As the majority of states in the US begin to ease social distancing restrictions and 70% of higher education institutions in the US have announced they plan to resume in-person or at least hybrid operations in the Fall, contact tracing has emerged as an integral component of re-opening plans. Alongside increased cleaning and sanitation measures, social distancing protocols, and Covid-19 testing, contact tracing may provide assurances to cautious individuals that steps are in place to promote safety and protect health.
Checklist for returning to campus
Learn more about four critical steps to reduce the risk of COVID-19 transmissionRead the insight
IT leaders are now grappling with how to effectively implement contact tracing technology and protocols on their campuses and ensure that data is being protected and ethically utilized. Although these new capabilities are still taking shape, we can glean some early lessons about the challenges and opportunities that contact tracing technology presents by reviewing how international and local governments have approached these tools.
What is contact tracing?
Contact tracing is a public health tool to identify, inform, and monitor people who may have been exposed to someone with an infectious disease, such as COVID-19. Traditionally, contact tracing entails a manual process by which trained staffers conduct detailed and intensive interviews with the infected person about the places and people they interacted with in a set amount of time.
Contact tracing has recently received a tech upgrade in the form of proposed apps or Internet of Things (IoT) devices. The proposed apps track proximity to other users’ phones, so that an infected person can self-identify their status in the app, which anonymously sends notifications to all other users who had come into close contact with the person and may have been exposed. Badges and other small devices that are not reliant on a smart phone are also being marketed with similar contact tracing capabilities.
What can we learn from government implementations?
1. Government-led contact tracing initiatives pushed to local and regional levels in US and Canada
While many international governments, such as Singapore, Australia, and the United Kingdom, are deploying federally-sanctioned approaches and apps for contact tracing, local and regional governments are taking the lead in the US and Canada. Regardless all governments are grappling with how to develop, deliver, and implement an effective and privacy-compliant contact tracing application. Higher education IT leaders within the US and Canada are even more challenged to define their protocols amidst persistent change and uncertainty from their local or regional governments.
This complexity is best illustrated through the roll-out of the Apple-Google Covid-19 contact tracing tool, which has gained traction with several governments. The tool is not a standalone app, but rather an application programming interface (API) that health agencies can use to build an app around.
Apple-Google Covid-19 Tool
The API’s use is restricted to a single public health agency per country to incentivize as many people as possible to use a single tool.
Apple and Google also released sample code and app concepts to help organizations and governments build apps if they are using a localized approach.
In order to preserve users’ privacy, all exposure notifications are processed on users’ phones, rather than being collected and processed on a secure central server.
Foundational Considerations for Higher Education Institutions
Compliance with local and regional government protocols and technology, which may not yet be fully articulated, will take precedence over institutional solutions.
While many businesses and universities have started building their own apps, a proliferation of contact tracing apps that have unique target audiences (e.g., university/company affiliation, geographic location, etc.) may diminish the efficacy of a single tool.
Any selected app must ensure secure storage of data collected and ethical use.
2. The best apps are voluntary, do not track location data, and have secure data storage
The best received contact tracing apps prioritize anonymity, privacy, and security of data to generate buy-in through three characteristics:
Opt-in apps are more palatable to a privacy-concerned population
Governments worldwide have found mandating usage of contact tracing apps politically untenable due to privacy concerns; however, the Chinese government has mandated use of its app. Higher education institutions similarly understand that campuses are unlikely to respond kindly to mandatory use of contact tracing apps.
Marketing contact tracing apps as voluntary with settings that allow users to provide consent to share their data and maintain control of their privacy and data helps ease the concerns of citizens who feel reluctant to share their data. For example, users of national contact tracing apps in countries like Poland, Singapore, and Australia who find out they are COVID-19 positive must voluntarily share their contact log data. Users can also revoke their consent and demand that any data regarding them be deleted at any time.
Bluetooth technology data is less invasive than mobile location data
Contact tracing apps which use Bluetooth technology not only provide more tracking accuracy than GPS and cell towers but are the most effective at preserving user privacy and anonymity. Bluetooth apps, such as the Czech Republic’s “eRouska” app, only identify if a user has come into close contact with another user (i.e., within 2 meters for a period of greater than 30 minutes), and do not track a user’s location and wherethe contact occurred. Malicious third parties can much more easily track and identify users when apps collect location data, even if data is incomplete and anonymized. The eRouska app uses radio waves to determine if devices are nearby by emitting an identifier beacon, in the form a random, anonymized, and temporary ID. When two devices with the app come within range of one another, the devices trade IDs. Each device then locally stores an encrypted time-stamped log of its interactions.
Bluetooth should not be mistaken as a perfect contact tracing app tool as its signal strength can vary greatly depending on if it is in a pocket or backpack and from device to device. Understanding this, Professor Po-Shen Loh from Carnegie Mellon University developed the ”NOVID” contact tracing app. NOVID employs ultrasound technology in conjunction with Bluetooth radio waves to more accurately track user interactions with infected persons.
Decentralized data storage provides more security and less opportunity for abuse
Apps that store and process data in central servers are more susceptible to both data breaches and function creep. Correspondingly, some governments are opting to employ contact tracing apps with decentralized architecture, despite their desire to centralize data to better spot trends. Similar to the Apple-Google API, the Singapore’s “TraceTogether” app uses decentralized data storage, where contact log data is stored on user phones and no identifying information is kept on central servers. The Singaporean government only stores on its central servers’ data such as contact logs that users who tested positive for COVID-19 have voluntarily provided. Multiple European governments even stopped backing the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) standardization protocol after PEPP-PT announced it was opting to use centralized data storage – despite PEPP-PT still being GDPR-compliant.
Public and private sector organizations as well institutions themselves are developing and releasing a bevy of contact tracing apps, many of which are open source. As institutions consider which apps to employ, they should prioritize apps with decentralized architecture to best protect user data. Doing so will help mitigate the risks of cybersecurity attacks and potential outcry from campus’ reluctance to collection of sensitive health information.
3. Apps require participation to be effective
Without widespread participation, contact tracing apps may do little other than make people feel safer. Researchers at Oxford University suggested that for a contact tracing app to be effective, 60 percent of a country’s population would need to download and use it. While Singapore’s approach to both manual and automated contact tracing was initially praised, only one-fifth of its population has downloaded its TraceTogether app. Conversely, the Chinese government requires citizens to download its contact tracing software on their devices and scan QR codes to enter any public place.
In theory, universities could take approaches as forthright as denying campus admission to persons who refused to use contact tracing apps. However, in practice, institutions must weigh the costs and benefits that mandating apps could have on community members’ health, perceptions of privacy, and enrollment preferences. Institutions can incentivize participation by:
- Clearly advertising the precautions they are taking to anonymize and secure data.
- Communicating the app’s benefits and frame adoption as a way to flatten the curve and drive a faster return to the campus experience, which many staff, faculty, and students are eager for
- Integrating the app into a seamless digital experience for students returning to campus, who will also turn to their technology to receive campus and virus-related updates and access counseling, advising and health services
The University of Washington’s CovidSafe app will not only automate the contact tracing process but will also provide guidance and help individuals who test positive to prepare for interviews with a public health agency contact tracer. The app also contains a messaging system through which individuals can receive announcements from local public health organizations.
4. Automated and manual contact tracing work best together
Automated contact tracing is not a miracle solution that will singularly help institutions get and keep faculty, staff, and students safe while on campus. Instead, institutions should use apps to supplement historically proven manual contact tracing efforts.
Iceland’s contact-tracing app, “Rakning C-19”, had the highest penetration rate found worldwide with 38% participation, but a senior official stated the app on its own was “not a game-changer” and attributed the flattening of Iceland’s curve to both automated and manual contact tracing.
Manual contact tracing provides depth and nuance to reported interactions in a way that escapes automated contact tracing apps. For example, automated contact tracing apps do not account for users wearing a mask or otherwise protecting themselves when exposed to an infected person – to an app, all interactions are equal.
4 considerations for resuming residential life this academic year
Institutions can learn from state and local governments that have committed to this dual approach. New York City is planning to employ both automated contact tracing in the form of Bloomberg-developed COVID-19 apps commissioned by the governor, as well as an army of manual contact tracers. New York is hoping to employ 2,500 public health testers and contact tracers by June, and eventually, 30 contact tracers for every 100,000 people in line with the National Association of County & City Health Officials’ recommendations. New York City is partnering with Salesforce to construct a call center and customer and case management system to help the city manually track potential cases and coordinate quarantine of exposed citizens. Johns Hopkins University also developed a free remote course that is now a requirement for anyone who wants to be hired as a contact tracer in the state of New York.
Similarly, CovidSafe at the University of Washington will operate in addition to traditional manual contact tracing conducted by public health agencies. Higher education institutions are particularly well-positioned to form their own cadres of contact tracers, as some are already partnering and being called upon to administer contact tracing training for governments and public health organizations.
5. Manual contact tracing can benefit from a data-driven approach
In the face of an uncertain future, institutions are evaluating a variety of innovative and unvetted approaches to help track and curb the spread of COVID-19 in the Fall. IT leaders are wondering what data could be used to supplement manual tracing efforts and how to build dashboards that track ID swipes used for building access, course registration and room scheduling data, events management data, geographic information systems (GIS), and potentially even de-anonymized cell tower data. For example, institutions could potentially use building/room scheduling and card swipe data to identify where an infected person traveled and who they might have infected.
Depending on the maturity of data governance, integration hubs, and access to real-time data, IT units will vary in their ability to create these dashboards, but regardless should consider the privacy risks and ethical considerations inherent to all data-driven approaches. As IT leaders begin implementing contact tracing programs, their primary concern should be securing that data and ensuring that campus community members are aware of and provide consent for any measures being taken.