Contract-tracing app tackles privacy concerns
July 1, 2020
A contact-tracing app said to be less invasive than Alexa has been funded under the European Open Science Cloud (EOSC) initiative and will launch this month. The monitoring system lets users with coronavirus symptoms take ownership of their personal data while participating in national track-and-trace schemes.
The EOSC Secretariat – an initiative that has approved €1.2m in emergency funding for 32 projects to tackle the Covid-19 pandemic – is supporting the app that it says will improve contact tracing while simultaneously maintaining privacy.
Concerns that digital tracing systems for Covid-19 could become back doors to mass surveillance have already mounted, with academics from 26 countries issuing a warning that contact-tracing apps could hamper trust.
Confirming someone has been infected with coronavirus requires personal data to be submitted, recorded, exchanged and stored, with some apps such as the UK government’s NHSX indicating that it may be stored and used for future research purposes.
But with backing as part of the EOSC – an initiative changing the way European research is conducted through open science where researchers are quickly developing instant diagnoses for major diseases and tackling climate change – a small research team has been able to respond rapidly to the pandemic and develop a contact-tracing app in the space of a few months.
Described by its creators as less invasive to personal data than Alexa, the app allows users with strong symptoms of coronavirus to take full ownership of their personal data while track and tracing. The goal of the project is to build up a picture of local infection clusters so that targeted regions can be restricted rather than having a blanket ban.
Developed by brothers Paul and Patrick Byrnes, the app invites users to participate via an opt-in facility, which can be removed or deleted at any time, and will be available to download on 10 July 2020 on iOS and Android.
This app – called Tracing Ireland’s Population (TIP) – is different to existing contact-tracing apps. TIP gives users ownership of their data, places them in full control of any track and tracing rather than an automated programme collecting and storing information to be used at a later date, and hosts all information in encrypted form.
“Alexa will invade your privacy more than our app does,” said Paul Byrnes. “Like many contact-tracing systems hoping to end blanket lockdowns by providing an accurate, targeted picture of infections, our new facility looks set to enable smaller, localised restrictions. The success of any contact-tracing app depends on whether people will engage with it, and if they don’t trust it, they won’t use it. It’s that simple. Once the pandemic is over, all data will be erased.”
Many tracing apps such as TraceTogether used in Singapore communicate with copies of themselves on nearby devices over Bluetooth. When a user confirms they have been infected with Covid-19, everyone who has been close to that person's phone will get a notification that they may have the virus.
But while most platforms exchange data with nearby strangers and store it remotely, the TIP app acts more like a digital version of a manual tracer.
“With no use of Bluetooth or GPS tagging, our app instead allows someone who shows strong symptoms of Covid-19 to submit their phone’s IP address which is stored in an encrypted form,” said Byrnes. “The user then submits the phone numbers of anyone they have been in contact with, who then receive a push notification and details of how to arrange an appointment for testing. They can choose to engage with it or ignore it. But, if they delete it, it is erased from our system. The point is to build up a picture of local clusters of infection so that we can target regions rather than a blanket ban.
“No person who uses our app is identifiable: we take 25 data points, and only three of which are personal – the IP address, the phone number and the county. We don’t ask for your name, age, sex or employment status. Google and Apple have more of your personal private information than TIP does.”
A condition for securing funding from the EOSC initiative was to have an independent data protection impact assessment – a process to identify any potential issues or risks to privacy in managing users' private data – something which the HSE has not had independently verified.
“We have been assessed by an independent body from the EU Commission and once this has been approved we will receive the green light for rolling out the app,” said Byrnes.
Although the brothers were rejected by Irish state development agencies for funding to develop their app, they were given hope by the EOSC initiative, granting them €20,000 to develop TIP.
“It has been a great scheme for responding to public emergencies like Covid-19 and has been vital to a small research team like ours,” said Byrnes. “Without the EOSC initiative, we could not create an encrypted data host or use graphic designers to create a front-end. Essentially we could not have developed the app.”
The EOSC Secretariat responded to the urgent international challenge caused by coronavirus by introducing a fast-track procedure to apply for co-creation funding, specifically dedicated to activities related to Covid-19.
Successful applicants to the co-creation funding have been notified and are in the process of receiving their allotted funds. Applications were evaluated according to Horizon 2020 criteria, by a specially established evaluation team working with the EOSC Secretariat steering group.