As researchers and public-health experts struggle to contain a global pandemic, some are harnessing the latest digital technologies for epidemiological detective work. Smartphones and other digital devices shed valuable data trails that a growing number of nations are capturing and using for aggressive surveillance systems to suppress coronavirus disease 2019 (COVID-19) outbreaks. But many of these tactics would cross liberty, consent, and privacy boundaries, especially in Europe and the United States. Now, cybersecurity and public-health officials are exploring new digital tools that could help track the disease without invading individuals’ private lives.
The rapid transmission rate of COVID-19 presents a challenge to local health departments. The epidemiological chain of test, trace, and isolate often cannot keep up with swiftly escalating numbers of new infections. In traditional—manual—contact tracing, trained health-care workers interview infected individuals by phone, at home, or in hospitals. Tracers then reach out to the infected person's contacts, asking them to self-isolate and get a test, treatment, or vaccination if available. Tracers follow up to check on contacts’ health status. It is a slow, laborious, and often inefficient process. Now, digital smartphone apps are being developed to supplement manual tracing and to identify new infections faster.
This illustration reveals spikes on the outer surface of Severe Acute Respiratory Syndrome coronavirus 2 (SARS-CoV-2), which causes the illness known as COVID-19. The spikes create a corona-like effect, giving these types of viruses their name. Illustration: Centers for Disease Control and Prevention.
COVID-19 is caused by the novel virus SARS-CoV-2. When the coronavirus jumped from an animal host into the human population sometime late in 2019, no one had immunity (measured traditionally by a host antibody that cripples the virus) to the pneumonia-like respiratory illness.
Like influenza, COVID-19 is transmitted by respiratory droplets from person to person, especially in confined spaces, such as homes and workplaces, and particularly in nursing homes and prisons. It could take many months or even years to develop a safe, effective vaccine. Even if a vaccine could be created quickly, manufacturing, distributing, and administering hundreds of millions of doses in the United States—let alone the rest of the world—would likely take much longer. In the meantime, many countries hope to speed up the epidemiological chain with help in the form of emerging digital technologies.
Choosing public health over privacy
Several countries in Asia—notably, South Korea—immediately moved to establish containment systems for COVID-19 that were effective but intrusive. South Korean citizens who tested positive for COVID-19 would be isolated in a government shelter, in a hospital, or at home, depending on their symptoms. Then, a contact tracing team would swing into action. Working as public-health detectives, tracers searched for people who recently crossed paths or interacted with an infected individual. Health officials accessed location data—travel, social, and shopping trails—from mobile phones, car GPS systems, public cameras, and credit card records. Within two hours, the officials would post an online map of locations where the affected person had spent time, warning others about potential exposures. Although they were anonymized, the posted data would include the individual's gender, their home neighborhood, even the names of specific businesses that had been patronized.
“In some cases, officials released enough information to make infected people with COVID-19 publicly identifiable, leading to cases of online harassment,” says Josephine Wolff, who researches cybersecurity policy at the Tufts University Fletcher School of Law and Diplomacy.
South Korea's public-health officials were able to move more rapidly through the epidemiological chain with the aid of new technologies. Those who test positive or are potentially exposed are quarantined at home and must download an app that warns police when they leave their home. A monitoring team conducts daily checks, asking about symptoms. Those who become very ill are assigned to the government's living and treatment support facilities, where they are monitored. If their symptoms worsen, they can be hospitalized. Digital contact tracing was effective in South Korea because its health departments also provided widespread and easily available testing, interview-based traditional tracing, and isolation of infected people and their contacts.
Customers received body temperature checks before they could enter a supermarket in Wuhan, China, during the COVID-19 outbreak. Photograph: Painjet.
Similarly, Hong Kong surveils families quarantined at home with electronic wristbands. Taiwan does the same with mobile-phone signals. China monitors quarantine compliance by programming government-installed cameras to watch infected people's homes. Israel's Justice Ministry ordered Shin Bet, the nation's secret service, to repurpose its terrorist-tracking system to trace the coronavirus. Other countries enforce curfews and other measures with the use of facial recognition cameras equipped with heat sensors, surveillance drones, and public cameras.
Prioritizing civil liberties
To Americans and Europeans, these measures may be seen as going too far. Now, coalitions of researchers, technologists, and governments around the world are racing to develop new privacy-preserving COVID-19 tracing apps. The US federal government is working with Apple and Google on an opt-in tracing feature for their operating systems (OS), which run on 99% of smartphones. Eight out of 10 Americans own a smartphone.
A contact-tracing app or OS feature must be used by between 40% and 70% of smartphone owners to be effective, reaching an adequate saturation of the population. But polls show that many Americans remain worried about privacy invasions.
Civil liberty advocates argue that health officials should not have to choose between fighting COVID-19 and protecting individuals from aggressive government surveillance and data snooping. “We need a contact tracing model that could work in just about every regulatory regime on the planet,” says Peter Eckersley, an artificial intelligence researcher based in Melbourne, Australia, who convened a group of technologists and epidemiologists called stop-covid.tech. “We’re afraid that if a great privacy protecting model isn’t developed, then there will be other models that protect privacy less well and perhaps also are less effective at fighting the coronavirus.” Models that fail to protect privacy would not be used by enough people to work.
Top10VPN, a digital-privacy consulting company based in the United Kingdom, has documented 47 contact tracing apps globally (as of 10 June 2020), with many more scheduled to be rolled out, according to its COVID-19 Digital Rights Tracker.
Public playground equipment was off limits during COVID-19 mitigation in Australia. Photograph: John Robert McPherson
Most European countries are developing, testing, or rolling out contact tracing apps. Governments have been studying the methods used in Southeast Asia and considering how far they can go in putting aside individual freedoms and privacy rights for the sake of public safety,” says Claudia Pagliari, a senior lecturer who studies data ethics and digital health at the University of Edinburgh, in the United Kingdom. “Privacy commentators and ethicists do recognize the ‘greater good’ argument. But they also recognize that there's a thin end of the wedge. And if you push that wedge in too far, you can split the whole tree. We want to make sure that where these methods are used, they don’t overreach into other areas of people's lives and that once used they don’t become permanent.”
Contact tracing
Manual contact tracing is time consuming. It typically requires 3 days to identify and communicate with an infected person's contacts. Manual tracing has been very successful in tracing sexually transmittable diseases (STDs), particularly syphilis, limiting its spread and increasing treatment for affected individuals. But STDs are characterized by smaller numbers of contacts, are often slow moving, and can be identified before the onset of symptoms.
Contact tracing is far more difficult for COVID-19, a highly infectious respiratory disease. Tracers might have to search for potential contacts who sat near an infected person on an airplane flight or at a sports event. Manual tracing depends on people's memories, which can be inaccurate, especially when patients are sick and exhausted.
Local health departments have lacked adequate numbers of trained manual tracers for even slow-moving diseases such as syphilis and tuberculosis. “We need an infrastructure that can quickly hire and train community health workers,” says epidemiologist Caitlin Rivers of the Johns Hopkins University Bloomberg School of Public Health. “In some rural areas, there may be just one epidemiologist for several counties. We are not resourced to do contact tracing on the scale that we would need to do for this pandemic.” But ramping up a system could be done, she said. “In West Africa, during the 2014 Ebola outbreak, there were thousands of people who needed monitoring to make sure that they didn’t develop symptoms. That outbreak happened in a resource-limited environment, but thousands of volunteers or newly hired employees were trained to do this work. And they implemented it in their own communities.”
In the city of Wuhan, where the COVID-19 pandemic first took hold, China hired and trained 9000 workers for the job. By contrast, the US Centers for Disease Control and Prevention (CDC) and state health departments employed a total of 2200 tracers in the early months of the COVID-19 crisis. In April 2020, the Massachusetts state government hired 1000 new contact tracers, and other states and localities plan to recruit and train workers.
The United States should hire an army of 100,000 contact tracers, according to an April 2020 report by the Johns Hopkins Center for Health Security, “A National Plan to Enable Comprehensive COVID-19 Case Finding and Contact Tracing in the US.” Others say far more will be needed. According to Resolve to Save Lives, a public health advocacy group run by Thomas R. Frieden, the former director of the CDC, the United States will need at least 300,000 new tracers.
But hiring more tracers will not address the problem's scale, noted a team of Oxford University scientists in an article in Science published 31 March 2020. The infection's “viral spread is too fast to be contained by manual contact tracing.” About 5% of infections are transmitted by people who never develop symptoms. About 45% come from carriers before they feel symptoms such as dry or sore throat, headache, nausea, and loss of taste and smell. This presymptomatic infectious period is 2–5 days, according to recent studies. About 10% of infections come from the environment, such as viral loads on surfaces. About 40% of infections come from symptomatic people. From first symptoms to hospitalization—when testing is most common in the United States—is a period of 5 days on average. Many COVID-19 transmissions, then, happen over a period of 7–10 days while infected Americans can remain untested.
Which nations were prepared for COVID-19?
COVID-19 is the third dangerous coronavirus to appear in recent years. SARS emerged in 2002–2003, and MERS (Middle East respiratory syndrome) coronavirus was first identified in Saudi Arabia in 2012. SARs was smothered by health surveillance systems within a year, but not before it was reported in 26 countries and sickened 8098 people worldwide, causing 773 deaths. SARS was deadlier per case than COVID-19, but individuals with SARS were not contagious until they had symptoms, as far as researchers know.
This image taken during the 2014 West African Ebola outbreak depicts US Centers for Disease Control and Prevention Epidemic Intelligence Service officer Dr. Djawe, seated on the right, as he was completing his daily tally sheets from his contact tracing visits in the city of Kamian, Guinea. Photograph: Centers for Disease Control and Prevention.
“SARS really frightened South Koreans,” says Alexis Dudden, a historian of East Asia at the University of Connecticut. “They were not ready for it. But special governmental units were created in a variety of different bureaucracies and never dismantled. Once the South Korean government made the decision that COVID-19 was coming, they were up and running within hours.”
MERS was reported in 27 countries. It arrived in South Korea in 2015, racing through hospitals, infecting 186 and killing 38 healthcare workers before authorities identified and contained the coronavirus. The public demanded more transparency about locations and identities of affected hospitals. South Korea revised its infectious-disease control and prevention law, allowing authorities to shut down facilities and gain access to personal information of anyone infected or at risk.
It may seem surprising that South Korea, known as a vibrant liberal democracy, has embraced such aggressive surveillance methods. “South Koreans have fought for the ability to be private citizens in a democracy,” says Dudden. For decades, South Koreans battled authoritarian regimes for greater protections of privacy and free speech and to stop blacklisting of journalists and artists for political stances. South Koreans view their government's current behavior differently. “Now people are less concerned that government might surveil what books you’re reading and what Internet sites you’re on,” Dudden continues. “They’re more concerned with how to prevent the total collapse of the society. They see it as a time of war. Future philosophical debates, they believe, can address, ‘Okay, what do we do in the next outbreak in terms of privacy protections?’”
In the fight against COVID-19, South Korea, Singapore, and Taiwan have benefited from effective social safety nets, including universal health care and insurance. For its 5.6 million citizens, Singapore covers the cost of all COVID-19 treatments and tests, which are widely accessible, and provides sick pay for people who stay home. National healthcare systems have also helped health departments surveil and trace the virus. One week after the first case arrived in Taiwan, the nation's officials merged national health-insurance information with customs and immigration databases in an effort to identify citizens who had recently traveled overseas and reported symptoms consistent with COVID-19. The US healthcare system, by contrast, is highly decentralized, with patient data housed in various silos. Hospitals and other healthcare organizations and insurance companies often use different information formats and protocols.
The Middle East respiratory syndrome (MERS) is a viral respiratory illness caused by a coronavirus called MERS-CoV. This colorized scanning electron micrograph of MERS shows virus particles (yellow) on the surface of infected VERO E6 cells (blue), which are used in cell cultures. Image captured and color-enhanced at the NIAID Integrated Research Facility in Fort Detrick, Maryland. Credit: National Institute of Allergy and Infectious Diseases.
Further reading.
Ferretti L, Wyman C, Bonsall D, Fraser C, et. al. 2020. “Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing.” Science 368 (art. eabb6936.
https://science.sciencemag.org/content/early/2020/04/09/science.abb6936
The Covid Tracking Project. https://covidtracking.com/
Edmond J. Safra Center for Ethics at Harvard University. 2020. “Roadmap to Pandemic Resilience: Massive Scale Testing, Tracing, and Supported Isolation (TTSI) as the Path to Pandemic Resilience for a Free Society.”
https://ethics.harvard.edu/files/center-for-ethics/files/roadmaptopandemicresilience_updated_4.20.20_0.pdf
Even Italy's highly regarded national health care system struggled to share crucial data and testing methods and protocols. Italy's system is decentralized administratively by region and even subregion. “Each person has a single ID and can be linked across all databases,” says Fabrizio Carinci, a healthcare statistician with the University of Bologna. “If a person has a prescription, they have only one doctor, and they are assigned to only one local healthcare authority. But regions didn’t share coronavirus data very well with one another during the outbreak. Regions have different attitudes [about managing the crisis] and particularly towards testing. We have all these different testing approaches in Italy and totally different approaches in the rest of Europe.”
Privacy protections and speed
Italy activated a new contact tracing app in June. But many Italians may resist such an effort as an invasion of privacy and an imposition on individual freedom, according to Carinci. “You would find a lot of opposition,” he says. “People would start looking for any possible way to trick the system and avoid being identified. And I think this would apply to most countries in Europe.”
Digital contact tracing can be based on location data from a mobile phone's GPS or cell towers, which can contain an “enormously invasive and personal set of information about each of us, with the potential to reveal such things as people's social, sexual, religious, and political associations,” according to an 8 April 2020 report, “The Limits of Location Tracking in an Epidemic,” by the American Civil Liberties Union, which notes, “The potential for invasions of privacy, abuse, and stigmatization is enormous.”
After 50 days fighting COVID-19, Arvin McCray was released by the Milwaukee VA Medical Center. For 18 days, he had been on a ventilator and had suffered multiple organ failure. Photograph: Milwaukee VA Medical Center.
But location tracking is not accurate enough to tell whether two people come into close physical contact. Instead, many contact-tracing apps use proximity tracking with Bluetooth Low Energy (BLE), a wireless technology that connects phones to other devices close by. BLE can determine whether two smartphones are near enough for their users to transmit the virus. When two users of the same app are close to one another, both phones estimate their proximity using Bluetooth signal strength. If users are less than about six feet apart, the apps exchange identifiers. Each phone app logs and stores each encounter with another's identifier. When app users learn that they are infected with COVID-19, they can anonymously volunteer this information on the app, and other users can be notified of their own infection risk. Local health departments might develop an app and receive individuals’ proximity data to hasten contact tracing if participants agree to use it.
“The goal is to identify a phone used by someone you spent maybe five or 10 minutes with, maybe a meter or two away, who has tested positive for COVID-19 and volunteered that information on the app,” says Eckersley.
But proximity tracking can also reveal sensitive information, such as whom individuals have spent time with.
“That's a hard sell” in the United States, says Manoj Jain, an infectious-disease specialist and epidemiologist at Emory University and an aide to Memphis, Tennessee, Mayor Jim Strickland on the administration's coronavirus response. “Our society is not there yet in recognizing and appreciating the benefit of this technology versus the risk to privacy. We value privacy more. Can such tools work? And are they useful? And the answer is definitely yes.” But many people would have to use them to be effective, he says.
Types of contact tracing
The European Union has released contact-tracing guidelines for its member states, encouraging them to develop voluntary apps with decentralized data storage to protect privacy, and some nations have already done so. Individuals would store their data on their smartphones.
But not everyone has access to a phone. Not all phones have Bluetooth technology. Many users do not turn on Bluetooth. Those people would be left out of the tracing system. Bluetooth can also be an insecure technology. Advertising companies often use Bluetooth to trace shopper behavior in stores. Apps on cell phones emit longitude and latitude readings, making it possible to track consumers. Location data are often triangulated with personal information. Although anonymized, these data can be unmasked to reveal identities—names, addresses, phone numbers, and health status. Advertising companies and others could hack Bluetooth signals and download invaluable data stored on smartphones.
“A second type of contact tracing app system uses encryption, so these data are stored in central databases but can’t be read by anyone,” says Eckersley. “Think of the central database as being like a notice board, where sealed envelopes of messages from smartphones get pinned up and retrieved. An encrypted envelope notifies a smartphone owner, ‘Okay, you should isolate, get tested, and if you wish to schedule a call with a local public health official, the app can help you with that.’ But this choice must be made by an individual rather than something that goes through a big government database.”
A centralized host for a contact tracing system should be a trusted, nonprofit organization—not a private technology company or the federal government, according to a 2020 report by the Center for American Progress, a think tank in Washington, DC. Congress or foundations could provide funding to develop and operate technology. States could license the app and provide ongoing operational funding to the nonprofit if states receive federal funding for this purpose. All Americans would be encouraged to download surveillance apps to their phones.
But a centralized system can be insecure too. If millions of people transmit private health data to a server, companies, governments, or hackers might gain access to their movements and personal interactions.
Most European nations have stringent digital data privacy measures in place based on the European Union's General Data Protection Regulation, but some are adjusting laws to address the coronavirus crisis.
“We’re in a crisis period just now,” says Pagliari. “Even countries with very strong privacy laws are implementing more intrusive measures to understand how the virus is spreading and inform interventions. Germany has some of the strongest privacy laws, mainly because of the way information was abused in the Second World War, but they are still finding ways to develop things like contact tracing apps, which can be used for public health. Health emergencies like COVID-19 can force both governments and citizens to reevaluate and recalibrate their views about the acceptable balance between safety and privacy risks. But for more digital surveillance to be accepted by Europeans, fear of illness is not enough. We also need strong assurances that these uses of technology are properly governed, that our privacy will still be respected, and our information safeguarded. We also need to know that our governments are being transparent with us about the scope and powers of surveillance, how these will be stepped up or down as threat levels ebb and wane, when enhanced powers will come to an end, and what will happen to our data once the epidemic is over.”
It is crucial to have an expiration date for a surveillance project, stress civil liberties advocates. “Ending it should be built into the system from the get-go,” says Wolff of Tufts University. “It's important not to say, ‘Let's use this [surveillance] and keep using it until we don’t need it anymore,’ because that's often how you end up in a situation where it never actually expires or goes away.”
A physician checks on a patient connected to a ventilator. At the height of the pandemic, ventilators were in short supply. At the same time, being placed on a ventilator comes with considerable risk and can have long-lasting ill effects on some patients. Photograph: Official US Navy.
An effective testing and surveillance effort for COVID-19 must reach the most vulnerable. Migrant workers in Singapore live beyond the city-state's safety net and testing systems. After Singapore had apparently suppressed COVID-19, an outbreak surfaced in migrant workers’ dormitories, accounting for most of the 25,000 confirmed cases by mid-May.
In the United States, people who are disproportionately affected by COVID-19 include minorities, the poor, the homeless, and the elderly who might not have access to digital devices. Many frontline workers are low wage, part time, or independent, lacking sick leave or health insurance. To keep their jobs and sustain their incomes, they might avoid digital tracing apps. Many immigrants, especially those who are undocumented, are worried about being targeted by immigration enforcement agencies or the police. Some false positives would be inevitable, even in the most sophisticated tracing system, and app users who receive frequent proximity notifications might simply turn the app off.
Where are we now?
Vaccines, antiviral therapies, and other measures could reduce the intensity of outbreaks, but that will take time. Meanwhile, the COVID-19 pandemic has exposed weaknesses in many nations’ social safety nets, health care and insurance systems, and public health programs. Now countries are working on new surveillance sensors and systems to trace infections and stamp them out before they can spread exponentially. But public trust is weak in many nations. Americans, Europeans, and others are worried about privacy and consent implications of surveillance. Technology companies and governments creating these tools must convince the public that private data will be protected and that surveillance systems will have clear expiration dates, preventing permanent snooping of citizens. At the same time, the global health community and national governments must increase support for public health departments and cooperate in more comprehensive surveillance systems, identifying and containing future infectious diseases that have potential to become pandemics.
Author Biographical
John H. Tibbetts (tibbettsjh@gmail.com) is a freelance science writer based in Charleston, South Carolina.