COVID-19 Contact Tracing Apps – How Good Is Good Enough?

As we approach three months since the WHO declared COVID-19 a pandemic, many countries are eager to loosen related restrictions and reopen businesses. Because returning to normal public life carries the risk of a second wave of infections, measures such as contact tracing are essential for public health officials and local communities to keep the virus in check.

Traditional manual contact tracing begins with a positive diagnosis. Public health officials contact infected individuals and question them on their physical encounters over the preceding two weeks. This is however prohibitively resource-heavy for overworked healthcare professionals and overwhelmed global healthcare systems.

New technologies are helping to provide automatic contact tracing solutions. Many countries have built or are building smartphone applications, services, and support systems for this purpose.

In South Korea, individuals who test positive are being monitored via GPS phone tracking, surveillance camera records, credit card transactions, etc. The Korea Centres for Disease Control and Prevention issues real-time alerts indicating where infected individuals were before their diagnoses. The South Korean government report Flattening the curve on COVID-19: The Korean Experience estimates that such automated tracing takes about ten minutes per case, compared to manual tracing by health workers which requires 24 hours per case.

South Korea’s rapid adoption of new technologies for automatic contact tracing solutions has proved effective. Along with extensive nationwide testing and strict follow-up and infection containment strategies, the country managed to flatten its COVID-19 curve within a month. A report from The Atlantic noted, “(South Korea) is perhaps the largest democracy to reduce new daily cases by more than 90 percent from peak, and its density and proximity to China make the achievement particularly noteworthy.”

Although automatic contact tracing seems to have saved South Korea from a worse fate, such an approach may not work elsewhere. In many Western countries, citizens have rallied against face masks, physical distancing, automatic contact tracing, etc. as threats to their individual rights and freedoms.

In the recent paper COVI White Paper – Version 1.0, 23 respected machine learning researchers propose that personalized peer-to-peer contact tracing through mobile apps has the potential to shift the paradigm of Covid-19 community spread. They also however warn that “While technological solutions can amplify the impact of contact tracing, if implemented incorrectly, they may also pose significant risks to citizens, including loss of civil liberties, erosion of privacy, and government private surveillance.”

Automatic contact tracing apps use location data or Bluetooth communication from phones to predict where and when users may have been exposed to the virus — for example by capturing infected persons’ phone location data and identifying other phones that were in the same location at the same time.

Other apps use Bluetooth proximity to track recent contacts by identifying the exchange of low-energy Bluetooth radio signals with any nearby phones. Such Bluetooth “handshakes” are considered easier to anonymize and better for privacy than location data. There are several different Bluetooth frameworks, such as TCN Protocol, Google-Apple Exposure Notifications, and the UK’s newly developed NHS contact tracing app.

Automatic contact tracing apps can be either centralized or decentralized. Centralized approaches gather anonymized data and upload it to a server that public health authorities can access to track contact encounters among the population. The South Korea contact tracing platform runs on a private network to reduce the risk of hacking, and all personal data stored on the platform will be deleted once the response to COVID-19 is complete. Only a small number of officials with the necessary security clearances have access to the platform.

The decentralized model meanwhile keeps the information on users’ phones. As explained in the paper COVI White Paper – Version 1.0, “Decentralized approaches automatically notify recent contacts of their risk without entrusting any identifiable contact information to a centralized governmental authority.” Does this mean decentralized contact tracing apps are immune to attacks? Unfortunately, no. Such contact tracing apps still have to inform users if they were exposed to an individual diagnosed with the virus, and even this could potentially lead to leakage of users’ diagnosis status and movement and location patterns.

Whether enough users will accept public safety versus individual privacy trade-offs and voluntarily use such apps is the question. In a recent survey of 789 Americans conducted by Microsoft Research, just under 80 percent reported their willingness to install a contact tracing app, but only if it is “perfectly” private and/or accurate. Presented with an app with unspecified privacy or accuracy, respondents’ willingness to install falls to about 50 percent.

• Perfect accuracy: Imagine that this app will work perfectly. It will never fail to notify you when you are at risk nor will it ever incorrectly notify you when you are not at risk.

• Perfect privacy: Imagine that this app perfectly protects your privacy. It will never reveal any information about you to the US government, to a tech company, to your employer, or to anyone else.

The majority (63 percent) of Americans answered that they would be willing to install an app that offers at least 50 percent improvement in public health or in personal safety over the baseline rate when not using the app.

The UK’s NHS contact tracing app began testing on the Isle of Wight on May 5. Apple and Google recently announced that 22 countries and some US states have requested access to their contact-tracing API. Last week, Switzerland rolled out the world’s first contact tracing app using the Google and Apple API.

How good is good enough for COVID-19 contact tracing apps, and will enough people use them to make them effective? As the world longs to return to normalcy and more countries and regions roll out such apps, these questions will be at the centre of tracing versus privacy discussions and debates.

---

Journalist: Fangyu Cai | Editor: Michael Sarazen