đź”’ How the Covid-19 alert app works in SA – govt expert

Using Bluetooth technology to take the fight to Covid-19, the newly launched Covid Alert SA smartphone application is the latest technological advancement in the war against the virus. Here, BizNews founder Alec Hogg talks to Gaurang Tanna – the head of policy co-ordination and integrated planning at the Department of Health – about how the app works, how it protects your privacy and most importantly, how it has the potential to protect and save the lives of countless individuals. – Jarryd Neves

Gaurang Tanna is the head of policy co-ordination and integrated planning at the Department of Health and the ideal person to put together the app that South Africa launches today, for contact tracing. Good to be talking with you. I say, ideal person because before you went into public health, you were a computer scientist, or at least trained in that field.
___STEADY_PAYWALL___

That’s right. Yes. So my background is in technology and I am an enthusiastic public health professional who has worked for more than a decade in the health department. It has made me somebody who’s got a hybrid skill set between public health and technology. 

And no doubt keeping in touch with developments around the world. I see you’ve tapped into Google and Apple and that’s quite important from a privacy perspective. How do you even start, though, putting together an app that one hopes all South Africans are going to download?

Covid Alert SA
Gaurang Tanna, head of policy co-ordination and integrated planning at the Department of Health

So there are various different modalities that countries have utilised around the world. We’ve had the advantage of learning from many other countries. Like Singapore, for example, that started using BlueTrace. The UK uses a centralised model for achieving the same objective. We followed a number of countries who decided to opt for an Apple/Google exposure notification. This was a trade-off between how much we can service our client, and how “privacy-conscious” the app would be. 

We settled on ensuring that the app is sensitive to privacy infringements. To get that public adoption, we need it to be effective, for a public health intervention to work.We are hoping that we’ve made the right choice. Time will tell how many downloads we get. Globally, countries have struggled in getting the adoption rates, but we’re hoping that privacy would not be one of the reasons why South Africans would not download this app. 

It’s so interesting you make that point because it’s becoming more mainstream now, the whole story of privacy, I don’t know if you watch the Netflix show House of Cards, but even there in this very popular series, you have these nefarious industrialists who get people to download an app so they can check where they’re going to. I guess that’s in the mind of many people in the public. They’re now worried about privacy. So how are we protected once we download this app? 

So, the way the app works is that you download the app, with the intention to receive a notification from somebody else who may test positive later, and may have come into contact with you. So it’s very important that people download this app before they become infected. We encourage all South Africans to download the app. In the eventuality that they come into contact with someone who’s positive, and hoping that person also had the app on, both of them could be protected.

The index case would then be able to inform you that they have come into contact with you and have now reported positive. If you walk into a supermarket and another positive person came into close contact with you – who didn’t know they had the virus – this person could a few days later, notify them of their diagnosis on the app. The app will then do the rest, notifying all the close contacts that the person came into contact with. 

Now I get that. But the problem here is Big Brother knows where you are at any point in time. So how are we protected against that? 

A very important question. This is how it works. I would have the app installed on my phone. You would have the app installed on your phone. The app doesn’t know my name. Your app doesn’t know your name. Both apps have unique IDs. If we come into close contact with each otherwith, say within two metres, or for a sufficient duration like 15 minutes (we use the WHOs as guidance on this), the apps would exchange IDs. Say a couple of days later I report positive. I didn’t know I came into contact with you. Only our phones know that this phone had a close exposure with that phone. 

Only our phones know that this phone had a close exposure with that phone.

So your phones are really your proxy measure of distance between two people. I would notify my device of my positive diagnosis using the PIN code that the Department of Health would have sent me. The app would then notify all the close contacts and do the rest.

And it’s all part of this project that Apple and Google have put together to make sure that isn’t going to be any abuse? 

So, there are two key pieces of technology that make it work. The first is Apple/Google interoperability between the two sets of devices and the app itself. The second is the validation of a positive. What you don’t want is a person who deliberately comes into close contact with thousands of people and then fictitiously reporting a positive to create panic in the system. The app has got a built-in validation process. Every person that gets a confirmed positive result will receive a PIN code. The PIN codes, by the way, are sent to positives and negatives. 

It’s on capture of that PIN code, together with your date of birth, that the app would then verify that against our Covid Connect system and verify indeed that this is a true positive and allow the exchange of keys to happen. This is just to ensure that the fidelity of the system is not compromised in any way. But the two are completely different services. The validation service and the exposure notification service that we use with support from Google and Apple are totally independent services of each other and therefore very much privacy preserving.

Read also: Covid-19 graft isn’t just a South African game – look at other African countries

It’s very sensible. A pity, however, that it wasn’t available six months ago. Why has it taken so long to put it together? 

At the onset, we started manual contact tracing methods. We then opted for an SMS and WhatsApp based service, largely because of its penetration in South Africa. We know +35-million South Africans use WhatsApp, and we thought that would ensure utility value and wouldn’t require anybody to download an app. We know many countries struggled with this, certainly at the onset when the system came out. Secondly, we wanted to learn from the process.

In building Covid Connect, what looks like a very simple user interface – both for healthcare workers as well as citizens – has got very complex architecture sitting behind it. It’s got an architecture where we draw on lab results from public and private labs across South Africa. It then goes to Covid Connect, which then sends out SMS messages and makes it – and the reporting back from citizens – available to healthcare workers. The entire integration was a very sophisticated process. We’re so glad we did it, because without that we wouldn’t be able to set up a validation service that we now use with the Covid Alert app. 

In March 2020, we started a WhatsApp service for health prevention messages. A month later, we started screening self risk assessment capability on that WhatsApp channel. A month or two after that, we introduced the ability to receive lab results through WhatsApp, notify contacts anonymously through SMS, and monitor the health status of index cases through WhatsApp. In as many months, we now have a Covid Alert app. So as you can see, we’re trying to use every technology we can find to actually improve the effectiveness of the contact tracing process. 

This is very positive for the future for a number of reasons, like government embracing technology and in such a sophisticated manner as you’ve done. But how much support did you get from those in the private sector? I do see on your FAQ’s that Discovery Health, for instance, has been pretty involved in this whole process. How so? 

We have been fortunate enough to have the Discovery team on our side. They’ve done all the work pro bono. The app itself was built with the support of Discovery. But let me also mention the commercial banks in South Africa – the Banking Association of South Africa and their members – who have been very supportive of this from the onset. They are going to be using the collateral we have produced (plus their own) to extensively market the service and the app itself for wider adoption. I must mention the mobile network operators. 

We’ve been very lucky to get support from Vodacom, MTN, Cell C and Telkom. They’ve all come to the party without hesitance, wanting to support this, drive communication and encourage our population to download this. If you cover the four telecommunication companies and the five largest banks in South Africa, you’re targeting a number of South Africans. We’re hoping that the call to action from those corporates will be received positively by our population who will download the app. It’s a classic partnership between the public and private sector. 

It’s brilliant to see. I hope that there’s been an oversight on this, but I didn’t see Capitec mentioned amongst the banks?

Capitec has been supporting us. A number of banks have offered to deep link their own mobile apps with this app to encourage downloads. Capitec has been one of the banks that is also trying to work out how best to achieve this. But they’ve all offered support to market this through the websites, through their digital communications channels, through various channels that they have with their clients, in order to get higher scales of adoption across the country.

To download the app, is it pretty simple? Is there a website? Is it on the Apple App Store or the Google App Store? Where does one get it?

Both the Android and the Apple App stores have the app available for download. You just have to search Covid Alert SA. We’re also working on the Huawei App Store – since they’ve sort of parted ways with Google – and we’re hoping to achieve this soon. We know 80-85% of smartphone users in South Africa use Android devices, maybe 18-20% are using Apple. We also know earlier versions of Huawei cellphones, make use of the Google Play store. I think we are covering a huge chunk of the smartphone population in South Africa. 

Read also: Still nervous of Covid? Create an age-friendly school at home – Wall Street Journal

So you’ve got the app, which is going to help with contact tracing and make it much cheaper and save our tax rands from doing it manually. You’ve addressed the privacy issues with us. You did say earlier, though, that around the world there has been a low uptake of similar type apps by the public. How are you going to address that challenge? 

So, as mentioned, there were two different modalities that many countries used. I think there were probably two or three broad concerns that have been blockers to this. The first is people are worried that we might be tracking them. The second concern might be that the Bluetooth might be draining the battery too much, therefore making it infeasible to use for long. The third may very well be that we might be taking personal information and using it for other purposes. 

Now, the benefit of the Google and Apple exposure notification service allows us to deal with those in one or another way. Privacy because they wouldn’t allow us to put anything else on the app, other than this. With regards to battery drainage, the BlueTrace protocol, for example – that Singapore implemented – was one of the first large scale implementations. The BlueTrace protocol had a significant battery drain, but that has been solved with Apple and Google because they’ve taken care of it by embedding some of the technology within the operating system and optimised it as far as possible. The third concern is personal information. That is also taken care of, largely because Apple and Google wouldn’t want us to put anything else on the app, other than it being used for this exclusive purpose. 

We’re hoping that we would be able to get that large scale adoption we need, to be able to get the highest effectiveness possible. Initial studies have shown that you need 60% of your population to download this app. We’ve been in contact with Oxford’s Big Data Institute and their subsequent findings have revealed that you can get effectiveness from even as little as between 10% and 15%, albeit on a lower scale or at a lower degree. We’re targeting 10-million downloads – roughly one third of the smartphone population in South Africa – and this need not be a national coverage. So if you have 60% at sub geography – so in a particular district, suburb or supermarket, for example -the app will be based successful in achieving that effectiveness.

Visited 957 times, 1 visit(s) today