Covid-19 tech needs blockchain, not carpet-bombing approach

There is a better way than the government’s track-and-trace program and centralised database

Picture: 123RF/SASHA 85RU

President Cyril Ramaphosa created a new stage in our fight against Covid-19 in his latest address to the nation when he announced two 

President Cyril Ramaphosa created a new stage in our fight against Covid-19 in his latest address to the nation when he announced two important policies: the wide-scale screening of people across the country, and the introduction of a “track and trace” system to follow up on the contacts of Covid-19 patients. Both policies, if done right, are crucial components of an efficient response to this and future coronavirus outbreaks.

The problem is that neither of the policies is being executed properly. Both come with very serious and negative consequences that could be avoided with only small changes.

First, let’s talk about the idea of screening a large part of the population. In principle, it’s an excellent policy, advocated for by the World Health Organisation. However, the problem is that screening as it is done now still focuses on patients who show symptoms.

Until now, those patients would have to go to a hospital and ask for a test. Under the president’s new policy — which started taking form on Tuesday with screenings being carried out in Alexandra, Johannesburg — field workers interview citizens and if they show symptoms they are being tested for Covid-19.

It is exactly this initial screening process that poses a problem. Screening before deciding who gets tested introduces what economists call a selection bias. Think about it this way: say you want to estimate how likely it is that a professor owns a fancy sports car, nut instead of asking all professors, or a random sample of professors, you only ask those who have recently won the lottery. If you then try to estimate how many fancy sports cars in SA are owned by professors, you will get an outrageous number that has nothing to do with reality.

By creating a centralised database of everybody’s location, the government creates a massive cyber-security risk

This, in essence, is how the government is collecting Covid-19 data now. It is only a small improvement over the previous procedure where only patients who went to the doctor of their own accord could get tested. In the analogy above, this would amount to asking professors if they own a fancy sports car while they are driving out of a Porsche dealership

There is a better way to get good estimates for the number of Covid-19 cases across the country: random sampling. Select a sample of people who are representative of the country as a whole, in terms of demographics, where they live, and their medical condition. Next, test everyone in this sample, even —especially — those who don’t show any symptoms. Then, and only then, will you obtain a reasonable measure of how large the problem is and, crucially, where Covid-19 hot-spots are emerging. Because these are the areas public-health interventions must focus on.

The other big policy announced by the president was a track-and-trace system. This will collect location data from all mobile phone users in SA for a centralised database that will be used to see where a patient who diagnosed with Covid-19 has been over the past two weeks. And everyone they were in contact with is then alerted that they were exposed to someone with Covid-19 and need to self-isolate and test.

In essence, this is a hi-tech version of the contact interviews currently undertaken with diagnosed Covid-19 patients.

On the face of it, it makes sense to have an automatic system to help with track and trace. It will speed up the process and thus lead to more efficient interventions. The problem is how this system is being built.

Let’s start with the use of geolocation data. The idea is that every mobile phone can be located through a triangulation procedure by the network operators. In particular in areas with good network coverage, this can work well, up to a couple of metres. But in more rural areas, network coverage is patchy, sometimes painfully so. In these areas the geolocation estimates are much less precise. What is worse, the areas of good network coverage are usually the areas where many people live.

In a large apartment complex in Sandton, for example, there will be dozens, if not hundreds of people with the almost identical geolocation. This does not, however, mean that they share the same space. The triangulation, or any geolocation measure, really, is not good at distinguishing points of similar latitude and longitude, but different altitude. In other words: just because you live below your noisy neighbours doesn’t mean you are likely to contract Covid-19 from them.

There are three additional problems of the approach adopted by the government. First, by creating a centralised database of everybody’s location, the government creates a massive cyber-security risk. We have seen time and again that centralised databases cannot be secured perfectly. The more valuable the data stored in a database is, the more likely it is going to be a target for hackers. And second, by collecting everybody’s geolocation data, we fundamentally alter our sense of privacy.

If the government can track where a journalist is at every point in time, will it not be tempted to see whom this journalist met? In particular, if the journalist just published a rather unflattering story about corruption within the government.

And third, there are computational issues with the matching algorithm in these track-and-trace programs. If you want to find out who a patient has been in contact with, you need to search through an enormous amount of data. Even with modern super-computers, this is an exceptionally challenging task.

Blockchain is better

All this sounds rather grim, but the good news is that there is an alternative. Instead of collecting all this data in a centralised database, we can use modern blockchain technology and design a decentralised system that provides exactly the same functionality. In such a system, a user’s location data would never leave their phone and they would only share it once they are diagnosed with Covid-19. By collecting contact data through Bluetooth instead of geolocation as, for example, Singapore does, we can drastically reduce the data that needs to be collected for every user.

Whenever two users pass one another, the app would do a Bluetooth handshake that records the contact in both users’ phones in a crypto-graphically secured list. If one of them tests positive for Covid-19, the app would simply go through the list of entries in this list and contact them one by one. This is, by many  orders of magnitude, more efficient and eliminates the need for invasive government surveillance.

Together with a group of students, entrepreneurs and large SA corporates, such an app is already being built (https://coviid.me). It will be open-source, available for free, and ready by the time the lockdown ends. Let’s hope the government is able and willing to adjust policies when they go astray, in particular when people’s health, life, and liberty is at risk.

• Georg is an associate professor at the University of Cape Town.