Contact tracing apps

Purpose and commonly considered best use for tracking apps

So the purpose of the contact tracing system is to allow people to be notified if they have been in close proximity to a person who is confirmed infected, during the approximate period the infect person has been contagious. The purpose of this is to aid in limiting the spread of the virus. So all the notified people would seek to get tested and all infected people should then be quarantined for the duration that they are contagious.

The creation of a surveillance solution will make it difficult to destroy the capability or system after use, as investments have been made and would perceivably go to waste. It is very hard to let go of advantages that have been gained. So it makes sense to create a system that has very few other uses.

Constraints and how it works

So let's look at some of the constraints that would be useful for designing a system like this. What is the minimum capability required so that the goals can be accomplished and that we do not inadvertently allow for misuse of the system.

The person who has potentially been infected and is unaware, needs to be able to know that this has happened. The person who is found to be infected in the first place doesn't necessarily need to know who they have been in contact with specifically. The healthcare official would like to know, but there are risks even if they would know peoples social graphs. Anyone observing the system and people externally should not be able to track people beyond what they are capable by observation alone.

So minimally the system would give nonsensical likely time dependent information to devices that are nearby. No GPS, no central servers, no long distance communication, no usable information for the long term. This is possible.

Photo by Taras Chernus / Unsplash

So how does one know that they have been near a contagious person?

The person should keep a record of seen nonsensical codes from other people for the one or two week period that they are relevant. By itself the data is useless even if you save it for longer. Then when one of the seen users, who also are broadcasting their own changing IDs is discovered to be sick, they may release the keys to prove that they generated the codes they have been spreading for the past n days, where n is long enough to be relevant for this purpose. This data is then broadcasted to the full network of users. For most users, nothing can be learned, except that some unknown person broadcast some data because they have been diagnosed sick. Some of the uesrs will have been near this person and have a record of their codes, which will verify with the key that was broadcast. The people will then possibly find out the time and duration that they were exposed to a contagious person or just that they have been exposed. They can not identify the infected individual from the data alone, but now know to get tested. It would make sense to fast track people who have this notice on their app.

This is essentially a version of what the DP-3T model and the Apple/Google API allow people to accomplish. Importantly:

There is no central repository of data, functionality is decentralised
The broadcast data does not identify people, or make it easier to track them
The broadcast data keeps changing and has an expiration date
The notification/decryption keys are kept only for the relevant period
People who use the system all stand to benefit from it, but must opt in to be included (this is a tough point sometimes, but adds trust)

Are these apps the answer?

No single tactic alone is the answer to a complex and changing situation. Many believe that the contact tracing app is a valuable tool when used with traditional contact tracing methods, namely interviews and discussions with the patient. We should use any and all cost effective methods to prevent more infections, tracing apps are one such method.

Photo by Markus Spiske / Unsplash

Debunking statements and FAQ

Does Bluetooth require too much power? - BLE is ubiquitous at lest in developed countries and low on power, this activity is nearly the same as using AirPods or having a handsfree nearby.
Do we need to know people's locations? - No we do not need to know peoples geographical locations, only allow them to discover that they have been near a contagious person. Recording locations makes the whole system much more complex and prone to misuse.
Should cell network operators handle the tracking of user locations? - This is possible and sometimes in use. However it is a centralised system that creates a percedent that errodes privacy in many cases and is exactly the kind of thing that many are warning against. Why would we use a system with so many downsides when there are better ways of doing it with less risk.
Will the apps need to keep the phone out of sleep mode constantly? - This is the main thign that Apple/Goolge is addressing. Normally you would need to keep the phone awake and it would use more power, as some of these apps are doing. A/G are providing an API that allows the operating system of the phone to handle the basic features that are needed, without any app needing to keep the phone awake and using more power. There will be a slight increase in power use, but it will likely be less than or comparable to when you open your screen for looking at the time.
Bluetooth signals are not realiable enough to gauge actual distance bewteen phones. - It is true that the environment, meaning both physical objects and people, effect BT signals so much that it is hard to tell from signal strength alone, how far you were from a contagious person. This is why some protocols are adding metadata for both sides' perceived signal strength among other things. I would also design the system to record the signal strength itself, rather than an estimate of distance (which can still be calculated later). This way the contact tracing interviewer may also adjust the treshold according to the story of the patient. E.g. if a patient says they staid at home, then took a bus to the store and back. We should be able to see different amounts of new contact codes being recorded for durations that match time in the store and bus respectively. Both environments have their own effect on the spread of infection and we could give stronger alerts to people who have been in more confined spaces with the patient, etc.

Beware of scams

Scammers are always looking for good material that will scare people into acting without thinking too much about what information they are giving away. Be wary of SMS messages that have links, you have nothing to lose by validating a legitimate link by accident. Giving out your info in an emotional state without thinking can lead to losing money or your identity being used without your consent.