Dear reader,
after posting some compilations about various aspects of the ongoing Covid-19 crisis it's time to deliver an article about contact tracing apps and why they have been omitted so far in the "technical solutions against Coronavirus" section.
The answer is that there's still a large gap between "can be a cool & smart solution" , but unfortunately its limit success so far makes it difficult to recommend it in its current form. There are several solutions "on the market" , but most importantly would be to see those apps only as tool between testing and isolating infected persons. The tool can work perfectly itself, but it will be rather useless if testing is flawed or isolating infected persons won't happen. The apps could be a welcomed addition to the expensive and demanding task of contact tracing performed by (more or less) well staffed call centers who try to trace all contacts during the time a Covid-19 positive person was deemed infectious. The traditional way of contact tracing has at least two major problems: an infected person's memory regarding whom he/she did meet during a time span of perhaps 10 days and the other problem is the infected person's honesty and those identified contact's honesty. If those persons have some motive for not telling the truth about their whereabouts during the infectious period contact tracing is rendered useless or just a very limited success. The other problem is that not all contacts can be reached by phone, e-mail, etc because they either don't pick up the phone or not answering mails or those communication data is simply not available to human contact tracers.
A Corona contact tracing app would be a good alternative, since its memory works better and can also identify contacts of the infected person this person doesn't know by name or doesn't consciously remembers to have met in the first place (maybe because he/she was only standing in front of those possibly also infected persons, but "patient zero" simply doesn't have a 360 degree round vision and can't see who is standing/sitting behind them)
A contact tracing app which relies on Bluetooth technology to determine who is near the device the app is running on. The app has a predefined time period which is necessary (as far as we know) to infect other people based on the assumption that the proximity is below 1,5 or 1,8 or 2 meters. There are tracing apps which only store random id numbers of the person's app on the device it's installed on. Other apps like the one used by France rely on transmitting the "found IDs nearby" directly to a central server. [see 12]
That system seems to be working based on numerous press reports, but the tricky part is the testing , the informing potential contacts in danger of infection or the testing / isolating of those contacted by the app.
The German model relies on the user to inform the app that he/she is tested positive and although the lab is offering a unique code to make sure that app users don't send fake warnings to possible contacts. The problem is that positive test results have to be communicated to the app manually by the user. If the user for whatever reason decides not to tell the app that he/she is infected this "App system" fails. According to press reports only about 50% of those tested (see:5) positive insert their result into the app. Maybe the app's user simply forgets to tell the app about his/her positive test result, maybe it's too complicated to activate the alarm or maybe it's intentionally, the result from the epidemiological point of view is the same: No warning sent out to others - exponential growth of infections not stopped.
One shouldn't forget the other big (current) problem, which is the lack of testing capacity (see:1) in many countries, so that government guidelines only recommend testing people which are quite obviously infected. The lack of testing capability is disguised by 'strict guidelines' which are nothing else as a cover for mismanagement of testing capability. Every government should aim for a testing capability more than sufficient to test large parts of the population from kindergarten, school, university to care homes for the elderly (and all other age groups in between) and even if this costs millions of Dollars or Euros, it's still much, much less 'expensive' as massive disruption in tax revenues because of an economy plunging perhaps 10, 20 or 30 % ! So having the perhaps perfect working app won't change much without the testing availability on the one hand and the will and the means of isolating positive cases resulting from that increased general detection capability. In the other blog entry the possibility of doing so by using (currently ample) spare capacity of hotels was mentioned already. Only when isolating infected person completely it's possible to stop the spread, otherwise family/household members could still (unwittingly) get infected and go shopping/to work or meet other people in general. Of course such countermeasures would cost some money on the one hand, but on the other there's the reduction of overall economic damage as well as the increasing revenue also for the hard-hit hospitality sector !
There have also been some technical issues like the 'slumbering app' where user's think their app works, but in fact the operating system has put the app in some background process which stopped it from send out Bluetooth signals all the time or receiving other ID numbers. Developers of the app and also Google and Apple as suppliers of the operating systems Android and IOS offered updated which addressed or should have been addressed. If a user deletes the app from his Android or Iphone device the (ID) data collected so far is gone and when he/she installs it again it starts from scratch. When two apps from different countries are installed one simply stops working and so forth.
The main problem however is the testing of persons and the 100% guarantee that all close contacts in danger of being infected are indeed being 'strongly advised' to get tested as well. If the app is used in such a way that the 'warned person' decides not to get tested, they won't get entrance to the local pub, restaurant, subway, train or any other enclosed public space, it would help to convince those to get test and isolate themselves. A big IF , because there have been press reports from NL and also UK that employers e.g. demanded that there employees switch off their phones or don't install the app because that would potentially lead to under-staffing of some departments. So the 'human factor' plays a role here as well and so far it's quite easy to undermine the contact tracing and isolating scheme necessary to curb the outbreak. No one is (so far) obliged to have a working app on her/him when entering a building, so when the phone is left at home the pandemic can simply go on for another day.
Even when all technical problems with the contact tracing app are solved and it works perfectly it's depending on human interactions and when the system isn't watertight the pandemic/virus wins. It's as simple as that. On the other hand if the (running) app is mandatory it could replace also other (ancient old) solutions like manual, hand written lists in bars, clubs, restaurants which have to be archived for a period of time and are collected by human contact tracers once a visitor of the location is tested positive. Once the pieces of paper are collected, contact tracers find fictitious names like 'Donald Duck' or 'Clark Kent' (see:13) on those lists which are of course completely useless when trying to disrupt the chain of infection. In some places like Hamburg, Germany officials said that they found up to 70% unusable or inaccurate information written on 'contact lists'. Throughout Germany there have been complaints by guests regarding 'contact lists' and sensitive info openly visible for all guests.(see 14)
The existing 'Corona warn app' issued by authorities like RKI could be modified in order to enable contact tracing of all guests visiting a place by using a Android or IOS based device at the entrance which would exchange those random ID numbers with guest devices. Only 1 smart phone per visitor group needed, if deemed necessary the app could store the ID card or passport numbers of all group. members (encrypted, stored locally on the device). This issue of 'reading' stored data on a device was a controversial issue before in the Netherlands (see 16), although gaining access to manual lists maintained and stored by businesses in case somebody is tested positive is exactly the same, except much slower. The 'house device app' could generate new range of numbers every 2-4 hours, so that only guests present at the time an infected person stayed at the location would have been contacted through their app. By using this technical solution less time is needed to warn those who might have been affected by a 'patient zero' in one crowded place. Privacy is guaranteed, employees of the establishment don't have to maintain manual lists and all visitor groups are contacted automatically.
The principle of proper contact tracing could and should have been developed before an actual outbreak and it would have been ample time to test such systems(not just the app!) so that they work properly when needed. All current problems are due to lack of planning and not only incumbent governments are to blame, but those pandemic plans have been neglected often for a decade or longer. So now is the highest time to correct all the known errors and the best way of doing so is by firing the obstructionists that are often telling:"Oh, it's impossible" or "Oh, it's too expensive" or "Oh, whatever" ... Since those pandemic plans have been neglected it was understandable that in Spring most governments have been overwhelmed by the first SARS-CoV2 wave, but since then there was some time to correct those initial mistakes. Now there are sufficient suppliers of rapid testing equipment available, which can produce them in sufficient numbers, and although they often aren't exactly as reliable as PCR tests, the increased local testing capability may compensates that difference of reliability. That's the opinion of some experts.
These tests are typically performed by centralized high-complexity laboratories with specialized equipment using qPCR assays, with results that can be reported within 12 to 48 hours. Major bottlenecks in testing, however, have led to turnaround times exceeding 5 to 10 days in some regions, making such tests useless to prevent transmission.
Screening testing of asymptomatic individuals to detect people who are likely infectious has been critically underused yet is one of the most promising tools to combat the COVID-19 pandemic (9). Infection with SARS-CoV-2 does not lead to symptoms in ~20 to 40% of cases, and symptomatic disease is preceded by a presymptomatic incubation period (10). However, asymptomatic and presymptomatic cases are key contributors to virus spread, complicating our ability to break transmission chains (10).[...]
When used strategically, entry-screening measures can be effective at suppressing transmission. Entry screening requires testing that provides rapid results—ideally within 15 min—to be most effective. The required sensitivity and specificity of entry-screening tests are, like all tests, context dependent. Entry-screening tests for a nursing home, for example, must be highly sensitive because the consequences of bringing SARS-CoV-2 into a nursing home can be devastating. Such tests must also be highly specific because the consequences of grouping a false-positive person with COVID-19–positive individuals could be deadly [...]
If a screening test does not achieve high-enough specificity (e.g., >99.9%), screening programs can be paired with secondary confirmatory testing. Unlike diagnostic tests, however, the sensitivity of screening tests should not be determined based on their ability to diagnose patients but rather by their ability to accurately identify people who are most at risk of transmitting SARS-CoV-2 [...] source: COVID-19 testing: One size does not fit all [M. Mina & K.G.Andersen, Sciencemag, Dec 21 2020]
When used strategically, entry-screening measures can be effective at suppressing transmission. Entry screening requires testing that provides rapid results—ideally within 15 min—to be most effective. The required sensitivity and specificity of entry-screening tests are, like all tests, context dependent. Entry-screening tests for a nursing home, for example, must be highly sensitive because the consequences of bringing SARS-CoV-2 into a nursing home can be devastating. Such tests must also be highly specific because the consequences of grouping a false-positive person with COVID-19–positive individuals could be deadly
If however politicians are still acting like having to win the next upcoming election instead of fighting the virus with all technical & logistical means at disposal the pandemic won't stop. If it is asked too much of citizens to follow some technical procedures or otherwise they are banned entry to a public space (like wearing a simple mask, or having a working smart phone on them) there's little hope of getting rid of the virus, although the growing availability of vaccines certainly helps. We are not talking about massive possible infringement of citizens' liberties like when using the domestic intelligence service for 'covert contact tracing' (Middle East) , but about reasonable adaptions to a life threatening new situation. There's little, or better:NO, understanding for 'refuseniks' who are just too stubborn, selfish and/or whatever to protect themselves and others(the very society they also rely on)
A widely available rapid testing routine combined with massive app usage (those who only have dumb phones can afford to 'invest' 30-50 euros for a mass produced simple smart phone running Android operating system) would be able to replace (now often overwhelmed) 'human contact tracing' and together with millions of doses of various vaccines to completely eliminate the virus. Fast and vicious response could have prevented economic and social damage in the first place, but we have to look forward and at least now try to not to make the same mistakes twice (or even more often). Only when 2022 offers the same level of 'carefree society' as 2019 we can reestablish economic growth and prosperity and also some level of 'happiness'. Nobody in national governments should deem this 'impossible' and on the contrary should see a perfectly equipped state being capable of reducing even the impact of other 'normal' infectious diseases like the flu. Contact tracing apps with the right balance of preserving user's privacy and guaranteeing success for curbing infectious diseases should become standard and could help to prevent illness, deaths (yes Flu is still deadly) and economic damage (sick leave days) Contact tracing apps should be seen as one vital tool of getting the virus under control, which is of little worth if testing and isolating skill/performance falls behind.
Speaking of 'sick leave days': Even employers would see the advantage of a contact tracing app when not half of the company is getting infected by e.g. the seasonal Flu, but those first cases are found 'quick & easy' and have to self-isolate at home for a week or two and by using that routine spare the rest of the firm of getting also very sick.
Last update: Dec 25 2020
references/further reading:
¹ (limited testing capability regarding app usage)
In der Testverordnung, die seit Mitte Oktober gilt, ist festgeschrieben, dass alle Nutzerinnen und Nutzer der App, die eine rote Warnmeldung erhalten haben, Anspruch auf einen kostenfreien Test haben. Allerdings räumte Bundesgesundheitsminister Jens Spahn im Bericht aus Berlin ein, dass das Gesundheitssystem häufig überlastet ist und daher oft nur testet, wenn man auch Symptome einer Covid-19-Erkrankung hat.
source: Die Tücken der Corona-Warn-App [Tagesschau, German public TV news, Dec 15 2020]
² (used algorithm not representing latest scientific insights regarding (often) aerosol based infection)
Für die Risikobewertung ist mit der Umstellung auf das ENF 2.0 nicht mehr eine einzige Begegnung ausschlaggebend, sondern die Summe der Risikominuten pro Tag. So können auch mehrere, kurzzeitige Risikobegegnungen zu einem erhöhten Risiko führen.
source: Infektionsketten digital unterbrechen mit der Corona-Warn-App [RKI (=German CDC), probably published December 2020]
³ (problems updating current test status of user)
Wer jedoch bereits zum wiederholten Male einen Test macht, kann dieses Ergebnis nicht per App abrufen. Denn das erste Testergebnis ist noch gespeichert und kann - auch bei einem negativen Ergebnis - nicht gelöscht werden.
source: 1,5 Millionen Warnungen - trotz Problemen [Tagesschau, German public TV news, Dec 6 2020]
A separate design issue has also limited the ability of other users who test negative, including those using home-testing kits or private providers such as the Lighthouse lab network, to log their result in the app.
People who report symptoms via the app but then book their test outside of the app will only get a code to input if their test result is positive.
source: NHS Covid app in England now able to log all test results after flaw fixed [The Guardian, Sep 26 2020]
Covid-19: Glitch leaves users unable to link test results to new contact tracing app [BMJ, Sep 28 2020]
4 (lack of app compatible laboratories for test result input)
Hinzu kommt, dass die Laboranbindung im klinischen Bereich noch weit hinterhinkt. Zuletzt waren nur elf Labore des Öffentlichen Gesundheitsdienstes und 15 Labore in Krankenhäusern angeschlossen. Lediglich bei den niedergelassenen Laboren sind nach Angaben der Bundesregierung 152 Stellen angeschlossen
source: 1,5 Millionen Warnungen - trotz Problemen [Tagesschau, German public TV news, Dec 6 2020]
5 (only partial (manual) input of testing results)
Nach Angeben der Entwickler teilen 46 Prozent der App-Nutzerinnen und -Nutzer ihr positives Testergebnis nicht.
source: 1,5 Millionen Warnungen - trotz Problemen [Tagesschau, German public TV news, Dec 6 2020]
6 (testing facility organisational mess)
Auch kommt es immer wieder vor, dass bei dem Test nicht - wie unbedingt notwendig - ein einzelnes Formular pro Patient generiert wird, sondern vorhandene Formulare fotokopiert werden,
source: 1,5 Millionen Warnungen - trotz Problemen [Tagesschau, German public TV news, Dec 6 2020]
7 (optional transmission of test results leaves room for errors/misunderstandings)
Oft scheitert die Übermittlung des Testergebnisses auch am fehlenden Datenschutz-Einverständnis. Etliche Patienten würden bei den Corona-Tests im Auftragsformular vergessen, das notwendige Häkchen zu setzensource: 1,5 Millionen Warnungen - trotz Problemen [Tagesschau, German public TV news, Dec 6 2020]
8 (insufficient updating/synchronizing intervals)
Während vorher nur alle 24 Stunden überprüft wurde, ob man in den vergangenen 14 Tagen Kontakt mit einer mittlerweile positiv getesteten Person hatte, erfolgt dieser Abgleich nun mehrmals am Tag.
source: 1,5 Millionen Warnungen - trotz Problemen [Tagesschau, German public TV news, Dec 6 2020]
9 (app problems working with 'overambitious operating systems')
“The reason why the first step wasn’t successful is fundamentally because Apple was concerned about battery life, particularly of older phones, so that it would prevent apps from activating the Bluetooth stack in the background. Bluetooth ping sending and receiving Bluetooth beacon messages is an expensive operation as far as power is concerned, and Apple was not willing to give up that restriction. That ultimately meant you had to fight the operating system, and ultimately that fight wasn’t successful in getting the app to work in the background.
source:The UK switches on to mobile contact tracing [Computerweekly, Oct 8 2020]
Documents tabled in the Senate in response to questions from the Centre Alliance senator Rex Patrick have shown, as Guardian Australia has been reporting, that communication between two locked iPhones – such as when people are walking in the street with the phone in their pocket – was “poor” when the app initially launched, meaning it picked up between 0% and 25% of all Bluetooth pings.
source: Australia's Covidsafe coronavirus tracing app works as few as one in four times for some devices [The Guardian, Jun 17 2020]
10 (not all test results can get processed by app (incompatible labs))
People tested for Covid-19 in NHS hospitals and Public Health England labs were unable to share their results with the NHS’s contact-tracing app in England, it has emerged.
source: NHS Covid app in England now able to log all test results after flaw fixed [The Guardian, Sep 26 2020]
11 In Israel, Shin Bet Security Services COVID-19 Contact Tracing Raises Privacy Concerns [VoA, Oct 5 2020]
12 (centralized approach contrary to anonymous contact data stored on the device)
Under the French system, data is uploaded to government-run centralized servers.
source: France rolls out Covid-19 tracing app amid privacy debate [France24, Jun 2 2020]
13 (wrong names , addresses used in hand-written contact lists)
Null Toleranz für „Donald Duck“: Wer in NRW falsche Namen in die Kontaktlisten schreibt, muss mit saftigen Strafen rechnen.
source: Neue Corona-Auflagen für Feiern in NRW [WZ, Sep 30 2020]
Auf Nachfrage sagte Droßmann, dass 70 Prozent der Bar-Besucher nicht kontaktiert werden könnten, weil sie auf den Listen unvollständige oder fehlerhafte Angaben gemacht haben
source: Kiez-Besucher: Nur 30 Prozent mit Kontaktlisten erreichbar? [NDR, German public TV, Sep 23 2020]
14 (privacy concerns regarding hand-written 'contact lists' in restaurants,bars,etc)
Stichprobenkontrollen in Hamburg ergaben, dass in einem Drittel aller überprüften Lokalitäten die Listen offen auslagen, sodass die Daten der Gäste leicht einsehbar waren. Auch die Datenschützer in Berlin und Baden-Württemberg berichten von Beschwerden wegen solcher offenen Listen. Laut der Datenschutzbehörde in Berlin müssen Gäste beim Besuch einer Gaststätte ihre Daten zwar angeben, können aber nicht dazu verpflichtet werden, sich in solche offenen Listen einzutragen. source: Herumliegende Listen zeigen: Wer war heute schon hier? [Die Zeit, Jul 16 2020]
15 (apps used for access control)
The apps have become a necessity for travel in China, to book train or plane tickets or enter many public places, though not all establishments require them, such as supermarkets.
source: Green or red light: China coronavirus app is ticket to everywhere [Japan Times, May 13 2020]
16 (access to privacy sensitive data stored in the app)
GGD employees can check whether someone who just tested positive for Covid-19 is using the app, and then use the app to warn their close contacts. In this way, the health service could theoretically convince or force someone to upload the codes the app collected of their close contacts. source: Another privacy risk uncovered in Dutch Covid app [NL Times, Sep 30 2020]
That identifier can be used by health authorities to determine the name, age range, postcode and mobile number that was used in the app's registration process by each contact.
The data is stored on a user's phone for up to 21 days. If a user tests positive for COVID-19, they can upload their stored contacts to a central repository held by the federal Health Department.
source: Experts raise concerns about security of coronavirus tracing app COVIDSafe [ABC, May 14 2020]
17 (number of participants in order to be effective)
A simulation on one million people found that 80% of smartphone users in the UK (56% of the general population) would need to install a contact-tracing app to suppress the epidemic effectively.
source: Privacy versus safety in contact-tracing apps for coronavirus disease 2019 [NIH, Jul 14 2020]
18 (different concepts in use)
Currently, various different frameworks have been developed to build contact tracing, such as open frameworks (GA-PPTP, DP-3T, Blue Trace, TCN) or private and controlled (PEPP-PT). The nature of implementation may be open source (DP-3T, Blue Trace, TCN) or private (PEPP-PT, GA-PPTP), and the control-based network can be decentralised or centralised proximity data. On 19 April, a letter signed by nearly 300 academics warned that centralised systems can risk surveillance, and suggested that Apple and Google (currently working jointly in developing a contact-tracing app) should consider developing one which uses an opt-in and decentralised system.5
source: Privacy versus safety in contact-tracing apps for coronavirus disease 2019 [NIH, Jul 14 2020]
19 (too much data stored, too vulnerable)
However, before the authorities took action to address the vulnerability, the QR code included sensitive personal information such as names (in English and Arabic), the location of confinement and of treatment. Amnesty was able to access sensitive personal information - including names, health status and GPS coordinates of a user’s designated confinement location - as the app’s central server did not have security measures to protect such data.
source: Qatar: 'huge' security weakness in COVID-19 contact-tracing app [Amnesty UK, May 26 2020]
CoronaMelder spoorde tot nu toe 1.300 besmette mensen zonder klachten op [NU.nl, Jan 14 2020]
