No Silver Bullet for COVID-19, But Tech Can Help

Experts agree that reopening the United States requires contact tracing—working out, when someone has tested positive for COVID-19, who they might have infected already. Contact tracing, like any kind of detective work, is ultimately a very human undertaking. It’s a labor intensive, empathetic process of walking people back through the last few days of their lives and helping them remember who they might have been in close enough contact with to infect.

You can’t do that with an app—especially one that’s not downloaded by 80 percent of smartphone users, and uses Bluetooth location data that might list someone in an adjacent apartment as a “close contact.”

But enterprise technology providers like Capgemini, PwC and Salesforce are making big market bets (Salesforce is giving its tools away for free) that you can systematize the contact tracing process through call centers or dashboards—making it possible to ramp up capacity fast. And you can use location data from Bluetooth proximity tracing apps and cellphone service providers, with the interviewee’s consent, to help jog their memory.

“Technology can help the contact tracers by augmenting and automating elements of the job,” says Pavel Doležal, CEO of Czech big data automation and orchestration firm Keboola. His company provides the software backend for the Smart Quarantine contact tracing system the Czech Republic rolled out May 1.

Keboola’s technology is being used in Slovakia too, and is being looked at by a couple of other European governments, Doležal says. In the United States, it’s being pitched by French government contractor Capgemini to state and city governments—and to big companies in the travel and hospitality sector—according to Czech officials.

Dozens of countries are deploying their own test-and-trace solutions, But some, like South Korea, have drawn fire for privacy violations that encourage public shaming. “We didn’t want to adopt the very top-down approach we’ve seen in some Asian countries. ... It’s important that this is all based on consent,” says Doležal of the Czech approach, adding that the system complies with the strict data protection and privacy requirements of Europe’s wide-ranging data law, the GDPR.

The call centers are staffed by employees of the Czech Ministry of Health. Anyone who tests positive will get a call and undergo an interview to help identify people they have been in close contact with over the past few days. The interviewee is asked for permission to use location data from their cellphone, collected by their mobile provider, to help them remember everywhere they’ve been. Their response is recorded. “Everyone is given a choice,” Doležal says.

Keboola’s platform pulls historical cell location data from O2, Vodafone and T-Mobile—the three largest Czech mobile providers—into a “memory map,” which visualizes places where the interviewee has been, emphasizing places where they have lingered. The location data collected by mobile providers generally is accurate to between 4 and 100 meters, not accurate enough to identify possible infective contacts by itself, but useful for the health worker conducting the interview. “It’s a tool they can use during the interview,” Doležal says.

Privacy advocates have criticized the notice and consent model of data protection as inadequate in the commercial context, because most users don’t bother to read disclosures before clicking “I agree.”

“Notice and consent is not a meaningful concept in the way it’s currently applied,” says Jay Stanley of the ACLU. And in the COVID-19 context, there are other issues too. “No one wants to get their family, friends or workmates sick,” observes Stanley, suggesting that interviewees might feel pressure to consent.

To protect interviewees’ privacy in the Czech system beyond consent, explains Doležal, location data is decoupled from the interviewee’s phone number and deleted after six hours. GDPR and data protection best practices generally mandate that data is retained only for as long as it is needed and Doležal says the system was designed to comply not just with the letter of regulation, but with the spirit of privacy and data protection.

To this end, he says, the Smart Quarantine system employs other protocols restricting who can see what data. The call center staff “can only see the memory maps from the numbers they’re assigned,” says Doležal. There’s also an audit trail which creates a record of every data transaction.

“You have to be able to show you are in compliance,” Doležal says. European publics won’t accept the Asian model.

An IDC analysis of the PwC Check In solution for workplaces, which combines automated contact tracing with tools to monitor the status of remote workers, says the company “must apply vigilance ... to avoid the appearance of ... using the software for ‘Big Brother’-type functions.”

And in the United States, recent polling data suggests that almost half of Americans would be unwilling to download a contact tracing app because of privacy concerns.

But the push for privacy might be complicating the drive to use technology to augment contact tracing. For instance, Google and Apple are teaming up to provide Bluetooth proximity data that national health apps can use for automated contact tracing. But they’re banning the use of location data in apps that use their interface.

Doležal isn’t overly concerned about the unwillingness to trust technology and thinks that it demonstrates a laudable skepticism in democratic societies.

“I think the debate is healthy, I think the opposition is healthy … In some ways, this is a conflict between a technology-based approach and a values-based approach and I think the values-based approach is winning.”

Shaun Waterman is an award-winning reporter and editor who has worked for the BBC, UPI and POLITICO. He is currently freelancing covering federal information technology, cybersecurity and homeland security.