Countries, states, and public health organizations around the world are digitizing contact tracing to speed up the manual and time-intensive method of tracking the spread of COVID-19. There are several ways to modernize the process ranging from using Bluetooth signals to track proximity to using apps to create a record of a person’s travels through a community. Geolocation is another way to monitor movement and interactions with other people.
Google and Apple announced at the start of April that they would first develop an API for contact tracing and then incorporate a tracing method in the phone operating systems. The companies just released an early version of the coronavirus exposure notification API to a limited group of developers working on behalf of public health authorities globally.
PwC is beta testing Check-In, the first enterprise-grade contact tracing system that could be added to existing corporate apps. This solution would only track employees at work, not an individual’s movements outside of the office.
The key to success for any new contact tracing system will be wide scale adoption. Companies and governments will have to address privacy concerns as well.
Myke Lyons, the CISO at data intelligence company Collibra, said this effort is an opportunity for Google and Apple to build trust with consumers.
“There is a lot of misinformation and distrust around data, and consumers need to know how their data is being used, where it came from, how it is being secured, and what will happen once the data is no longer needed,” he said.
The Kaiser Family Foundation found in a recent poll of 1,202 Americans that opinions are split over digital contact tracing. Fifty percent of respondents said they would download an app to notify them when they come into close contact with an infected person but 47% wouldn’t.
Here are three approaches to contact tracing and the pros and cons of each.
Using Bluetooth and smartphones for contact tracing
The appeal of using mobile phones for contact tracing is scale. A solution that is available to everyone with a cell phone would have a much wider reach, which is vital for contact tracing to succeed. The initial apps from Apple and Google will be available for users to download via their respective app stores.
Next Apple and Google will build a Bluetooth-based contact tracing platform into the phone operating systems. This approach would remove the requirement to download an app to participate and potentially reach even more people, as long as they opt-in.
SEE: Coronavirus: Critical IT policies and tools every business needs (TechRepublic Premium)
Apple explained that the proximity identifier changes every 15 minutes, would not have any personally identifiable information attached to it, and requires the necessary key to be traced back to the user. These identifiers are processed on the device and not in the cloud. Each user chooses whether to contribute to the contact tracing. Those diagnosed with COVID-19 must give their consent before sharing the data with the server.
A user’s contact trace list consists of unique IDs collected via Bluetooth from other phones. If a person tests positive for the virus, he or she would share this list with the health authorities for contact tracing purposes, not a list of names and phone numbers.
Gonzalo Raposo, tech manager at Globant, said that in general Bluetooth is better for contact tracing because it provides more precise information about how close two phones get to each other and it works well indoors.
Using location data for contact tracing does not provide that level of detail, but it can be useful for building epidemiology models.
Raposo said that another advantage of the Google and Apple approach is an algorithm that will assess an individual’s exposure risk based on certain factors, proximity to a person who tested positive and for how long.
“This feature helps to reduce false-positive cases because if you were 10 feet away from the infected person, your exposure risk is considerably lower than being 3 feet away,” Raposa said.
Raposo said that the contact tracing apps should not ask location sharing permission or access to the contact list because the tracing information will be based on proximity and collected via Bluetooth.
“When a user is diagnosed positive, the contact list from the phone has to be updated to the backend server, in order to notify the impacted users,” he said. “Depending on where that information is stored, the user will ask for permission to share that information, if necessary.”
In the second phase, the contact tracing solution will be part of the operating system, which means users will have less visibility into how the data is being collected and used.
Using an app for contact tracing
North Dakota and South Dakota are encouraging residents to use Care19 for contact tracing, an app that was first used by college football fans attending national championship games.
Tim Brookins, founder of ProudCrowd, built the app so that fans of the North Dakota State Bisons attending national championship games could connect. Brookins contacted North Dakota Gov. Doug Burgum in March in response to the coronavirus epidemic and learned that the state needed help with contact tracing. That meeting was March 28 and Care19 was approved April 7 on the AppStore.
“In its current versions for both iOS and Android, it uses the native location services capabilities on the phone OS to provide you with a list of the places you have visited to serve as a memory aid in case you become COVID positive in the future,” Brookins said.
The application collects no personal information about the user and has a unique code generated for each install. If a user tests positive for the virus, he or she can share that code with the state department of health. The state receives all COVID-19 test results and contacts individuals who have tested positive. The Care19 data is automatically integrated into the state’s Post-COVID-Positive Contact Tracing Management system.
The user also can consent to share this data with the state to start the contact tracing process. This part of the process requires some human detective work. Brookins used the example of a person with the virus getting a haircut.
“The Department of Health will actually call that barber and ask them to look up the positive person in their reservation system and find out who cut their hair, and then call the stylist and inform them on next steps,” he said.
The user also can consent to notify other Care19 users with whom they came in contact. Brookins estimates that about 5% of North Dakota residents are using the app to date.
ProudCrowd controls the data which is encrypted in transit and at-rest and stored on Azure servers for up to 14 days. Brookins said the states do not have access to the data unless an individual has tested positive and consented to share it. The application will use the new Google/Apple API when it is available.
Brookins is a principal software engineer at Microsoft and works in the Office of the CTO, Research. The Care19 app is a personal project.
Using geolocation for contact tracing
An Israeli company is reconfiguring a platform originally designed for law enforcement and intelligence organizations to do contact tracing. Wave Guard’s Tracer platform uses raw cellular network data and multiple positioning methods to geolocate specific individuals or groups and tracks their movements in real-time.
Uzi Moscovici, the CEO of Wave Guard Technologies, said the platform can monitor quarantined people in real time, support contact tracing, and help officials track the spread of coronavirus cases.
Moscovici said that Wave Guard’s platform could be used by any entity managing the response to the epidemic, such as a government’s technology division or a public health organization.
“The flexibility of the Wave Guard system allows a public health organization or the administering entity to respond to its geolocation information in any way that it deems appropriate, including issuing SMS warnings or developing heat maps for observations and lockdowns,” he said.
The geolocation data is generally kept for two weeks and then can be automatically deleted from the system database, Moscovici said.
He added that the system includes the option to require consent for data sharing as well as access controls and an audit function to monitor attempts to misuse the system.