Contact tracing tech

What is contact tracing?

The COVID-19 pandemic has created a need for rapid, population-wide digital contact tracing.

Contact tracing is a public health practice to identify and notify those people who had contact with or visited the same locations as an infected person during their contagious period.

Manual contact tracing follows these steps:

1. Obtain consent from the infected or suspected patient.
2. Work with the patient to re-trace their whereabouts during the contagion period.
3. List any contacts the patient interacted with.
4. Visit places of potential contagion and notify exposed individuals and advise them what to do (e.g., get tested or self-isolate).

Manual contact tracing has certain shortcomings in fast-spreading viral outbreak. Recollection of patients might be poor, they might be unwilling to disclose information, tracing takes time and it is very labour intensive.

Digital contact tracing offers technology-supported solutions to alleviate some or all of the above shortcomings. Three different approaches exist, location-based tracing, centralised proximity tracing and decentralised proximity tracing.

Location tracing

Location tracing either uses a location-tracking app or is carried out top-down using a range of data and surveillance technologies to retrospectively retrace the movements and contacts of a newly diagnosed patient and identify those who frequented the same locations at the same time.

It might use a variety of digital data, such as GPS and cell phone locations, data from social media platforms, CCTV camera and facial recognition data, travel booking and transport data, and other data points. As a result, location tracing is considered highly privacy invasive. While successfully used in some countries it is considered intolerable or may even be illegal in many other societies, particularly Western ones.

Proximity tracing

Proximity tracing collects data while contacts between people take place, instead of tracing retrospectively,. It uses a smartphone’s Bluetooth technology to establish contact between two users by measuring distance (using signal strength) and duration of a contact. It works as follows:

1. The user installs the service (e.g., via app download or OS update) on their smartphone and activates Bluetooth. The phone is registered with an ID at a central infection tracking server.
2. The service operates in the background and acts as a beacon and receiver. It sends out its own ID and collects the IDs of other users located within a certain radius and time span.
3. When a user tests positive, he/she tells the app. The service then registers the infection with the contact tracing server.
4. All users the patient came in contact with receive a notification as well as instructions what to do.

There are two versions of proximity tracing that come with different privacy implications.

Centralised proximity tracing

Users register their phone number with a central computer server, which then creates the anonymized IDs that devices exchange. Anonymity is thus preserved between devices but not vis-à-vis the central authority (such as government health agencies). The central server is in charge of decrypting keys and contacting devices of exposed users via their phone numbers. This centralisation allows authorities to know who is infected and who was exposed, which can feed into manual contact tracing efforts.

Decentralised proximity tracing

Users register with the central server anonymously rather than with their phone number. Individual phones carry out much of the tracing and notification. Instead of centralized registration of exposed users and push notifications to devices, each device pulls all known IDs of infected users from the server and compares these with the decentral, locally held list on the device, which means the server does not need to know the identity of any device, infected user or those exposed. While the most privacy-preserving solution, it does not allow authorities access to exposure data, thus disconnecting the solution from manual contact tracing.

The most widely used technology is Apple and Google’s decentralised Exposure Notification service that underpins apps in many countries. Implementation at the operating system level ensures seamless functioning of apps with a device’s Bluetooth. While centralised solutions, like the Australian COVIDSafe app, are favoured by some governments because they intersect with manual contact tracing, they suffer from certain restrictions in accessing Bluetooth while phones are not in use, limiting their efficacy

Contact tracing apps

The following table provides a structured overview of the digital contact tracing solutions used by countries around the world. We are comparing these solutions according to their technical approaches (see above), and in more detail, their privacy implications:

• Penetration / diffusion: percentage of the population using the app (at time of data collection)
• Tech: Bluetooth proximity tracing, or location-based tracing – see above for detailed descriptions
• Voluntary: Is the individual user free to adopt and resist adoption or is use mandated or centrally enforced?
• Centralisation: centralised vs decentralised (see above), location-based tracing is always centralised

Note: where cells are marked as TBD, we are actively looking for this information. If you are able to help, please get in touch.

Contact tracing around the world

Contact tracing in the US

In the United States every state creates their own individual contact tracing solution. Those solutions are not included in the above table. As most US states are still developing their solutions, the following table presents very much a work in progress.

Corporate contact tracing

A range of commercial products and services have been launched to help businesses and public organisations to safely re-open their premises. The following table gives an overview of the range of approaches that are being implemented; it is not meant to be exhaustive. It becomes obvious that privacy is less of concern in on-premise tracing, compared with the implementation of public solutions by governments and health agencies.

Challenges of contact tracing adoption

Pandemics such as COVID-19 present large-scale crises that require collective action at the societal level to be contained, including the use of digital technologies.

The following research paper discusses in detail the challenges of contact tracing adoption and proposes a framework for governments and health agencies to govern the roll-out and adoption of, in particular privacy-preserving Bluetooth-based proximity tracing.

Digital Contact Tracing Adoption in the COVID-19 Pandemic: IT Governance for Collective Action at the Societal Level
By Kai Riemer, Raffaele Ciriello, Sandra Peter, Daniel Schlagwein
https://doi.org/10.1080/0960085X.2020.1819898

Abstract

The COVID-19 pandemic has created a need for rapid, population-wide digital contact tracing. One solution, Bluetooth-enabled digital proximity tracing using smartphones, promises to preserve individual privacy while helping to contain society-wide viral outbreaks. However, this digital solution works effectively only if adopted by the majority of the population. This poses a collective action problem: everyone would benefit from wide-spread proximity tracing, but the benefits for the individual are indirect and limited. To facilitate such collective action at the societal level, this paper conceptualizes the option space of IT governance actions for proximity tracing adoption along two dimensions: decision-making entities (who will govern the roll-out) and accountability enforcement (how strictly will adoption and use be enforced). Examining coherent governance approaches that arise from the framework, we show that there are no globally ideal approaches but only locally contextualized ones that depend on immediate health risk, prior experience with pandemics, societal values and national culture, role of government, trust in government and trust in technology in each society. The paper contributes specific propositions for governing digital contact tracing in the COVID-19 pandemic and general theoretical implications for IT governance for collective action at the societal level.