The struggle to create COVID-19 contact-tracing apps

Image source: Shutterstock/PST Vector

The emergence of the coronavirus COVID-19 switched a spotlight onto digital health technologies. Most countries tried to contain the virus with a more or less comprehensive set of lockdown measures – now being slowly lifted alongside lowering infection rates. To prevent the infection rates from surging again, many governments are looking into coronavirus contact-tracing apps that could help to disrupt infection chains early on. The study ‘Investigation of a COVID-19 outbreak in Germany resulting from a single travel-associated primary case: a case series’, recently published in The Lancet, confirms that such an app is a crucial tool to contain the pandemic.

How a contact-tracing app works

The basic principle of such an app is the exchange of individual identification numbers when people meet, a specific minimum distance is not maintained and a defined period of time is exceeded. The strength of the Bluetooth signal estimates the distance. The app issues a so-called daily tracing key for each user which, in turn, generates a short key several times per hour. If a person tests positive for SARS-CoV-2 he/she must enter this information in the app. All smartphones regularly retrieve a list of anonymised IDs of infected people to determine whether a user was in contact with an infected person. Those affected are asked to test for SARS-CoV-2 and self-isolate, whilst their identity is not revealed.

Experts point out that a coronavirus contact-tracing app is only effective if at least 60 percent of the population use it. This poses the question whether the use of a tracing app should be mandatory or voluntary. Each society will have to decide about this based on its values. Surveys in Germany have shown that about 50-70 percent of the population are prepared to install such a tracing app – if privacy is protected. 

Centralised vs decentralised data storage

This is a controversial issue. In Germany, the government did an about-face and finally settled on a decentralised data storage architecture after it initially favoured a centralised approach. The same might happen in the UK. In the centralised storage approach, the server traces with whom an infected person was in contact; in the decentralised approach this task is performed by the individual smartphones.

The Pan-European-Privacy-Preserving Proximity Tracing Consortium (PEPP-PT) supports a centralised approach, which in turn is supposed to be implemented in national tracing apps. However, especially Apple and Google favour a decentralised approach. They plan to jointly develop the basis for a tracing app on a system level, to enable data exchange between their systems and, consequently, between the majority of smartphones. The two tech companies opt for open source and anonymity. They announced they would make their smartphone programming interfaces for the coronavirus tracing apps available for only one application per country to ensure a homogenous app landscape. Nevertheless, they agree to cooperate with countries that wish to have different apps for different regions. 

Apple and Google are not involved in the actual development of the app – this is taken care of by developers in the individual countries. The app will be made available for download via the app stores. There will not be a central database where the IDs of the mobile devices are stored; most data will be stored locally on end users’ mobile phones. 

The UK, France and Norway opted inter alia for centralised data storage while Germany, Italy, Switzerland and Austria adopted the decentralised approach.

Country comparisons

China’s mandatory tracing app

When the lockdown was lifted in Wuhan in April, a mandatory COVID-19 tracing app was introduced. This is linked to a user’s ID and the data is accessed centrally. The app is integrated in the popular messaging app WeChat and in the widely used online payment system AliPay. 

The app uses augmented reality (AR) and needs the ability to scan QR codes. Users must provide certain information on their health status. Moreover, the app accesses other information, such as recent travel data, information regarding the social environment and health records. After having processed this data the app issues a colour code to the respective user granting (green) or denying access (red) to certain locations. A yellow respectively red code means one week and respectively two weeks self-isolation. Only those with a green code are allowed to use public transport and enter shopping centres.

Germany, Italy and the UK opt for voluntary cooperation

In late April, the German government asked Deutsche Telekom and SAP to develop a contact-tracing app based on a decentralised data storage concept. On 13 May, a preliminary concept was presented on Github with a roll-out target of mid-June. The app was launched on 16 June under the name ‘Corona-Warn-App’.

The decision by the German government to abandon their initially favoured PEPP-PT solution was a response to severe criticism by data protection advocates. According to the government, it fully complies with European and German privacy laws. Only epidemiologically relevant contacts in the past three weeks should be stored on the users’ smartphones in anonymised form. Movement profile will not be stored and the use of the app is voluntary.

‘Immuni’ is the Italian version of the coronavirus contact-tracing app developed by Bending Spoons S.p.a. Its use is voluntary, and users will maintain control over their data. Only when a person tests positive for SARS-CoV-2 will the data be transmitted to a server. All recent contacts will be identified via Bluetooth and alerted. According to Bending Spoons, the app, which was launched 8 June, complies with European privacy laws. The company granted the Italian government rights of use and future updates free of charge.

UK follows a two-pronged approach

Originally, the British government opted for a centralised data storage architecture with users uploading their data to a central government server as soon as they develop corona symptoms. A test version of this app is available in the app stores and has been tested since 5 May on the Isle of Wight. If the test results are satisfactory the app will be rolled out UK-wide. However, there is a discussion as to what will happen with the data post-pandemic. Matthew Gould, CEO of NHSX – the digital innovation arm of the English National Health Service (NHS) – explained that the NHS will use the data only with the data owner’s consent and will be stored a maximum of 28 days.

In the meantime, however, technical and ethical concerns were raised within the government and a second app with a decentralised architecture is being developed just in case the first app turns out to be not supportable. So far, the NHS has not committed to a timeline on when the app will be launched.

Upon publication of the article in Lancet, Professor Annelies Wilder-Smith of the London School of Hygiene & Tropical Medicine publicly emphasised the significance of a contact-tracing app. ‘All countries that have introduced rigorous contact tracing were most effective in keeping the number of newly infected people small. South Korea, Taiwan, Hong Kong, Thailand, Vietnam and Singapore are clear examples of countries that do not economise on resources and technology to carry out rigorous contact tracing.’ Hopefully, the app will be rolled out soon and using international standards so that it can support all users once travel restrictions are lifted.

13.07.2020

• apps (94)
• coronavirus (703)
• healthcare politics (255)
• IT (883)
• mobile devices (51)