+ A
A -
THE sudden outbreak of the coronavirus pandemic and subsequent lockdowns across the globe have seen international scientists and governments working around the clock to find appropriate policy responses, medical and technological solutions. Observing the extraordinarily infectious properties of COVID-19 and hopeful early results achieved, particularly in Asia, it is individual contact tracing that has widely emerged as a tool of paramount importance in the battle against this health threat.
Tracing contacts and interaction of people aims at early identification, notification, testing and quarantining of possible new cases, thus limiting the rate at which the virus is able to spread across populations. Contact tracing is even more essential in the case of COVID-19, where a large percentage of carriers remain entirely asymptomatic and are therefore never tested. In a classic epidemic scenario, where the spread is geographically limited, contact tracing can be performed by teams of healthcare professionals, involving the interviewing of every newly infected individual. Interviewed patients report every close contact they have had over the previous timespan, so they can be tracked, notified about their potential exposure, and eventually be sent into self-quarantine. Such an approach cannot, however, scale up to handle the hundreds or even thousands of daily infections in a worldwide pandemic without unrealistic workforce and resource requirements. Likewise, it is virtually impossible to trace every potential case, as all of us constantly come into contact with others without necessarily taking notice, such as in a supermarket or a shopping mall.
To this end, the most efficient solution turns out to be digital contact tracing. Digital contact tracing is an automated, transparent process that consistently keeps track of the user’s physical contacts and location. It is put into play by a smartphone app running in the background and monitoring its user’s contacts with other people, leaning on a set of radio technologies. While Bluetooth is used to detect close proximity within 2m to other enabled devices, the Global Positioning System (GPS) functionality is used to track and document the user’s movements and geographical location. When an app user tests positive for COVID-19, health authorities access the phone’s log data, so that registered contacts can be tracked and notified.
Digital contact tracing is now gradually being deployed in numerous countries across the globe, most of them adopting tracing applications developed domestically. France has recently introduced the first edition of its tracing app; the UK and Germany are following soon. Simulations conducted by the University of Oxford for instance, suggest that for this measure to achieve success, approximately 60 percent of the population will have to adopt the system. In light of this, Qatar has opted to make installation and use of its tracing app ‘Ehteraz’, Arabic for “precaution”, mandatory for its citizens and residents.
To quantify potential privacy challenges, it is important to consider the type of logged information on the one hand, and where this information is stored on the other. Perhaps the greatest concern for app users relates to GPS location data, as it in principle discloses an individual user’s movements throughout the day. Notably though, the accuracy of GPS measurements is rather limited for precise tracing, especially indoors. The actual purpose for an app collecting comparably low-resolution location data is mostly of a complementing nature to its more important Bluetooth functionality. Bluetooth contact tracing does not rely on location data. Instead, every device periodically broadcasts a beacon that is received and logged in the contact lists of nearby devices equipped with the same app. These beacons are usually random and change frequently, in order to anonymise the mobile users, making Bluetooth the central, as well as in fact, the least invasive feature.
Contact tracing can moreover be implemented either as a centralised or decentralised solution. In a centralised architecture, all Bluetooth-generated contact logs and the complementing GPS data are directly transmitted and stored in a central database operated and protected by the concerned health authorities. These consequently fast accessible data sets allow for the shortest reaction time from detection to tracking and notification of all individuals at risk of a COVID-19 infection.
The alternative decentralised approach, as currently mulled in Germany for instance, requires each smartphone to store and maintain its own private contact log. While preferable from a privacy perspective, having the data sets stored in a decentral manner would most importantly be sizably slower to access, delaying the crucial response time when infections occur.
There is no panacea for all issues yet and even if at an unprecedented pace and scale of international collaboration, all states are still in a phase of constant learning and improvement. Even with anonymised beacons and the most sophisticated cybersecurity infrastructure as is fortunately present in Qatar, storage of all contact logs at a centralised location may in theory be vulnerable to advanced cybersecurity breaches. Likewise, decentralised solutions are not perfect as the discourse, primarily in Europe, shows. Individuals testing positive for COVID-19 have to disclose their beacons and contact logs, enabling tracing of recent movements.
To this end, the Cyber-security Research Innovation Lab (CRI-Lab) at Hamad Bin Khalifa University’s College of Science and Engineering is working towards developing contact tracing protocols that protect the privacy of all individuals, such as in the prototype application ‘SpreadMeNot’. The research team is also advising on how transparency may help the understanding and acceptance of digital contact tracing, for example by publishing such apps as open source software, allowing cybersecurity experts globally to validate security and privacy characteristics.
Dr Gabriele Oligeri is an assistant professor at the College of Science and Engineering, part of
Hamad Bin Khalifa University.
Dr Spiridon Bakiras is an
associate professor at CSE.
(The views expressed are the author’s own and do not necessarily reflect HBKU’s official stance)
Tracing contacts and interaction of people aims at early identification, notification, testing and quarantining of possible new cases, thus limiting the rate at which the virus is able to spread across populations. Contact tracing is even more essential in the case of COVID-19, where a large percentage of carriers remain entirely asymptomatic and are therefore never tested. In a classic epidemic scenario, where the spread is geographically limited, contact tracing can be performed by teams of healthcare professionals, involving the interviewing of every newly infected individual. Interviewed patients report every close contact they have had over the previous timespan, so they can be tracked, notified about their potential exposure, and eventually be sent into self-quarantine. Such an approach cannot, however, scale up to handle the hundreds or even thousands of daily infections in a worldwide pandemic without unrealistic workforce and resource requirements. Likewise, it is virtually impossible to trace every potential case, as all of us constantly come into contact with others without necessarily taking notice, such as in a supermarket or a shopping mall.
To this end, the most efficient solution turns out to be digital contact tracing. Digital contact tracing is an automated, transparent process that consistently keeps track of the user’s physical contacts and location. It is put into play by a smartphone app running in the background and monitoring its user’s contacts with other people, leaning on a set of radio technologies. While Bluetooth is used to detect close proximity within 2m to other enabled devices, the Global Positioning System (GPS) functionality is used to track and document the user’s movements and geographical location. When an app user tests positive for COVID-19, health authorities access the phone’s log data, so that registered contacts can be tracked and notified.
Digital contact tracing is now gradually being deployed in numerous countries across the globe, most of them adopting tracing applications developed domestically. France has recently introduced the first edition of its tracing app; the UK and Germany are following soon. Simulations conducted by the University of Oxford for instance, suggest that for this measure to achieve success, approximately 60 percent of the population will have to adopt the system. In light of this, Qatar has opted to make installation and use of its tracing app ‘Ehteraz’, Arabic for “precaution”, mandatory for its citizens and residents.
To quantify potential privacy challenges, it is important to consider the type of logged information on the one hand, and where this information is stored on the other. Perhaps the greatest concern for app users relates to GPS location data, as it in principle discloses an individual user’s movements throughout the day. Notably though, the accuracy of GPS measurements is rather limited for precise tracing, especially indoors. The actual purpose for an app collecting comparably low-resolution location data is mostly of a complementing nature to its more important Bluetooth functionality. Bluetooth contact tracing does not rely on location data. Instead, every device periodically broadcasts a beacon that is received and logged in the contact lists of nearby devices equipped with the same app. These beacons are usually random and change frequently, in order to anonymise the mobile users, making Bluetooth the central, as well as in fact, the least invasive feature.
Contact tracing can moreover be implemented either as a centralised or decentralised solution. In a centralised architecture, all Bluetooth-generated contact logs and the complementing GPS data are directly transmitted and stored in a central database operated and protected by the concerned health authorities. These consequently fast accessible data sets allow for the shortest reaction time from detection to tracking and notification of all individuals at risk of a COVID-19 infection.
The alternative decentralised approach, as currently mulled in Germany for instance, requires each smartphone to store and maintain its own private contact log. While preferable from a privacy perspective, having the data sets stored in a decentral manner would most importantly be sizably slower to access, delaying the crucial response time when infections occur.
There is no panacea for all issues yet and even if at an unprecedented pace and scale of international collaboration, all states are still in a phase of constant learning and improvement. Even with anonymised beacons and the most sophisticated cybersecurity infrastructure as is fortunately present in Qatar, storage of all contact logs at a centralised location may in theory be vulnerable to advanced cybersecurity breaches. Likewise, decentralised solutions are not perfect as the discourse, primarily in Europe, shows. Individuals testing positive for COVID-19 have to disclose their beacons and contact logs, enabling tracing of recent movements.
To this end, the Cyber-security Research Innovation Lab (CRI-Lab) at Hamad Bin Khalifa University’s College of Science and Engineering is working towards developing contact tracing protocols that protect the privacy of all individuals, such as in the prototype application ‘SpreadMeNot’. The research team is also advising on how transparency may help the understanding and acceptance of digital contact tracing, for example by publishing such apps as open source software, allowing cybersecurity experts globally to validate security and privacy characteristics.
Dr Gabriele Oligeri is an assistant professor at the College of Science and Engineering, part of
Hamad Bin Khalifa University.
Dr Spiridon Bakiras is an
associate professor at CSE.
(The views expressed are the author’s own and do not necessarily reflect HBKU’s official stance)
