Contact Tracing: the Way Out of Lockdown?

Each solution has its own advantages and disadvantages. The server used in the centralized protocol, for example, would be the preferred target for attacks, but it would also then be the only server that would ultimately need to be protected against them.

However, Google and Apple recently announced the development of an API (application programming interface) using the decentralized solution. This, coupled with Apple's refusal to modify their devices’ Bluetooth functionality to optimize the operation of centralized protocols, led several European States to later explore the decentralized option, thus putting France in a difficult position.

StopCovid, the "made in France" tracking application for the general public

During the lockdown, the French government decided to consider implementing an optional contact tracing smartphone application called StopCovid. The app is slated to be made available in early June. The stated objective is to make it possible to inform a person that they have been in contact with an individual who has tested positive for Covid-19. To do this, the application lets phones record a history, via Bluetooth, of details of the people an individual has been in contact with for a certain length of time, and from a certain distance. These contacts are anonymous, with numerical IDs that keep individuals from being identified.

Upon finding out that they are infected, an individual can agree to share their history using, a QR code issued by a health professional that is not linked to the test or to the individual, which is the solution currently being considered. The central authority thus receives only the history of the numerical ID associated with the contacts, without identifying the individual sharing them. The contact that individuals have recorded in their history then receive an alert when there is prolonged interaction with the virus. As it currently stands, the anonymous numerical ID makes it more difficult to identify the infected individuals.

The application does not require access to location data. The plan is to store the data (the numerical IDs of the people using the application) on a centralized French server that uses the ROBERT protocol (Robust and Privacy-Preserving Proximity Tracking). This prevents any sharing of infected people’s IDs, which would allow potential ill-intentioned computer experts to discover their identity. f. On the other hand, access to the data by government administrations is precisely what raises questions. The whole challenge is to put procedures into place which ensure that this data is not stored for an extended time or used for other purposes.

In a publication on April 24, 2020, the CNIL deemed the application to be legally compliant, but requested certain additional guarantees. It stressed the voluntary nature of the application and asked that its non-use not have any negative consequences for individuals, such as limiting their access to public transport. They call for the application to be evaluated regularly and for it to be used for only a limited amount of time, the same time limitations applying to the storage of its data. They requested to be consulted again if it is adopted after its vote in Parliament in order to make recommendations on the architecture and security of the application.

Contact Covid and health brigades: healthcare professionals on the front line

Faced with the backlash to the StopCovid application, two digital tools are currently being developed and deployed by Assurance Maladie and the Ministry of Solidarity and Health. "Health brigades" will be responsible for tracking and tracing cases of potential exposure. Made up of nearly 4,000 people, most of whom are employees of the Assurance Maladie, they will get their data from general practitioners, who themselves will receive a flat-rate fee for participating in the system. This manual tracking is likely to be extremely time-consuming and will require an enormous amount of human resources, compared to a digital application.

This large-scale system will be based on a screening information system called "SI-DEP", which will automatically collect diagnostic test results (RT-PCR) and create alerts for any new cases, and on a remote monitoring system called "Contact Covid". From mid-May onward, Contact Covid will be available to healthcare professionals (doctors, biologists, and pharmacists) as well as authorised agents of the Assurance Maladie and Regional Health Agencies (ARS), but patients "won’t be required to do anything", said Nicolas Revel, the director of the Assurance Maladie.

This remote monitoring service enables doctors to provide a wide range of information during consultations about people who have tested positive: name, social security number, address, telephone number, symptoms, the screening test used, place of work or other - retirement home, daycare, school, prison - and individuals they were in contact with within two weeks of diagnosis. The platforms set up by Assurance Maladie in each department then call those exposed, to inform them on how to proceed and to figure out any potential needs. This data is required to be deleted after three months.

The Regional Health Agencies are then responsible for identifying and treating chains of infection and managing the reported concentrations of positive tests. People exposed to the virus will be encouraged to comply with quarantine instructions, and they and everyone in their household will receive sick leave, as well as those outside the household showing symptoms of the disease. For symptomless out-of-home cases, quarantine will be maintained until testing has been completed. The sick leave will be extended if the result of the PCR test is positive, reduced if it’s negative.

The aim of this system is also to provide testing in Biology Laboratories and to allow masks to be distributed in pharmacies for all close contacts, whether or not they are presenting symptoms. This would explain why biologists and pharmacists are involved in the process beforehand.

According to the Ministry of Solidarity and Health, Contact Covid was "developed in compliance with French law for the protection of personal data and the GDPR (General Data Protection Regulation)". The identity of the infected person will be revealed to those they have been in contact with, after they have consented to do so. The stored data will be accessible to the patient, the doctor, the French Public Health Agency, Assurance Maladie, and the Regional Health Agencies.

The system was submitted to the CNIL for an opinion. They called for great vigilance as data relating to health and to certain aspects of private life will be recorded in two national files, accessible to a large number of people. They also call for a certain number of guarantees, in particular regarding the data to which each category of user of the two files will have access, and calls for more detailed consideration of the data storage periods. There are therefore still some reservations concerning Contact Covid, which has not yet been the subject of the same outrage that StopCovid created, although it has been developed in close collaboration with patient associations.

StopCovid and Contact Covid: avoiding silo thinking

Use of StopCovid is voluntary and available to smartphone users, while Contact Covid should make it possible to prevent exposure for those who do not have the application. This keeps the same person having to enter the same information twice, or for GPs and health brigades having to enter information that is already available on the application.

In addition, the information from Contact Covid is descriptive but does not take into account "anonymous" contacts, i.e. people that a patient does not know but may have encountered in public spaces or on public transport, which StopCovid is able to do.

In order to take full advantage of the complementary nature of StopCovid and Contact Covid, the data from these two services must be interoperable, to be able to get an overall view of cases of exposure, clusters, and the status of virus circulation within the territory. If the data is not correctly aggregated and analyzed, there is a real risk of dispersing resources that will make it more difficult to manage a way out of the crisis.

The risk of a lack of interoperability within the territory itself is a bit of a paradox at a time when there is a desire to do so between European systems. As early as April, the European Union warned Member States of the need for interoperability of national systems, but left the choice of protocol up to them. The European Commission has reiterated this desire, with the stated objective that "European citizens must be able to be alerted to a possible infection in a secure and protected manner, wherever they are in the European Union (EU), and whichever application they use".

Copyright: Juan MABROMATA / AFP