Since its first imported case of COVID-19, contract tracing has played an important role in Singapore’s containment strategy. It aims to reduce the spread of the viral infection by adopting an early intervention approach. Contact tracing allows health authorities to identify close contacts of COVID-19 patients, and to subsequently provide them with quicker detection and treatment when necessary. By isolating and monitoring those at risk of infection themselves, contact tracing helps to limit the community spread of COVID-19. This flattens the curve of Coronavirus infections, which eases the burden on Singapore’s healthcare system.
Contact tracing involves multiple stakeholders such as the Ministry of Health (MOH), hospitals and clinics, paramedics, the police, and more. It is indeed a very labour-intensive process. Fortunately, Singapore has come up with a way to manage this complicated and tedious approach: TraceTogether. Developed by the Government Technology Agency (GovTech) in collaboration with MOH, the app has now piqued the interest of governments across the world.
Here’s why:
How Does TraceTogether Work?
In a joint statement released by MOH and the Smart Nation and Digital Government Office, the lines of weakness in manual contact tracing were discussed.
“Currently, contact tracing relies on the recall and memory of interviewees. There were, however, instances when interviewees could not remember all their contacts, or did not have information on whom they had been in contact with.”
This is where TraceTogether fills in the gaps.
When a user downloads the TraceTogether application, he or she will be required to register with his or her phone number. The back-end server then uses that phone number to create a random and distinctive UserID. When the mobile device encounters other devices that have likewise installed the application, Bluetooth signals are exchanged. These exchanges contain “non-personally identifiable messages,” which are otherwise known as temporary IDs (TempIDs). Each TempID is encrypted with a UserID, the time at which the exchange occurred, and an expiry time. These TempIDs are purposefully designed to have a short lifetime—a recommended 15 minutes—to prevent any third-party exploitation. Only MOH can encrypt and decrypt TempIDs, ensuring that the stored data is used for the right purposes.
TraceTogether does not record any location-based data and has no access to any private user information on the mobile device. All data that is collected will be encrypted and stored locally in the user’s mobile device for 21 days. This effectively covers the incubation period of the COVID-19 virus, after which all data will be automatically deleted. The stored data will not be accessible by MOH unless permission is given by the user in the event he or she is contacted as part of the contact tracing process.
Think of it this way. Instead of constantly tracking you, your phone exchanges ‘name cards’ with people you come into contact with. It doesn’t know where you exchanged that card, nor does it let you look at the cards you’ve received. Even if you managed to look at the cards, they would all be safely encrypted in code. In other words, to an average person, it would just look like a string of gibberish. Only the government holds the key to decrypt this code and gain access to the information when the need arises. This way, most privacy measures are alleviated.
As TraceTogether requires Bluetooth to operate, users’ Bluetooth function on their mobile devices must be enabled at all times. The detection range of the application differs based on the user’s mobile device. Nonetheless, the data provides good insight as to who was within the 2 metre range of the user and whether they stayed in that range for over 30 minutes. This follows the guideline set out by MOH to determine who constitutes a close contact.
For the application to be effective, users have to turn on their push notifications. This allows official contact tracers to initiate contact with the user when the need arises. They will provide a code that users have to match with a corresponding verification code stored in their TraceTogether application. Once verified, users will be given a PIN number to facilitate the submission of their stored data to MOH.
TraceTogether complements the manual contact tracing process by enhancing the amount of information provided by the patient that is beyond what he or she can offer. By utilising both the information given by the patient and the TraceTogether application, a more complete dataset can be established. This allows health authorities to more accurately pinpoint close contacts of the confirmed COVID-19 patient for further monitoring.
Should I Be Concerned About TraceTogether Breaching My Privacy?
Some Singaporeans are doubtful about whether TraceTogether truly protects their privacy. After all, the application does record day-to-day details about one’s whereabouts to some extent. This must be viewed in consideration of the data leaks that have occurred in Singapore in recent years. The SingHealth data leak is one such incident, where the medical records of 1.5 million Singaporeans and even that of the Prime Minister were unlawfully accessed. The illegal retrieval and download of MOH’s HIV databank just last year constitutes another such example. Hence, Singaporeans’ worries over privacy are not unwarranted. In fact, this concern has been cited as one of the main reasons for its low usage rate among Singaporeans.
To its credit, TraceTogether uses BlueTrace, which is specifically designed to first and foremost safeguard the privacy of its users. BlueTrace is touted as a “privacy-preserving protocol,” and is what enables TraceTogether to perform its contact tracing functions via the Bluetooth feature.
BlueTrace helps TraceTogether to protect their users’ privacy through four key methods.
Firstly, third parties are unable to use BlueTrace communications to track users over time. This is so because a user’s TempID changes frequently. This prevents third parties from tracking one’s data over a period of time by sniffing for BlueTrace messages
Secondly, BlueTrace only collects a very limited amount of personally identifiable information. Only one such piece of information is required — the user’s phone number. Even then, this is securely stored by the health authorities and will only be used when required.
Thirdly, a user’s encounter history with others will be stored locally on the user’s mobile device. The relevant health authorities will only gain access to that information when the user gives permission to do so.
Lastly, users have control over their personal data and are free to redraw consent at any point. When this is done, all his or her personally identifiable data stored with the health authority will be removed. Additionally, all of the user’s encounter history will no longer be associated with him or her.
Therefore, TraceTogether does have measures in place to prevent users from giving up more information than they might be willing to. This helps to secure their privacy while ensuring that they continue to be kept in the loop of accelerated contact tracing whenever possible.
How Effective is TraceTogether in Contact Tracing?
TraceTogether has great potential to become an extremely valuable tool in Singapore’s contact tracing process. But as of right now, its effectiveness is very much limited. This can be attributed to its low adoption rate.
Despite campaigns on the government’s part, only about 1.4 million out of Singapore’s population of around 5.7 million have downloaded and used the application. This means that for every 10 Singaporeans, only 2 are TraceTogether users. This brings Singapore’s adoption rate to only 25%. When there are too few participants, there are too many loopholes present within the system. For instance, a TraceTogether user could have encountered 10 people in close proximity over a prolonged period of time in a given day. However, because all of these 10 people have not downloaded the application, TraceTogether will not be able to record such encounters. If say one of these individuals happen to contract COVID-19, the single TraceTogether user would not be promptly notified, if at all. Therefore, in order for TraceTogether to be truly effective, a minimal 75% adoption rate needs to be hit.
Thus, many more Singaporeans need to become active users of TraceTogether for the application to more effectively achieve its intended purpose.
Does TraceTogether Have Any Limitations?
The answer to this is yes.
The biggest technical challenge TraceTogether faces is related to Apple and its iOS devices. For Android users, TraceTogether functions fully both when the application is running in the foreground (when the application is in use itself) and in the background (when another application is in use instead). However, for Apple users, iOS is only able to perform its functions in the foreground. When running in the background, the application is also unable to detect other TraceTogether users in a meaningful way, rendering it ineffective.
As a result, iOS users are required to keep the TraceTogether application open at all times when they are in public places. This drains the batteries of users’ mobile devices much more quickly. Moreover, it is very difficult in itself to keep the TraceTogether application always open. As Mr Adrian Ng, the CEO of mobile app developer Codigo says, “(Keeping the application open) is also pretty difficult as users will be using their phone for other purposes, which causes the TraceTogether application to go into the background”. It is inconvenient for users to reopen TraceTogether every time they exit the application to use other mobile functions.
To combat this issue, the team behind TraceTogether have installed a “power saver mode,” where users can flip their mobile devices upside down to dim their mobile screens. This allows the application to function on less battery power while remaining in the foreground.
This might not be a problem for too long. Apple’s next iOS update reportedly allows apps like TraceTogether to send Bluetooth signals even while they are running in the background. Although iOS 13.5 has yet to be officially released, Apple has made it available in its beta form for other developers to test.
Encouragingly, Apple and Google have announced that they are working on a toolkit that allows their respective mobile devices to better communicate with each other via Bluetooth. Instead of developing another contact tracing application, their collaboration will come in the form of operating system updates, which will make the tech work more efficiently in the background. TraceTogether will definitely benefit from this.
Can TraceTogether Replace Manual Contact Tracing?
No, it cannot.
This is a sentiment shared by Jason Bay, the senior director of the Government Digital Services at the Government Technology Agency in Singapore, who also happens to be the product lead for TraceTogether.
“If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, no.”
“An automated algorithm will necessarily generate both false negatives and false positives. A human contact tracer will similarly make mistakes. However, because a human contact tracer would seek to incorporate information beyond just physical proximity, he/she can correct for systematic biases introduced by automated notification systems.”
Mr Bay highlights how contact tracers categorise human interactions as close, casual, or transient, which depends on the proximity and duration of the contact. These categorisations depend on environmental and location-based factors. However, in an application like TraceTogether, these factors are not captured. Interaction that is short in duration in enclosed and poorly ventilated areas can constitute close contact with humans conducting contract tracing. This is even if the proximity and duration both do not meet the required algorithmic thresholds.
In Israel, a similar problem was recorded, cautioning against an over reliance on such technology-based contact tracing approaches. When an Israeli was confirmed to have the Coronavirus, all those who had very remote contact with, including his upstairs neighbour and their visitors, were notified of their exposure to the virus and had to go into quarantine.
According to Mr Bay, it is precisely because Bluetooth-based contact tracing solutions cannot record critical data about a user’s location and geographical whereabouts that such information must be collected via other means. This is where human-led contact tracing interviews become ever so important. By having humans in the system, valued judgements can be made based on a case-by-case basis.
“The experience of Singapore’s contact tracers suggest that contact tracing should remain a human-fronted process.”
“Singapore’s contact tracers are on the frontline of the fight against COVID-19; they are able to do this because they incorporate multiple sources of information, demonstrate sensitivity in their conversations with Singaporeans who have had probable exposure to SARS-CoV-2, and help to minimise unnecessary anxiety and unproductive panic. These are considerations that an automated algorithm may have difficulty explaining to worried users.”
How is TraceTogether Helping the Rest of The World?
The Coronavirus, and other future transmittable diseases, does not respect national boundaries, and so should humanity’s response. This outlook is embedded in the BlueTrace Manifesto, where its developers strongly believe in the interoperability of the TraceTogether application and its other implementations.
In view of that, TraceTogether has been made open-source. This means that the BlueTrace Protocol which underpins the application and its accompanying OpenTrace code have been made available to the public. Developers all over the world are now able to easily leverage Singapore’s work to produce their own variations of the TraceTogether application.
The Singapore government’s conscious decision to open-source TraceTogether is intended to better help the international community fight against COVID-19, which has rapidly spread all over the world at an alarming rate. By doing so, Singapore is doing its part in combating against the highly infectious virus.
Dr Vivian Balakrishnan, Singapore’s Foreign Minister, had this to say, “We believe that making our code available to the world will enhance trust and collaboration in dealing with a global threat that does not respect boundaries, political systems or economies. Together, we can make our world safer for everyone”.
In fact, more than 50 governments have expressed interest in fully adopting or adapting TraceTogether for their own countries’ use since the release of the application. While countries such as New Zealand are still considering its adoption, others such as Australia and the Czech Republic have developed and launched their own versions of Singapore’s TraceTogether application. In Australia, the COVIDSafe application runs in a way that Singapore’s TraceTogether application does. It is based on the same BlueTrace Protocol developed by the Singapore government. In the Czech Republic, the government has released the application eRouška (eFacemask), which is inspired by Singapore’s TraceTogether application.
There are also diplomatic considerations at play. As a small island nation, Singapore cannot rely on projecting military and economic might. It has long sought to paint itself as a reliable partner and an active supporter of the current liberal international order. Contributions like this continue to cement that image. When countries perceive Singapore in a positive light, due to the international contributions that it has made, they are more likely to remain open and friendly to Singapore, especially in its times of need.
How Else is Singapore Using Technology to Fight COVID-19?
Besides the TraceTogether application, GovTech has also created SafeEntry to improve its contact tracing process. SafeEntry is a digitalised check-in system that records an individual’s entry into a venue. It comes in the form of a QR code, which users must scan with their mobile devices before entering. They will be prompted to provide personal information such as their names, NRIC, and phone number. Upon exiting the venue, they must also check out. This helps to speed up the contact tracing process by enabling faster identification of potential close contacts of the infected patient within the past 14 days. This also helps to prevent the formation of new clusters in the event of a confirmed patient in a particular location.
SafeEntry will be deployed extensively around Singapore, especially in areas where there is a greater risk of non-transient contact. Such places include supermarkets, workplaces, and shopping malls. As of May 9, SafeEntry QR codes have been placed in well over 16,000 venues. SafeEntry will also be gradually introduced in street hailed taxis in time to come.
SafeEntry is meant to complement the TraceTogether application. The QR code system collects more detailed information as compared to TraceTogether, which can add value to its database.
Leong Thin Yin, a professor at the Singapore University of Social Sciences, commented that “The two systems in Singapore complement each other, and potentially are synergistically more effective, especially if data collected from them are merged”.
However, SafeEntry raises more privacy concerns. With that, the government has emphasised that strict measures are put into place to ensure that the information collected is used only for authorised contact tracing purposes. These measures are in line with the government’s data security standards.
Mr Leong expressed that he did not feel that such a concern would significantly deter Singaporeans from using the technology.
“The Singapore citizenry and residents trust the government, and hence, it would not be a challenge to implement SafeEntry, especially during a crisis.”
What’s Next for Singapore’s Technology-Based Contact Tracing Approach?
The Singapore government recognises that technologies such as TraceTogether and SafeEntry are contingent on Singaporeans’ use of smartphones. However, not all Singaporeans own such mobile devices. For instance, young children and especially the elderly are less likely to own a smartphone of their own. Therefore, to address this issue, the government announced on May 4 that it is developing alternative technological solutions to include these groups in Singapore’s contact tracing efforts.
National Development Minister Lawrence Wong commented that possibilities include the use of wearables, which are dongles that people can carry around with them.
Furthermore, there has been some discussion over whether the TraceTogether application should be made compulsory to all Singaporeans. This is to increase the effectiveness of the application in its totality, especially since Singapore looks to ease its circuit breakers measures come June 1. As of May 15, some 20,000 foreign construction workers will slowly return to work on June 2 onwards, but not before downloading the TraceTogether application. This is now mandated by the government to step up its contact tracing processes, particularly among this population group that has seen the greatest spike in COVID-19 cases. Additionally, other forms of technology such as CCTVs and video calls will be used to enable supervisors to ensure that their workers keep to the safe distancing requirements. If a breach is found, alerts will be made to those in violation of the rules.
Christopher Gee, the head of the governance and economy department at the Institute of Policy Studies (IPS), recognised the need for Singapore to mandate the use of the TraceTogether application for all Singaporeans. This is particularly so since Singapore has seen hundreds of new COVID-19 cases on a daily basis. That being said, he also acknowledged that this might lead to a “slippery slope” of greater governmental surveillance over its citizen’s personal information.
In an interview with TODAY, Calixto Tay, the managing director of mobile app development agency Originally Us, also shared his apprehensiveness to making the application mandatory.
“We should strongly encourage the use of the application but making the application mandatory is quite a strong-handed approach.”
He referenced the 2017 SGSecure saga, where soldiers in Basic Military Training (BMT) were forced to download the mobile application as part of a counter-terrorism training programme, as an example of how an overly strong approach could instead backfire. Unhappy BMT soldiers left negative in-application reviews, which tarnished the overall image of the application in general.
“It is more about Singaporeans needing to see the value in it,” Mr Tay expressed.
While nothing has been confirmed, one thing is for sure. The role that technology plays in disease prevention will outlast this Coronavirus pandemic.
