The privacy imperative of digital contact tracing

As countries take steps to reopen borders and society it is essential to have robust contact tracing systems in place to slow the spread of Covid-19.

Looking back through history, a core strategy for infectious disease management is the process of test, trace and quarantine, which is used to break the chain of transmission and reduce the spread. This strategy was impactful for containing outbreaks of other diseases such as HIV/AIDs and ebola. However, unlike these other diseases, Covid-19 is easily transmitted through the air, spread by asymptomatic carriers and widely distributed. This has made manual contact tracing even more challenging as a key pandemic response strategy despite billions in spending by governments around the world.

While manual contact tracing efforts are effective against the virus, they rely on knowledge of direct or indirect interactions with people who have tested positive. This challenge has paved the way for digital contact tracing solutions as an effective supplement to manual efforts, as they produce better exposure tracking because they can catch contact with unknown individuals.

But in order for these solutions to be widely used and most effective, privacy concerns must be addressed.

The rise of privacy-preserving exposure notification solutions

Given the difficulties associated with manual contact tracing efforts, many countries and public health authorities have turned toward digital technologies in the form of digital contact tracing and exposure notification solutions.

Early in the pandemic, several countries effectively used digital strategies for contact tracing, including South Korea and China. However, these strategies were not privacy-preserving and allowed centralized oversight of peoples locations and movements. The threat to privacy also increases resistance in populations to the use of these strategies.

Instead, companies like the PathCheck Foundation built exposure notification solutions on top of Google and Apple Exposure Notification APIs that detect contact between positive and non-positive people in a way that is secure, anonymous and scalable. These solutions are being deployed in places like Hawaii, Minnesota, and Louisiana. Additionally, public health organizations like the Health Service Executive (HSE) in Ireland created contact tracing apps built on top of the Google and Apple APIs.

Building exposure notification apps on top of Google and Apple’s APIs makes digital contact tracing more effective and safe. Smartphones are practically ubiquitous in industrialized countries and are toted everywhere people go. Exposure notification apps allow users to self-report a positive test and then detect and flag other phones that have been in close proximity using the smartphone’s features. The phones that have been flagged can then, in turn, notify their users that they have been exposed to a person who has tested positive. The exposed person can then book a test or self-quarantine, preventing further spread of the virus.

The PathCheck exposure notification app, which our team at Rocket helped to develop along with thousands of volunteers, is especially notable for a couple of reasons. First, it preserves user anonymity. When the app is enabled, phones running the app use unique identifiers through Bluetooth to exchange information. This information, including the user’s unique identifier and the telemetry data that calculates proximity to another person/phone, is kept on an encrypted record that is erased after 14 days. Secondly, it is an end-to-end, open source solution that uses a special API available in iOS and Android smartphones to implement exposure notifications. Open source technology has a number of benefits, including greater transparency and better security that comes from thorough vetting.  

Exposure notification solutions like PathCheck’s help alleviate some of the challenges associated with manual contact tracing, as they can track exposure between parties who do not know each other or may not even be aware they were in proximity to each other. By rapidly delivering notifications to people who have been exposed, exposure notifications reduce spread by triggering people to self-quarantine faster than the cycle with manual tracing.

Additionally, the footprint created by the large-scale adoption of these types of exposure notification apps can provide a unique channel that governments can use to reach consumers going forward. These solutions provide a privacy-preserving, decentralized, scalable platform for distributing vaccines, tracking adverse reactions, and providing verifiable credentials online and offline.

Getting the general public on board

Data shows that broad adoption of exposure notifications could help significantly reduce the spread of Covid-19. Modeling by the University of Oxford shows that the impact of exposure notification apps increase as they are adopted in a population. So, 15% adoption would result in a 15% decrease in infections, and an 11% decrease in deaths.

But, as with any app, the impact of exposure notification solutions relies on getting people to actually download the app. And many consumers remain uncertain about contact tracing apps, their effectiveness and their privacy.

That was a major factor for Ireland’s Health Service Executive (HSE), which coordinates resources and efforts across eleven regions. To help slow the spread of Covid-19 and protect the entire population, the HSE worked with an app developer to create a contact tracing app that harnesses Bluetooth technology to improve and speed up contact tracing. But the HSE recognized that in order for the app to be effective in helping slow the spread of the virus, they needed a coordinated effort to convince the public to download and use it.

Our pals at Dept stepped in to coordinate efforts with the HSE to create a website, write accessible content, and draft social media assets to explain and promote the app to the general public, the media and other stakeholders. Also, the roll-out of Ireland’s coronavirus contact tracing app was set against a background of media scrutiny and privacy concerns around the technology involved. So it was crucial that any content created addressed and reassured the general public about data and privacy issues.

By tackling the challenge of raising awareness for Ireland’s Covid-19 Tracker app in a 360-degree manner, the HSE was able to deliver quality content that focuses on transparency and public reassurance designed in a simple and effective website that encouraged citizens to use the contact tracing app.

Innovating without precedent

There is no precedent for using this type of digital technology as part of public health response to a disease or outbreak. This is unchartered territory, and these solutions were developed in the middle of a pandemic. So we are learning as we go. But any impact in reducing the spread of the virus is a good thing. And everything we are learning today will help us make better solutions and decisions when it comes to future public health crises.

On a broader scale, there is a significant opportunity for the expanded adoption of these types of privacy-preserving exposure notification solutions as a complement to other response strategies in the future. Pandemic digital response apps can be converted into general-purpose apps for public health services. And public health authorities will be able to acquire significant, anonymous user bases for their digital channels to support other public health interventions at scale.

By facilitating more open source, privacy-preserving, inclusive public health solutions, the technology industry can help create platforms that will both protect our privacy and serve people and our communities long into the future.