The Promise and the Perils of Contact Tracing

The global pandemic that the WHO declared on March 10 sent global leaders racing to “flatten the curve” to forestall an overwhelming wave of COVID-19 patients. The primary method used to accomplish this was as old as time—quarantine. Now countries and regions are moving into what we call the Fight phase, aiming to restart their economies while maintaining low and controllable levels of infection.

Lifting restrictions in a way that avoids a large spike in infections—and the need for subsequent shutdowns—requires an integrated, technology-enabled viral monitoring system with three essential components: a robust testing regime, significant contact tracing capacity and capabilities, and a concerted tracking effort to locate and extirpate the inevitable resurgence of disease hot spots.  Although testing and tracking present their own challenges, contact tracing is in many ways the most difficult piece of the puzzle, given the tough social issues that it presents—particularly when coupled with contact tracing technology, whose effectiveness depends on a high level of adoption in the population. Various obstacles, including privacy concerns, have the potential to limit citizen adoption of contact tracing apps and thus render a potentially powerful tool in the fight against COVID-19 ineffective.

Those issues are not, however, insurmountable. Public sector and private sector leaders can put strong safeguards in place, create incentives that encourage adoption of contact tracing apps, and take steps to ensure compliance with selective quarantine recommendations. In doing so, they can begin to revive hard-hit economies while protecting public health as well as individual liberties and privacy.

The Promise

Contact tracing is a critical element in combating the COVID-19 pandemic. (See “The 4T's in the COVID Battle.”)

How Contact Tracing Works. Essentially, contact tracing is a sophisticated form of sleuthing to determine who has come into contact with an individual known to be COVID-19 positive, identify any person with whom the exposed individual has been in contact, and then alert every person in that chain, as well as the relevant authorities, to the exposure. Rapid and effective contact tracing breaks the chain of infection and drives the reproduction (R) number—the number of new cases created by each infected individual in a particular social context—toward 1 or less, which is the level necessary to keep the coronavirus contained. (See Exhibit 1.)

The principal benefit of contact tracing is that it provides a basis for risk stratification so that authorities can limit quarantine to infected and at-risk individuals, without having to impose a lockdown on the entire population. Individuals can be classified into five groups, according to their likelihood of Covid-19 infection. (See Exhibit 2.) Depending on their classification, individuals may be notified, tested, or quarantined.

A contact tracing system starts with identifying individuals who have tested positive for the disease, and therefore fall into the “maroon” group. Individuals in this group must be isolated until they no longer test positive. Known contacts who meet certain criteria—generally, having been within 2 meters of the infected individual for at least 10 to 30 minutes during the previous 14 days—are separated into two categories—those who are symptomatic (“red”) and those who display no symptoms (“yellow”). People in either group may be infected, and thus may need to remain in isolation for a period of at least 14 days. Individuals in the yellow group who remain asymptomatic for 14 days are presumed to have had a mild case of the disease or to have avoided infection altogether. If sufficient quantities of molecular diagnostic tests are available, health care providers can test members of both groups; but if molecular diagnostic tests remain scarce, testing should focus on members of the red group.

The vast majority of individuals have had no known exposure to the virus. Consequently, they sit outside the contact tracing chain and are presumed healthy and free to circulate (“green”). Meanwhile, the population of individuals who have recovered from the disease grows steadily. The hope today is that those recovered patients will be immune to reinfection and—with validation from a reliable antibody test—can safely be excluded from further contact tracing.

The Required Elements of a Tracing System. Speed is critical if a contact tracing system is to be effective, for two reasons. First, infected individuals may begin exhibiting symptoms of COVID-19 only after having been contagious—and shedding virus—for four or five days, and perhaps even longer. Second, the disease is highly transmissible, so an infected individual can transmit the disease to a significant number of people in a relatively short time before being diagnosed. An entirely manual system would quickly sag and collapse under the strain of tracing large numbers of contacts for each infected individual, or it would require very large, continuous capital investments. Therefore, effective contact tracing efforts require technological augmentation—most likely in the form of a smartphone app—that addresses five key capabilities:

• Proximity. To align with our best understanding of exposure risk, the contact tracing app must be able to detect encounters of a given duration and within a distance of 2 meters over a rolling two-week period. The Bluetooth feature on smart phones could easily perform this function, logging all such encounters for the preceding two weeks either on the device or in a local or cloud-based central database.
• Location. It is critical to identify where encounters with a COVID-19-positive individual occur in order to effectively track the spread of the disease and identify hot spots. Although Bluetooth does not provide location information, such information would be readily available via the smartphone’s GPS function.
• Ubiquity. To be useful, the technology must be easy to use and available on as many devices as possible.
• Interoperability. The technology must connect seamlessly with the broader public health system. For example, it must allow users to enter symptoms or request tests from health care providers and send the app official test results that confirm infection. At the same time, it must also be compatible with public health databases and tools used by those engaged in testing, manual tracing, and hot-spot tracking, in order to facilitate quick access to scarce tests and convey relevant information to tracing teams.
• Security. In light of privacy and practical concerns, the technology must include a secure encryption feature and strong data governance, including deletion of an individual’s data (consistent with what is known as “the right to be forgotten”) after the COVID-19 pandemic can be declared over. Such protections will be critical to preventing fraud and abuse and to giving users confidence that their privacy rights will be respected.

Contact tracing systems used in other parts of the world could serve as useful models for a US system. Singapore, for example, has made its solution available to other countries—an offer that could help developers in the US accelerate their work. Several homegrown solutions are available in the US as well, often backed by big players. Most prominent in this group is the Google/Apple consortium, which has created a COVID-19 exposure notification system. The solution has the advantage of ubiquity, but its utility within a full testing, tracking, and tracing system is limited because it does not provide location data and because it offers limited interoperability with public health systems. Other applications, such as Safe Paths from the MIT Media Lab, permit secure location tracking and use an open-source framework, so others can adapt and leverage them freely.

The Perils

In order for the overall testing, tracing, and tracking approach to be effective, each element must take into account the underlying disease prevalence and spread, as well as the impact that lifting specific restrictions will have on the rate of propagation. For contact tracing, in particular, adoption rates for a supporting app must be relatively high to prevent out-of-control spread of the disease—and higher still as more restrictions are lifted. But there are significant challenges to widespread adoption.

Balancing Testing, Tracing, and Restrictions. To understand the dynamics at work, we modeled how transmission rates change at various levels of activity restriction, depending on different levels of contact tracing app adoption and testing, using the methodology described by the Fraser group at Oxford University and published in March 2020. 1¹ 1 “Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing,” by Luca Ferretti, Chris Wymant, Michelle Kendall, Lele Zhao, Anel Nurtay, Lucie Abeler-Dörner, Michael Parker, David Bonsall, and Christophe Fraser, Science, March 31, 2020. Notes: 1 “Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing,” by Luca Ferretti, Chris Wymant, Michelle Kendall, Lele Zhao, Anel Nurtay, Lucie Abeler-Dörner, Michael Parker, David Bonsall, and Christophe Fraser, Science, March 31, 2020.

We devised four different scenarios (shown in Exhibit 3) depicting increased relaxation of social restrictions, ranging from the most limited scenario (R = 1.2) on the left (perhaps a less densely populated city that is maintaining relatively strict social restrictions as it reopens) to the most permissive (R = 2.0) on the right (perhaps a densely populated city with fewer social restrictions). For each scenario, we identified a set of minimum testing requirements (shown on the x-axis) and app adoption rates (on the y-axis) that allow us to drive the R number down to an effective level of 1 or less—the level required for a containment strategy to be successful. The results are plotted as lines, which differ depending on the number of manual tracers deployed.

The results illustrate the need for more extensive testing and tracing as the authorities lift more and more restrictions. If they lift restrictions aggressively to R = 1.7, for example, they would need to administer roughly 10,000 tests per 1 million people—and at least 70% of the population would need to adopt the tracing app (as reflected in the gray line in Exhibit 3)—to maintain control over disease spread. If we add manual support from contact tracers at a rate of 350 per 1 million people, the required rate of app adoption falls to about 60% (as shown in the orange line).

Barriers to Adoption. As our modeling demonstrates, widespread adoption of contact tracing apps is critical for success. Only a few nations have achieved an adoption rate of 60% or above, and those that have succeeded did so by imposing credible civil or criminal penalties for noncompliance.

Certainly there are operational obstacles to widespread adoption, including how to ensure access to the app itself, how to make installation and use as easy as possible, and how to communicate clearly about the importance of participating.

While those issues are significant, the complex ethical issues are even more challenging. Contact tracing systems are necessarily invasive, since they require a detailed accounting of an individual’s travels and encounters and knowledge of the individual’s COVID-19 status. Appropriately limiting access to that information entails establishing suitable guardrails, security, and cryptographic solutions to control access to specific information. Such solutions should limit access to as few individuals or groups as require it, and probably should restrict access to health, location, and proximity data to public health officials only.

A Possible Path Forward

An effective contact tracing system is critical to the safe reopening of national economies. But could such a system work on the basis of voluntary adoption of contact tracing apps by the public? Countries or cities would need to achieve a significant threshold of app adoption as they moved away from stay-at-home orders to selective quarantine. Otherwise, they would risk triggering uncontrolled spread of COVID-19.

So how can governments address individuals’ privacy concerns and create the right incentives for people to voluntarily opt into the system by adopting the app and follow the rules related to selective quarantine? Three levers can help make this happen:

• Safeguards. Citizens will be more comfortable with a contact tracing system if it incorporates strong privacy protections. For example, while it is true that an app provider will have access to certain location and interaction data, they need not be privy to sensitive health data. And while health systems need access to medical data, including a patient’s COVID-19 test status, they don’t need access to location data. One could envision a system in which an honest broker—perhaps a public or private health institution—tightly controls sensitive, personalized information. That entity would forge the crucial link between health information and location information, sharing the relevant information with contact tracing teams and public health officials monitoring for geographic hot spots, but not with other public or private organizations such as law enforcement or immigration authorities. To provide maximum protection for patient privacy, the contact tracing app could include an auto-delete function that purges sensitive, individual-level information after 14 days. If the option to remove data purges were more expansive, however, and if aggregated anonymized data were not preserved, public health officials and researchers would lose access to anonymized data about the paths, rates, and outcomes of COVID-19 transmission—information that is invaluable for tracking hot spots now and for anticipating the likely path of future threats.
• Adoption Incentives. Private and public leaders might treat the risk stratification system discussed earlier as a roadmap for creating incentives within a voluntary adoption system. In principle, downloading and using the app would be voluntary. However, certain activities—for example, entry to certain public spaces, stores, restaurants, bars, or public transit—could be limited at the door, via a QR reader, to people who are using the app and are in the green risk category. Not using the app would curtail access to those venues, effectively mimicking the restrictions of a shelter-in-place order. To further encourage app adoption, governments must address technology accessibility barriers, including by offering people financial incentives to upgrade their phones. They might also offer other financial or social incentives as an inducement for app adoption.
• Quarantine Compliance. Quarantine compliance may be hampered as much by apathy as by privacy concerns. As a result, governments may find it necessary to encourage and enforce compliance with quarantine recommendations. As part of such efforts, governments must provide support to those under quarantine. Otherwise, if faced with severe economic and social hardships, individuals may break their quarantines, undermining the effectiveness of containment efforts. A contact tracing app or welfare checks (home visits by a qualified nurse or other public health professional) could easily spot quarantine-breaking travels, but they could also be used to reward compliance with financial support, food aid, and necessary services for the duration of the self-quarantine.

An integrated viral monitoring system anchored by a tech-enabled contact tracing system offers a roadmap for our restart. Such a system could allow us to move away from universal lockdown measures, instead implementing selective quarantine rules to thwart the advance of the invisible enemy, restore balance to our overloaded health care systems, and put our economies back to work.