Ep. 20: How Does Contact Tracing Work?

Listen, Rate & Subscribe

Apple Podcasts // Spotify // Google Podcasts

Kelowna2019.jpg

A national effort is underway to encourage people to download the contact-tracing app, Covid Alert, which according to governments should be available in early July. To help listeners understand why it’s so important that they do, host Shaun Francis talks to the University of Waterloo math Ph.D. candidate who pioneered the “decentralized Bluetooth exposure notification” idea that led to the privacy-securing technology—James Petrie, the director of research at Covid Watch. Also featuring an interview with Florian Kerschbaum, the director of the University of Waterloo’s Cybersecurity and Privacy Institute.

Related links:

James Petrie cofounded Covid Watch with Tina White of Stanford’s Institute for Human-Centred Artificial Intelligence. According to the non-profit’s web page, Covid Watch “was the first in the world to publish a white paperdevelop, and open source decentralized Bluetooth exposure alert technology in early March 2020. Our TCN protocol led to the rapid development of very similar anonymous protocols worldwide, like DP3T, PACT, and Google/Apple exposure notifications.”

Details on Canada’s backing of Covid Alert, the federally backed app developed by volunteers from Shopify, Blackberry and others, which uses James Petrie’s idea of “decentralized Bluetooth exposure notifications” from the CBC. And more details on Ontario’s backing, from CTV.

Highlights from Shaun’s conversation with James:

Shaun: James, can you describe how the technology works so that any of our listeners, regardless of background, can understand it?

James: The basic idea is people download this app. And in the background, it communicates over Bluetooth with other phones that have this app, and they can exchange—we're calling them temporary contact numbers. So that if someone is diagnosed positive, they can upload to every other device, all of the numbers that they’ve seen before, and doing this allows each of the other devices to see if they were in the same room at the same location as that person. One of the major benefits of this is that there's absolutely no loss of privacy for the people to just download the app. You don't need anybody spying on your GPS location. It's basically an anonymous messaging system. One of our pilot partners gave a great metaphor for this. The idea is that you give everybody a roll of raffle tickets, and each raffle ticket has two pieces with the same number on them. But these numbers are completely random. And then everybody can go around, and when they sit beside someone, they exchange tickets. So now everybody has a ticket from the people they've been in contact with. And then if one of these people is later diagnosed positive, they can broadcast the numbers they've given out. If you've been in contact, you don't need to upload your GPS history. You don't need to upload who you can contact with. Everything is private to you.

Highlight from Shaun’s conversation with Florian Kerschbaum:

Shaun: Can you describe to us why we should be comfortable using this technology?

Florian: So, this is about the simplest, most privacy-preserving design, that I have seen. I always say, an app like this is [like] an electronic face mask. So this app does not protect you. Once you're infected, you have to quarantine—this app protects people who have not been in contact with you. And therefore do not have to quarantine, that can go out and enjoy the nice weather. But you are actually doing a favour. It's like a donation. It's like wearing a face mask. Your face mask protects me, [and] my face mask protects you. So we actually really have to get people to install the app, and make wide use of the app, so that we can get enough efficiency out of the app. And I'm doing all of these interviews in order to get people to understand, there really is no privacy concern, these apps have been designed with high levels of privacy in mind.

Please subscribe and rate us on your favourite podcast platform. Eat Move Think host Shaun Francis is Medcan’s CEO and chair. Follow him on Twitter @shauncfrancis. Connect with him on LinkedIn. And follow him on Instagram @shauncfrancis. Eat Move Think is produced by Ghost Bureau.


Listen, Rate & Subscribe

Apple Podcasts // Spotify // Google Play


How Does Contact Tracing Work? final web transcript

Christopher Shulgan: Christopher Shulgan here, executive producer of Eat Move Think. Welcome to our 20th episode. It's about contact tracing. Specifically—and this is quite a score for us—it features an interview by host Shaun Francis with the math PhD who pioneered the technology that will help to save the world economy. His name is James Petrie. He's 26 years old, and he lives in Waterloo, Ontario.

Christopher Shulgan: We'll get to James in a minute, but first, some background. Contact tracing is one half of the two things that, if public health authorities do them really well, they allow us to get back to somewhat normal living, even before a vaccine is developed. Testing is one—we have to test lots of people. contact tracing is the other. That's the practice of tracing the people you've been around, if you test positive for COVID-19, so that those people can be notified, get tested, and self-isolate if they test positive too. And if that system works well enough, then we get ahead of the virus, numbers fall, the outbreak is contained, and we can get back to normal living in a way that doesn't completely destroy the world's economy.

Christopher Shulgan: The problem with that process is that—well, there are lots of problems with it. There's a limited number of human contact tracers, so they may not get to your case fast enough. Or maybe they can't find your phone number. Or maybe you just don't answer their call. Think about it: how often these days are you picking up calls from a new number? Which is why there's so much talk about contact tracing software. Again, there are some problems: privacy. Do we really want governments tracking who we've been with every day, all day?

Christopher Shulgan: So computer programmers began trying to figure out how to create an app that secures your privacy, while still retaining the ability to notify those people who have come in contact with an infected person. And by all accounts, they've done it. The technique is called decentralized Bluetooth exposure notification. That's a mouthful, but it's really important. The person behind the technique is a PhD candidate at the University of Waterloo. Back in February, he got the idea and began talking about it with his friends online, and he ended up starting a nonprofit with an artificial intelligence PhD candidate at Stanford University. They led a team that published a white paper on the idea in March.

Christopher Shulgan: Then something remarkable happened. Google and Apple both noticed and they said essentially "Whoa, this is a really good idea. You know what, folks? This idea is so important that we're going to stop our rivalry, and we're going to cooperate so that we can set up our phones—like iPhones and Android phones—to make it really easy for developers to create apps using this technique invented by this PhD candidate from Waterloo, Ontario.

Christopher Shulgan: And now, Ontario is promoting its own contact tracing app based on Petrie's technology. The Prime Minister has said that he hopes that all provinces promote it, and other Western democracies are using it as well, like the United Kingdom. We'll get to our interview with James Petrie in a moment, but first, here's Eat Move Think host Shaun Francis talking to Florian Kerschbaum, the director of the University of Waterloo's Cybersecurity and Privacy Institute for some context.

Shaun Francis: Welcome, Florian, and thanks for joining us. Can you describe to us how this technology works, and why we should be comfortable using it?

Florian Kerschbaum: So this is about the simplest, most privacy-preserving design, a distributed design that I have seen. I always say an app like this is the electronic face mask, right? So this app does not protect you once you're infected or you're tested positively, you have to quarantine. This app protects people that have not been in contact with you, and therefore do not have to quarantine, that can go out and enjoy the nice weather in Ontario at this point of time. But you are actually doing a favour. It's like a donation. It's like wearing a face mask. Your face mask protects me, my face mask protects you. My use of the app protects everyone else out there, and their use of the app protects me.

Florian Kerschbaum: So we actually really have to get people to install the app, and make wide use of the app so that we can get enough efficiency out of the app, efficiency that we have a good use of the app that we can use the protection of the app in an electronic way. And I'm doing all of these interviews in order to get people to understand there really is no privacy concern in these apps. These apps have been designed with high levels of privacy in mind. And we really should try to use the app to have an alternative to manual contract tracing. This app is actually a really, really good thing.

Shaun Francis: So just let me drill into this from a privacy perspective. If I now am notified by Public Health Ontario that I am COVID positive, does public health notify the app to notify others? Or is it up to me to let my app know this?

Florian Kerschbaum: Okay, this is a very good question. This is a very important question. So there are a number of aspects here. So what you have to do is, you will get a code from public health that will allow you to put into the app to upload these random numbers that you have sent out to a central server. It's not your name. You will not upload "Florian Kerschbaum has been tested positive." You will upload these bunch of random numbers belonging to someone who has been tested positive. And then everyone else sees, look, these random numbers belong to someone who has been tested positive. Have you seen any of these random numbers? And then they say, look, you have been in contact with someone who has been tested positive.

Shaun Francis: Talking to the former head of Ontario Public Health, he said for the app to be effective, we need probably 60 percent of the country to adopt it. Is that what you've heard as well?

Florian Kerschbaum: Yes.

Shaun Francis: So about 60 percent of the country would need to use this for it to really have an impact.

Florian Kerschbaum: I would hope that we could get adoption rates to that level.

Shaun Francis: And could a business—I mean, I guess it also has applications at a business level too, right? Or even University of Waterloo for example, right? If 60 percent, or the majority of the students and faculty were using this app, at a minimum, you might think you could have some positive impact on infectivity when we all go back to school.

Florian Kerschbaum: Indeed, this might be a thing that happens that some municipalities or regions have a wider adoption and they will be protected. They will have a better protection against the spread of the virus, and some other ones will not. I mean, that is a very possible kind of development that we see here.

Shaun Francis: Florian, this has been super helpful. I really appreciate your time elaborating on this for our listeners, and we will eagerly be looking forward to the app coming out in mid-July. And certainly, I'll be pushing for Canadians to adopt it so we can get to that 60 percent threshold.

Christopher Shulgan: That was Shaun Francis talking to Florian Kerschbaum, the director of the University of Waterloo's Cybersecurity and Privacy Institute. Now, here's Sean's conversation with James Petrie.

Shaun Francis: I'm really delighted today to have James Petrie with me. Welcome, James.

James Petrie: Thank you. Glad to be here.

Shaun Francis: In addition to saying, "Testing, testing, testing," tracing, tracing, tracing is something we've heard a lot about, and we've heard how we just don't have, or haven't had, at least historically, the human resources to do it properly.

James Petrie: Yeah, it's a super important part of the big picture for how to deal with coronavirus. There's been a number of studies with, like, numeric models, and also with, like, countries that have done this well. And if you have contact tracing or testing, like, done with really high precision, then you don't need to shut down as much, you can shut down new outbreaks before they start up. It's a really powerful tool.

Shaun Francis: So how did you become interested in this?

James Petrie: Back in January, when I was first hearing about this pandemic, I was trying to think of ways that I could help to stop this from happening. My background is in a lot of numerical modelling, and I've seen some of the models that were coming out, and some of the ideas about contact tracing. My background's also in technology, but did programming for a while, so I wanted to know if this could be done faster, if it could be done better because, like, a lot of areas don't have many people who are able to do contact tracing. And if you suddenly get thousands of cases, it just can't be done.

James Petrie: So in January, when I was trying to make this technology work, I reached out to a few professors, and I realized that some of the things I wanted to do were quite hard. So I started working on simulations to show the world why something like this should be very important, and how, like, I found that if you got this technology working, you could really stop the pandemic. But I was a bit stuck, and I was really excited to see that the other co-founder, Tina White, she made a post in February that I found on a forum. And she was working on a very similar idea to use heat maps to prevent people from getting sick. So I sent her an email right when I saw that, "Please can we, like, join forces to make this happen?"

James Petrie: And she actually got back to me right away and we started working. At first, it was all about deciding what technology to build, and also just getting the right people in the room. So she started reaching out to all of her contacts. And yeah, so many people joined right away, many of her friends and some of my contacts. And we found this really exciting technology, which is now just described as decentralized Bluetooth exposure notifications. And I think the exciting part about this technology was that you didn't have to just pick privacy or your health, you could have both because this system is, like, super anonymous, but you can still do very fast contact tracing, and you can do it at scale.

James Petrie: So once we found this idea, we started to develop it. We reached out to iOS and Android developers. Actually, we just tried to build it. We wanted to make it happen before the first wave happened. Unfortunately, there are a lot of challenges with building this technology that I wasn't aware of at the beginning. The main one would be devices don't work pretty well in the background when your screen is locked. So the second big exciting thing was when Apple and Google announced in April that they would be developing this technology and would make APIs for this. I think we'd been reaching out to them through a few channels for a few months. And we kept hearing that no, they wouldn't be able to help, they were too worried about, like, a number of things. So it was a big surprise when they actually said yes, we're going to develop this. We're going to make the most private version possible. And we're going to distribute it to billions of phones in a matter of months.

Shaun Francis: James, can you describe how the technology works so that any of our listeners, regardless of background can understand it?

James Petrie: Yeah, so the basic idea is people download this app. And in the background, it communicates over Bluetooth with other apps, other phones that have this app. And they can exchange—we're calling them temporary contact numbers. So then sort of each phone makes up a number, exchanges it with the other phone, and both the phones record that number. So that say two weeks later, if someone is diagnosed positive, they can upload to every other device all of the numbers that they sent out before. And doing this allows each of the other devices to see if they were in the same room or the same location as that person.

James Petrie: One of the major benefits of this is that there's absolutely no loss of privacy for the people to just download the app. You don't need anybody spying on your GPS location or anything like that. It's basically an anonymous messaging system. One of our pilot partners gave a great metaphor for this a few days ago. And so the idea is that you give everybody a roll of raffle tickets, and each raffle ticket has two pieces. They each have the same number on them. But these numbers are completely random. And then everybody can go around, and when they sit beside someone, they exchange tickets. So now everybody has a ticket from the people they've been in contact with. And then if one of these people is later diagnosed positive, they can broadcast the numbers they have given out. So people will check if any of the numbers that are published match with any of the ones they've got. So basically, we're just making a phone system that does exactly that. And it's great because you can do this without losing any of your privacy.

James Petrie: A lot of the debate has been about decentralized versus centralized models. So with our decentralized model, nobody has any information about you. Your device is the one that is responsible for checking if you've been in contact. You don't need to upload your GPS history, you don't need to upload who you've been in contact with. Everything is private to you.

Shaun Francis: Does everyone have to have the app, however, for this to work?

James Petrie: Yeah, so that's one of the big issues. Apple and Google have announced two stages to this. So in the first stage, you need to have the app for it to work. And that poses a large challenge, because we've seen it can be a very effective technology if a large number of people use it. And it can be helpful if a medium number of people use it. But getting to those levels is—but also, Apple and Google have plans to add this as an update to their operating systems, so people can opt in at the next time they update their operating system. And they don't need to download an app, and it'll just work.

Shaun Francis: James, you know, I know you're collaborating with Google and Apple. Have you had any discussions about working with them?

James Petrie: We meet with them every week to discuss our pilots, to discuss improvements to technology. But I think we're both working on different parts of the problem right now. I just want this technology to happen. So I'm happy that they can devote their engineering resources to making it happen. And I'd like for Covid Watch and our volunteers to work on the parts of the problem that still need to be solved, which right now is interfacing with public health. So we're developing websites for public health authorities to do this authentication process, to look at what thresholds to set. We're developing the apps themselves, making very nice user interfaces. And we're working on making a system like this interoperable with other apps in other regions.

Shaun Francis: So it's still not—I mean, we're nowhere near where we probably need to be at the moment in terms of technology adoption.

James Petrie: In North America, no. India has published some very strong results in the past week or so, where I think they've got 120 million downloads of their app and have, I think they've said they've sent out 900,000 exposure alerts. And it seems to be working really well for them, because they've said that 24 percent of the people who they've asked to get tested have tested positive, which is a bad thing for those people, but it's been a good thing for how well the app can determine who's at risk. To give some context, I think their background testing rate was four percent. So it sort of shows how good of a tool this can be.

Shaun Francis: And are they using the Bluetooth technology there, too?

James Petrie: They're using Bluetooth, but it's a different system. Their system, I don't think is as private as our system. But in terms of the user's perspective of what actually happens, it works very similarly.

Shaun Francis: I mean, you talked earlier about the proximity and duration of contact may be different between countries. Does it know how close I am to the contact and for how long?

James Petrie: It definitely knows how long you were there. How close, it has an idea. So what we're using is the signal strength of— so your two Bluetooth devices will be able to measure how strong the signal is, and this is a proxy for distance. It isn't perfect, but we can set some thresholds to have a fairly good idea if you're within two metres or not.

Shaun Francis: And it could know if it was for, say, 15 minutes, as an example.

James Petrie: Yeah. It'll be running in the background on your phone, and it will take a measurement every five minutes. So you'll have the five minute resolution, the duration of your interaction.

Shaun Francis: Right. So for example, if I was simply passing someone in the store, that won't be recorded, or data that we have to worry about.

James Petrie: I think your phone would measure a five-minute interaction, and hopefully your health authority has set it to 10 or 15 minutes, and you would never hear about it.

Shaun Francis: What's the minimum you've seen a health authority ask for that sort of proximity data?

James Petrie: I think a lot of these things are still being sorted out, but I haven't heard anything less than 15 minutes so far.

Shaun Francis: Got it. And this could run autonomous of government, really, in a full market system. Because who wouldn't want to know they had this?

James Petrie: Yeah.

Shaun Francis: Right? And if you could get tested easily?

James Petrie: Yeah. Kind of make this painless as possible.

Shaun Francis: Yeah, sure. Download your app, and then gosh, I know I've now been in contact with somebody for 10 minutes. What's the harm in me getting myself tested today, if I can do it easily?

James Petrie: Yeah. There's no huge cost in terms of your day-to-day life. And especially there's no cost to privacy. I think it really makes sense for people to opt into a system like this.

Shaun Francis: Is this as precise as the GPS data, other than the obvious privacy concern?

James Petrie: I think it's actually way more precise, because with Bluetooth you will know if someone is within a few metres of you, whereas GPS has an accuracy maybe of tens of metres or more. And GPS can't tell you what floor of the building you're on, and it's not as accurate within cities and places like that. Also, Bluetooth's signal strength goes down a lot with walls and floors of a building. So it gives you a pretty accurate measure of who's nearby.

Shaun Francis: Right, as opposed to two people sitting in offices side by side. In other words, you're saying Bluetooth would be more likely to understand they're in separate offices than GPS would.

James Petrie: Yeah. And well, if one's on the second floor and one's on the 15th floor, GPS would see those as the same.

Shaun Francis: So for example, if you look at employers—you know, the meatpacking plant being an obvious one—had one person been tested positive there, immediately, probably half the plant would know that they were in close proximity vis a vis this technology, and in theory would go get tested more or less immediately.

James Petrie: Yeah, I think if it's running well, I think it can have a huge impact. And I should highlight that the goal isn't this to completely replace manual contact tracing, the goal is just to augment it, because even if everybody downloads it, there's populations that don't have smartphones, and some situations are tricky. So the goal for this technology is to make the overall contact tracing system better.

Shaun Francis: It would mean that we would have to spend—the people resources would then be focused on the people without the technology.

James Petrie: Yes. Give them more time to focus on the harder situations. A number of simulations have shown that the amount of time it takes to get these alerts is very important, because people start being contagious fairly fast.

Shaun Francis: It's occurred to me, James, too, that this is now something that Ontario is endorsing in Canada. We want it to be part of the Post Promise Pledge, which is to encourage all businesses to adopt it as well, and to be promoting it, right? Because you need to get 60 percent of the country using it, that's sort of what Vivek Goel at U of T, you know, this is great, except we need the majority of the country to use it to make it worthwhile.

James Petrie: Yeah. Well, if you get less it could still be helpful, but yeah, 60 percent would be great.

Shaun Francis: Yeah, less would be helpful. But yeah, to really actually get ahead of the virus, right? And, you know, this idea of hiring 100,000 people to call people, like, that's medieval. In fact, I've read articles that contact tracing, physical contact tracing has never worked, unless you have a technology.

James Petrie: Yeah, it's hard. Like, insane structure to do it with manual contact tracing.

Shaun Francis: Yeah, you need China. You need, like, China to force a million people, and then you'd have to answer your phone, right? It's crazy. But with this tool, you get away from all that. And it's anonymized, right? You're more likely to do this than you are to tell people, you know where you were, who you talked to. Even your memory's faulty, right? Like, what's your 70-year-old dad going to do when he can't remember—you know, like, I don't know who I talked to you like last Saturday, right?

James Petrie: Yeah.

Shaun Francis: I have no idea. "I met so and so at the golf course. Who was that guy?" Meanwhile, that guy went to a wedding and there's, like, 20 more people infected.

James Petrie: Yep. And then whole new outbreak.

Shaun Francis: Yeah, that's right. Whereas with this, it controls for all of that.

James Petrie: So I think we've got to get testing super easy, so it's just like, you get the notification, you get the test. It takes an hour. Not even a problem.

Shaun Francis: Not even a problem, yeah. And that's where it goes—because I'm looking into saliva-based testing and, like, stuff that's super easy. Because between this app and saliva-based at-home testing that's available in 24 hours, like, you kind of fix the whole pandemic issue.

James Petrie: If we get the buy-in.

Shaun Francis: If you get the buy-in.

Christopher Shulgan: That's a wrap for this episode of Eat Move Think. 20 episodes, pretty crazy! We'll post links and highlights at the Eat Move Think website at eatmovethinkpodcast.com. Eat Move Think is produced by Ghost Bureau. Senior Producer is Russell Gragg. Remember to rate and subscribe to Eat Move Think on your favourite podcast platform. Follow Shaun on Twitter and Instagram @shauncfrancis—that's Shaun with a U—and Medcan @medcanlivewell. We'll be back soon with a new episode examining the latest in health and wellness.

Previous
Previous

Ep. 21: What’s The Best Sport For Your Health?

Next
Next

Ep. 19: The Woman Who Changed Her Life