Coronavirus-Tracking Apps Take Different Approaches in Keeping People Safe

A South African team is building a blockchain-powered COVID-19 status verification app, using a different approach to Russian, Chinese solutions.

A team of academics at the University of Cape Town in South Africa is developing a blockchain-powered application that will allow users to verify their own COVID-19 status. The platform, named Covi-ID, is still under development but aims to address a number of pressing concerns around the global coronavirus pandemic. It’s being developed by a team of academics and software developers in Cape Town and is aiming to launch on April 21.

The application intends to improve contact tracing of infected patients, while users of the platform will be able to provide a verified COVID-19 status. Additionally, the app will reward people for responsible behavior, like remaining at home during lockdown periods. Covi-ID is being built on permissioned blockchain platform Sovrin, which is a self-sovereign identity network. The primary goal is to give users ownership over their data while providing accurate information relating to COVID-19 infection hotspots to ecosystem participants.

This South African project is not the first to be exploring the use of a mobile application to improve contact tracing. Countries like China and Singapore, which were initially hit hard by the COVID-19 pandemic, rolled out their own tracing platforms while a number of European countries have also been developing interoperable applications as well. The Covi-ID app also differs from these varying projects in its privacy-centered approach that uses SSI and blockchain technology. 

How will it work?

For developers, the first port of call was creating an account that verifies a user’s COVID-19 status. Potential users have two ways of creating a Covi-ID account. The first option is through a custodial wallet provided by one of the partnering commercial companies, which includes local South African banks, and government and health institutions. The second option is a completely self-sovereign identity wallet solution that is being developed by Covi-ID. Both options promise to safeguard users’ data. The latter option will store all of the users’ data on their phone, which means that personal information never physically leaves the device.

The nature of life in South Africa is also important to consider, as a large portion of the population may not have access to a smartphone. In this case, potential users can still engage with the platform by creating one of the custodial accounts with one of Covi-ID’s commercial partners.

The process entails taking a photo to prove the user’s identity, as well as providing a full name and telephone number — which can be a friend’s or relative’s in case users do not have their own number. Each user will be issued a QR code that can be printed, or potentially issued on a card similar to a bank card. This QR code can then be scanned by authorities to prove a user’s COVID-19 status.

Users’ information is stored by these commercial partners in custodial wallets, similar to how a cryptocurrency exchange stores a user’s currency holdings. Whenever their QR code is scanned, for instance, when they enter a supermarket, an event is logged in their wallet. Users can then be informed if they potentially come into contact with a COVID-19-positive user at that supermarket on that day. Users are required to provide phone numbers so that they can be easily reached in this case.

If users become symptomatic, they can go to a testing center or go see a doctor. The practitioner would scan their QR code and verify their identity with the photo that was given to the custodial wallet provider. Once the test results are confirmed, they would be logged into the users’ Covi-ID account. Once a user has recovered from COVID-19, or has received a vaccination — when they’re finally made available — they will be given a green status in the app and will pose no further health threat to the public.

All of this allows the second implementation of the Covi-ID, which is verification. This will most likely become essential as countries try to curb the spread of potential viral outbreaks in the future. If users try to enter any space that has implemented health screening, they will present their QR code, either through the app on their smartphone or a hard copy. Users then consent to give read-only access to their COVID-19 status. 

A green status would indicate users have either recovered from the virus or have received a vaccination in the future. A yellow status would indicate users are COVID-19 negative but have never been infected nor been vaccinated — this would necessitate certain screening practices. A red status would indicate that a user currently has COVID-19 and would need to immediately be isolated from the public. 

Blockchain technology to ensure privacy comes first

The major focus of the project is to ensure that users’ data remains protected while providing important information that will improve contact tracing and create a tool that will allow society to gradually return to some sense of normality. The developers of the application make use of users’ geolocation data, but instead of this valuable data being stored by a centralized server or institution, the users maintain possession of their actual geolocation data.

This is a fundamentally different way, in which users’ data would usually flow. The app will send out possible ‘infection hotspots’ to a user’s wallet, which will then check if the user stored location history overlaps. In this way, Covi-ID is able to carry out similar functions to a track-and-trace system that stores data in a central database. Co-Pierre Georg, an associate professor at the University of Cape Town, is a leading member of the project. Georg told Cointelegraph that the project is being developed on the open-source, decentralized SSI platform Sovrin:

“We are building using self-sovereign identity and, specifically, we are building on the Sovrin ledger at the moment. But our app will eventually be platform-agnostic, and we are complying with all standards currently being developed by the SSI community to ensure this interoperability.” 

Georg said that the team wants to build an open-source system that will eventually be an enabler of “disruptive innovation,” also adding: “So, we will have an open-source version of the app and eventually also for the custodial wallets, which are currently being built as white label solutions for partner organizations like corporates, non-profits or government entities.”

Georg said that the end goal is for a large portion of the South African population to use an SSI application. However, due to the ambitious launch date, most users will initially be using a custodial wallet. He described it as a hybrid solution that will gradually move toward a completely decentralized system. Georg added that custodial wallets can be trusted:

“First, we have strict privacy regulation in place in South Africa already. And as we are working with well established corporate partners, the cost of not complying would be significant. Second, our open system incentivizes competition between the custodial wallets. As privacy is the most sensitive aspect of the system, we believe that we will see a race to the top where the best custodial wallet will eventually win the most users.”

Georg also believes that using QR codes will allow for widespread use because they can be scanned by phone cameras, which are ubiquitous in African countries. Furthermore, the project will provide an open-source application for anyone who needs to verify a user’s COVID-19 status:

“Most of the verifiers will be taxi operators or security guards, and almost all of them do have smartphones as well. What sets us apart, though, is that we do not require every user to have a smartphone as well. This makes the system more inclusive than existing and fully decentralized solutions.”

European applications to be rolled out by Mid-April

While the Covi-ID app hopes to provide a solution that is primarily suited for a South African setting, various European countries are developing track-and-trace applications that intend to share monitoring data. The initiative, dubbed Pan-European Privacy Preserving Proximity Tracing, was proposed in an effort to collate data and contract tracing through a number of applications that are being rolled out across the continent. This would enable various applications that are being developed to interact with each other to improve the efficacy of contact tracing — a crucial part in curbing the spread of COVID-19. 

There are, of course, pressing privacy concerns around such projects, however, it has also been reported that the PEPP-PT program will offer both centralized and decentralized options to its users. The application will use Bluetooth technology anonymously without storing the geolocation data of users.

Many of the applications that are being developed will use Bluetooth technology to track the proximity of users to one another in relation to their COVID-19 status. Users who have come into contact with a person who is later confirmed to be infected, which is identified by the Bluetooth proximity, would then be notified by their respective applications.

Additionally, Russian authorities have announced that they will launch their own tracking application for patients who test positive for COVID-19 in Moscow at the beginning of April. The city has been in an indefinite lockdown since March 30. The monitoring application will be issued to people who have tested positive for the disease and have been ordered to self-isolate at home. It’s reported that the application will request access to users’ calls, location and camera, as well as network information — in an effort to monitor and ensure that sick patients are not leaving their homes while they’re contagious.

China also released an application in February that allows users to check whether they’ve come into contact with a person who is potentially infected with COVID-19. The New York Times reported that the application shares users’ location information to a centralized server whenever their barcodes are scanned at a checkpoint either in public transport hubs or other access-point controlled areas.

Singapore is another country that has released and made use of a contact-tracing application that uses Bluetooth technology. The TraceTogether app monitors a user’s proximity to other people using Bluetooth technology and uses timestamps to provide a history of contact. If users contract COVID-19, they can allow the app to identify people who they’ve come into contact with. Data is stored locally on users’ phones and is deleted after 21 days. The platform states that users’ locations and contacts are not tracked at any stage.

Meanwhile, another group of European researchers has been working on its very own decentralized platform for contact tracing — called Decentralized Privacy-Preserving Proximity Tracing.

The project’s white paper has been published on GitHub and is another Bluetooth-based proximity-tracing application that is primarily focused on privacy-protection. The app intends to provide warnings to users who have come into close contact with an individual suspected of being infected with COVID-19, without giving up any identity or location data.