Because of COVID-19, our lives have changed dramatically in many ways during 2020. Our new normal has required us to adjust to new societal norms, new ways of working, and new rules and regulations for public health. We are isolated from friends and family. When we are in public, we wear masks, apply social distancing protocols, and avoid contact such as shaking hands or hugging one other as greetings. Most of us have been working remotely whenever possible, and many miss the social interaction of being at an office.
To help manage the spread of COVID-19, several types of contact tracing solutions have begun to appear on the market. Let’s talk about contact tracing, different kinds of deployments, and some challenges facing these solutions.
There are different ways of implementing contact tracing, ranging from manual collection through opt-in self-reporting to explicit user tracking.
The simplest example would be a manual approach. When we arrive at restaurants now (if they are open), the staff may require you to fill out a paper form with contact details – names and phone numbers. The effectiveness of this method is very questionable. First, someone needs to collect and process the data manually. Also, there is a high probability that a percentage of guests are giving false information (intentionally or unintentionally). Finally, the chances of a person who has tested positive for COVID-19 calling back into the public places that they previously visited are relatively low.
Enterprises are looking to utilize existing WiFi, Bluetooth and UWB protocols to support contact tracing solutions. These involve less manual labour and may have a more effective outcome.
In addition to helping to trace potential exposure, other advantages to these solutions include alerting of staff and guests to potential hot zones, isolation of affected workspaces, minimizing the disruption of different workspaces, and helping to re-engineer the workspace such as building new or temporary walls, paths, or limiting the use of certain areas. Leveraging your existing installed infrastructure provides significant value but may also limit your options for a solution.
Many countries around the globe have begun implementing mobile applications which would help with contact tracing. There are different methods and different levels of concern with the management of sensitive data. China, for example, already collects a significant amount of data on its citizens which could be used for epidemiological research and public health purposes. The means and methods of data collection aren’t specific to public health.
Other countries have come up with opt-in applications for mobile devices which generate one-time codes to exchange proximity and duration information amongst users. A user may then self-report a positive test through the app, and any stored codes are uploaded. Anyone who also has that code associated with a contact will be alerted to a potential exposure.
Countries with governments which limit privacy may have a greater ability to collect data. However, that data is not subject to the same type of protection and oversight as other nations.
Contact tracing, by nature, immediately opens up significant privacy concerns. Issues such as the retention of personal identifying data, the perception that reporting an infection may impact healthcare or insurance availability, the disclosure of data with third parties, and the potential for security breaches have all been discussed concerning contact tracing applications since the beginning of the pandemic.
While much of the world has gone mobile, if not all devices connect to the wireless network, contact tracing solutions which leverage wireless technologies to assess proximity and duration may have limited value. With MAC randomization, the ability to maintain location and tracking data for a device becomes difficult without having a means of associating a user with a device. If a person is connecting with a wired device, then tracking the user may become impossible.
The political state of a nation has a significant impact on the quality of data for public health purposes. At one end of the spectrum, China has reported that, as of November 2020, it has single-digit cases in several regions. Official information provided during the height of the pandemic has been challenged by leaked documents showing that the reported totals may have been significantly higher. This lack of transparency can lead to challenges with tracking the spread of a virus such as COVID-19.
Conversely, in Canada, the federal government has released an open-source exposure notification tool called COVID Alert, which leverages the exposure tools within the Android and iOS operating systems. Yet not all provinces and territories have agreed to support exposure reporting.
For enterprises, legal requirements and regulations have been changing quickly, and employers are under stress to maintain compliance with not only federal and local governments but health authorities who may have additional powers granted them by their role. In California, a law known as AB 685 takes effect on January 1, 2021. This update to the state’s Labor Code allows state officials to shut down any workplace that does not provide notifications to its employees within one (1) business day of notice of potential exposure and to retain records of that notification for three (3) years. While not a contact tracing issue per se, being prepared to act and to have the right tools in place may help remain in legal compliance.
Any community needs to have at least 60% – 80% application adoption rate to start having any effect from such an initiative. Reasons for low adoption for public sector app-based solutions may include privacy concerns, battery usage, an ineffective user experience, political views, or even user apathy. Certain demographics, such as senior citizens, may not have the technical knowledge required to install or use these applications. Additionally, geopolitical boundaries and overlapping digital healthcare strategies can lead to incompatible solutions and fragmentation. All of these challenges may lead to insufficient or incomplete data.
Within the enterprise, adoption may be a matter of enabling a direct integration with the existing infrastructure without impact to the user experience. The difference between non-authenticated proximity reporting and authenticated user tracing makes a significant difference in determining who may have potentially been exposed. Non-integrated solutions may not necessarily support BYOD deployments, guest access to the workplace, or shadow IT solutions, which impact the value of the solution. Leveraging third-party solutions may introduce additional privacy concerns, so it is vital to investigate how those solutions protect user privacy and who is responsible for that data.
Contact tracing in itself is not necessarily very useful. The ability to take action when exposure has been reported is a vital step. It’s the «so what do I do now?» moment that is key. The value of a contact tracing solution should not be limited to identifying and alerting for potential exposures. It should trigger a process for actions such as initiating deep cleaning of hot spots or areas of potential exposure, maintaining or adjusting cleaning schedules, and identifying how and where potential exposure might be mitigated in the future.
The biggest question for the companies who are looking into these corporate solutions is whether investing now will be justified in a post-pandemic world. Will users demand that such solutions be disabled to prevent user tracking? Would those systems be useful for seasonal outbreaks of the flu every single year? Will the urgency be there to maintain funding for such solutions outside of a global pandemic?
Scientists have stated that it’s not a matter of if, but when, another pandemic will occur. Can contact tracing platforms provide – and maintain – value in the interim?
Keeping citizens safe and limiting the transmission of something like Ebola or Zika through regional use of governmental exposure notification and contact tracing systems may become more common. In business, this will most likely not be applicable. But perhaps the cost of such solutions for the lifetime of a pandemic is justified to keep each other safe.
