South Africa has gone to great lengths to keep up its contact tracing efforts while this crucial system faltered around the world. The burden has often fallen on healthcare workers to literally pick up the phone or visit homes to find out who may have been exposed to Covid-19. 

Since March, the government has tried at least three different ways to digitise this system to lift the workload off healthcare workers and to make the process more private and faster for citizens. It has been just over a month since it launched the COVID Alert SA app. The app was hit by fake news and misinformation on social media – nevertheless, hundreds of thousands of people have downloaded it. The team behind it and experts alike say they have good reason to – after all, they have nothing to lose and only public health is at stake. 

South Africa’s contact tracing strategy 

Contact tracing is nothing new in public health emergencies. For instance, it played a crucial role in interrupting the transmission of Ebola in Democratic Republic of Congo – contact tracers were able to trace 25,000 people a day at the height of the epidemic in 2014, despite operating in isolated areas gripped with violent conflict. 

Contact tracing intends to follow the path of transmission of a disease and stop it in its tracks. Covid-19 spreads from person to person through droplets expelled from the respiratory system. The only way to stop the spread of this deadly virus until a safe and effective vaccine is found is to literally stop it in its path – by washing it away with soap and water, wearing a face mask or keeping a physical distance of 2m from people. 

Once someone tests positive for Covid-19, contact tracing aims to find all those who they were in close contact with in the lead-up to their positive test result. This is in order to isolate those people and offer them the medical help and advice they need to recover and not pass the virus on. 

South Africa’s manual contact tracing approach has relied on healthcare workers making phone calls or home visits to find out who a person with Covid-19 has been in contact with. Their task is then to contact those people and advise them on testing, isolation and quarantine. However, not all contacts are reachable by phone or some were simply unknown to the person who tested positive for Covid-19. 

‘Track and trace’ strategy is launched 

Since March 2020, South Africa has been utilising digital technology to enhance its contact tracing efforts. While it was never meant to replace manual contact tracing, it was envisaged as a way to lessen the workload for healthcare workers and speed up the process of disrupting the spread of Covid-19. 

Between March and May 2020, the South African government launched the “track and trace” digital contact tracing strategy. It used location data derived from cellphone towers to track the movements of those who tested positive for Covid-19 and determine who they came into contact with. 

Legal experts and civil society organisations raised concerns that there was no mechanism for oversight in the process as to how data will be stored and accessed. The government was soon forced to declare it was not “spying” on anyone and amended the regulations to allow retired Constitutional Court judge Kate O’Regan to oversee the process and report back on it to the public. 

The government pivoted away from this strategy in April 2020 as it was ineffective and “people were scared and worried”, says Gaurang Tanna, head of policy coordination and integrated planning at the Department of Health. He is the lead of the app development team at the Department of Health. 

“We really didn’t want to create fear in people’s minds so we diverted away from that completely. That’s when I got involved and we built COVIDConnect.” 

Next in line: A self-service digital portal 

COVIDConnect is a WhatsApp and SMS-based self-service portal run by the Department of Health since July 2020. It allows those who have tested positive for Covid-19 to digitally provide the names and contact details of those they have been in close contact with through the WhatsApp or SMS chat. The contacts will be alerted that they may have been exposed to Covid-19 without disclosing who tested positive. In addition, the service updates people on their test result and helps them to monitor their symptoms.

A video recording of this journalist’s process of opening COVIDConnect for the first time on WhatsApp on her smartphone and navigating through the self-service portal. (Source: Christi Nortier).

 The service caused some concern among digital privacy experts and citizens alike. Some argued that the wealth of centralised data made it attractive to hackers if there was no end-to-end encryption. Besides, they said the privacy aspect of the service was not well communicated to the public and there were concerns that the service would not be that effective, given its reliance on memory and uptake. 

According to Tanna, the entire process has end-to-end encryption to protect personal information and it received legal clearance and ethical clearances from health research ethics committees. 

South Africa was the first country in the world to build a WhatsApp channel like this for Covid-19, says Tanna. Two weeks after its launch, “the service was so well utilised that the World Health Organisation borrowed it for global use”. A month in, the service had been used by eight million people in South Africa. More than 400 million messages had been processed and 2.5-million people had used the self-screening function. 

Nevertheless, this service did not reach everyone. It was limited by the fact that not everyone knew or remembered those they had been in contact with. Also, between 30% and 40% of people in South Africa don’t use WhatsApp. The “journey” on the portal costs less than 2c but this is a barrier if there is no data or airtime on a phone. 

“Our intention was never to get to everybody [through COVIDConnect] but certainly to get to as many as possible so that the burden on our healthcare workers is managed. Certainly, when we had 14,000 cases a day that was a blessing,” explains Tanna. 

Next steps: a small, simple and secure app 

To address the shortcomings of COVIDConnect, the department decided to build its own contact tracing app. It used a software framework designed by Google and Apple in which to build an app suited to South Africa’s needs: it is small, doesn’t drain the cellphone battery, is privacy-preserving and is zero-rated by all mobile operators. 

Apple referred the department to Discovery’s software team just as Discovery approached the department to offer its help pro bono. The company was already assisting its clients to manage Covid-19 and wanted to extend this to the entire country, says Maria Carpenter, Discovery’s head of digital channels. 

Why build this app when the peak has passed? The app removed the obstacle of having to know or remember close contacts, thereby making the entire digital contact tracing process more efficient, quicker and anonymous, explains Tanna. It has launched just as the country faces the threat of a “second wave” as more and more people interact at supermarkets, transport hubs and homes under lockdown Level 1. 

The COVID Alert SA app was launched on 1 September 2020 and has been downloaded by 600,000 people in South Africa. The team behind it is aiming for 10 million downloads – they say it can be achieved in a week. 

How does the COVID Alert SA app work? 

The app is available on Apple and Android smartphones and will soon be rolled out to Huawei devices. It makes use of the exposure notification system designed by Apple and Google. 

Smartphone users can choose whether or not to download the app. And there is no user registration, meaning you don’t enter in any of your personal details. It is entirely anonymous. 

The app uses Bluetooth, and not location data, to detect other phones which have the COVID Alert SA app downloaded within a range of 2m. It only interacts with those that are in range for more than 15 minutes. This length and range of exposure would qualify someone as a close contact according to the National Institute for Communicable Diseases’ definitions. 

The phones interact through Bluetooth and they swop anonymised and randomised codes. Each phone keeps its own record of which codes it has received. This does not go to a central server. 

When someone tests positive for Covid-19, they will receive an SMS telling them so. Along with their result, they get a code to enter into the app. The app then requests the person’s date of birth to make sure they have the correct code – this ensures people don’t alert others unnecessarily or incorrectly. They can choose whether or not to enter the code into the app. There is no consequence if they don’t. 

Once this information is entered, the exposure notification server sends an alert to all other phones with the app loaded to check for this specific code. If the phone picks up that it has received this code in the past 14 days, then it sends a notification to the phone user to say they have been exposed. The app then advises the user on the next steps. They are not told when or where this exposure took place. 

A video recording of this journalist’s process of opening the COVID Alert SA app for the first time on her smartphone and navigating through the app. (Source: Christi Nortier)

App team knew privacy would be a concern 

The app development team foresaw that South Africans would be sceptical about the safety of their data and privacy using this app, say Tanna and Carpenter. 

As a result, communicating how safe and private the app is was front and centre in their mind from the start. As Carpenter commented, app users are very quick to voice their disapproval and will reject an app they feel doesn’t work for them. 

Tanna explains that Apple and Google’s framework was chosen because it is privacy-preserving and that some people might trust the tech giants more than they trust the government. In releasing the framework, the companies promised that it would make sure citizens around the world wouldn’t have to trade their data privacy for their health. 

Both Carpenter and Tanna say the two companies put them through their paces to make sure the app met their standards. The app could only be released to the public once they signed it off. 

Why trust these two tech giants now? Carpenter says they have both put their reputations on the line. This software will be used globally and if it fails, they will feel the repercussions. 

The app itself has extensive information to answer common queries around privacy and data security. This is to address concerns on the individual level and make sure people have the information at hand, says Carpenter. They hope people will feel empowered by the information and the ability to opt-out of the system at any time. 

Both Tanna and Carpenter emphasised that the only information the government can gain from the app is how many people report testing positive on the app – and this they already know because they have access to laboratories. 

The app from a user’s perspective 

With all the promises of safety and privacy, how does the app fare from a user’s perspective?

“I understand that a lot of people are feeling a bit anti-government at the moment and a bit like everything they do must be dodgy. I’ve looked at this app in detail and I’m not worried about it,” says social media law expert Emma Sadleir. 

“There are a few key aspects that give me comfort. First of all, it’s voluntary. It’s not something that has been secretly inserted on everybody’s phone, as some suggest.” 

She adds that the app is compliant with the Disaster Management Act as well as the Protection of Personal Information Act. 

“The second is that it’s anonymous – when I downloaded the app, I didn’t have to give them any personal information whatsoever. No name, email address or phone number. The app itself doesn’t collect any personal information… I really don’t have privacy concerns,” she says. 

She added that while it is wise to be concerned about privacy when it comes to anything on a smartphone, it is a constant balance between the small risks that might be present and the benefits that come along with their technology. She says that Bluetooth does not store your location data and is not commonly used for hacking. She keeps her Bluetooth on all day because it improves the functioning of her devices. 

“Some people have argued that when you get something for free then you’re the product. This is a valid concern when you’re dealing with a company, but not when you’re dealing with a health department,” she says. She says apps like Facebook, Instagram and WhatsApp have the intention of making money out of users, whereas the Department of Health wants to manage an epidemic. 

The voluntary nature of this app puts the power of tech back into people’s hands, says Thami Nkosi. He is Right2Know’s advocacy organiser for secrecy and securitisation. 

“We [Right2Know] have been struggling to put the tech power back in people’s hands. You now have the chance to contribute to how the app functions because if you don’t input the information into the app, then it renders the app useless. It won’t be able to trace people as it would like to. This empowers us to a degree to make an app effective or not. This gives people leverage to define what the app is and what becomes of it,” he explains.

He says this app is an improvement from the “track and trace” strategy because it doesn’t collect personal information without consent in the name of public health. Nevertheless, he says the government owes the country an explanation as to why it discarded this strategy and what became of the personal data it did collect. 

He argues the app goes far enough in providing information about privacy; however, it could say much more about why people should make the choice to opt in. This could strengthen their drive to take part and make a difference. 

In addition, it would improve government transparency and trust if the app itself explained how to give feedback. This would also provide an avenue to voice concern if users suspect something has gone awry. 

The road ahead 

“We are going to be learning from the South African public. We made some upfront assumptions but now that it’s live, we want to get feedback and understand what can make the app richer and more meaningful for the public,” says Carpenter. 

Tanna and Carpenter hope the app will be refined in the coming months, depending on what users say they need. Their focus now is getting people to download the app so that it can be the potentially powerful public health tool it is designed to be. 

Another goal is to adapt the app to assist with other health challenges in the country. Tanna explains that the technology could help the department communicate with TB or HIV patients securely and directly. 

For now, this is not possible because the software is so specific to Covid-19. Nevertheless, Tanna believes it has the potential to assist in future pandemics as well as routine care. 

“People say the app is not perfect. I’ve studied hundreds of contact tracing solutions globally and I’ve not come up with one perfect solution. There is no panacea in digital contact tracing,” explains Tanna. 

“You have to try and put in place every additional modality that you can. Every 100 infections we avert with this technology we save two lives. And those two lives do matter. It’s a fairly low-cost intervention and it’s the least South Africans can do to help us fight Covid-19.” MC