Understanding Digital Contact Tracing: Limitations, Implications and Recommendations
Contact tracing is not a new concept — manual contact tracing is a proven, effective method of general epidemic management used in past outbreaks such as HIV and Ebola. But digital contact tracing, and the technology and challenges that come with it, is an entirely new, automated approach that is largely untested. In order to support governments in need, U.S. Digital Response (USDR) has reviewed digital contact tracing applications, contributed to a data privacy rights framework to inform buyers and protect users, and is available to advise and share learnings.
USDR can provide free help to evaluate any services governments may be considering, share best practices from other jurisdictions, establish procurement guidelines, and work alongside government teams to integrate and scale contact tracing tools.
Key Findings
- Contact tracing is just one part of a much broader solution. Widely available testing, supported isolation and thoughtful, data-driven policies are of equal, if not greater, importance in informing government plans to reopen society.
- Digital contact tracing is a new concept that is commonly misunderstood and comes with its own set of limitations. Not only are these new applications a small supporting piece of a much larger solution, they require widespread adoption, deliberate, privacy-preserving collection and use of data, and integration with manual contact tracing workflows to be effective. Moreover, many “Digital Contact Tracing” applications are better referred to as “Exposure Notification,” as they do not actually do full tracing.
- States and localities deciding whether to use digital contact tracing need to take into account some key factors. Contact us for advice on specific questions to ask application developers.
- Efficacy: Do these solutions actually solve the problem. What is the reach of the application and who is the target audience? How will the data be used and by whom? How does this integrate into the broader public health solution including manual tracing, monitoring, testing, and isolation?
- Privacy: It is easy for a solution to seem trustworthy while mishandling personal data. This unified set of data and privacy guidelines for contact tracing and exposure notification was created to educate developers and inform end-users of the data rights they should expect any effective solution to respect.
- Interoperability: According to research, 60–80 percent adoption is required to make these digital systems effective. No single app is likely to get there, but all apps working together have a much better chance. Developers should use openly published protocols and work collaboratively to ensure their solutions are verifiable and interoperable.
Governments seeking guidance regarding contact tracing can connect directly with USDR for assistance. We can work alongside your teams to evaluate, integrate, and scale any proposed solutions. We are also working with partners across jurisdictions to document and share best practices for reopening communities.
In what follows, we define contact tracing; propose a privacy-preserving approach to its adoption; and make key recommendations for governments considering deploying the tool.
What Is Contact Tracing?
Contact tracing is the process of identifying those who have come into close contact with an infected person and taking actions to prevent them from further spreading the disease. This could mean connecting people with public health officials for testing, recommending self-quarantine, and/or providing access to care and treatment.
Manual contact tracing (MCT) requires public health officials to interview infected patients in order to create a history of who they’ve been in close contact with. States working with their local health departments already have a way to trace contacts through a COVID-19 specific investigation form passed from the Centers for Disease Control. This process was used with HIV, Ebola, and Tuberculosis, and is a proven way to control outbreaks. However, due to the fast growth of COVID-19, existing MCT processes have been unable to scale quickly enough. Furthermore, a large percentage of COVID-19 cases are asymptomatic, making contact tracing especially important as communities relax shelter-in-place guidelines.
In order for MCT to work, governments must dramatically increase their capacity of tracers, help them be effective, and provide enough tests to ensure infections are accurately tracked. The State of Massachusetts recently released its plan to hire 1,000 people to staff MCT. This sounds like a lot, but if there are 1000 daily cases, each case has 10 contacts on average, and (according to protocol) contacts are monitored for 14 days, then at any given time 1000*10*14 = 140K people need to be monitored. In other words, with 1000 tracers, each tracer needs to monitor 140 people! Their team is working with Partners in Health to hire and train contact tracers, and leveraging tools such as RedCap and Salesforce to manage and scale the operational team. Other organizations like NextTrace and Resolve to Save Lives are working on digitizing the MCT process to increase efficiency.
Digital contact tracing and exposure notification (DCTEN) uses information shared via mobile devices to notify people who might have had contact with an infected individual. While MCT can take time due to the need for individual interviews, DCTEN makes it possible to identify hundreds or thousands of at-risk persons extremely quickly. This is usually done by logging “close contact” events between mobile phones. Whenever someone is reported to be sick, their log of contact events is used to alert anyone they’ve contacted within a certain time period. Note that if the application only goes so far as alerting potentially affected individuals, and does not assist with interviews, testing, and follow-up monitoring, it’s better described as “Exposure Notification”.
DCTEN apps use different technologies to track proximity, store, access, and report any close contact events.
How apps can determine when you’ve been in contact with someone:
- ✅ Bluetooth Proximity Detection: The same technology that you use to connect your phone with your wireless earbuds can be used to detect when your phone is in close contact with another phone.
- 🔴 GPS Logging: Most phones are equipped with GPS technology, and can be used to make a literal map of where you’ve been. GPS-based notifications might assist with history gathering or other data used during contact tracing interviews, but is regarded as ineffective for DCTEN. As a result, leading applications rely on Bluetooth.
How apps can identify you as a user:
- 🔴 Identifiable Information: Applications can use a federally issued ID (e.g. US social security numbers), or phone number to identify you as an individual in a database of contact events. This is less protective of your privacy.
- ✅ Contact Event Numbers: Apps can also create random numbers (sometimes called Contact Event Numbers) to serve the same purpose. This is anonymous and far more privacy-protecting than your social security or phone number.
How apps store and access your data:
- 🔴 Centralized: In servers controlled by specific app developers, tech companies, or governments.
- ✅ Decentralized: Distributed across peer-to-peer networks that don’t rely on the oversight of any individual organization.
A Privacy-Preserving Approach to Digital Contact Tracing and Exposure Notification
To better inform developers and potential users of this technology, USDR worked as part of a new global coalition alongside privacy researchers, technologists, and epidemiologists to co-develop a bill of Data Rights for Exposure Notification. These principles emphasize the importance of efficacy, privacy-preservation and interoperability. They limit data access only to specific use cases that protect users — notifying individuals that they may have been exposed, providing anonymized, aggregate data to public health officials, and verifying whether an individual is healthy or sick, with their explicit consent.
Google and Apple also recently announced their new Exposure Notification API that uses Bluetooth technology on mobile devices, which is expected to be released in mid-May. We expect to see prototype apps (some included below) available for download soon.
Classifying Applications using Data Rights for Exposure Notification
The Bigger Picture
To reiterate, contact tracing is just one part of a much broader solution, and digital contact tracing exposure notification technology will likely play a small part in a public health effort. Scaling manual contact tracing operations is of paramount importance, and will only be effective alongside widely available testing, case monitoring, supported isolation, and thoughtful, data-driven policies.
If you are considering using a digital contact tracing and exposure notification system, applications will need to reach 60%+ adoption, be interoperable, privacy-preserving, utilize decentralized data storage and Bluetooth technology, and be well-integrated into your broader public health strategy in order to be effective.
We are in touch with governments across the country and are standing by to help whichever stage a team is in. We can provide technical evaluations of new vendors, work alongside government teams to integrate and scale selected tools, and will continue to share best practices as we hear of them from other jurisdictions.
Request assistance and our Government Partnerships team will be in touch within 24 hours.
To learn more, visit www.USDigitalResponse.org or contact info@usdigitalresponse.org.
