Over four months after the first Covid-19 cases were identified in the country, the National Department of Health augmented its approach to contact tracing by adding a new digital component.

At a recent press conference, Minister of Health Dr Zweli Mkhize officially launched COVIDConnect, calling it “an easy-to-use self-service portal to your cellular phone”.

“It is freely accessible through WhatsApp and SMS. What also makes it more accessible is that it does not require for a user to have a smartphone, but it works on any mobile phone,” said Mkhize. The system has been tested in several provinces and is now in use nationwide.

“Between 28 June and 15 July 2020, it has dispatched 674,380 SMSes to users nationwide and relayed 326,522 test results. [A total of ]39,463 users have engaged with the service,” Mkhize said.

Not replacing contact tracing teams

The COVIDConnect platform is not meant to replace manual contact tracing, however. “This is just one capability. It does not, for example, replace the participation of tracing teams on the ground. It’s a whole combination of things that we are going,” Mkhize explained.

“It helps to augment the work that is done by manual tracing, it doesn’t change it. In fact, with the increasing number [of Covid-19 infections], we need to increase the number of tracers,” he said. “In addition, we will be having call centres continue to call. It’s a whole combination of [a] package of things that are involved, so nothing gets removed or replaced by this platform.”

The COVIDConnect service’s contact tracing component relies on people who test positive, providing the names and contact details of their contacts. This is different from the automatic tracing of contacts found in some apps used in countries like Germany and Ireland. These more automatic contact tracing apps typically use Bluetooth technology, often using a platform developed by Apple and Google, to keep track of contacts – although it requires contacts to also have the app installed on their phones.

The manual process of contact tracing involves getting a list of people and their contact information from the person who has tested positive. COVIDConnect essentially allows that process to happen through an app. 

In theory, this may in time reduce the workload on people like Princess Hewana, the branch manager for Red Cross in Vereeniging in the ‎Sedibeng District in Gauteng, who is part of a contact tracing team.

“Our nurses were trained by the Department of Health (for the swabbing part of the testing), and then we got involved with the contact tracing,” Hewana told Spotlight.

Hewana said the Red Cross team gets called out to a household when a member of that household tests positive for Covid-19. Then this specific team, which includes two clinicians, a social worker, a care worker and a counsellor, assesses the household. “When a person has already gotten the results and they test positive, that’s when the Department [of Health] will contact us and say there is a patient and we need to go and do the contact tracing,” she said.

Hewana said the positive patient, or the “index person” has to tell the team who they have been in contact with recently and everyone on that list needs to be contacted.

“Really, it is a lot of work. We leave no stone unturned. We follow each and every person who has been in contact with the [Covid-19 positive] person,” Hewana said.

“We are scared because it is a risk. Every day people get infected,” she said. “I just wish that people can be more welcoming, and for people to know that Covid-19 is here. So that it can be everybody’s baby, you know… It’s not just the Department of Health [business, it’s everybody’s business.”

Concerns about COVIDConnect

Murray Hunter, a digital rights activist, has concerns about the manner in which the COVIDConnect platform was implemented and how difficult it has been to get detailed information about it.

“We can appreciate that health officials are in an unprecedented situation, under such pressure and really stretched to their utter capacity,” Hunter said. “But you cannot start implementing these complex, technological solutions in a situation where you don’t have the bandwidth to simplify it, or to talk about it, or brief the public ahead of time.”

Yet, Hunter does not suspect that there is any malicious intent with this platform. “There is no evidence that this system has been designed with malicious purposes and in fact, in many ways, the regulations [relating to contact tracing] that have been drafted, were very clearly sensitive to the privacy concerns people were raising,” he said.

For Hunter, the bigger problem was that solutions like COVIDConnect were being designed and implemented with “very little input, information, public consultation and information about how they were going to implement it”.

Professor Co-Pierre Georg from the University of Cape Town (UCT), who has written a series of articles on the country’s approach to contact tracing, also raised some concerns about the COVIDConnect platform, chief among which were data security and the overall effectiveness of tracing contacts in this manner. According to him, a team of academics and students from UCT and Stellenbosch University had engaged with Praekelt.org, one of the companies involved with creating the platform, about some of these concerns.

“The problem with this combination of data, health data, location data, identity data, is that it makes it very attractive for hackers,” Georg said.

He explained that if the data is stored in a centralised database, and the WhatsApp server doesn’t have end-to-end encryption, then it will be vulnerable to hackers. “Here’s what I’m not 100% sure about. If the WhatsApp server they have at the end allows for end-to-end encryption… if it’s not, then it’s deeply worrying because it means there are all kinds of metadata analysis that you can do with it (the data),” he said.

“For this [COVIDConnect] to be effective, you need to collect quite a lot of information… You need to trace 60% of the contacts of 50% of the positive cases within 24 hours,” Georg explained. “If you want to get to that threshold, you can’t just ask people to volunteer their closest contacts because the close contacts are just one transmission factor… These are not the difficult contacts,” he added.

COVIDConnect will not be effective in tracing the “weak ties” between different communities that rarely interact, argues Georg. An example of a weak tie or connection, he said, is someone who works in one community, but stays in a community that does not normally interact with the one they work in.

“The problem with these connections is that they connect otherwise very different communities. By creating these shortcuts, you change the transmission speed of the virus fundamentally. That is why it is so important to track these weak connections in particular,” Georg explained. “Having a contact tracing system where you ask about strong links, your closest contacts, you will always miss these [weak] links.”

Developers respond

Spotlight put these concerns to the department and Praekelt.org, and the other company involved in building the system, BCX.

“The security of citizen data has been a priority of all parties involved in the programme throughout the various phases of the programme,” says Debbie Rogers, MD at Praekelt.org. “From a technical perspective, key components of the security measures in place include encryption of data when transferred between systems.”

According to Rogers, Praekelt, which has been a technical partner with the National Department of Health’s MomConnect App and the 0600 123456 Covid-19 WhatsApp chat, was approached in May 2020 by the department to work on this platform.

Vish Rajpal, Chief of ICT at BCX, told Spotlight they foresee that COVIDConnect will positively impact contact tracing processes as public participation increases and will free up the time contact tracing teams spend on making calls and doing site visits. Rajpal said the engagement rate among positive individuals varied (during the pilot), but on average, it stood at 20% (nationally). 

On security concerns, Rajpal said, all data collected is encrypted to ensure security. “BCX will continue to work closely with the Department of Health to ensure that personal information is protected and that various regulations are adhered to. We must also remember that it is only when an individual tests positive for Covid-19 that the identification of primary and secondary infected individuals becomes active. COVIDConnect operates on end-to-end encryption,” he said. 

The department did not respond by the time of publication. However, Mkhize previously said that the track and trace service will not infringe people’s privacy or data. “In fact, one of the reasons we delayed implementing the system was to ensure that it passes the legal muster and adheres to legal prescripts relating to personal information, confidentiality, and individual and data privacy,” he said.

“In terms of data and security, the systems are fully secured. The responses that are provided on the WhatsApp platforms are directly fed to the contact tracing teams. The contact tracing teams are therefore able to see which people have responded, which ones have not responded, and from those who have responded, who are at a higher risk,” said Gaurang Tanna, the Director of Strategic Planning at the National Department of Health, speaking at a press conference.

“The data is fully protected. Only the contact tracing teams, the case managers in the district as well as provinces have access to the data. No data is shared with any other person,” Tanna said.

Previous approach to digital contact tracing

A previous digital contact tracing effort that would have involved using geolocation data derived from cellphone towers appears now to have been shelved.

Georg slammed this effort as having been an “unmitigated disaster, which is not surprising, given that this method located phones only within a 400m radius in an urban setting”. “However, in a 400m radius around someone in a township there are about 5,000 others, so there simply is no way that this method could identify contacts in any meaningful way,” Georg wrote in a series of papers on the issue.

During a Western Cape Parliament Ad Hoc Committee Meeting on 17 July 2020, Milani Wolmarans, the chief director of policy coordination and integrated planning from the National Department of Health admitted that the use of geolocation data provided by mobile network operators had been unsuccessful.

“During the period of 17 April to 14 May 2020, we did collect data from the mobile operators,” she said. “The information that we got during the period we collected data, was basically the RICA information because it was difficult to get the location information. It was even more difficult to get the movement as well as who the person was in contact with, because it needed to come from the cellphone towers. It was complex.”

“Meanwhile, that database and all the data we’ve received from mobile operators has been demolished. We only have the data from the individuals whom we have collected data from the MNOs [operators] which we will publish as per the regulations.” DM/MC

This article was produced by Spotlight – health journalism in the public interest. Sign up for our newsletter.