Introduction

Technology giveth and technology taketh. This is one of the many paradoxes of human relationships with non-human objects. It applies both in good and in bad times, and the beginning of the COVID-19 pandemic was no exception to this techno-paradox. Modern technology—for example, in the form of airplanes facilitating international travel—enabled the SARS-CoV-2 virus to spread much more rapidly across the world when compared to plagues in past centuries.Footnote 1 Modern technologies also came to the foreground in responses to the COVID-19 pandemic, most notably in the rapid development of novel vaccines. Equally prominent in pandemic responses were the waves of information communication technologies (ICTs) rolled out to mitigate the spread of SARS-CoV-2 through personal location data collected via mobile phone networks, Bluetooth technologies, and satellite navigation systems (e.g., GPS, Galileo). The use of these technologies led to several waves of smartphone applications (‘apps’) bringing together these and various other existing technologies, such as mobile network signals.

Initially, smartphone apps were rolled out to locate, track and alert individuals to the spread of SARS-CoV-2. Subsequently, apps sought to facilitate the retrieval, processing and presentation to authorities of certificates of a negative test, recovery from COVID-19, or immunisation through vaccination. In between waves of infections, apps were used for quarantine enforcement. Particularly in East Asia—for example, China, Hong Kong, Taiwan and Singapore—global positioning systems signals were used in addition to networking data and Bluetooth to trace the precise geographical positions of individuals. In European countries, such as the Netherlands, intense discussions were held about whether such mobile network data could and should be used to track everyday movements of people using public transport or work from home. While not all implemented, use-cases for COVID-19 app data that were contemplated included: flow modelling to identify how many people passed through certain locations and how quickly, social graph making to identify which people meet frequently, self-evaluation of symptoms to assess if individuals have COVID-19 symptoms, as well as to distribute financial aid and serve as communication platforms (Blauth & Gstrein, 2021, 19).

This chapter investigates what happened, how and what is likely to emerge from what we argue was a timid turn to COVID apps in Europe during the initial outbreak of the pandemic. The first section highlights the wide variation in COVID-19 app (non-)deployment across Europe, providing a high-level overview of the various ways in which apps were deployed and used, as well as set aside. A second section lays out an initial explanation of the paths (not) taken in app deployment during the early days of the COVID-19 emergency. The third section links the European COVID-19 app experience to what we see as a troubling expansion of a permanent preparedness infrastructure both within the European Union (EU) and more widely beyond the continent.

Our central argument is that COVID-19 app reliance re-turned to and extended a long-standing emphasis on digital technologies as quick fixes to complex socio-ecological problems, a tendency known more widely as ‘techno-solutionism’. Identified more widely in responses to crises ranging from climate change and migration to financial meltdowns (Morozov, 2013, 2020; Campbell-Verduyn & Lenglet, 2022; Coeckelbergh, 2021; Vavoula, 2021), techno-solutionism in the context of COVID-19 informed immediate attempts to address a complex and fast-evolving socio-political and ecological problem through a reduction to statistical calculations, electric signals, and automated algorithmic decision-making (see e.g. Helbing et al., 2021, 2; Campbell-Verduyn, 2021; Mann et al., 2022; Marelli et al., 2022; Martins et al., 2021; Milan, 2020).

Our analysis builds on and expands the growing literature on COVID-19 era techno-solutionism in two ways. First, we explain how smartphone apps showed anxious citizens and consumers the rapid responsiveness of both governments and companies to the emergency in ways that navigated tensions between privacy and surveillance. Second, we elaborate how app-based responses have solidified an increasingly permanently ‘datafied’ emergency management infrastructure that threatens the very solution governments and technology firms have sought between desires for privacy and surveillance. The technological fix COVID-19 apps provided in the short-term pandemic emergency period undermine the precarious balance of personal data protection and omnipresent monitoring in the medium and longer terms.Footnote 2 Enhancing opportunities for data collection and aggregation in exceptional times expands an emergency preparedness infrastructure with growing costs to citizens not only in exceptional times, but also for ‘normal’ times especially those living ‘at the margins’ (Milan et al., 2021b). It is this extension of the exceptional into less exceptional times that we find the most troubling lesson from an otherwise unexceptional fall back on smartphone apps in the initial outbreak of the COVID-19 pandemic. Our chapter concludes by pointing to further lessons to explore from this case of techno-solutionism in troubled times.

What Happened? Timid and Varied Turns to Tech

EXCEPTIUS data illustrates how, in the first 18 months of the COVID-19 pandemic, governments across Europe set out general parameters for digital contact tracing technology to be developed, tested and rolled-out in smartphone apps on a rolling basis at subnational and national levels.Footnote 3 Varying forms of formal engagement with COVID-19 apps were undertaken in the emergency environment of the initial months of the pandemic, from January 2020 to April 2021, our main temporal focus in this section.

Table 7.1 shows that digital contact tracing apps were officially made voluntary in seven European jurisdictions: Austria, Estonia, Finland, Hungary, Portugal, Scotland and Switzerland. They were rendered obligatory at the national level in only two countries, Czech Republic and Denmark, as well as six regions of Italy. In five countries (Austria, Belgium, Denmark, France and Norway) as well as two regions of Spain (Madrid and Basque Country) “soft disadvantages” were rolled out for citizens to not use COVID-19 apps. Formal incentives to use the apps, meanwhile, were also legislated national in Denmark and Italy, as well as in seven Italian regions and the Swiss capital of Bern.

Table 7.1 Official uses of COVID-19 apps in Europe
Full size table

Most European countries relied on a privacy-preserving approach to decentralised data processing and storage of contact data, as well as Bluetooth-based tracing to inform measures that sought to prevent viral spread. This was the result of a gradually harmonised approach through networks associated with the European Union (EU). It took some time to develop this approach in response to national initiatives, and the development did not come without political tensions (European Commission, 2020). Still some countries maintained a more individualistic approach, emphasising their sovereignty and particular societal characteristics. For instance, Norway made a notable and controversial exception by also using the global positioning system (GPS) for more accuracy to detect individuals. This led to an investigation of the Norwegian data protection supervisory authority, and the use of the app had to be changed several times before it was officially stopped (Lintvedt, 2021). Norway and later, in April 2021, Italy’s cessation of its COVID-19 app were the earliest cases of apps being discontinued, many more of which occurred following the first 18 months of the pandemic. At the time of writing, COVID-19 tracing apps were discontinued in Austria, Belgium, Cyprus, Croatia, Czech Republic, Denmark, Finland, Hungary, Lithuania, Malta, the Netherlands, Poland, Portugal and Spain.Footnote 4

Beyond the few cases in which COVID-19 app usage was mandated, the European turn to tech was a rather timid one. Governments largely took a ‘hands-off’ approach to the development and maintenance of apps after tendering their creation. Draconian impositions of the apps from governments were the exceptions rather than the rule in European countries. Though not wholly absent from the continent, only a few countries and regions imposed their use. A key question stemming from this brief overview of ‘what happened’ is how such timidity in the turn to smartphone apps as leading pandemic tech can be understood? The next section elaborates a necessarily preliminary answer to this ‘how’ question, building on the small but growing interdisciplinary literature on COVID-19 apps. We situate our understanding of these emergency responses in long-standing techno-solutionist impulses to locate quick technical fixes to complex, fast-evolving socio-political and ecological emergency.

How to Understand Timid Turns to Tech? Techno-Solutionism and Its Limits

Technical ‘silver bullet’ solutions formed prominent responses to a wide range of crises in the lead-up to the COVID-19 pandemic. To put this into context, regulatory technologies (‘RegTechs’) were developed in the wake of the global financial crisis of 2007–2008 and Eurozone crisis that followed in 2010 (Campbell-Verduyn & Lenglet, 2022). Sustainability technologies (‘SusTechs’) emerged as key solutions to a wide variety of environment and labour abuses around the world (Bernards et al., 2022; Sætra, 2023), most notably to climate change. Notably, however, technological fixes in no way resolved any of what remain ongoing crises as the emissions of greenhouse gases has risen every year beyond 2020 and the banking system in particularly remains in a highly volatile state as illustrated by the panic of early 2023 in which Silicon Valley Bank was bailed out and Credit Suisse was taken-over by its rival UBS. Nevertheless, despite declines due to social media controversies, digital tech has consistently been amongst the most trusted economic sectors as measured by Edelman’s Trust Barometer (Edelman, 2022).

This persistent yet exaggerated trust in technologies informed the timid turn to COVID-19 apps to track and trace the spread of a virus by governments across Europe. The response was both unexceptional and exceptional at the same time. On the one hand, smartphone apps seemingly provided quick solutions that concretely showed citizens that their governments were doing something. Apps formed responses that citizens could literally see on their smartphones, in a time where they were often staring at their screens. The largely voluntary and soft incentives to ‘nudge’ citizens towards adopting the apps also navigated privacy rights in exceptional times. Despite some exceptions, the main COVID-19 contact-tracing apps were developed within privacy and data protection principles set out in the expansive yet flexible General Data Protection Regulation (GDPR) (Bradford et al., 2020). This ‘being seen to act’ performative dynamic was accompanied by a flurry of various other forms of ‘immunity theatre’, ‘border theatre’, ‘behavioural theatre’ and ‘equality theatre’ in which actors on various different stages sought to demonstrate doing something, often without actually addressing the fundamental issues at stake (Milan et al., 2021a).

In contrast, the low number of total cases of officially sanctioned COVID-19 apps combined with the fairly rapid discontinuing of apps, including in the Italian and Norwegian cases during the first 18 months of the emergency, highlight the limits of this techno-solutionist dynamic. The rapid turn away from simple app-based contact tracing along with timidity in the turn to tech across Europe were also exceptional responses given the wider context of techno-solutionism. Nevertheless, as we will argue in the next section, the timid turn to tech have laid the socio-legal groundwork for a growing datafied permanent emergency response infrastructure. To provide the basis for our wider argument, however, this section first traces the congruence of app-based responses with four features of techno-solutionism (Morozov, 2013), drawing on studies of technological fixes in other areas of activity. The short-term technological fix that COVID-19 apps provide, however, overlooked deeper problems.

A Focus on Solutions Rather Than on Problems

By foregrounding solutions, techno-solutionism assumes and naturalises problems. As Morozov (2013, 6) writes, “solutionism presumes rather than investigates the problems that it is trying to solve”. Key assumptions underlying the European COVID-19 smartphone app roll-out were that (a) the virus would spread without digital means to track and trace its spread and that these means were (b) superior to traditional human-centred forms of contact tracing that relied less on apps, while (c) creating new challenges stemming from the increasing collection of potentially highly sensitive personal data.

On their own, smartphone apps do little to investigate the first assumption above. They simply facilitate narrow functions, such as recording viral spread in near real-time. While there is some evidence that the use of digital contact-tracing apps could efficiently slow viral spread, it remains difficult to demonstrate this clearly with scientific evidence (see, e.g. Cencetti et al., 2021). Apps also do not investigate the second assumption above—namely, that older, less app-centric forms of contact tracing are somehow unfit or unsuitable to tracing the SARS-CoV-2 virus spread. This becomes particularly visible when considering how users should react to notifications of the app that they might have been in contact with an infected person, or which concrete actions should be taken. That a digital approach was prima facie better remained largely assumed rather than proven that digital solutions were superior to non-app-based contact tracing of the sort long used to tackle other pandemics. At the same time, the increased digital collection of data came with challenges for data management as evidenced in countries such as the Netherlands, where large-scale data leaks of potentially infected persons have re-occurred.Footnote 5

A Solidification of Existing at the Expense of New Paradigms

The timid turns to tech solutions across Europe in the context of emergency management post-2020 solidified existing pre-2020 fetishisation that there is ‘an app for every problem’ (Taylor, 2021). COVID-19 apps extended two existing processes in their “failure to ‘problematize the norm’ ” (Williams, 2013: 556).

First were key roles of American Big Tech firms in app development and maintenance. These pre-COVID dominance of smartphone software by Apple and Google was simply extended into exceptional pandemic times. Nominally competitors, these two firms teamed up to harmonise requirements and capabilities of COVID-19-tracing apps whose successful implementation ultimately depended on both the support of their Android and iOS operating systems, as well as distribution through the app stores controlled by the companies. Fear of harming the reputation of their highly valuable app stores led to a privacy and security preserving approach by the two companies who did not want to be seen by their users as offering unsafe, badly functioning, and privacy-invasive apps. What this action effectively meant, however, was that two American companies were deciding on the framework for app-based COVID-19 tracing in Europe (Hoepman, 2022). Although some countries such as France tried to challenge this positioning based on concerns around sovereignty (Pohle & Theil, 2021), they ultimately remained unsuccessful (Hern, 2021).

In other periods of turbulence and exception, such as the 2008 global financial crisis, European governments had stepped far more forcefully into market processes, re-regulating and at times even nationalising key firms. In 2020–2021, by contract, such public steering of tech-based responses was timid. Standards for the design and maintenance of COVID-19 apps were largely left for Apple and Google. These two US-based Big Tech firms cooperated to make the market-based race to innovate a highly constrained and uneven affair, one metaphorically confined to an existing motor track, with little in the way of ‘off-roading’. COVID-19 app development thereby remained on the existing, pre-pandemic route dominated by Apple and Google, who effectively set the key standards for digital contact-tracing apps, in part to protect the reputation of their mobile app stores. Reliance on Big Tech firms thereby stayed within—rather than outside—the pre-pandemic paradigm. Although there were attempts to undertake more ‘out of the box’ actions, for example, with more decentralised standards discussed further below, the main way in which existing trends were solidified in the European COVID-19 apps roll-out was the centralisation of activity around two American Big Tech firms.

Second, COVID-19 apps solidified digital dataveillance (Clarke, 1988; Csernatoni, 2020). Edward Snowden’s disclosures in 2013 revealed just how pervasive surveillance had become via the spread into daily activities of digital technologies, including smartphone apps. The revelations instigated what amounted to a slow-burning ‘tech-lash’ prior to the pandemic outbreak in 2020 (Foroohar, 2019). Overlaps between American security agencies and Big Tech firms in the surveillance of even the most powerful European leaders, such as Angela Merkel, were especially decried. Yet, beyond vague invocations of ‘digital sovereignty’, little change had occurred to counter widespread dataveillance and the “disciplinary and control practice of monitoring, aggregating, and sorting data” (Raley, 2013, p. 124). The initial spread of SARS-CoV-2 had offered a historic opportunity to put grandiose declarations of digital and data sovereignty into action and push back on America’s “surveillance valley” (Levine, 2018). As noted, however, the wholly unexceptional reliance on foreign tech firms—Apple and Google in particular—to standardise apps development solidified the privacy-surveillance imbalance in the generation, collection, and storage of COVID app data. Smaller start-up firms in consortia with academics in Europe did turn to ‘distributed ledger technology’ in attempts to better preserve privacy in generating different standards (Campbell-Verduyn, 2021; Zwitter & Gstrein, 2020). However, the leading pan-European consortium developing Decentralised Privacy Preserving Proximity Tracing (DP-3T) called Pan European Privacy-Preserving Proximity Tracing (PEPP-PT) collapsed as “the tech giants entered the scene” and it became clear that “[a]ll state-sponsored COVID-19 apps are de facto public–private partnerships between a government, Apple, and Google” (Veale, 2020). More privacy-preserving apps, based on blockchain or other more distributed technologies, were left to fringe projects as COVID-19 apps that came to be in-use across Europe were developed and maintained by Big Tech firms based in the United States. Even so-called ‘privacy-preserving’ apps, such as SafeTrace, ultimately relied on the proprietary IBM Cloud.Footnote 6

“Twisting” the Perception of Problems and Obscuring the Meaning of Success

In a focus on solutions, “the problem becomes something else entirely” (Morozov, 2013, 8). The need—especially of politicians—to be seen to be concretely ‘doing something’ while ensuring some degree of privacy in app-balance surveillance morphed measures of success for app-based techno-fixes. Success came to entail whether apps preserved (or at least did not significantly worsen) dataveillance by American Big Tech firms. While important, a focus on the means of maintaining some degrees of individual privacy in generating, storing as well as analysing data in accordance with the GDPR obscured the ends of app-based contact tracing responses: their very purpose as methods of limiting the actual spread of the SARS-CoV-2 virus. The ‘innovation’ here involved a rather dramatic silencing of potential alternatives (Sharon, 2021). In addition to the more decentralised technologies noted above, further notable alternatives included devoting resources to simpler non-, or less, app-based contact-tracing solutions. Giving limited resources of money and time that are very valuable in an emergency to tried and tested forms of contact tracing might have provided more accurate data to inform policy-makers in ways that would preserved health rather than just privacy. Evidence instead suggested a lack of actual success of digital apps in holding back the spread of the virus as possible contagion alerts became either too infrequent or too frequent and ignored. Nevertheless, success was re-framed away from preventing viral spread to preserving privacy to varying degrees. Yet, by their very stress on quantification (Milan, 2020), COVID-19 apps tended to obscure more than reveal to citizens how the spread of SARS-CoV-2 affected them, particularly in populations afflicted by the various digital divides with less or no access to smartphones (such as the elderly and the young) or mobile network coverage (rural populations). Success in limiting or taming spread even in better-resourced and well-connected adult populations twisted the ultimate policy goal of fighting the wider pandemic, which strikes at all populations, to one of preserving privacy in doing so. COVID-19 app techsolutionism, in short, betrayed a “predisposition to seek out quantitative and linear casual explanations that have little respect for the complexity of the actual human world” (Morozov, 2013, 260–261).

Universalising of Solutions as Always Applicable, Everywhere

Techno-solutions are “seen as eternal”, as “timeless and never expire” (Morozov, 2013, 260). The universality of app-based contact tracing techno-solutions across both time and space is reflected in both the continent-wide turn to smartphone apps as well as the persistence of this turn in the face of critiques of their ineffectiveness in turning the tide against the spread of SARS-CoV-2. In almost every European country, a contact-tracing app was deployed, with the exceptions of Bulgaria, Luxembourg and Sweden, or contemplated even if not ultimately deployed as in Greece and Romania, leading to scarce resources being devoted to such responses in times of emergency.Footnote 7 While, as noted, mandates on the usage of these apps were confined to the few jurisdictions mentioned above—mandates that were ultimately struck down—the voluntary prompts towards app use persisted well beyond the first year of the pandemic. Though they were slowly set aside by the time of writing in February 2023, with just over a half dozen national apps remaining in use,Footnote 8 the initial turns across Europe towards app-based contact tracing has solidified a far wider infrastructural legacy. The limits of app uses were largely set aside in favour of a “hard-wiring” (de Goede, 2021) into both formal legislation and informal socio-technical relations between big tech firms, governments expert developers and citizen expectations that digital tools are to form important, if unexceptional, responses to exceptional times to come.

What Comes Next? A Datafied Europe and Beyond

On 22 December 2022, the European Commission published a report on the EU Digital COVID Certificate (EUDCC) to establish a standardised framework to coordinate the digital infrastructures of EU Member States pursuant to Article 16(3) of Regulation (EU) 2021/953. This report reflects the paths taken forward to catalyse regional sharing and action on health data in exceptional times. The initial drafts of the legal frameworks were criticised, however, for prioritising the continued free movement of capital, goods, and services in the bloc’s single market while—once again—failing to address broader societal implications and concerns over privacy safeguards (Gstrein, 2021, pp. 374–380). The legislation thus illustrated how economic circulation was set to remain enabled by digital circulations of data in order “to cancel out the effects of the illegitimate circulation of the virus through exactly replicating the pattern of the virus’s mobility” (Langenohl & Westermeier, 2022).

Little indication was provided by the Commission of whether, or how, the emergency infrastructure under construction was ever to be rolled-back in less exceptional times. The report mentions that EUDCC ceased to apply at the end of June 2023.Footnote 9 Yet, in an attempt to avoid criticism for being unprepared to protect European unity in times of crisis (Alemanno, 2020), a proposal was presented for a Regulation to establish a ‘Single Market Emergency Instrument’ on 19 September 2022. This instrument was “put in place a flexible and transparent mechanism to respond quickly to emergencies and crises, threatening the functioning of the single market” (report, p. 24). At the time of writing, however, it remains unclear whether such a legal framework will be adopted by the legislators of the EU. Nevertheless, what is suggested by these activities is a state of “permanent emergency” (Wolff & Ladi, 2020) wherein technical fixes initiated at the beginning of the pandemic form the ‘installed base’ (Star, 1999) of a growing regional health and economic data infrastructure.

The remit and rapid growth, both real and potential, of this data infrastructure in governing everyday life is striking. According to the Commission (report, pp. 1–2), more than 2 billion certificates were issued in the 27 member states to certify either testing, recovery or vaccination between the inception of the EUDCC on 14 June 2021 and 31 October 2022. Member States mostly used the EUDCC to regulate access to events and cultural activities, as well as restaurants, bars, and nightclubs. Additionally, the EUDCC was used to monitor access to hospitals, nursing homes and other health-care facilities, wellness facilities, hotels, the workplace, universities and public transportation (report, p. 12).

Not only is it Europe that is affected by this infrastructural expansion. The Commission has high hopes that the EUDCC will become an international benchmark and amongst the leading manifestations of the ‘Brussels effect’ in which European regional standards come to form global standards (Bradfords, 2020). Within Europe, but also beyond the continent, movements of people are increasingly reliant on the data infrastructures being carved out of standards initiated and catalysed during the first years of the COVID-19 pandemic, when the roll-out of contact-tracing apps formed what scholars increasingly understand as a major standard setting exercise (Kokoulina, 2023). The EC reported that 49 non-EU countries and territories facilitate international travel based on these standards, including large countries such as Indonesia, Malaysia and Vietnam (report, p. 19). The Commission is actively trying to build on the ‘international success’ (report, p. 25) of the EUDCC in coordinating with countries around the world to establish, reuse and extend the techno-fix established at the beginning of the COVID-19 pandemic to generate, collect and analyse information without (further) eroding privacy rights.

In sum, the European Commission and EU Member States are setting up ‘Single Market Emergency’ (report, pp. 24–25) infrastructures that are expanding across both space and time. This is a medium- to longer-term agenda emerging out of the short-term solutionist fix to the regional experience of emergency pandemic management in 2020–2021. Blanket permissions to extend techno-solutions are being developed to respond to whatever the next emergency might be. Digital technologies are being enshrined as means for extending the status quo of privacy surveillance (in)balance in (hopefully distant) future emergencies. They are also being hard-wired into daily activities during less exceptional times, with important implications that future research needs to remain attuned to.

Conclusion

This chapter has provided an overview of what happened with COVID-19 apps developed in Europe and how we can understand the timid turn to technology as an emergency solution with major implications for the future. We first argued that European COVID-19 apps formed largely unexceptional techno-solutionist responses to exceptional emergency times. Although the returns to tech were largely timid and varied greatly across the continent, they were largely successful in demonstrating to anxious citizens that governments and big firms were ‘doing something’ while maintaining a balance between individual autonomy and state monitoring of digital traces. Second and what we argued is more troubling, however, is that this timid return to tech has laid the basis for a permanent emergency infrastructure that threatens to skew the precarious balance between privacy and datafied surveillance in Europe and beyond in the medium- to long term.

In this concluding section, we identify two paths for research and policy practice going forward. First is a need for critical consideration of how (un)exceptional paths emerge out of and structure responses to exceptional events like pandemics. Scrutinising claims that ‘everything will change’ or that the spread of a novel virus bifurcated stimulates novel policy responses, scholarly analysis needs to navigate between policy-makers’ tendency to simply fall back on existing modalities or to develop new, untried ones (Campbell-Verduyn et al., 2021). As the present case illustrated, long-standing techno-solutionist impulses led to familiar fixes in the short-term responses to a pandemic while encoding actions taken in exceptional times to less exceptional times. Change in other words emerged out of continuity, an outcome that complicates simple dichotomised diagnoses that ‘everything stays’ and ‘everything changes’. There are also lessons here to be learned from similar tendencies in other exceptional periods, like financial crises, where the ‘flight to safety’ supports the international status of American dollar even when the likes of the 2007–2008 ‘global’ financial crisis centred on the United States. This leads us to a related take-away.

Second, the European experience needs to be considered as not only informing but also informed by unexceptional techno-solutionism to exceptional times elsewhere in the world. As noted, the idiosyncrasies of the far grander European socio-political and technological infrastructure emerging out of timid tech-solutionism in 2020–2001 are being exported worldwide. Yet, given the transboundary nature of modern technological diffusion, there are both overlaps and important divergences between the European experiences with COVID-19 apps and those of democratic and non-democratic countries. For instance, East Asian democracies like South Korea were “presented as a model” for democracies elsewhere through their use of “fine-grained locational data and social network analysis to track and target individuals for containment and treatment” early in the COVID-19 pandemic (French & Monahan, 2020). Parallels can productively be drawn out in the differing forms of “algorithmic vulnerability” that app-based responses posed for citizens in Europe, China and beyond (Xue, 2021). COVID-19 tech, including apps, are part of a growing surveillance infrastructure that is spreading, if unevenly, across democratic and non-democratic alike that scholars need to understand by focusing on legislation, citizen trust and the work of police organisations (Pathi et al., 2022). In short, there are many lessons to draw on and draw out of the limits of the COVID-19 app experience in Europe’s initial approach to exceptional times.