Contact tracing for Covid-19: Monitoring virus hotspots through apps.
As the rates of new Covid-19 cases across the United States begin to plateau, or perhaps even decline, states are considering taking steps to relax social distancing measures. However, there are concerns that this may open the door for secondary or even tertiary waves of infections. Until a vaccine is available, there is a great need for widespread testing and contact tracing in order to detect and suppress future virus outbreaks.
Contact Tracing and Technology
Contact tracing is the process of finding and isolating people that have recently interacted with someone that has tested positive for an infectious disease. In other words, it is a way to stay one step ahead of disease transmission. For COVID-19, manual contact tracing may have limited efficacy; it is labor-intensive, not cost-effective, does provide a rapid response, and is quite error-prone. States likely do not have the capacity to hire the number of personnel that would be needed to perform comprehensive manual contact tracing.
The use of technology, however, may be able to supplement and augment manual contact tracing efforts. Digital contact tracing has been successfully implemented in places such as China and South Korea; however, these efforts raised a number of privacy concerns as they required the collection of large amounts of personal data to be stored and processed.
In response to these concerns, a number of privacy-preserving digital contact tracing projects have been initiated. The majority of these projects use either global positioning system (GPS) or Bluetooth data from smartphones to determine proximity between individuals. While not without their fair share of criticisms, these approaches were designed with privacy in mind and attempt to limit the potential to be abused for surveillance purposes.
In this article, we discuss some of these privacy-preserving digital contact tracing initiatives, along with our own proof-of-concept contact tracing app based on quick response (QR) codes.
GPS-Based Digital Contact Tracing
One of the most prominent of these initiatives is the SafePaths app developed by researchers at Massachusetts Institute of Technology. This app requires access to users’ mobile GPS data and periodically records these GPS coordinates and stores them privately on the user’s smartphone. These coordinates are not shared with any third parties and cannot be accessed by anyone without the user’s permission.
When a user tests positive for COVID-19, they will have the option to share this file with authorized personnel who can redact their private information and anonymously upload this data to a public repository of places that could have been exposed. Other users who were in proximity can then be notified of their risk.
Bluetooth-Based Digital Contact Tracing
In contrast to using GPS data, other privacy-preserving initiatives have instead turned to using Bluetooth to determine proximity. Examples of such projects include the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) project in Europe, the TraceTogether app in Singapore, and the joint initiative by Apple and Google to build contact-tracing support into their smartphone platforms.
These projects share a similar design in that they rely on smartphones continuously broadcasting Bluetooth signals which can be picked up by nearby devices, although the specific designs may vary. As an example of how the Bluetooth approach can work, signals exchanged between two devices based on private codes stored on each device can be anonymized such that they cannot (in theory) be traced back to a particular user or device.
A user testing positive for COVID-19 can then choose to share their private codes with authorized personnel, who can have these anonymously uploaded to a database which other devices can continually check to see if there are any matches with their own saved codes. A matching code would indicate a potential exposure.
QR-Based Digital Contact Tracing
The proof-of-concept app we developed, TrackCOVID, presents an alternative to both GPS and Bluetooth systems, and instead uses QR codes to determine proximity. Each QR code represents what we call a “checkpoint”. Checkpoints can be placed at public places (such as grocery stores, restaurants, universities, hospitals, or public transit) and scanned by anyone with a smartphone.
When a checkpoint is scanned, it is stored privately on the user’s device and associated with the time at which it was scanned. Similar to the projects described above, these saved checkpoints can be shared by confirmed COVID-19 positive users with authorized personnel who can upload these to a database. Other devices can continually compare their checkpoint history to determine if there is a match, which would indicate a possible exposure.
Comparison of GPS-, Bluetooth-, and QR-Based Digital Contact Tracing
There are strengths and weaknesses to each of the approaches we have described above. The SafePaths approach to contact tracing using GPS coordinates can in theory function well with careful coordination in conjunction with government authorities and health care providers. Because it is continually logging data in the background, it requires minimal action from users (once they have installed the app) and provides data regarding how long a user may have been in any one location, which can impact the likelihood of exposure. It also respects user privacy in that no user data is shared without their explicit consent; and, when diagnosed users do choose to share this history, it is done so anonymously.
However, a major limitation of this approach is that it likely requires a large number of users to download the app. Users may choose not to do so either due to lack of interest, being uncomfortable with a contact tracing app that requests access to GPS location, or concerns that such an app may shorten their smartphone’s battery life. Such an app may also be prone to false positives arising from either location coordinates that are too broadly defined or a device being left in a location unattended while the actual person is in another location.
The Bluetooth-based approach has similar strengths and weaknesses compared to the SafePaths app using GPS in many respects. With sufficient adoption and coordination with authorities and health care providers, Bluetooth also has the potential to be used for effective contact tracing. Bluetooth runs continuously in the background just like GPS, so it similarly provides useful data regarding timing of contact and does not require user action once the app has been installed.
Bluetooth may additionally have an advantage over GPS due to user perceptions regarding privacy. Specifically, Bluetooth may be seen as less invasive compared to GPS. However, in reality, this is not the case. Bluetooth may actually be a weaker design in terms of privacy, as there are theoretical privacy-related attacks that involve “eavesdropping” on the Bluetooth signals emitted by devices, and later attempting to associate these signals with real people that were nearby at the time. Also similar to GPS, Bluetooth-based solutions may suffer from lack of participation if users are not motivated to download an app and allow Bluetooth to run in the background.
Our approach using QR codes differs from both GPS- and Bluetooth-based approaches in that it does not require anything to run in the background and instead relies on continual user participation in the form of scanning QR codes. Our solution also differs in that it is actually a web-based application that runs in the browser rather than a native app, providing simplicity and ease-of-use.
These differences present both strengths and weaknesses compared to other approaches. The advantage of our app is that it presents a realistic approach to achieve widespread adoption; that is, it presents an opportunity for local municipalities and businesses to encourage people to use the app by placing QR codes at public places. Publicly displayed signs can remind users to participate, as people will be prompted by both the sign and by watching other people participate.
Furthermore, because there is no process of downloading an app or enabling access to location, there is in theory a chance to recruit more people to use the app who might never download an app and allow it to run in the background. It also possesses similar privacy-preserving properties compared to the SafePaths app, in that it does not allow eavesdropping to occur. On the other hand, the continual user engagement required by our app may also cause people to become fatigued and less engaged over time. Parameter optimization is needed as there is also a concern for false positives.
Specifically, QR codes might in theory cover very large areas (such as a shopping mall), where many people that scan the same code may never actually be in close proximity. An additional concern with QR codes is their lack of granular data, such as not capturing precise time information. This could be addressed by allowing users to scan as they leave a location, but this might serve to further discourage use.
Ultimately, digital contact tracing is one of many tools we have available to protect ourselves against potential future COVID-19 secondary and/or tertiary outbreaks as we seek to allow local businesses and public venues to re-open.
Due to capacity limitations with manual contact tracing, digital contact tracing could greatly improve our ability to contain future waves of COVID-19. However, for digital contact tracing to be effective, the issues of privacy, user adoption, and accuracy will need to be carefully considered and addressed.
Tyler Yasaka, BS
Brain & Spine Report is a product of the Brain and Spine Group, Inc. and the statements made in this publication are the authors’ and do not imply endorsement by any other group. The material on this site is for informational purposes only and is not medical advice. Unauthorized reproduction in prohibited.