How does contract tracing work around the world?

How does contract tracing work around the world?
Moai Team
Moai Team

We compare the approaches taken to trace and halt the spread of COVID-19 by different governments, with a particular focus on citizen privacy. Why are they broken, and how can we do better?

How are countries around the world monitoring the spread of coronavirus?

As public health experts in most nations scramble to come up with a sensible way to trace citizen exposure to COVID-19, the approaches vary around the world. And, as hackers at the annual Defcon event (held online in August) noted, most of the proposed apps display serious privacy pitfalls, and generally collect more information than they need.

Indeed, some parts of the world have come under additional scrutiny by Amnesty International for being particularly intrusive, and “putting the privacy and security of hundreds of thousands of people at risk.” So what are the various approaches, and the pitfalls they face?

Norway

Although it has now been paused, the Smittestopp app proposed in Norway came under some of the most intense global scrutiny from a privacy perspective. As well as relying on Bluetooth signals, it collected location data and used a (permanent) ID code for users. All data about a user would have been stored centrally on a server.

Qatar, Beirut, Kuwait

The contact tracing apps in these countries require users to register with a national ID number. Like Norway’s app, they capture location data via GPS and pass this to a central database. Amnesty International has written about its concerns regarding the risk to privacy where authorities can easily link individuals with their sensitive personal information.

Amnesty International also alerted authorities to a major security vulnerability in Qatar’s EHTERAZ app, which would have made it possible to access highly sensitive personal information about users, including their name, national ID, health status and confinement location.

India

India's contact-tracing app, Aaroya Setu, is also controversial. The government has mandated that all government and private sector workers must use it. Relying on a phone's Bluetooth and location data, Aarogya Setu (which means “Bridge to Health” in Sanskrit) tells users if they have been near a person with COVID-19 by scanning a database of known cases. The data is shared with the government.

The BBC reports that, “While your name and number won't be made public, the app does collect this information, as well as your gender, travel history and whether you're a smoker.”

China

China’s system for contact tracing gathers lots of data, including citizens’ identity, location, and even online payment history so that local police can watch for those who break quarantine rules. Hardly any information is available to the public about how the underlying technology works.

Singapore

Singapore was quick off the mark, releasing its TraceTogether app in March. It relies on contact tracing via Bluetooth, and data is stored on individual devices. The Ministry of Health still collects data, but only when someone is confirmed to have COVID-19, and consent is gained. The data is anonymised. According to Tate Ryan-Mosely from MIT Technology Review, this app represents something of a “gold standard” although, with a centralised data structure, “there are still some people who say [it’s] not ideal from a privacy perspective.” There are also technical restraints to relying on Bluetooth on Apple devices, which will persist if Singapore does not move to a decentralised approach.

Italy

The first European country to be hit by coronavirus, Italy launched Immuni in June and has managed to achieve decent levels of adoption (2.2m downloads in first 10 days) – despite privacy concerns. The app also uses Bluetooth, but based on a joint technology standard from Apple and Google to collect information on people users come into contact with, on their own device. When someone receives a positive test result, a doctor uploads the result anonymously to a server; everyone who has been near the infected person (who also has the app) is alerted.

The USA

There is currently no national contact tracing app to tackle the spread of COVID-19 in the United States, and commentators believe one is unlikely to emerge. But individual states have been launching their own apps, usually mired in privacy and security issues as they rely on location tracking. It is expected more states will move to Apple/Google technology, with Virginia the first to do so at the start of August.

The UK

In what was a second attempt at a contract tracing app, the technology arm of the NHS (NHSX) was developing its own application, with trials on the Isle of Wight from early May. They took a centralised approach that, it was found, would not work unless it was running constantly in the foreground, and there were concerns it could break the country’s data protection laws. Files found in an unlocked Google Drive folder seemed to suggest additional personal data would be requested via the app in the future. It was also set to rely on self-reported diagnoses of COVID-19.

The UK government announced on 18 June that it would switch to a model developed with Apple and Google (which will work on a decentralised basis). A pilot phase for the app is currently underway in Newham, London, although little has been revealed about its success.

Is there a perfect approach?

It’s clear that there are privacy pitfalls for contact tracing around the world. While many authorities have taken the route of the Google/Apple solution, which is secure and does preserve privacy reasonably well, it does not allow data upload to the cloud, and does not allow researchers to analyse the data. Relying only on Bluetooth also has limitations: “Things like walls, human bodies, or interference from other phones can throw the signal off, rendering the data useless.” (MIT)

Another pitfall is transparency. Privacy experts have asked that code is made open source, so that it can be reviewed and improved, and so that users – citizens – can fully trust the software governments roll out.

Moai uses Bluetooth as part of its contact tracing solution, and QR codes in locations for another. What’s unique about the Moai app is that data is encrypted at all times - total privacy for users is ensured. A decentralised but open technology, the data can be analysed by researchers, to help us better (and more quickly) understand how the disease is spreading.