The process of getting a list of everyone a patient has been in touch with, then contacting them, has a formal name called contact tracing. The technique, processed and run by people, has been around for decades and was used to eradicate smallpox in the early 1970’s. 

Contact tracing does have limits; for example, it can be incredibly difficult to find everyone who was in a grocery store from 1:00-1:30 pm last Thursday. Unless there was an app for that–as it turns out, there is.

SEE: Coronavirus: Critical IT policies and tools every business needs (TechRepublic Premium)

The private contact tracing API

Imagine a simple application that everyone signs up for–at least everyone with a smartphone. Sick or not, everyone signs up for it. Then, at some point, if you realize you have an infectious disease, you click that you have it, and your phone begins broadcasting over Bluetooth. 

Bluetooth by definition is a personal area network with a distance of about 30 feet. The infected person’s phone can simply reach out without reporting through any centralized server. In fact, if your phone keeps a record of who it contacted, and you find out that you were infected, your phone can warn other people to isolate and get tested. All of that can be done peerless, without a server, and without records.

That, in a nutshell, is the theory behind Apple and Google’s shared program for privacy-preserving contact tracing. The two companies have co-developed a set of Bluetooth APIs to support this behavior under iOS.

But what if you want the data? A county health and human services department might want to know where the “hot spots” are, especially as the stay-home orders expire, to open up most of the world, but not quite all of it just yet. 

The trade-offs in this data between public health and privacy seem obvious, if difficult to solve. Apple’s approach does not include GPS location, instead relying on records of Bluetooth contacts. There is no central server; the phones just talk to each other.

One alternative to Apple’s approach is to use GPS tracking. This data could be helpful in tracking how the coronavirus is spreading, where people are going, and what sorts of quarantine are more effective than others. You could even have people self-report additional information, like temperature and symptoms, and use machine learning to predict outcomes and take corrective action.

Apple’s APIs, however, are only open to one application per country. Contributors will generally need to work for a single government agency; there is little chance to “build your own.”

The all-volunteer Safe Paths Project, hosted by the MIT Media Lab, is taking a second approach: Using GPS and making the data available. With support from public companies like EY, TripleBlind, and Earned Media Consultants, Safe Paths is also mentoring and getting support from the Mayo Clinic, Harvard, Stanford, and the World Health Organization. Safe Paths will know the location of infected citizens and be able to trace their interactions.

Is Safe Paths safe?

The gamble Safe Paths is making is that the value of centralized data exceeds the privacy concerns. This is the same kind of decision that physicians and health authorities already need to make. I spoke with Ramesh Raskar, the head of the project and a professor at MIT’s Media Lab, about the potential for the project along with potential privacy issues.

Rashkar explained that his work at MIT sits at the intersection of machine learning, health, and privacy. A great deal of his research is on how to build large AI systems and allow people to collaborate without giving away their data. In the case of Safe Paths, the software only tracks where people spend at least 10 minutes, where they stop. 

Once you subtract sleep, redact work and home, that isn’t really that many data points. The non-profit that came out of his work, Safe Paths is building a set of tools, along with a flagship application, that people can download. People who are infected give permission to upload their data; the healthy can download the data periodically to see if they have crossed paths. 

Raskar is quick to point out that open source projects flounder without a commercial component. Initially, the project had volunteers who were simply passionate about the topic and whose company missions aligned with the idea. Now, he is adding for-profit partnerships, with groups either creating their own application, integrating it into a larger system, or building data on top of it. It is the commerce that Raskar sees driving open source contributions–commerce that gives open source value.

He also provides some assurances about the use of the data. “The personal information is never shared. It is scrubbed [made anonymous], put into a database, and then released. Your house and work locations will be scrubbed.” Raskar is quick to remind me the only people who are tracked are the known infected. However, with a bird’s eye view of how the virus spreads, with data shared, instead of used as a sort of “national security risk,” he hopes to enable health authorities to make more informed decisions and make better tradeoffs of shut-down versus life. On the user side, the data is anonymized. You’ll know you can be in contact with people who are infected, but not know who or where.

Making your contribution

Safe Paths is an all-volunteer, open-source project that is looking for volunteer contributors. Contributors do not need to sign an NDA, just a volunteer agreement. I found out about the project in a tweet from Diarmid Mackenzie, a volunteer tester on the project. The project has a volunteer signup page, and they do weekly webinars that are broadcast on YouTube. The British Computer Society asked Dairmid to do a technical introduction to testing contact tracing as a webinar, which is available on YouTube on demand.

The code is available. The project is open. Kick the tires of Safe Paths if you’d like, or look into other contact tracing applications. If you’d like to be a hands-off conspiracy theorist, I’m afraid that ship has sailed.

5G and Mobile Enterprise Newsletter

5G networks and devices, mobile security, remote support, and the latest about phones, tablets, and apps are some of the topics we’ll cover. Delivered Tuesdays and Fridays

Sign up today

Also see