Against the backdrop of the COVID-19 pandemic, our series of special reports on Enterprise Essentials – technology products that are deemed vital for the ongoing global recovery efforts – continue with a look at a raft of contact tracing tools that are entering the mainstream.

Despite a lack of consensus on its privacy implications, digital contact tracing remains one of the most effective weapons to halt the spread of the virus. Contact tracing is the process of identifying, assessing, and managing people who have been exposed to a disease to prevent onward transmission. When systematically applied, contact tracing will break the chains of transmission of COVID-19 and is an essential public health tool for controlling the virus. The casual ‘contact tracing’ process is generally a laborious, slow process that relies on in-person interviews, tracking down all the recent contacts, informative fact sheets and detective work.

Digital contact tracing during COVID-19
As the recovery effort is under way, a spate of contact tracing apps rise to the occasion

A new breed of mobile apps is a must in order to automate the process of retracing a person’s movements to find people they might have infected and possibly notify them at the earliest possible stage. Infected people can transmit the virus for days before they develop symptoms, and it can take several more days for public health investigators to learn about a case and confirm it with testing. These teams then have precious little time for traditional contact tracing and getting those people to self-isolate before they, too, pass on the virus.

There are different proposals about what information an app should gather and how much it should share with health officials (centralized vs decentralized). The Chinese government has taken phone tracking to an extreme, monitoring citizens’ locations and purchases to gauge their risk and restrict their movement. GPS data from phones can identify potential hot spots and indicate who has been exposed. Government programs in South Korea, India, Iceland, and U.S. states including North Dakota and Utah are using phone location data to monitor COVID-19’s spread. But GPS technology isn’t precise enough to gauge short distances between two phones to determine which encounters are most risky. And widespread, automated GPS tracking raises privacy concerns that could lead to legal challenges in some countries.

Many governments are instead developing mobile apps and Exposure Notification protocols that identify recent contacts by the exchange of low-energy Bluetooth radio signals. Each phone generates a random numerical ID that it broadcasts to nearby phones, which record such Bluetooth “handshakes.” If a user experiences symptoms or tests positive, they can trigger notifications to phones they’ve recently been near.

Apple and Google Explore Exposure Notification

Exposure Notification was developed by Apple and Google for using smartphones to determine whether a person may have recently been within the proximity of someone that had been infected with Coronavirus. Exposure Notification is a decentralized reporting based protocol built on a combination of Bluetooth Low Energy technology and privacy-preserving cryptography and is designed to be implemented as an opt-in feature within COVID-19 apps developed and published by authorized health authorities. Originally unveiled on April 10, 2020, it was first made available on iOS on May 20, 2020 as part of the iOS 13.5 update.

The Apple/Google protocol is heavily influenced by the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) and the Temporary Contact Number (TCN) protocols, but is implemented at the operating system level, which allows for more efficient operation as a background process. Protocols such as TCN, DP-3T, and BlueTrace are constrained in how they operate as they have no special privileges over normal apps.

Maintaining user privacy is an essential requirement in the design. The Google-Apple rules do provide a level of privacy that they might not have otherwise. It only permits apps that store data on the user’s phone by default, instead of automatically uploading it to a central database; users have to give permission to share it with authorities. But the limits on the type of data collection are the core concern for states.

The app stores from Apple and Google also offer contact tracing apps from other vendors as long as they are affiliated with a public health agency or meet strict requirements.

BlueTrace Makes Its Debut

Initially developed by the Singaporean Government, BlueTrace powers the contact tracing for the TraceTogether app. Each app implementing the BlueTrace protocol has a corresponding central reporting server operated by a health authority. When the user first launches a BlueTrace app, they will be asked for their internationally formatted phone number and are assigned a static UserID. This phone number is later used if the user has registered an encounter in an infected patient’s contact log.

Singapore and Australia have seen some of the highest adoption rates of the TraceTogether app, in part due to intense government marketing, while other countries such as New Zealand are considering BlueTrace for adoption.

Currently, all major digital contact tracing apps use Bluetooth, no digital contact tracing apps currently make use of GPS, however, some implementations do make use of network-based location tracking. This approach has the advantage of eliminating the need to download an app.

As governments and health authorities are struggling to find solutions to fight the pandemic, many countries remain undecided on the digital contact tracing system.

Digital Contact Tracing for the Enterprise

With some countries reopening their economies, contact tracing apps, along with emergency response and employee health and safety products, are rising to the occasion.

In May 2020, Salesforce launched Work.com to help businesses reopen safely and re-skill their employees. It includes employee wellness assessment; shift management; contact tracing; emergency response management; and grants and volunteer management. Work.com’s Contact Tracing allows public and private sector leaders to manually trace health and relationship contacts in a safe and private manner, by collecting data from individuals who are infected or potentially exposed to infectious disease and creating visual maps of contacts and locations to monitor potential interactions and outbreak.

Salesforce and Siemens announced a strategic partnership to develop a new workplace technology suite that will support businesses globally to safely reopen and deliver the future experience for physical workplaces. The partnership will combine Salesforce’s Work.com, powered by Customer 360, and Siemens’ Smart Infrastructure solutions, including Comfy and Enlighted, to orchestrate the processes, people and things that are essential to creating safe, connected workplaces for the future. Key solutions include a ‘touchless office’ with mobile employee boarding passes for building and elevator entry, and a safe occupancy management system, which allows employees to reserve conference rooms and desks through Comfy’s app that sends real-time alerts as thresholds are reached.

Another example is ServiceNow’s Safe Workplace Apps, which includes a new Contact Tracing app. This app helps employers support a safe workplace for their employees by identifying potentially exposed employees based on workplace data. Shortly after the release of ServiceNow’s Safe Workplace Apps, the vendor said close to 400 customers worldwide have implemented over 1,600 app installations to manage the safe return of their employees. These enterprises include Uber, Coca Cola European Partners, State of North Carolina, BankUnited, and AmeriGas and others.

Oracle is working with the US government to develop what it terms a Therapeutic Learning System. It consists of a mobile-ready app for doctors and clinicians to enter information about their patients, and for patients to report their experiences with drug therapies on a daily basis. The goal is an aggregate picture that could provide real-world data on which medications and dosages work against the coronavirus.

On March 30, less than two weeks later, the app was generally released on the public Oracle Cloud. The app runs on Exadata Cloud Service, Oracle Cloud Infrastructure, and a multi-layered architecture for keeping the app secure. One key attribute is Oracle’s APEX low code web-based application development framework that is offered as a Platform-as-a-Service (PaaS) that developers can access on a self-service basis.

Additionally, Gretchen Alarcon, Oracle group vice president of HCM strategy, said the vendor is making its Workforce Health and Safety module available to existing Oracle HCM customers free of charge, essentially providing an incident management dashboard for the HR department to compile and enforce safety checklists, virus exposure monitoring and reporting, in addition to carrying out other corrective and health compliance measures. She added that more than 100 customers have already gone live with the Workforce Health and Safety since it became available in March.

The product is part of the Employee Care Package, which also includes Onboarding or reboarding, Work Life, Digital Assistant, and HR Help Desk for employees to incorporate social distancing and mental well-being, reskilling, volunteering and giving back into the new workplace, as well as addressing personnel issues with self-servicing and automated tools that prioritize efficiency as much as safety.

Contact Tracing Systems Go Global

The United States‘ efforts to fight the pandemic have been hampered by a lack of national coordination. And Silicon Valley is still trying to find a workaround. With varying opinions on what data the contact tracing apps should record, the federal government has so far failed to institute concrete privacy standards.

Apple and Google have sought to resolve the issue by asserting their own standards, flexing the power they hold over the software on almost all smartphones, but some states are refusing to follow their lead and fear the tech companies’ rules could render the apps nearly useless.

At least nine states have released or begun to develop contact tracing apps, and more than a dozen are actively considering them. But their approaches are far from consistent. Some states, such as Oklahoma and Virginia, are using the Apple+Google framework. Others, like Utah and Rhode Island, are going with independent apps. North Dakota is doing both.

What’s more, at least 15 states have rejected the idea of using smartphone apps for contact tracing, instead, they are relying largely on thousands of workers to do the tracing. Meanwhile, a handful of major cities have launched their own apps, and some employers and schools are working on tracing apps as part of their own reopening plans.

By relying on mobile technology and big data, the Chinese government has used a color-based “health code” system to control people’s movements and curb the spread of the coronavirus. The automatically generated quick response codes, commonly abbreviated to QR codes, are assigned to citizens as an indicator of their health status.

Although authorities have yet to make the health codes compulsory, in many cities, citizens without the app wouldn’t be able to leave their residential compounds or enter most public places. The Chinese government has enlisted the help of Alibaba and Tencent to host the health code systems on their popular smartphone apps. To obtain a health code, citizens have to fill in their personal information including their name, national identity number or passport number, and phone number on a sign-up page.

Following China’s lead, other governments have also turned to a similar technology to battle the virus, Moscow has also introduced a QR code system to track movements and enforce its coronavirus lockdown.

Recently, the Japanese government released its coronavirus contact tracing app for iOS and Android. The apps rely on Apple and Google’s co-developed exposure notification platform, using Bluetooth to help determine whether users have come into close contact with others who have tested positive for COVID-19. Japan refers to the app as COCOA, a somewhat convoluted backronym that stands for COVID-19 Contact-Confirming Application. It was developed by Microsoft engineers hired in May after Google and Apple reportedly led the government to abandon the work done by a Tokyo-based team in favor of a bigger corporation.

The UK’s Britain’s National Health Service (NHS) is considering a major U-turn on its new NHS COVID-19 contact tracing app, just days after launching it on the Isle of Wight amid concerns that it doesn’t work as it’s intended to. NHS’s digital innovation arm, NHSX, has awarded a £3.8 million contract to Zuhlke Engineering, a Swiss IT firm to “investigate the complexity, performance and feasibility of implementing native Apple and Google contact tracing APIs (application programming interfaces) within the existing proximity mobile application and platform.” The contract started on May 5 and runs until November 10.

In May 2020, the German government brought SAP and Deutsche Telekom subsidiary T-Systems to develop and deliver the official Corona-Warn-App for Germany, based on open source and a decentralized Apple-Google approach. After only 50 days, the federal government’s Corona Warning app was ready to go and is available for download in the Apple App Store and the Google Play Store in June. It has been downloaded over 6 million times.

Corona Warn App developed by SAP and Deutsche Telekom
Corona Warn App developed by SAP and Deutsche Telekom

The Corona warning app does not require information such as name, age or address, nor does it record a location. Only randomly generated codes are passed on if two smartphones come relatively close over a certain period of time. The codes of the respective encounters are only stored on the owners’ smartphones themselves. It is not possible to determine which device is behind this code because the code is encrypted. The Corona Warn app is the largest open-source project ever implemented in Germany on behalf of the Federal Government.

Previously, SAP helped a local health department in southern Germany to automate and speed up the contact tracing process after a COVID-19 case is confirmed by developing a Web application that runs and leverages SAP Cloud Platform, resulting in no additional expenses for hardware or other IT requirements.

Italy, once at the heart of Europe’s coronavirus pandemic, launched an app called Immuni. Based on the Apple-Google model, the app was made by local developer Bending Spoons. It has seen more than 1 million installs on Google’s Play app store.

The French National Assembly approved the release of the StopCovid app to help combat the COVID-19 pandemic. StopCovid is a digital contact tracing app based on a Bluetooth tracing protocol developed especially for the app. The app was released on June 2, 2020. The StopCovid app will supplement work already being done by a French team of human contact tracers who are trying to identify people who are infected with the disease but unaware of the fact.

The app works by using Bluetooth signals to detect when two handsets are in close proximity, in order to log an estimation of the distance and length of the encounter. France has opted for a “centralized” app, which carries out contact matches on a computer server. That contrasts with the “decentralized” model – an approach advocated by Google and Apple – which carries out matches on users’ own devices.

In June 2020, Canada decided to roll-out an app called COVID Alert. The project is spearheaded by the Canadian Digital Service, a federal initiative, and the Ontario Digital Service, with help from volunteers from Shopify. It incorporates Bluetooth technology provided by Apple and Google. The app will undergo a security review by BlackBerry.

There are over 30 million smartphones in Canada that could use the app, which makes a significant portion of the Canadian population. Ontario will roll out the app first. Officials in that province said they hope to have the app available for download on July 2 for iPhones running iOS 5.0 or later versions, and for Android phones running Android 6.0 or later versions.

Meanwhile, the Alberta province has already developed an app called ABTraceTogether. It is a mobile voluntary app that complements traditional manual contact tracing being performed by public health officials.

Table 1: Contact Tracing Apps Step Up The Fight Against COVID-19

LocationNameTechnologyNotes
AustraliaCOVIDSafeBluetoothCOVIDSafe is a digital contact tracing app announced by the Australian Government in April 2020. The app is based on the BlueTrace protocol developed by the Singaporean Government.
AustriaStopp CoronaBluetooth, Google/AppleAustria was one of the first major European nations to align with the Google/Apple API.
BahrainBeAwareBluetooth, LocationBeAware Bahrain is the official mobile app for Android and iOS, developed by The Information & eGovernment Authority (iGA), in collaboration with the National Taskforce.
BulgariaViruSafeLocationViruSafe is a mobile application created to assist society and governmental institutions in the fight against COVID-19. The app was approved by the Bulgarian Ministry on April 4th and launched for mass use on the Google Play and Apple Store on April 7th.
ChinaChinese health code systemLocation, Data miningChina has both a national app and a number of regional ones with disparate approaches to collecting data and keeping it private. The Chinese government, in conjunction with Alipay and Tencent, has deployed an app that allows citizens to check if they have been in contact with people that have COVID-19. It is in use across more than 200 Chinese cities.
CyprusCovTracerLocation, GPSThe Cypriot app was one of the earliest efforts to launch contact tracing apps since February 2020.
CzecheRouskaBluetoothThe government launched a Singapore-inspired tracing app called eRouška (eFacemask). The app was developed by the local IT community, released as open-source software, and will be handed over to the government.
EstoniaEstonia’s AppBluetooth, DP-3T, Google/AppleThe Estonia government has called on nine companies to help with a privacy-preserving approach that will leverage DP-3T and the Google/Apple API.
FinlandKetjuBluetooth, DP-3TFinland’s approach is based on anonymity and voluntary use.
FranceStopCovidBluetoothThe French National Assembly approved the release of StopCovid to help combat the COVID-19 pandemic. StopCovid is a digital contact tracing app based on a Bluetooth tracing protocol developed especially for the app. It was released on June 2, 2020.
GhanaGH COVID-19 TrackerLocationThe app was developed by the Ministry of Communication and Technology and the Ministry of Health.
IcelandRakning C-19LocationRanking C-19 route tracking is a GPS logger app for Android and iOS, with a user interface and content from the national COVID-19 web page Upplýsingar um Covid-19 á Íslandi. When the infection is confirmed the route data is used to support more traditional contact tracing. So far, it has the largest national market penetration rate of contact trackers in the world, having been downloaded by 38% of Icelanders.
IndiaAarogya SetuBluetooth, LocationIndia is the only democracy making its app mandatory for millions of people. India’s Covid-19 tracking app Aarogya Setu became the world’s fastest-growing application beating Pokemon Go with 50 million users in the first 13 days of its release.
IsraelHaMagenLocationOn March 22, 2020, the Ministry of Health launched “HaMagen”, an iOS and Android contact tracing app. The HaMagen app was specifically designed with a privacy-first approach where information about locations and times is cross-referenced on the user’s device, and not transmitted on to the cloud database.
ItalyImmuniBluetooth, Google/AppleItaly’s government launched an app called Immuni, based on the Apple-Google model. The app was made by local developer Bending Spoons.
MalaysiaMyTraceBluetooth, Google/AppleThe government launched MyTrace on May 3, 2020, one of three tracing apps that released alongside Gerak Malaysia and MySejahtera. Gerak Malaysia is a tracing app which allows police and the Ministry of Health to track and analyze users’ movement, and register for permission to allow state border crossing. MySejahtera is an app build by the National Security Council and the Ministry of Health to retrieve updated information and statistics of the pandemic.
MexicoCovidRadarBluetoothThe specific privacy and data policies for the Mexican app are quite opaque.
North MacedoniaStopKoronaBluetoothThe government launched “StopKorona!” on April 13, 2020, becoming the first country in the Western Balkans to launch a COVID-19 tracing app. The Bluetooth-based app traces exposure with potentially infected persons and is designed to help healthcare authorities provide a fast response. The app was developed and donated by Skopje-based Software company Nextsense.
NorwaySmittestoppBluetooth, LocationNorway didn’t adopt the Google/Apple API, contributing to a European split. The Smittestopp app is developed by the Norwegian government and uses Bluetooth and GPS signals. On June 15, 2020, the country halted the app over privacy concerns after the Norwegian Data Protection Authority said low infections could no longer justify the risk of privacy invasion by the end-user. The app ceased collecting new data and plans to delete all data collected so far with any additional collections effectively paused indefinitely.
PolandProteGOBluetoothPoland’s Ministry of Digital Affairs and the Chief Sanitary Inspectorate have launched ProteGO, one of EU’s first official COVID-19 tracking applications. The current version requires users to enter their data themselves for the purposes of health self-monitoring. According to Ministry sources, it will soon be supplemented with a Bluetooth module, so as to collect information about encountered devices and inform about contacts with COVID-19-positive persons.
SingaporeTrace TogetherBluetooth, BlueTraceTraceTogether was the first major Bluetooth contact tracing app. It uses a digital contact tracing protocol called BlueTrace, developed with an open-source reference implementation called OpenTrace.
SwitzerlandSwissCovidBluetooth, DP-3T, Google/AppleInitially, the Swiss opted to use DP-3T over  the Google/Apple API. Now it looks they will be using both. SwissCovid [fr] uses the DP-3T protocol and is built on top of Apple/Google Bluetooth API.
TurkeyHayat Eve SığarBluetooth, LocationTurkey mandates people who test positive downloads the app and can then share data with police.

Source: Apps Run The World, June 2020