Assessment of contact tracing apps for South Africa

Survey Report
Executive summary

Current epidemiology research on COVID-19 shows that contact tracing is only able to curb the growth of the epidemic, if we identify 50% of the positive cases ​and ​trace 60% of their ​contacts with no delay (Ferretti et al., 2020). If we take more than three days to quarantine contacts, the growth of the epidemic cannot be controlled. This puts enormous strain and pressure on manual contact tracing regimes to meet these tight requirements and provides motivation for other more automated tools that use smartphones or some other means to help provide faster notification times. 

In countries like South Africa that have a dual economy with high income inequality and unemployment, there is no one-size-fits-all solution to contact tracing. Most automated contact tracing hinges on owning a smartphone and having Internet access, but Smartphone ownership and Internet access is limited. Current estimates are that between 49 and 52% of the rural population and between 63 and 69% of the urban population own a smartphone. A national contact tracing system that depends on smartphone ownership alone would leave a large section of the population (mostly the low-income portion of the population) locked out of the contact tracing programme.

There is an argument to be made for smartphone-based contact tracing in urban areas due to its higher smartphone penetration. The effectiveness of a smartphone application in detecting person to person encounters follows Metcalfe’s law where the number of encounters is asymptotically proportional to the square of fraction of the population using the application. If a contact tracing application was installed on smartphones in urban areas and we achieved close to 100% uptake (approximately 60% of the population that have smartphones with the required contact tracing features); we would detect approximately 36% of the contacts made.  

Epidemiology models show us that this level of contact detection would require 80%1 of the cases to be detected with immediate notification and isolation to have an impact on reducing the spread of the virus. This is a tough target and provides motivation for a better approach that uses a combination of multiple contact tracing regimes (manual and automated) that all have an underpinning theme of being privacy-preserving. 

The following approach is suggested:

  • Continue with manual contact tracing augmented by the COVID Connect application and ensure that the notification interval does not exceed two days and ensure that checking the status of test outcomes can be carried out in privacy. An external security audit should be regularly carried out on the central database, to ensure it is POPI compliant and the sensitive data is only used for its original intended purpose and is anonymized for research or deleted once the pandemic is over.
  • Rapidly scale up the GAEN-based contact tracing system, COVID Alert, for users who have smartphones – specifically targeting the major city centres. In addition to zero rating data used by the app, explore zero rating the app itself and Google Play Services library that runs the GAEN system and translate the app into all South Africa’s official languages to ensure that there are no barriers to uptake. 
  • For users without smartphones, users that don’t want to install the GAEN-based application due to security concerns or users who want additional knowledge about potential contacts, deploy the CoviID system
  • Continue with country wide hotspot mapping (such as the one being run at the CSIR in partnership with the National Department of Health) using randomized locations of individuals who test positive and aggregate movement data from operators and platform providers such as Google. This system can be supplemented with a GAEN-based contact tracing system and the CoviID system to provide a more complete picture of where there are higher risks of infection. 
  • Use an incentive scheme to encourage users and businesses to make use of contact tracing applications. For example, medical aids schemes that have reward programs such as Discovery Vitality and Momentum Multiply that already have some tracking systems for fitness purposes could provide rewards for 14 day self-isolation. For users that are not on these medical schemes, mobile operators could partner with the government to provide data rewards for users that strictly follow a self-isolation period. A tamper-proof application would be needed to track compliance. The software would need to be smart enough to see anomalies where the phone was left at home or given to another user. 
  • Ensure that all deployed systems can interoperate in a secure manner. Data formats for contact and location data and security mechanisms for shared data should be agreed on. This will help, for example, provide notifications to individuals where detection of this exposure could have been through manual contact tracing, smartphone-based contact tracing or QR-code-based contact tracing. 
  • Cross-border contact tracing will become critical as South Africa opens up its borders. Similar to Europe (Lomas, 2020), South Africa should participate in discussions in various regions on how to exchange encrypted tracing keys of infected individuals to enable travellers who enter the country to be alerted if they were in contact with somebody who tested positive for COVID-19 while outside the country. 

Time barriers to implementation are often more political than technological. It may take time to agree on a protocol for providing test verification codes that can securely provide confirmation of test status to multiple applications without revealing personal information. The Protection of Personal Information Act 4 of 2013 (POPIA), which finally came into force on 1 July 2020 can be used as the guiding principle for this purpose. Contact tracing creates another political challenge – it allows certain sectors of the economy to open up and others not. For example, more crowded businesses districts in the city may need to temporarily close whereas less dense suburban businesses may be able to stay open. This will need to be managed very sensitively.

It is also critical to have oversight to develop and enforce privacy guidelines for these technologies and continually review the impact in real-world situations. In South Africa, a judge has been appointed for this purpose, but civil society organisations, community groups and social movements should also continue to keep a close watch on how sensitive data collected from contact tracing systems is used and disseminated. Given that many of these recommendations will take time to put in place and implement, it would be prudent to implement these without delay to at least attempt to contain any further new waves of the COVID-19 pandemic and to contain new pandemics that will occur in the future. But, equally importantly, we also need to constantly guard against abuse of our civil liberties by an increasingly securitized state during the pandemic.

Download the full report below.

Suggested citation

Johnson, D. (2020). Assessment of contact tracing apps for South Africa (Research Report 2020). Research ICT Africa. https://researchictafrica.net/publication/assessment-of-contact-tracing-apps-for-south-africa/