Attention: How Covid-19 Contact Tracing Apps Work

Attention: How Covid-19 Contact Tracing Apps Work

 Across the world, countries are trying to find solutions to fight the COVID-19 pandemic. Health authorities have different tools at their disposal. To avoid drastic emergency measures like lockdowns, where nobody is allowed to leave their home, it is necessary to know, how and where a disease spreads. If it were possible to notify potentially infected people before they infect others, they could get tested and isolate themselves in time and slow or stop the spread.

 Traditionally, this is done by asking confirmed sick patients a series of questions, like who they've been in contact with and for how long. Health care workers would then call their contacts and notify them. While this process is usually thorough and accurate, it is also quite slow and laborious. If it takes several days or even weeks to inform contacts, the virus could have spread further in the meantime. Here is where digital contact tracing may come in.

Using smartphones, it could be possible to determine whether a person may have recently been within the proximity of someone that had been infected with the virus. According to a model by the University of Oxford’s Big Data Institute in March 2020, a coronavirus outbreak in a city of one million people could be stopped if 56% of the general population were to use a contact tracing app. Lower usage would still slow the spread. While this sounds quite promising, privacy campaigners and civil liberties activists swiftly voiced their concerns regarding surveillance and data security. Governments

tracking the location of all citizens, 

discrimination and information leaks are just a few possible drawbacks digital contact tracing might have. Multiple civil rights organizations made it clear that any widely adopted contact tracing would have to adhere to a strict set of rules to protect citizens. In May 2020, the two major manufacturers for smartphone operating systems,

  Apple and Google, developed an API - Application Programming Interface
together to enable privacy-preserving contact tracing. They call it "Exposure Notification" and it’s available for iOS as well as Android. Health authorities worldwide are now able to create their own apps using this interface. The Exposure Notifications
system does not use or collect location data but instead relies on

Bluetooth technology. 

A user's device will regularly send out a beacon via Bluetooth that includes a random string of numbers that isn't tied to a user’s identity and that changes every 10-20 minutes to prevent tracking. Other phones are able to store received beacons while sending out their own. This way, the only thing that is recorded is the relative distance between nearby devices. At least once a day, each phone will download list of the random strings that belonged to people confirmed as positive for COVID-19. The phone compares this list with its own list of identifiers it has "seen". If there is a match, the user may be notified and informed on what to do.

If an app user is tested positive themselves, they are free to choose whether to report their case and warn others. If the user consents, their phone uploads the last 14 days of its random keys to the notification system. To counter abuse, each report should require an authorization by the local health authorities, like a letter with a unique QR code

to scan or a transaction number to enter. It is important to note that the user's identity is never revealed to the notification system, it requires explicit choice to turn on the technology and it can be turned off by the user at any time. Unless a user explicitly chooses to report their positive diagnosis, all collected exposure data will be stored and processed on device.

This is called decentralized contact tracing

contrary to centralized tracing which uses a central server for communication or even to store personal data. The system is only open to apps by public health authorities and Apple and Google will disable the system by region once it is no longer needed. Both companies plan a more robust solution than an API (Application Programming Interface)

by integrating the tracing functionality into their platforms in the coming months. While the joined approach by Apple and Google checks many boxes privacy advocates have laid out as requirements, we shouldn't throw caution to the wind. There are still some privacy aspects to lookout for. The apps by public health authorities will have to be open source so anyone can check the code. And there must not be negative consequences for people who refuse to use the system. This is mainly the responsibility of each government. Any contact tracing apps will likely be not perfect and produce at least some false positives and negatives.

It remains to be seen if the apps can deal with potentially difficult to recognize situations like being physically close but separated by a window.

A real life example of digital tracking gone wrong recently happened in Moscow, where hundreds of citizens were wrongly fined for allegedly breaching self-quarantine. Moscow's social monitoring app requires many more permissions like location, calls and camera. Apart from invading users' privacy, technical glitches and an ill-considered notification system lead to law-abiding citizens being automatically fined despite staying at home. Considering the emphasis on privacy and anonymity, would you be willing to use a contact tracing app? I'll be interested to read your comments.

employee notification of exposure monitoring results