Let’s start by defining a parameter called basic reproduction number or R0, the typical number of infections caused by any infected individual before there is widespread immunity in the community. Later, as the disease spreads, the effective reproduction number, or R, becomes less than R0. Eventually R becomes less than 1, in which case herd immunity will have been achieved.
Ferretti and colleagues calculate the R0 for SARS-CoV-2 to be 2.0. In their paper in Science Magazine, they break the number down as follows: 0.9 from pre-symptomatic, 0.8 from symptomatic, 0.2 from environmental (such as contaminated surfaces, etc) 0.1 from asymptomatic (people that never develop symptoms) transmission.
Social distancing and implementing quarantine by contact tracing can be thought of as measures that aim to reduce R to a value below 1 to have the same effect as herd immunity would achieve (sustained epidemic suppression). The problem is that for COVID-19, contact tracing and quarantining would have to be done at a speed that is just not realistically achievable. Just to give you an idea: health authorities would have to be able to identify 70% of newly infected people, and then 70% of the contact persons would have to be identified and effectively quarantined within 1 day (!) to push R below 1. It’s not hard to see, how this may be problematic. This is where a mobile phone App would be able to help.
And here’s how it would work: the App would store location data for a limited time. People who develop symptoms would use the app to notify health authorities and then get tested (ideally immediately, and at home). If the test is positive, the app automatically notifies all the people this person came in contact with within a predefined time frame so that they can go to self-quarantine. If testing is not widely available (this is the case in several countries), the platform may be adapted in a way that symptomatic individuals are automatically considered positive for COVID-19. This is an especially valid approach for people, who have been identified through contact tracing by the App, since their pre-test probability to have the virus is much higher. Thus, time required to organize a test, wait for results and then perform contact tracing can be very efficiently reduced, and contact isolation can happen almost instantaneously.
It should be noted that both China and South Korea have used apps that operated on similar principles, and both countries have managed to achieve sustained epidemic suppression.
Ring a bell…?
One doesn’t have to look hard to see that we have been here before. After September 11, 2001 the Patriot Act was signed into law within days. It has been with us ever since. Yes, I am comfortable saying “us” as a non-US citizen, since the patriot act probably has an effect on everyone who is connected to the online world. It has allowed the US intelligence community to build the current surveillance infrastructure that has become the standard. The only serious blow this system of surveillance has ever had to endure was the one caused by the Snowden-revelations in 2013. It is the prime example of measures introduced fast as lightning in the wake of a national emergency, where everyone who dared to suggest thinking twice about the consequences of giving government such drastic powers was immediately labelled a traitor. The very same argumentation and the very same process could now happen in many countries, where governments are all too eager to expand their power, profiting from the current fear and lack of attention by their citizens scared of the coronavirus and having their hands full of dealing with the economic repercussions of the current pandemic.
Avoiding a privacy nightmare
All this being said, how can we have our cake and eat it too? Is it technically possible to build a contact tracing app, while preserving its users’ civil rights and privacy? It seems to me that it is and it has. But let´s roll back a little – what are the characteristics that such an ideal app should have?
- Voluntary: first and foremost
- Anonymous (no registration or accounts)
- Decentralized
- Open source
- Preferably avoid collecting data, that can personally identify you, such as IP-addresses and information about your devices
- Specifically avoid collecting and storing location data
Obviously, the prototypic Corona-Apps deployed in China and South-Korea have done a poor job in fulfilling most (or all) of these criteria, they have, however, arguably been effective in controlling the epidemic.
The solution to build a Corona App that is suitable for the general public in countries with strong privacy laws, such as in the European Union, lies in the use of a technology called “Bluetooth Low Energy” (BLE), a function available in Android Smartphones and iPhones that can constantly scan and identify other Bluetooth devices in the immediate vicinity. “Low Energy” means that the extra battery drain is kept tolerable (still significant). Apple and Google both developed this functionality early on in the pandemic for their respective platforms (“COVID-19 Exposure Notifications” for Android and “COVID-19 Exposure Logging” on iPhones), but they only grant one official App per country the Application Programming Interface Key (API Key) required to access this feature.
By relying on the identification of smartphones that a given individual (and their phone) have been in the close proximity of in a critical time frame, Bluetooth Low Energy provides a means for contact tracing without the necessity of using geographical location data. Signal strength is used to estimate the distance between the two devices (although this might not always be accurate, as discussed here).
While most versions of the App in EU member states are fulfilling the conditions outlined above, the differences mostly lie in the “decentralized” nature of the App. The argument for a centralized approach is that it is in the public interest, to provide health agencies access to information on infection clusters, to facilitate research on relevant phenomena (such as “superspreading”). For instance, France opted for a centralized version and to develop its own app independent of Google/Apple. Others believe that the advantage is not worth the risk of privacy violation by the government. I agree with the latter.
Germany’s Corona Warn App
The Robert Koch Institute (German CDC) provides the official contact tracing app for Germany, called the “Corona Warn App” that was rolled out last Tuesday, June 16. Ilona and I downloaded the app yesterday, also taking the time to read the “Data Privacy Information” in detail. Germany is traditionally strong on privacy law, so as expected, the German model for the app is a completely decentralized one. The App uses the APIs provided by Apple and Google, and has been developed by Telekom and SAP. The code is open source and has been extensively reviewed. Randomly generated identifiers of the devices are exchanged and stored for 14 days in devices that come in the vicinity of each other (currently 2 m). The identifiers are not shared with the servers of the RKI. If a user is tested positive for COVID-19, they may decide to enter the test result into the app using a QR code generated by the testing laboratory, or using a TAN number provided by the hotline of the app if the given lab doesn’t support QR codes. In case of a positive test result, contacts (<2 m, over 15 min of proximity) are notified via the app using the anonymous device identifiers stored in memory, and contacts receive suggestions for further action (ie. get tested or self-quarantine). Currently, efforts are being made to make national apps relying on the Google/Apple API framework compatible with one another, to facilitate use of the app across borders and make travel within the European Union safer in terms of infection control.
So we have the App – what now?
Apps are launching all over Europe, in Germany 8 million people downloaded the Corona Warn App in the first week after launch. As shown by model calculations in the Science paper by Ferretti et al, 60% of contacts of an infected person need to be identified and effectively quarantined in the case of instantaneous contact tracing to push R below 1 – which can be translated to 60% of the population needing to have the app on their smartphones (and willing to go to quarantine based on notifications from it) to produce the same effect as real herd immunity. Even if this goal seems far away, this doesn’t mean that fewer people using the app wouldn’t have any effect at all. On the contrary, it will contribute to other interventions such as social distancing, face masks, limiting crowds and traditional contact tracing. However, a large proportion of the population using the app may allow governments to relax some measures still necessary for pandemic control, thereby relieving tensions on the economy and improving our quality of life.
Downloading the app is voluntary – but what if private businesses start to require their employees or prospective clients to use the app? Say you are not allowed into a restaurant, unless you show that you are “Low Risk” according to the app. Thus it will still be voluntary, but may become discriminatory. Currently, at least in Germany, no extra legislation exists governing the use of the app. Instead, existing privacy laws relying on “informed consent” are supposed to be sufficient as legal basis for its widespread use. This is the first time anything similar is attempted, and we should remember that technology (smartphones) is being repurposed to be used for something that it was not intended for (pandemic control). For the moment, I am cautiously optimistic about contact tracing apps relying on the decentralised, Bluetooth-based model. May the apps prove as efficient as predicted. However, safeguards and open-source code aside: governments and tech companies are once again asking us to trust them – we can only hope that this time, they won’t abuse it.
Sources
Ferretti et al, Science 2020 Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing
Glenn Greenwald interviews Edward Snowden on the privacy aspects of Corona Apps
The Intercept – Responsible Coronavirus surveillance
The Intercept – Possible technical issues with Bluetooth-based contact tracing
About the French Stopp Corona App
Spiegel on Corona Apps
Podcast – Lage der Nation from 20.06.2020 on the Corona Warn App