South Africa became one of the first African countries, if not the first, to implement the COVID-19 contact tracing app. Globally, Switzerland was the first country to release an app using Google and Apple’s exposure notification system in May. In health and technology terms, it’s an important step in the fight against COVID-19. Like all things tech which tend to be beneficial, there are also reasons to be vigilant.
Contact tracing is normally accomplished through a manual interview of the infected individuals, conducted by the health authorities. The aim of the interview is to collect contacts the infected individual had with other individuals in the past 14–21 days (identified as the incubation period for COVID-19). The health officials can then use that information to compute a risk score for each of the contacts, based on the context (e.g., indoors/outdoors), duration, and proximity (distance between the contacts). The tricky part is that it is challenging for people to accurately recall each person that they may have met in the last three weeks. The reality is that an infected individual might have infected many persons that they cannot identify, for example, contact with unknown persons standing in a supermarket checkout queue. Another important factor is that many subsequent interviews require a considerable workforce of health officials trained in the art of manual contact tracing. South Africa knows very well about the health workforce challenges.
In this context, researchers around the world have been focusing on technological solutions to automate the contact tracing process with the aim of quickly and reliably identifying contacts that might be at significant infection risk. The ubiquity of smartphones and their ability to keep track of their location (e.g., via GPS and WiFi), along with their in-built Bluetooth interface allowing communication and proximity detection with nearby smartphones, makes them ideal devices for automated and reliable contact tracing. As a result, many smartphone contact tracing apps have been proposed, with some already deployed. Using the Bluetooth interface these tracing apps automatically collect the contact data of their users – data to be subsequently used in the future event of a user being identified as infected with COVID-19.
Contract tracing apps if adopted by citizens will make a difference in the fight against COVID-19. They are also raising important ethical concerns.
The introduction of contact tracing apps has led to a debate regarding their architecture, data management, efficacy, privacy, and security. Most of these apps claim to be privacy-preserving – meaning that they do not reveal any Personally Identifiable Information (PII), identity, or location information of the contacts without explicit user permission. In countries where such apps were implemented privacy concerns associated with them are one of the factors that influence their adoption.
Another primary concern by privacy advocates is the extent to which the apps can be re-purposed to track their users, and how the collected data may be used when the current pandemic ends.
South Africa has chosen an app architecture, built by both Apple and Google, that takes care of most concerns around privacy. The protocol maintains privacy by the following means: The Exposure Notification Bluetooth Specification does not use the location for proximity detection. It strictly uses Bluetooth beaconing to detect proximity. A user’s Rolling Proximity Identifier changes on average every 15 minutes and needs the Temporary Exposure Key to be correlated to a contact. This behavior reduces the risk of privacy loss from broadcasting the identifiers. Proximity identifiers obtained from other devices are processed exclusively on the device. Users decide whether to contribute to exposure notification. If diagnosed with COVID-19, users must provide their consent to share Diagnosis Keys with the server. Users have transparency in their participation in exposure notification. The challenge with such an app is not so much about its current use. No one can argue with the value of using any means possible to save lives. There should be more concern about what could happen in the future. In the absence of proper public consultation and transparency, such a tool can easily be re-purposed for a post-COVID-19 world.
Many may consider such a possibility as highly unlikely. Here’s a possible scenario: Under a less democratic government. In the interest of not repeating the past where most countries were caught off guard and could not easily trace how people were infected, the contact tracing app may have a reason to live longer. Authorities could easily argue that the app will assist in dealing with future similar pandemics and that will make sense. The challenge with this reasoning is that it will mean compromising citizens’ privacy from now going forward. It’s an ethical dilemma that each country has to face. It’s one of the reasons why some countries in Europe have delayed implementing such apps.
Wesley Diphoko is the Editor-In-Chief of Fast Company (SA) magazine. You can follow him on Twitter via @WesleyDiphoko