The smartphones carried in so many pockets and purses could play a key role in keeping COVID-19 under control as the nation cautiously reopens the economy.

That goal received support April 10 with an announcement by Google and Apple that they are collaborating on standards and tools to make it easier for software developers to build apps that can help fight the pandemic. 

For the past month, a team of researchers at the Georgia Tech Research Institute (GTRI) has been working with a community-driven open source project on a “privacy first” open-source app that can take advantage of these tools to do something known as “contact tracing.” Contact tracing software, running on smartphones of persons who’ve chosen to participate, records the kind of person-to-person interactions that have the potential for transmitting contagious illnesses. If any of the other participants the user has interacted with becomes ill and chooses to share information about their symptoms, the software then alerts the impacted user anonymously. During this process, all shared information remains completely anonymous – to other users, to the government, to technology companies, and even to the database that makes the exposure matching possible. 

Individuals notified of a potential exposure could then receive information and guidance about steps they might take, including suggestions to get tested for COVID-19, to self-quarantine, or to closely monitor for symptoms. The notification would be one part of a larger effort to control virus clusters before they become outbreaks. To be most successful, a software-based contact tracing system will have to be coupled with broad-based testing able to quickly determine who’s infected with the virus.

Similar approaches have proven effective in countries such as Singapore and South Korea, though these systems have weaker privacy guarantees in place. A key feature of this new approach is that it would not exchange or publish any personally identifiable information and does not disclose any information at all unless someone voluntarily chooses to share their symptoms or diagnosis. This approach accomplishes this using Bluetooth signal strength to assess proximity rather than GPS data, which is difficult to anonymize and could be used to identify individual users based on frequently visited locations.

“We really need a better early warning network to guard against the re-emergence of COVID-19 in the general population,” said J. True Merrill, a GTRI senior research scientist who is working on the project. “In the early part of this outbreak, COVID-19 was spreading easily across the United States without an early warning of it. After the current shelter-in-place period is over, we are going to need tools to help people determine when they need to self-quarantine in order to stop outbreaks before they can grow.”

Manual contact tracing to identify who’s been infected has long been part of public health strategies to contain serious communicable diseases, but the speed at which COVID-19 has spread outpaced traditional methods, said Alexa Harter, director of GTRI’s Cybersecurity, Information Protection, and Hardware Evaluation Research Laboratory.

Privacy First, for the Common Good

“Smartphone contact tracing is a way of using technology to automate and augment some of the techniques that public health agencies have used,” she said. “Technology can enable us to do this, but for people in the United States to adopt it, privacy will really have to be locked down. Everything we’re doing in this project aims at providing privacy first. Manual contact tracing is still critically important, but digital contact tracing and alerting can significantly assist these efforts.” 

Beyond protecting privacy, large-scale adoption of smartphone contact tracing will need a social component that appeals to supporting the common good.

“To be successful, we’ll need to turn participation in this into a socially good thing, perhaps like the Ice Bucket Challenge,” Merrill said. “We’ll need people to voluntarily opt-in, and to get that, users would need to have full knowledge and control over where their data is stored and with whom they choose to share it.”

An Open-Source Global Effort

GTRI researchers are working with an open source community-driven project known as CoEpi (which stands for Community Epidemiology in Action), which envisions an app of the same name that could be installed on phones running Apple’s iOS or Google’s Android systems. CoEpi focuses on anonymous symptom sharing and alerting to stop the spread of transmissible illnesses like COVID-19. 

Other organizations are also working on contact tracing apps, and these organizations have recently joined together to form the TCN Coalition to support privacy-preserving digital contact tracing protocols to flatten the curve and stop the spread of COVID-19 while reopening the economy. TCN, the core component of the effort, stands for “temporary contact number,” which is an anonymous number generated to privately record interactions between mobile devices without allowing the devices themselves (or their users) to be tracked.

The TCN Coalition developed a common, shared protocol so that all of the different apps in the entire digital contact tracing network can cross-communicate, no matter which app is used. The TCN Coalition also developed a "Digital Contact Tracing Bill of Rights" that outlines requirements to minimize data collection, restricts what can be done with the collected data, and establishes security guidelines to protect civil liberties.  

The Path Forward, Group Benefits

“A symptom-sharing app such as CoEpi would allow us to relax stay-at-home orders so that we can increasingly return to work and public spaces, while providing a way for individuals to get early alerts about potential exposures to symptoms,” said Dana Lewis, one of the founders of CoEpi. “CoEpi can provide early detection of exposure risks for individuals, and an early warning system for the communities they interact in to detect and slow the transmission of illness like COVID-19, influenza, and even the common cold.”

Convincing a hundred million U.S. citizens to install a new app on their phones could be a significant challenge, but the CoEpi focus on symptom sharing and alerting could yield benefits to smaller groups even before being widely adopted.

“The good thing about this is that it could help protect small groups without needing the buy-in of the whole population,” said Harter. “An example would be a retirement community that is largely self-contained. If someone there got sick, it would be important to alert everybody that person had interacted with so they could self-quarantine and protect other people in the community.”

Other groups might include organizations performing critical services, such as factories, warehouses, or package delivery companies. “If you had a group where people really needed to work together, you could get early alerts to stop outbreaks from happening,” she said. It could also be used among small clusters of high-risk individuals and their family and friends, or at universities and schools as they emerge from self-isolation.

How Contact Tracing Would Work

The contact tracing component of the system would work something like this.

Each user opting into the service would install an app that would generate personal keys – long strings of letters and numbers unique to that specific smartphone, which are in turn used to generate randomized temporary contact numbers. The phones of users opting in would then communicate those temporary numbers with each other when they were nearby, using low-energy Bluetooth, a short-distance protocol widely used on mobile devices. Signal strength could provide a measure of how close the phones are to assess the risk of virus transmission when those people crossed paths.

“The idea is to log close interactions,” said Michael Brown, a GTRI research scientist who is the Georgia Tech technical lead of the project. “We’ll want to eliminate as many false positives as possible. For example, it’s highly unlikely that person-to-person transmission would occur across a large room.” For each interaction, the system could also record the duration of proximity, another factor in assessing potential risk.

Each phone would periodically generate new anonymous unique keys, and use those to generate new temporary contact numbers each time it crossed paths with another phone running similar apps. It would record those keys in a database that would be kept on the phone for a short period of time determined by the incubation period of the virus. 

If a CoEpi user developed symptoms, they would share their symptoms in their app. In future versions, the CoEpi developers envision that the sick user would be presented with a series of options such as anonymously notifying public health authorities. For now, the symptoms are sent to the CoEpi system, which would add the anonymous key and symptom report from the sick user’s phone. 

Each user’s phone would periodically download the list of keys associated with known symptom reports and check the temporary numbers generated by those keys against those of the phones it had been near. A match between each phone’s database and the numbers generated from the server’s key list would generate a notification of the exposure, and the app would then help the user decide whether the match likely represented a real exposure, and if so, decide what to do: self-quarantine, be tested, and/or notify public health authorities.

“Everyone would be pinged when they get tied to a known case, but only over a time range that really could have created a risk of transmission,” Merrill said. “There would be no identification information exchanged between the phones or the phones and the server.”

Other Potential Epidemiological Uses

Beyond advice on illness and notification of potential contacts, the system could also generate anonymized epidemiological information useful to researchers tracking pandemics. Users of the system would decide if they want to opt into the database and share their anonymized information with public health authorities.

“The CoEpi project will help provide earlier detection and testing of potential cases, and that information would be helpful for our predictive models,” said Pinar Keskinocak, who is William W. George Chair and Professor in Georgia Tech’s H. Milton Stewart School of Industrial and Systems Engineering.

Beyond programming support, GTRI will assist the effort through security analysis and potentially testing in its Atlanta facilities, Brown said. The testing will need to include many different environments and handset types, including multiple variations in operating systems.

The GTRI researchers have been racing to help CoEpi roll out software for beta and on-site testing, which should occur over the next several weeks. “The time line for this is super aggressive,” Harter said. “There is an urgency to this because we know it will be very useful in helping people stop social distancing, return to work and school, and try to get back to a more normal life.”

If you're interested in helping CoEpi as a mobile developer who can help at #WeAreNotWaiting speed (e.g. today or this week), please reach out to CoEpi: https://forms.gle/MLeKz9nerPvX8fwC8 

Similarly, individuals who are interested in becoming early testers of CoEpi can sign up via the same form: https://forms.gle/MLeKz9nerPvX8fwC8.