with New Hampshire or Wyoming. Neighborhood workers in San Francisco are compensating for data being organized by ZIP code, as that doesn’t map well to the neighborhoods they live in.

Apps that collect data have privacy concerns. If communities are frightened the information might be used against them, be they immigrants or the religious, they might balk or lie, and these might ruin the desired public health outcome.

How many people have to have it?

How wide does your adoption have to be to be useful? There are many useful things you can do that are statistical, and others that require a strong network effect before they work well. Adoption is hard and takes time. The many contact tracing efforts each have this issue, and it’s one of the biggest reasons that Apple and Google have teamed up for a common API to tackle contact tracing.

You’re testing it, right?

Yes, the crisis means we’re in a hurry. You’re feeling the same pressure we all are, that your app really needed to be done yesterday. Yet this is why testing is even more important than in non-crisis situations. The last thing you want is a set of embarrassing bugs showing up once people start using it. The most likely result of a buggy app is that people won’t use it. Or you might end up with the sort of attention that Zoom has had.

Who is your audience?

Apps aimed at helping individuals get through the crisis and apps for epidemiologists and policymakers are very different beasts. In some ways, it’s easier to make an app for the latter group, because you can use trend and aggregate data. Building an app that is personally valuable for an individual is a different app completely.

Each is a good thing on its own, but know which you’re doing. I love this Genomic dashboard and visualization. I’m not a virologist, so I barely understand its many colorful branches yet it’s helped me learn. This dashboard shows where cases of COVID-19 are growing or shrinking. It does so simply and is understandable for just about anyone.

Look at what other people are doing

Some of our colleagues have quipped that there’s a 30 percent growth per day in COVID-19 apps. Any time you want to do an app, seeing what else is out there is a good idea. It’s more important to look at what other people are doing when there are a lot of apps in the same space. If there’s an app to help people find toilet paper in DC and a similar app being done in Texas you might want to think of something else to do.

This list of thirty APIs to help track COVID-19 gives a good idea of some of the APIs that have already been built.

Moreover, you might be inspired by seeing something that is almost what you would want yourself. Of course, looking at other work also gives good examples to learn from as well as examples and what to avoid.

It has to be accurate (within bounds)

There will be false positives (just consider the recent uproar over serology tests). There will be false negatives. You have to deal with them, and how you deal with them may mean the difference between success and failure of your app. False positives just scare people. False negatives mean information was lost.

Where to go from here?

Full Speed Ahead. You read these considerations and you’re ready to go. If you’re using this as an opportunity to learn, or your idea is unique and innovative, these cautions might have given you energy and enthusiasm. Go for it!

You’ve reconsidered. Larry David was not wrong when he suggested staying home and binge-watching. Writing a COVID-19 app isn’t quite as ubiquitous as having your own podcast, but research tells you that lots of people have the same brilliant idea you do. Maybe the answer is to riff on this article and start a podcast about different COVID-19 apps. Heck, I’d subscribe or even be a guest. The world needs intelligent critics as much as it needs products, especially in a crowded space.

Join forces with someone else. You saw something that was good but could be better, and you know just how to make it better. Perhaps you’ve realized your security is lacking and you need a partner that can help you think your safety concerns. A number of groups working on one thing or another are actively asking for people to volunteer to help.

All of these options are viable and a better way to spend your days.

Jon Callas is a senior technology fellow at the American Civil Liberties Union. A cryptographer and software engineer, he previously worked at Apple, where he helped design the encryption system to protect data stored on a Mac.

Apple and Google provide financial support to the Brookings Institution, a nonprofit organization devoted to rigorous, independent, in-depth public policy research.