MIT's COVID-19 app uses smartphones' Bluetooth to anonymously spot disease contacts

The in-development system foregoes GPS tracking and other identifying data collection methods in its effort to automate labor-intensive COVID-19 contact tracing.

A research effort based out of MIT is looking to individuals' smartphones as tools for automatic COVID-19 contact tracing, but it's taking a unique approach that doesn't log GPS data or other potentially identifying information.

Rather, the multi-organization Private Automatic Contact Tracing (PACT) team is turning to smartphones' Bluetooth functionality – or more specifically, the short-range data strings known as "chirps" that smartphones regularly emit to connect with other devices.

By downloading a PACT app, individuals enable their phone to continuously send out these random data strings and keep a log of those from other participating devices it has encountered. If a user is diagnosed with COVID-19 by a healthcare professional, they would receive a QR code that notifies a cloud system of their status and uploads their list of received chirps.

All other participants in the system would be able to initiate a scan of the collective logs at any time through their own app and, if any of their outbound chirps match an instance stored in the cloud, would be warned of a potential (but still anonymous) COVID-19 contact. Of note, the system also keeps track of the approximate distance between each individual's device and that of their contact, as well as a rough estimate of the time they spent in range of the chirps.

“I keep track of what I’ve broadcasted, and you keep track of what you’ve heard, and this will allow us to tell if someone was in close proximity to an infected person,” Ron Rivest, an MIT Institute Professor and principal investigator of the PACT project, told the institution's communications outlet, MIT News. “But for these broadcasts, we’re using cryptographic techniques to generate random, rotating numbers that are not just anonymous, but pseudonymous, constantly changing their ‘ID,’ and that can’t be traced back to an individual.”

Once launched, participants will be able to download and join the effort "in a number of ways," according to MIT News, one of which is through another digital COVID-19 effort already launched by the organization called SafePaths.

WHY IT MATTERS

Manual contact-tracing is a labor-intensive task for any public health organization, let alone one overwhelmed by the magnitude of COVID-19. Once established and distributed, automated systems such as these could not only cut back on that burden, but also notify officials of incidental contact that the infected individual might not recall or even be aware of.

“In order for the U.S. to really contain this epidemic, we need to have a much more proactive approach that allows us to trace more widely contacts for confirmed cases," Dr. Louise Ivers, executive director of the Massachusetts General Hospital Center for Global Health and an advisor on the project, told MIT's communications outlet. "This automated and privacy-protecting approach could really transform our ability to get the epidemic under control here and could be adapted to have use in other global settings.”

But the particular appeal of PACT over several other automated contact-tracing or behavior-tracking projects is the minimal amount of data collection it requires. Bluetooth-enabled smartphones already keep a record of the chirps they have sent and received, and the project's database only maintains the outbound chirps of a positive case's device – in other words, no location data, and just a one-way log of unique contact events that can only be completed by a match from the second device.

The team hopes that being transparent with their approach and ensuring user privacy will help drive greater adoption of the platform and, ultimately, more comprehensive contact-tracing.

“We’re not tracking location, not using GPS, not attaching your personal ID or phone number to any of these random numbers your phone is emitting,” Daniel Weitzner, a principal research scientist in the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) and PACT's co-principal investigator, told MIT News. “What we want is to enable everyone to participate in a shared process of seeing if you might have been in contact, without revealing, or forcing anyone to reveal, anything.”

THE LARGER TREND

Several countries have already begun looking into, or have rolled out, mobile-phone-based efforts to track the spread of coronavirus among their citizenry that are often based on GPS tracking. Reports coming out just a few weeks ago that the U.S. government was discussing similar GPS-based efforts with leading tech companies.

Policy thought leaders have gone back and forth on the concept. For instance, former FDA Comissioner Dr. Scott Gottlieb floated the idea of GPS tracking on cellphone apps to ensure home isolation as a potential component of a robust coronavirus response in a report penned the other week. But more recently, he signed onto a Duke Center for Health Policy working paper that preferred "timely contact tracing ... augmented by technology" to "cell phone-based apps recording proximity events between individuals," due to concerns that these apps would not be well adopted, insufficiently discriminate between cases and contacts and potentially introduce privacy or security issues.

But the privacy and effectiveness debate hasn't stopped big tech from repurposing the data it's already collecting to help combat the disease. Within the past week alone, both Google and Facebook launched maps and reports to the public describing large-scale movement, behaviors and potential contacts within certain regions.