Contact Tracing Part 1 - NHS: How Contact Tracing Will Work

Major corporations (Apple, Microsoft and Google) will release NHS contact tracing app in June 2020 in the United Kingdom and North America to assist return to work activity.

What is Contact Tracing?

When somebody tests positive for an infection, the intent of contact tracing is to discover with whom the infected person has been in close physical contact recently, and then notify those people about their exposure. Ideally, anybody exposed would then be tested themselves and would be quarantined until the incubation period has passed. Contact tracing is a component in ending mass pandemic “stay-at-home” orders. Contact tracing can be used as part of the “return-to-normal” strategy.

How could your business use Contact Tracing?

Your business can use the contact tracing solution being implemented in the UK. This will be based on a phone app, and your employees should use whilst they are on your premises. However, the contact tracing app will only fulfil its potential if a large proportion of the employees uses it. Contact tracing is independent of other measures such as masks, gloves or social distancing.

Ideally the app would always be active while an employee is on your premises, and it could potentially be extended so that your employees are required to have this feature on, even when they are away from work. This requires a policy decision by your business.

Employees would always need to carry their phones, turned on and with Bluetooth enabled. So, keeping these phones charged will be important, so the provision of some charging stations might be a good idea in your business environment to enable charging at work.

In order to gain the trust and understanding of employees, education sessions should be held in each business location to explain the purpose of contact tracing, show people how it will be done and answer questions. These sessions should emphasize the importance of compliance and address privacy and other considerations, such as those listed below.

Contact tracing considerations

• How to maximize coverage. In a workplace such as yours it should be possible to mandate the use of a phone app for all employees, provided that they carry mobile phones in their pockets. If employees are unable or unwilling to use their own phones, could temporary devices be provided for them, for use only while they are on site? What would you do about visitors?

• Privacy concerns. A legal opinion should be sought, because – even though the data is only being collected on your premises for the purpose of Covid-19 contact tracking – it could also be accessible by some external entities such as the phone companies. Microsoft, Google and Apple clearly state that the contact between devices are not linked to actual identities nor locations. A key point is that these apps are not collecting location data. However, a privacy agreement and/or waiver might be advisable to make it acceptable to employees. A review of data collection, usage, storage and retention might be relevant.

• Data collection and analysis. The app will only be useful if the data can be easily understood and interrogated. The primary question that it will need to answer is “Who has person X come into contact with during the past 14 days?” Apps that are under development are specifically designed to do exactly that, while still respecting people’s right to privacy. As of the 29th April - It is not yet known if the apps will be configurable e.g. the length of time and distance that define a “contact event”.

How do Contact Tracing Systems Work?

Apple and Google are modifying their operating systems to allow their mobile phones’ Bluetooth LE functions to record contact events, and they plan to release an app in mid-May. Microsoft has also developed a solution (CovidSafe) in conjunction with the University of Washington. Importantly these solutions keep the anonymity of everybody involved by storing the data on people’s phones and by transmitting an anonymous key which is only decoded when an alert needs to be sent out.

The app constantly pings Bluetooth signals to nearby phones, looking for others that might be running the app within about two meters, or six and a half feet. If two phones spend a few minutes in range of each other, the app considers them to have had a "contact event." They each generate a unique random number for that event, log the numbers, and transmit them to each other. These so-called “beacon” numbers are based on encryption keys stored locally on each device.

Subsequently, if a user is diagnosed with Covid-19, they must update their phone app which immediately uploads their last two weeks of contact data to a server. The system retrieves and transmits the event numbers to all other users of the app. Each phone checks against its stored list of events, and in the event of a match they alert the user that they have been in contact with a potentially infected person, and tell them what to do next to help prevent further spread.

The alerts would not include the identity or the GPS location of the individuals concerned because that information is not being stored.

How Google’s Contact Tracing works

Sources

https://www.geekwire.com/2020/uw-microsoft-release-contact-tracing-app-aiming-battle-covid-19-preserving-privacy/

https://www.wired.com/story/apple-google-bluetooth-contact-tracing-covid-19/

https://www.wired.com/story/value-ethics-using-phone-data-monitor-covid-19/

https://covidsafe.cs.washington.edu/

Summary

Businesses should start to think and plan for contact tracing. In part two of this article will discuss recommend next steps and policy changes that your business may want to consider. If you want to discuss this article, please contact us here.