Digital contact tracing for COVID-19

KEY POINTS

• App-based contact tracing has the potential to address traditional contact tracing’s limitations of scalability, notification delays, recall errors and contact identification in public spaces.

• The effectiveness of contact-tracing apps in identifying exposures depends on widespread use of individual apps and the ability of their underlying technologies to identify nearby phones.

• Use of contact-tracing apps brings inherent trade-offs between privacy and effectiveness.

• Before being released, apps must be field tested in real-world conditions to understand their sensitivity and specificity for identifying exposures.

• Integrating app-based and traditional contact tracing may leverage the advantages, and mitigate the limitations, of each approach.

The rapid spread of severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) exceeded the capacity of many public health agencies to undertake traditional contact tracing. To address the limitations of traditional contact tracing, numerous governments — including those of Alberta in Canada, Australia, France, Germany and the United Kingdom — have deployed or expressed interest in digital contact tracing.^1–5 Although the benefits of digital contact tracing may be appealing, in considering whether to adopt these technologies, public health agencies and governments must also consider their technical limitations and the inherent trade-offs between privacy and effectiveness. Furthermore, success of digital contact tracing will depend on access to diagnostic testing, widespread adoption and the ability of the underlying technologies to identify exposures. We analyze the strengths and limitations of digital contact tracing, to inform governments and others in their considerations of whether and how to deploy these new tools.

What is digital contact tracing?

In traditional contact tracing, public health officials interview an infected individual, identify contacts and advise exposed contacts to self-monitor for symptoms, self-quarantine or obtain medical evaluation and treatment. This approach has had success in reducing infection transmission in many epidemics, including severe acute respiratory syndrome–associated coronavirus (SARS-CoV) and Ebola.^6,7 However, limitations have become apparent during the coronavirus disease 2019 (COVID-19) pandemic. Traditional contact tracing is labour- and time-intensive, making it challenging to scale with increasing numbers of people infected with SARS-CoV-2. Furthermore, it is less effective as COVID-19 has a shorter serial interval.⁸ Recall errors and exposures in public settings can further impede contact identification.

Digital contact tracing makes use of electronic information to identify exposures to infection; it has the potential to address limitations of traditional contact tracing, such as scalability, notification delays, recall errors and contact identification in public spaces.

Multiple digital contact tracing paradigms are possible. Several countries, including South Korea and China, have adopted involuntary data collection systems, such as use of security camera footage, financial transactions and cell phone location data.^9,10 However, lack of participant consent in such systems and infringements on individual privacy make them less likely to be accepted in North America and Europe. Voluntary approaches to digital tracing have focused on the development of mobile applications (apps) that can be downloaded on an opt-in basis.

Most COVID-19 contact-tracing apps use Bluetooth signal strength to infer distance between smartphones and define exposure status based on distance from, and duration of proximity to, an individual subsequently identified as infected. Bluetooth-based apps have been released in Alberta, Australia and Singapore using a framework developed by Singapore’s Government Technology Agency.^11–13 Separate protocols are in development in France and Switzerland.^14,15 In May 2020, an Apple–Google collaboration plans to release an application programming interface that will assist public health agencies to develop customized apps.¹⁶

Location-based approaches to tracing do not require Bluetooth. Instead, they use cell phone network data, Global Positioning System (GPS), Wi-Fi signals and other smartphone sensors to identify the geolocations of app users and location information is used to determine proximity to infected individuals. Barcoding strategies are an alternative approach to digital contact tracing. Quick Response (QR) codes (barcodes that can be scanned by phones) can be placed in public spaces such as bus doors and store entrances, allowing users to log visited locations. Tracking based on QR codes is being used in China,¹⁷ but familiarity with QR codes in that country is high owing to their use in mobile payments, and it is unclear whether the strategy could be adopted for Europe and North America. A related strategy is Wi-Fi fingerprinting, using the received signal strength from each Wi-Fi network to create a “fingerprint” of each location.¹⁸

What are the limitations of app-based contact tracing?

Contact-tracing apps have 5 major limitations. First, the effectiveness of a contact-tracing app is dependent on the degree of adoption: an app’s potential to identify contacts varies with the square of the fraction of users in a population.¹⁹ In the first month after the release of Singapore’s app, it was adopted by 20% of the population.²⁰ If the app had perfect ability to identify exposures, only 4% of total contacts would be expected to be detected through the app. Similarly, apps are able to identify contacts only when both the infected and exposed individuals have their phones near them and both individuals are using intercommunicating apps. All contact-tracing apps have reduced effectiveness in communities where smartphone ownership is limited, where individuals share smartphones, or where people are unable or unwilling to use an app. The Apple–Google partnership plans to release operating system updates “in the coming months” that will permit contact identification on an opt-in basis without downloading an app, which could increase adoption if jurisdictions use their framework.¹⁶

Second, the underlying technologies have measurement error, limiting the effectiveness of the apps in identifying contacts. For Bluetooth-based apps, there are several challenges in using signal strength to determine distance between devices: Bluetooth signal strength is hardware dependent, exhibits substantial fluctuations and is attenuated when people are between the transmitting and receiving devices.^13,21,22 Signal processing and hardware testing may mitigate some of these challenges. Bluetooth signals are also attenuated by walls and floors, which is advantageous in that it may reduce incorrect identification of exposures. The precision of location-based measurements is also limited; in outdoor testing on an American university campus, location identification with the iPhone 6 with Wi-Fi enabled had root-mean-square errors between 3 m and 16 m at various testing sites and times.²³ Barcoding strategies also have limited spatial specificity.

As a result of measurement errors, digital contact-tracing technologies will have less than 100% sensitivity and specificity for identifying exposures among users of an app. Missing exposures or falsely identifying exposures both have ramifications, including unnecessary exposure of others or unnecessary quarantine, with its resultant psychological, financial and social toll. False identification of exposures must particularly be minimized among health care workers and first responders who may be near infected individuals but wearing protective equipment, and for whom widespread quarantining could cause systemic difficulties in providing care. Excluding health care workers altogether would reduce the impact of an app, however, given that they may account for a large fraction of cases and that they care for (and could transmit the infection to) vulnerable individuals.^24,25

Third, Bluetooth-based approaches that do not use the Apple–Google framework will be limited by restrictions in Bluetooth scanning on iOS-based smartphones. Apps running on iOS can scan for nearby Bluetooth devices only if the app is visible on the screen (foreground) or, when the app is not visible (background), if the target device is explicitly specified.²⁶ Given that target devices are generally not known by the scanning device before detection, this prevents iOS-based devices with background contact-tracing apps from detecting one another. Apple refused requests from France and Germany to remove these restrictions.^4,27 Australia reported finding a workaround but did not disclose it; the workaround recommended to users in Singapore and Alberta is to maintain the tracing app in the foreground on iOS.^1,12 This increases battery drain and also reduces the sensitivity of the app if users do not adhere to the request, use other apps or lock their screens. Even in the Apple–Google approach, limits in scanning frequency designed to reduce battery consumption will decrease detection of short exposures.

Fourth, the constant and widespread monitoring by contact-tracing apps introduces privacy concerns beyond those generally accepted in traditional contact tracing. Protocols based on Singapore’s framework (including Alberta’s) require all users to register with a central server, with each phone broadcasting temporary identifiers and storing the identifiers broadcasted from nearby phones.^1,2,28 When a user tests positive, the public health agency allows the user to upload the stored temporary identifiers to the central server, which matches them with registered devices and provides this to human contact tracers, although it does not automate contact notification. This approach has been criticized for, in theory, allowing a government to reconstruct a “social graph” of contacts within society,²⁹ but it also allows governments to incorporate additional information that may reduce the false identification of exposures. The Apple–Google framework proposes a decentralized data structure to preserve privacy and prevent governments from ascertaining a network of social contacts. Each phone broadcasts changing identifiers derived from rolling cryptographic keys and stores identifiers broadcasted from nearby devices.³⁰ When a user tests positive, the public health agency provides the user with the option to upload their past cryptographic keys to a central server; these are then broadcast to all devices, enabling local (on-device) matching with received identifiers. Public health agencies are given only keys voluntarily provided by infected individuals and the day and duration of exposure for users identified as contacts. Although such an approach limits governments’ ability to deidentify data and ascertain contact networks, it also limits the ability of public health agencies to audit recommendations for quality control, review the accuracy of exposure notification and undertake quality-improvement initiatives.

The collection of location data has further implications: it would allow organizations collecting the data to obtain information about all individuals’ movements and thereby make inferences about habits and preferences. Even de-identified location data cannot be fully anonymized; paths of geographic coordinates can be cross-referenced with other public records to create probabilistic models of whom they belong to.

Fifth, although modelling studies have suggested that contact-tracing apps could reduce transmission,¹⁹ there have not been any published studies on the effectiveness of such apps. If contact-tracing apps lead to reduced adherence to other preventive measures or reduced cooperation with traditional contact tracing, their impact would be reduced and could potentially be negative.

What is the optimal path forward for digital contact tracing?

Integrate digital and traditional contact tracing

In South Korea, traditional contact tracing was conducted with each case, verified by and supplemented with data from medical records, closed-circuit television cameras, cell phone geolocation data and financial transactions, to create a detailed record of an infected individual’s past movements.⁹ Detailed information about each infected individual’s past movements was then sent by text message to individuals who may have been nearby. It is unlikely that this would be acceptable in Canada because of privacy concerns. How then can this be adapted for the Canadian context?

Traditional contact tracing should be recognized as a highly specific way to identify exposures and should be substantially expanded to address scale and timeliness issues. Technology can be implemented to improve the efficiency of data collection, automate portions of contact notification and support quarantined individuals.³¹

In addition to recording contact logs, apps can allow users to optionally record location data locally on their phones, which could assist as memory aids during traditional contact tracing.³² To further reduce recall errors, infected individuals can be encouraged to voluntarily review digital records such as financial transactions. Both strategies would allow digital information to complement traditional contact tracing while preserving privacy and voluntariness.

To minimize delays between case identification and contact notification, apps can be deployed as a rapid screening tool, with distance and duration thresholds defining an exposure set to enable sensitive detection of contacts. Notifications could be rapidly and automatically sent to potential contacts, recommending isolation until follow-up with the more specific traditional contact tracing. Such an approach would mitigate the effects of the technologies’ imprecision, although it would result in short-term notification of falsely identified exposures. As case numbers decrease, adopting progressively more sensitive thresholds could help with containing SARS-CoV-2.

Protect privacy

In addition to using a privacy-preserving contact detection framework, apps should incorporate features to mitigate privacy concerns and ensure compliance with federal and provincial privacy laws and international best practices enshrined in the European Union’s General Data Protection Regulation. Such features include encryption of all personal data, explanations in plain language and user consent for data storage and use, restrictions on use of the data outside the public health responses to COVID-19, automatic deletion of data, and the option to delete data at any time. (Data deletion maintains privacy and may assuage concerns about surveillance that prevent adoption; however, it limits retrospective audits of an app’s accuracy and efforts to improve effectiveness.) Use of an app should be voluntary and users should have the option to pause contact detection, both to further protect privacy and to allow health care workers to disable monitoring when they are using appropriate precautions.

Field test in real-world conditions and publish results

Before release, apps must be field tested under real-world conditions to understand their receiver operating characteristics. Distance and duration thresholds for defining an exposure must be selected based on the desired combination of sensitivity and specificity. The sensitivity and specificity of each app and the Apple–Google framework should be published to allow public health agencies to decide which, if any, to deploy.

Promote adoption

With contact-tracing apps critically dependent on wide adoption for success, governments should encourage their use if field testing indicates that apps can reliably identify exposures. Apps can also be effective within subpopulations that have a high proportion of users. Adoption should be particularly encouraged in subgroups who are exposed to situations in which traditional contact tracing is inadequate, such as public transit, grocery stores and — when restrictions are lifted — business, social and public gatherings. Adoption should also be encouraged among hospital workers, long-term care workers, correctional staff and others who care for individuals vulnerable to developing severe COVID-19. To ensure equitable access and to enhance the effectiveness of contact tracing, governments should provide low-cost devices to individuals without Bluetooth-enabled smartphones. In regions with separate public health jurisdictions and high interregion travel, such as among Canadian provinces or between US states, coordination between public health agencies will be necessary to ensure exposures between individuals with different apps can be identified.

Increase access to diagnostic testing

Because digital contact tracing depends on identification of people with SARS-CoV-2 infection, widespread availability of high-sensitivity diagnostic tests will be crucial to the success of contact tracing. Testing all individuals flagged as exposed by an app can help identify asymptomatic infected individuals. With the short serial interval of COVID-19, minimizing test turnaround times and the delay between symptom onset and contact identification and testing will be crucial to the success of contact tracing.

Conclusion

In considering whether to adopt digital contact-tracing technologies, public health departments and governments must be aware of the potential benefits, technical limitations and inherent trade-offs between privacy and effectiveness. Thresholds determining the sensitivity and specificity of digital tools, informed by real-world field testing before release, should be set for their intended use. The success of digital contact tracing will depend on access to diagnostic testing, widespread adoption and the ability of the underlying technologies to identify exposures. Combining traditional and digital contact tracing may leverage the advantages, and mitigate the limitations, of each approach.