Resolving the $100 million TraceTogether dilemma

TraceTogether
Image: GovTech

Japan recently announced that it will soon launch its own contact tracing smartphone app. According to the Straits Times, to protect users’ privacy, the app does not collect names, phone numbers, user locations or any other personal information. This follows the launch of SwissCovid, an app built in Switzerland which boasts of similarly strong privacy protections.

Both apps use software jointly created by Apple and Google, called the Exposure Notifications System, which uses Bluetooth technology to help health authorities perform contact tracing, while ensuring that user privacy and data security remain central to the design.

Singapore’s Government Technology Agency (GovTech) built its own TraceTogether app on a different protocol. Jason Bay, TraceTogether’s product lead at GovTech, wrote in a blog that since March, GovTech had been working with Apple and Google on the specifications for contact tracing technology which “allows cross-border interoperability.” He wrote this on April 10th, the day that Apple and Google announced their partnership to create the Exposure Notifications API.

It is widely known that TraceTogether does not work well on Apple’s iPhones, which are used by a third of smartphone users in Singapore. This is because iOS, the operating system running Apple devices, suspends Bluetooth scanning when the app is running in the background, preventing it from collecting data from contacts in the proximity of the user.

Mr Bay posted as recently as April 20th that GovTech will continue to work with Apple and Google to improve TraceTogether using the new API. It therefore came as a surprise when on June 5th, Dr Vivian Balakrishnan, Minister-in-charge of the Smart Nation Initiative, told Parliament, “We have had repeated discussions at both the technical and policy level with Apple, but we have not yet been able to find a satisfactory solution.”

The government has not announced any further plans to use the Apple-Google API. Instead, it plans to issue a wearable device to all Singapore residents and make it mandatory for everyone to carry it around. On June 13th it was reported that the government had already awarded a tender to a company to manufacture the first 300,000 units of the device. Based on the tender price for the pilot batch, CNA estimated that the device will cost $110 million to be rolled out nationwide.

Why couldn’t TraceTogether be made to work with the Apple-Google software? Dr Balakrishnan did not elaborate on what the technical and policy issues were. However, an examination of the two main protocols used by contact tracing apps around the world could give us some clues.

Centralised vs decentralised contact tracing

TraceTogether uses BlueTrace, a centralised report processing protocol. When a person tests positive for Covid-19, they will be required to upload the entire contact log from their phones onto a central server managed by the government for the purpose of contact matching and tracing.

TraceTogether’s current protocol also has no special privileges over normal apps, preventing the app from running Bluetooth scanning in the background.

Contact Tracing
Image: BBC

Exposure Notifications, on the other hand, employs a decentralised report processing protocol. User data is not stored in a central server and the matching of Covid-positive cases is done on users’ devices. Users can still opt to share their phone number and details of their symptoms with health authorities through the app, so that they can be contacted and receive advice on the next course of action to take.

Because the Exposure Notifications protocol is implemented at the operating system level, it allows for more efficient operation as a background process. It could also extend battery life and improve detection across iPhone and Android devices.

Several countries which initially pursued the development of centralised contact tracing apps have now decided to adopt the decentralised architecture pushed by Apple and Google. In late April, Germany abandoned a home-grown app design in favour of a “strongly decentralised” approach after Apple refused to budge on the settings of its iPhones.

At least 22 countries have now received access to use Exposure Notifications, including Austria, Belgium, Germany, Ireland, Italy, Latvia, Poland, and several U.S. states.

Even Australia, which created its COVIDSafe app based on TraceTogether’s open source code, is now exploring a switch to Exposure Notifications.

Why do we need a contact tracing app?

With all the privacy risks that contact tracing technology brings, why do we even need to use it? Don’t the traditional modes of contact tracing suffice?

Effective contact tracing and widespread community testing have been recognised as the twin keys to enable the safe and wide opening of economies from Covid-induced lockdowns, of the sort we have endured in Singapore for the past three months.

Manual contact tracing involves interviewing the patient and asking them to recall all their movements for the past 14 days to determine whom they came into close contact with. Large teams of contact tracers then track down these contacts to instruct them to self-isolate or get tested. This is a laborious exercise which can take a few days. The delay could result in an infected person roaming the streets for several days, unknowingly transmitting the virus to others.

Contact tracing apps, if widely adopted, can instantly alert all the close contacts of a new case and instruct them what to do next, drastically reducing the time needed for contact tracing and stopping the spread of infections.

Contact Tracing 1
Contact Tracing 2

The win-win solution for Singapore

The Covid-19 pandemic has done much damage to our economy, with as much as a 7% GDP contraction expected in 2020. It is the worst recession in our nation’s history. Therefore any solution that will allow us to safely reopen our economy should be considered. Contact tracing apps can provide a way forward.

We need not make a false choice between privacy and public health. The Exposure Notifications System provides both privacy protections and privileged operating system access to allow contact tracing apps to work on almost all smartphones, even when they are locked.

By improving privacy protections and reducing the battery drain on phones, an enhanced TraceTogether app will become more attractive for Singapore residents to install on their phones, improving its current 25% adoption rate to a level closer to what is needed for effective contact tracing.

As more coronavirus-torn countries manage to contain their outbreaks, talks are underway on the establishment of “travel bubbles”. This would allow quarantine-free movement across borders. An important prerequisite would be effective contact tracing.

Interoperability between contact tracing apps would certainly help. As more countries around the world decide to adopt the decentralised protocol created by Apple and Google, it makes sense for Singapore to move in sync with them, to enable TraceTogether to “talk” to apps in other countries.

Given that 91% of the population in Singapore uses smartphones, rolling out a working contact tracing phone app can be done much more easily and cheaply than issuing a hardware dongle to all 5.7 million residents. It is also more seamless to fix bugs or add enhancements to an app and roll out an update to App Store or Play Store. If the hardware token has a serious bug, that’s $110 million down the drain.

It is still not too late to reverse course. The TraceTogether app should be re-programmed to adopt Apple and Google’s Exposure Notifications system. This will enable the app to run effectively on all smartphones, maximise adoption, protect privacy, enable cross-border interoperability and, most importantly, become a real weapon in our battle against Covid-19. The wearable device then only needs to be issued to the 9% of residents who don’t own a smartphone, saving taxpayers over $100 million.

Author: Gerald Giam

Gerald Giam was a Non-Constituency Member of Parliament from 2011-2015. He is a member of the Workers' Party of Singapore and currently runs a technology consultancy which he co-founded. The opinions expressed on this page are his alone. Published by The Workers' Party, 701 Geylang Road, #04-02 Teambuild Centre, Singapore 389687