Digital contact tracing - Q&A

• Why do we need contact tracing? (And why digital?) Social distancing measures seem to work. Do we really need the app?Tech giants are already sharing our data - why should we collect more?Why should I download the app?When will it be available?
• How does the app work? What does "close contact" mean, and how does the app know?How will people notice that they have the app?
• What about our data? How is the use of data regulated?What kind of data is being collected and how?Where and how long is the data stored?Will this data be used for anything else?Who will have access to the data?
• Is it safe to use (how can I trust it)? What kind of security is in place?What about privacy?Will I be tracked or monitored all the time?How are those that don’t use the app affected?
• What about other solutions? Revenues for usage of Smittestopp abroad?Why not copy the app from Singapore?Why not just wait for the Google/Apple solution?Why not publish the source code?What about oversight from an independent expert panel?Why not use local storage of data?What is the rush?
• Agreementbetween FHI and Simula

Why do we need contact tracing?

(And why digital?)

The coronavirus has proven to be highly contagious. The best way reduce its harm to people and society is to slow its spread. Contact tracing is an important tool in this work. When a person is diagnosed with the infection, contact tracing typically involves interviewing the patient to identify everyone they have been in recent contact with. The process is time-consuming, inaccurate, and far too often inadequate.

Digital solution - The “Smittestopp” app automates large parts of the contact tracing process, and thereby lead to faster and more accurate results. Those who have been in close contact with an infected person will quickly be notified and asked to isolate themselves to avoid further infection.

Reducing pressure on healthcare system - Rapid response to new cases of infection is critical in slowing the spread of the virus. This in turn will reduce the pressure on the health service and lead to better treatment for patients, both those suffering from COVID-19 as well as those with other ailments.

Individual contribution – by using the app, you contribute directly to public health efforts to mitigate the spread of COVID-19, and to safely lift some of the social distancing measures and restrictions currently in place.

Social distancing measures seem to work - do we really need the app?

Norway, like many countries, has introduced strict and intervening measures to prevent the spread of COVID-19. These measures seem to be working - the number of newly infected and the number of hospitalized patients in Norway have leveled off. However, such measures have major deliterious consequences for society.

In order to loosen some of these restrictions, an effective system is needed that can quickly detect and control new outbreaks of the virus. Such a system requires three main components: large scale testing, effective infection tracing and notification, and a rapid response to contain new virus outbreaks (e.g., isolation). This app is built to contribute to more effective infection tracing and notification.

Tech giants are already sharing our data - why should we collect more?

Some of the biggest technology companies, such as Google and Facebook, are able to use the data they have gathered about us in the fight against corona. This data is based on GPS, and can provide a useful picture of the movement patterns in large sections of the population.

GPS location data on its own cannot flag the kind of close contact that is more likely to lead to transmission, which is defined by the health authorities as being closer than two meters to another person for longer than 15 minutes. This can be achieved by combining GPS with Bluetooth.

Why should I download the app?

It is voluntary to download the app, but the more people that use the app, the better and more comprehensive contact tracing will be. And the better the contact tracing, the tighter the control on new outbreaks. And if the transmission of COVID-19 can be tightly controlled, it will be safer to open schools and businesses once again, while lowering the risk of repeated shutdowns.

When will it be available?

The development of the Smittestopp app is complete, and the healthcare authorities will decide when to launch the app.

How does the app work?

In short, the app collects location data from a user’s phone. This information is used to see who an infected person has been in close contact with recently. Those persons can then be informed and take the necessary measures, both to protect themselves and to prevent further spread of infection.

Once installed, the app will collect location data using the phone’s GPS and Bluetooth. The data is then encrypted and stored in a separate, secure cloud solution. If a user is diagnosed with the virus, it is possible to retroactively trace the phones that have recently been in close contact with the infected person. The health authorities will then send an SMS to those phones so that the owners can take the necessary precautions.

Data is only collected from those who have voluntarily downloaded the app. As such, the automated contact tracing will only pinpoint close contact with other users of the app; only those phones with Smittestopp installed can receive notification of close contact with someone who has been diagnosed with infection.

What is "close contact", and how does the app know?

Close contact, in this context, means at least two phones with the app installed have been closer than two meters for longer than 15 minutes. Later, if a user is confirmed to be infected, the app can use the location data (GPS and Bluetooth) to find out which other phones (with the app installed) have been in close contact. The users of these phones will be notified by SMS from the health authorities that they must take the necessary precautions. This notification will state on which day this close contact occurred, but will not include the exact time nor the name of the infected individual.

How will people notice that they have the app?

Once the app is installed and activated, the user will not notice it. The app will operate in the background and only use small amounts of battery and mobile data. No other information should be input into the app, nor will it be used for any other purpose. The app will automatically stop collecting data when the virus is no longer a threat. If a user has been in close contact with another user who is later diagnosed with covid-19, the user will receive an SMS from the health authorities.

What about our data?

How is the use of data regulated?

The use of this app is limited and controlled by a separate regulation (forskrift), which clearly defines how the data can be collected and used. This regulation can be found here (Norwegian only): Forskrift om digital smittesporing og epidemikontroll i anledning utbrudd av Covid-19.

What kind of data is being collected and how is it used?

Once installed, the app will collect location data using GPS and Bluetooth. The data is encrypted and stored in a separate, secure cloud solution. This data is not read by anyone and no person (or phone) will be tracked or monitored. It is only when a user is diagnosed with the virus that a program searches the data to find incidents of close contact with other users. Health authorities only receive the information they need in order to notify those affected (who also use the app).

How long is the data stored?

This data will be stored for 30 days, after which it will be automatically deleted. 30 days is the maximum period that could be required to notify persons that had been in close contact with someone diagnosed with the virus.

The regulation (forskrift) that defines the use of this app clearly specifies, among other things, that the data will be deleted after 30 days (Norwegian only: Forskrift om digital smittesporing og epidemikontroll i anledning utbrudd av Covid-19).

For questions regarding central versus local storage, see "Why not local storage of data?".

Will this data be used for anything else?

Anonymized and aggregated data will be extracted for research purposes. It will not be possible to identify individuals in this data. The purpose of extracting this data is to learn about the evolution of this ongoing epidemic and to be better prepared for a new pandemic in the future. These data can be stored for longer than 30 days, but information about individuals will not be identifiable in the anonymized and aggregated data; all identifying information will be deleted after 30 days.

Who will have access to the data?

The app and associated data are protected using the same standards that protect other digital systems in the Norwegian healthcare system. Only those technicians and researchers that are working directly with the data will have access to it. Whenever they access the data, their access will be recorded (logged) such that the health authorities have oversight into who has accessed the data.

Is it safe to use (how can I trust it)?

The app has been developed from scratch by researchers and developers Norway, according to Norwegian expectations of privacy and security. It will only be used for infectious protection purposes. Security and privacy have been central from the beginning.

What kind of security is in place?

Simula has used well-established industry and encryption standards. The app is no more vulnerable to hacking than other apps. In theory, all data processing associated with the web can be hacked, and, like all other apps, there will be different security challenges in different parts of the value chain. Simula has, to the best of its ability, developed the app in line with the security and vulnerability requirements of the authorities and in accordance with the relevant best practices.

What about privacy?

The app has been developed from scratch in Norway and will only be used for infectious protection purposes. The app collects location data; it does not collect other data (e.g., health-related data). Notification to users takes place outside the app through SMS from the health authorities. Any data that can be linked to a person is deleted after 30 days (see "Where and how long is the data stored?").

By limiting the app's scope, we can better ensure the privacy and security of using the app. The Norwegian Data Protection Authority (Datatilsynet) has been kept up to date on how the app is designed throughout the development process.

Will I be tracked or monitored all the time?

No. The program only searches for incidents of close contact after a user has tested positive for the virus. It does not track a person’s movements nor search for where they are at a given moment. It only searches for incidents where a user was closer than two meters for longer than 15 minutes to a person that has been diagnosed with the infection. The health authorities are then given the information they need to send notifications.

How are those that don’t use the app affected?

Persons that do not use they app will not be affected by it, nor will they benefit from it. No location data will be collected from their phones so no digital contact tracing can find them, and thus they will receive no warnings regarding their close contact with infected persons.

How will society be affected is perhaps a better question. The more effectively new outbreaks of COVID-19 are controled, the safer it is to loosen the strong social distancing measures currently in place and businesses can open again more confidently. The smaller the proportion of the population using the app, the less effective the contact tracing will be. This would increase the likelihood that the virus would once again spread beyond control.

What about other solutions?

From the start, the aim was to develop a solution specifically tailored to Norwegian society. In order to have full insight and control over all functions, it has been essential to build the app from scratch. The contact tracing apps developed in other countries may have features that are not suitable in Norway, such as direct links to the police or storing health information.

Revenues for usage of Smittestopp abroad?

Simula is a non-profit enterprise. Our main purpose is to conduct research in information- and communication technology (ICT), and through this contribute to innovation in society.In connection with the launch of Smittestopp, Simula has received inquiries about whether other countries can use the app, as well as the conditions related to this. Here we explain how we share this code with other countries.

Why not copy the app from Singapore?

In Singapore, they have developed the app called "TraceTogether". This app is reported to use only Bluetooth to detect distance between users and all data regarding close contacts is stored locally on the phone. If a user is diagnosed with infection, healthcare workers must access the user’s phone to send alert to those who have been in close contact with the person.

Singapore has stated that it will release TraceTogether's code in mid-April. As of now, we do not have access to the source code and as such we have not been able to assess whether it (or parts of it) can be used in Norway's solution.

Why not just wait for the Google/Apple solution?

What Google and Apple are aiming to release in mid-May is not a complete contact tracing solution. What they are developing is an API (application programming interface) that will interact with and support the official contact tracing apps developed by governments and public health authorities. In short, the API will enable interoperability between Android and iOS smartphones and allow Bluetooth signals to be sent and received even when the phones are not in use. Google and Apple are also planning a longer term solution that will build this functionality directly into the iOS and Android operating systems; this step will take many months to develop and will still involve the use of official contact tracing apps.

How does this affect Smittestopp? It doesn’t. By combining GPS and Bluetooth, Smittestopp produces very accurate contact tracing results without the need for this API. It also gathers anonymized population-level data, which can help evaluate the effectiveness of social distancing measures and the development of the pandemic over time. That said, Simula is committed to the continual improvement of Smittestopp and is closely following the development of this API. If integration with this solution will improve the functionality of Smittestopp, we will be keen to use it.

Smittestopp is ready for use now. The technology has been tested, quality control has been completed, and the legal regulations defining and restricting its use are all in place. This provides Norway with many advantages. There is no need for Norway to wait at least another four to six weeks for this API to be ready in order to start digital contact tracing. This means that safely re-opening schools and businesses can take place sooner. The experiences gained over the next month can also act as a benchmark in evaluating what the API can (or cannot) do; when the API is ready, we will know how to make best use of it.

Why not publish the source code?

Simula is a research institution. Openness and the sharing of knowledge are defining characteristics of how we work. In many cases open source code can be preferrable, as it can build trust and benefit from an engaged community that will work to find and fix weakness or holes over time. In this specific case, time is too short to benefit from this process. For security and privacy reasons, it is not wise to openly share the source code of the app (see here for more detailed answer, in Norwegian only).

What about oversight from an independent expert panel?

The Ministry of Health and Care Services (Helse- og Omsorgsdepartementet) has established an external expert panel to study all code that comes into contact with personal data, as well as the tools used to create such code (official press release and mandate can be found here).

The panel has full access to everything they need, including unlimited access to the source code, so that they can conduct a thorough evaluation. Any errors or bugs they find will be shared with the development team, such that they can be rectified immediately. The panel will also provide the Ministry with a report detailing their overall assessment of whether safety and privacy have been adequately taken care of.

Why not use local storage of data?

Norway has a well-developed system to ensure that neither software developers, researchers nor authorities can misuse data. It has also been very clear from the start that the Smittestopp app should not be used for any purposes other than contact tracing and research related to this. A separate regulation regulates how this app can be used, including the collection and use of data (This regulation can be found here (Norwegian only): Forskrift om digital smittesporing og epidemikontroll i anledning utbrudd av Covid-19).

With these conditions in place, it is possible to store data centrally and benefit from faster and more accurate infection tracking, as well as better understanding the impact of various measures and research to understand future epidemics.

What is the rush?

It is obvious that the strong restrictions put in place to curb the pandemic have significant disadvantages for the economy and other parts of society. In order to loosen some of these strict measures and to gradually get people back to work, an effective system must be in place to control new outbreaks. There are three key components of such a system: increased testing, digital contact tracing, and effective response to new outbreaks (Smittestopp contributes to digital contact tracing). The sooner these components are in place, the sooner society can get back on track.

Agreement between FHI and Simula

Simula will receive5 million NOKfor the development of Smittestopp.Approximately 2 million of this will go to the other partners (e.g., Shortcut and Scienta) that have assisted in developing the app, and the remaining 3 million will cover approximately half of Simula's costs related to the development work.

In addition, Simula will receive approximately 11million NOK to cover the costs for the operational phase during which Simula will be running the app (the rates set by the Research Council of Norway).

Maintenance agreement between FHI and Simula (Norwegian)

Agreement on cooperation (Norwegian)

Contacts:

• General inquires should be directed to:Norwegian Institute of Public Health (Folkehelseinstituttet)telephone: +47220 78300email: medievakt@fhi.no
• Inquiries regarding Simula’s role should be to:Deputy Managing Director, Kyrre Lekvetelephone: +47934 24311email: kyrre.lekve@simula.no