ENG: Simula is working with the Norwegian Institute of Public Health

The purpose of the app is to help Norway reduce the spread of the virus through a simple digital solution that runs in the background of an individual's phone. It is quite clear that everyone wants to contribute in the fight against covid-19. Simula has developed a tool for this purpose, and we hope and believe that most people will use this new tool to participate in the joint effort to curb the spread of the infection.

The app is now undergoing the final rounds of testing and adjustments before it can be launched. A launch date will be communicated at a later time.

Why do we need this?
The coronavirus has proven to be highly contagious. The most important thing we can do to reduce its harm to people and society is to slow its spread. Infection tracking is an important tool in this work. When a person is diagnosed with the infection, infection tracking (contact tracing) typically involves interviewing the patient to identify everyone they have been in recent contact with. The process is time-consuming, inaccurate, and far too often inadequate.
The app can automate important parts of the contact tracing process and lead to faster results. By promptly informing those who have been in close contact with an infected person, they can immediately isolate themselves and avoid infecting others.

How does the app work?
In simple terms, the app collects location data from a user’s phone. This information can then be used to trace back in time to find out who an infected person has been in close contact with. Once installed, the app will collect location data using the phone’s GPS and Bluetooth. The data is then encrypted and stored in a separate, secure cloud solution. If a user is diagnosed with the virus, it is possible to retroactively trace the phones that have been in close contact with the infected person in the past 14 days. The health authorities will then send an SMS to those phones so that the owners can take the necessary precautions. Only those who have chosen to download the app receive a notification.

What does "close contact" mean, and how does the app know?
Close contact, in this context, means at least two phones with the app installed have been closer than two meters for longer than 15 minutes. The app collects data using GPS and Bluetooth. Later, if a user is confirmed to be infected, the app can use that data and find out which other phones (with the app installed) have been in close contact. The users of these phones will be notified by SMS from the health authorities that they must take the necessary precautions. This notification will inform the users about which day this close contact occurred, but will not include the exact time nor the name of the infected individual. Only phones that are running the app can take part in this process, meaning that only those users that have voluntarily downloaded the app will directly benefit.

Reducing pressure on the healthcare system
The app can significantly increase both the speed and accuracy of infection tracking and notification. Rapid response to new cases of infection is critical in slowing the spread of the virus, which in turn reduces the pressure on the health service and leads to better treatment.

How will people notice that they have the app?
Once the app is installed and activated, the user will not notice it. No other information should be input into the app, nor will it be used for any other purpose. The app will automatically stop collecting data when the virus is no longer a threat. If a user has had close contact with another user who is later diagnosed with a covid-19, the user will receive an SMS from the health authorities.

What about privacy?
Privacy concerns have been central from the beginning. The app has been developed from scratch in Norway and will only be used for infectious protection purposes. The app does not collect health data. Notification to users takes place outside the app through SMS from the health authorities. By limiting the app's scope, we can better ensure the privacy and security of using the app. The Norwegian Data Protection Authority (Datatilsynet) has been kept up to date on how the app is designed throughout the development process.

Why not use similar apps from other countries?
Right from the start, it has been important to have a solution that is tailored to Norwegian society. By developing the app from scratch in Norway, it is possible to have full control over all its functions. Apps developed in other countries often have additional features that are not desirable in Norway, including direct links to the police or features that include storing health information.

What about security?
Simula has used well-established industry and encryption standards. The app is no more vulnerable to hacking than other apps. All data processing associated with the web can be hacked, and, like all other apps, there will be different security challenges in different parts of the value chain. Simula has, to the best of its ability, developed the app in line with the security and vulnerability requirements of the authorities.

What about the code found by NRK?
This project has developed at a very high tempo, as this situation is urgent. However, such speed increases the likelihood of mistakes. One mistake is already well known through NRK, which had found an early version of a small portion of the code on an open Github account (https://github.com/). This is regrettable, and we cannot guarantee that the process will be flawless in the future. Piet Hein wrote aptly: Err and err and err again, but less and less and less. That is how software is developed. We expect that the system will contain some errors and that it will need to be maintained and improved continuously. That said, we feel confident that the most important aspects of privacy and security are taken care of in so far as possible.

What about storing and accessing the data?
The data will be stored for 30 days and then deleted. This limit of 30 days was set, as it is the maximum period that will be required to notify those you previously had close contact with when a diagnosis is made.

Research
Anonymized and aggregated data will be continuously extracted, so that they can be stored and used for research. It will not be possible to identify individuals in this data. The purpose of extracting this data is to learn about the evolution of this ongoing epidemic and to be better prepared for a new pandemic in the future. These data can be stored for longer than 30 days, but information about individuals will not be identifiable in the anonymized and aggregated data.

Who is paying for this?
So far, Simula has covered its own costs, and no financing agreements have been entered into as of now. Simula contacted the Institute of Public Health to offer our services. As a research organization owned by the Norwegian public, we believe that we have a responsibility to contribute with our expertise.

Who has done this work?
Professor Olav Lysne and Research Professor Ahmed Elmokashfi are leading the development work. Together with a team of 20 researchers, they have made a heroic effort that started on March 13th and has continued day-in and day-out ever since. “I am very impressed with the efforts our employees have put into this critical project. It has shown a level of commitment I have never seen before in my entire life,” said Professor Aslak Tveito, CEO of Simula. He also expresses his gratitude to several industry partners who joined this team at short notice and have played a crucial role both in developing the app and in testing it. A special thank you goes to Scienta and Shortcut employees.

When will the app be available?
Simula is working intensely with the Norwegian Institute of Public Health and other partners to get the app ready for launch. An app with these specifications is pioneering, and there are still some remaining assessments and work to be done to ensure the privacy and the stability of the software, and to coordinate with the public infectious control effort. These must be in place before the app can be launched.

Read more in a related op-ed in VG:
VG recently published an op-ed "App for smittesporing: Nytt virkemiddel i en vanskelig tid" about this app, co-authored by the following:
Camilla Stoltenberg - Director of the Norwegian Institute of Public Health
John-Arne Røttingen - Managing Director of the Research Council of Norway
Christine Bergland - Director of the Norwegian Directorate of eHealth
Aslak Tveito - Managing Director of Simula

Contact:
General inquiries can be addressed to the Norwegian Institute of Public Health (telephone: 22078300, medievakt@fhi.no).
Questions about Simula's role can be directed to Deputy Managing Director, Kyrre Lekve (93 42 43 11, kyrre.lekve@simula.no).