A Norwegian virus app to help stop the spread of COVID-19
Norway will soon launch an app that can notify people if they have been in contact with someone infected by the coronavirus. The app will also allow authorities to monitor the effect of other measures to stop the spread. One in four Norwegians are sceptical, but half of those surveyed said they will download the app.
An app called “Smittestopp” (Infection stop) will be launched soon, according to the Norwegian Institute of Public Health.
Norwegians can voluntarily choose to download the app on their mobile phones and the app will be available for both Apple and Android systems. But many have warned that the app could compromise privacy.
Deputy Managing Director Kyrre Lekve at Simula Research Laboratory, who have developed the app, emphasizes that it only sends alerts to and from people who have downloaded it.
“The motivation for downloading the app is that you can be notified that you might have been exposed to infection. And people who get infected get technical help to alert people who they may not remember having been in contact with in recent weeks,” he said.
Development of the app was commissioned by The Norwegian Institute of Public Health, the Norwegian Directorate for e-Health and the Research Council of Norway.
Norway's lockdown following the spread of the coronavirus began on March 12. Just before Easter, the government announced that they were in control of the spread, with a reproduction rate of 0,7 - meaning each newly infected person infects 0,7 others. A soft opening of various institutions has been announced, starting with the opening of kindergardens and grades 1-4 in schools between April 20th-27th.
Will notify anyone who has been near an infected person
Lekve says the app works like this:
When a person is registered as having been infected by the coronavirus in the government's MSIS registry, the Norwegian Surveillance System for Communicable Diseases, and has downloaded the app, a text message will be sent to that person's close contacts.
A close contact is defined as people who have been within two metres of the infected person for at least 15 minutes.
“This notification goes out only once, and is sent to all close contacts the infected person has had for the last 14 days, and who has downloaded the app,” says Lekve.
Naturally, one condition for this to work is that both the person who has been infected and their close contacts have to have brought their mobile phones with them during these meetings.
"Only one notification is sent out, because the authorities assume that the infected person will comply with the 14-day isolation requirement after having been infected," he says.
The Smittestop app uses both GPS and Bluetooth to work. GPS makes it possible to collect and encrypt data and place it in central data storage.
That allows infection tracking to happen faster. The Norwegian Institute of Public Health currently traces contacts manually.
Criteria can be changed
Lekve said while these are the criteria with which the app is programmed now, things can change.
“It’s conceivable, for example, that infection control assessments lead the authorities to change the contact time to five minutes, depending on new knowledge about the spread of infection,” he says.
The system is so flexible that it is very easy to change the criteria, Lekve said.
Privacy a concern
The planned app has been criticized by several groups for posing a risk to privacy.
The Data Protection Authority has been involved in the app’s development and has made a positive statement about the app as long as it is downloaded voluntarily.
"The app can be a useful tool for saving lives, but it is important that there is full transparency about what data are collected and what they are used for," said Bjørn Erik Thon, director of the Data Protection Authority, on the Authority's website.
An expert group has evaluated the security of the app. The group submitted a preliminary report to the Ministry of Health and Care Services (HOD) on April 9.
The report reveals weaknesses and vulnerabilities in the app's code, writes Dagens Medisin. Nevertheless, the group concluded that the data will be collected, transmitted and stored in a way that makes the risk of a data breach acceptable for an app with such sensitive data.
Simula and FHI have now made changes to the code based on recommended measures from the expert group.
“Most weaknesses, and the major ones they pointed out have been changed in the version to be rolled out,” said acting assistant director at the Institute of Public Health, Gun Peggy Knudsen, in a statement on the Institute’s website Tuesday.
Among other things, the emphasis has been on hardening the app and ensuring that data are as locked down as possible.
The expert group also recommends that the app be rolled out in two municipalities first.
Privacy at risk?
Privacy expert and lawyer Jon Wessel-Aas, a partner at Lund & Co, has pointed out that many people may be sceptical about downloading the app because it may mean that the government will store detailed information about where they have been at any given time.
He argues that it’s not necessary for the authorities to centrally store data on where an individual has been for the app to do its job.
Certain professional groups such as journalists and lawyers may refuse to download the app to protect sources and clients, Wessel-Aas points out to Advokatbladet, a publication of the Norwegian Bar Association.
Gard Steiro, editor in chief at VG, a national newspaper, has also warned employees against using the app because of concerns about protecting sources, according to an article on the online Journalist magazine, published by the Norwegian Union of Journalists.
“There is an opportunity to temporarily turn off data collection if you feel you need to be extra careful in this context,” Lekve responded.
Secondary routes of infection
The app will also detect secondary pathways of infection digitally: People who have been in contact with someone who has been in contact with someone who has become ill can also be followed up with tips and advice.
Data on individual users will be stored for up to 30 days. Older data is automatically deleted, Simula has written on its website.
At the same time, data to be used for research will be stored longer, but these data should not be identifiable with respect to individuals.
The authorities believe this will provide good infection detection.
Privacy expert Wessel-Aas believes that the purpose of infection protection can be achieved without the information about the individual being stored centrally with the authorities.
"The authorities have wanted a more comprehensive system of central storage of information, because it provides a more efficient and accurate infection detection," says Lekve in response.
Can evaluate infection control measures
The Institute of Public Health also wants the app to become a tool to see how various government measures work. The researchers can monitor whether new measures increase or decrease the total number of close contacts.
This provides the chance to monitor the effects of various measures on an ongoing basis, Lekve explains.
“For example, you can see if there has been a dramatic increase in close contacts if the government has relaxed specific infection control measures, such as when the schools re-open,” he says.
The app can thus help make sure that effective measures are continued and ineffective measures are stopped.
Can identify hotspots
Another reason for the approach is that central storage of information can reveal hotspots, that is, if there are many contacts in specific areas.
“We’re not talking about parties at home, but whether there are more close contacts in shopping malls than on football fields, or whether public transport is a route of exposure,” says Lekve.
Privacy expert and lawyer Wessel-Aas warns of the risk that authorities may use the information for other purposes, so-called disclosure backsliding.
In the article in Advokatbladet, Wessel-Aas cites a Supreme Court ruling where a DNA register was used for purposes other than for criminal matters.
Simula’s Lekve says it’s unlikely that information the app collects would be used for purposes other than planned.
“It is very unlikely, because the government would have to reverse its own decision. Ultimately, we have to trust the government to use this information for infection detection and to measure the effect of various measures,” he said.
Translated by: Nancy Bazilchuk
———
Read the Norwegian version of this article on forskning.no
