Blockchain contact tracing app aims to win public trust to tackle COVID-19

A new form of digital contact tracing which uses unbreakable encryption to secure personal data could help win the level of public engagement required to fight the spread of COVID-19, scientists say.

In a new paper published in IEEE Internet of Things Journal, engineers from the University of Glasgow outline how a trustworthy contact tracing system could be built on the unique properties of blockchain technology.

Track and trace apps have the potential to be invaluable tools in the effort to contain the virus. Traditional track and trace methods, which involve healthcare staff personally contacting every infected person, are effective but are time-intensive and rely on the ability of the patient to correctly remember everyone they have recently interacted with. An app capable of mapping how infected people have interacted with others can help make the process faster and more accurate.

A mobile phone-based contact tracing system called TraceTogether helped the government of Singapore to contain their coronavirus outbreak. TraceTogether tapped into mobile users’ Bluetooth tech to map the interactions symptomatic people had with others. That data was shared with contact tracers who encouraged those who had contact with the symptomatic individual to self-isolate, preventing further spread of the virus.

Tech giants including Apple and Google and the governments of some countries have developed similar systems to help contain the virus. However, digital privacy advocates have expressed concern about how effectively users’ personal data will be shielded from hacking, theft or misuse.

The University of Glasgow researchers’ proposed new mobile-based system, named BeepTrace, harnesses the unique properties of blockchain technology to create a decentralized, potentially international system to help break the chains of virus transmission.

Blockchain is best-known for its application in cryptocurrencies like Bitcoin, where it facilitates secure financial transactions between individuals without the involvement of central banks. However, it is also in use in a wide range of other environments, including healthcare, supply chain management and information and communications technology.

Dr. Lei Zhang, of the University of Glasgow’s James Watt School of Engineering, is the paper’s lead academic author. Dr. Zhang said, “One of the primary advantages of a blockchain-based system is that no one central authority is required to oversee the maintenance of data. Individual users’ information is stored in a tamperproof digital ledger to which only they have the ability to add by using their unique digital signature.

“Copies of that ledger are held locally by every user of that blockchain network, which ensures it remains accessible and consistent, and each change to the network is verified by a process called the consensus mechanism.”

BeepTrace, which is currently being tested as a smartphone app by a small amount of volunteers on the University of Glasgow campus before being opened to wider testing later in the year, ensures user privacy by the way their data is handled on the blockchain.

Each user is assigned a randomly-generated anonymous ID, which changes regularly to prevent tracking or identification. If they test positive for COVID-19, their GP or other healthcare provider notes their infection on the blockchain using the IDs stored on the app over the last 14 days. Any other BeepTrace user who has been in contact with them during that time will receive a notification.

Since only healthcare professionals (or apps verified by them) can update the blockchain with details of infection, there is little risk of misinformation being spread by users mistakenly or maliciously marking themselves as having tested positive.

The app itself has two modes of operation: active or passive. The operation of passive mode is outlined in the IEEE Internet of Things Journal article. It uses smartphones’ global positioning systems (GPS) to track users’ movements and uploads the encrypted data to the blockchain. A special mechanism is designed to preserve user’s privacy. When a new infection is added to the blockchain, a central server calculates where users have had close contact based on their GPS data. When the information on users’ phones highlights a match with someone who has been infected, the app will push them a notification.

Active mode is discussed in a second article set for publication shortly in a second journal, the IEEE Internet of Things Magazine. It works by harnessing the Bluetooth tech in users’ smartphones. Every time two phones with BeepTrace installed are in close physical contact with each other, the app makes a note on both users’ phones about their location and the date and time they interacted.

The app regularly checks the locally-held information about contacts against the information in the blockchain. When news of an infection is added to the blockchain, the app pushes a warning notification to everyone who has been in recent contact with the infected person without disclosing their identity.

Dr. Zhang added, “There are advantages and disadvantages to both systems. Active mode may be more demanding on users’ smartphone batteries, and Bluetooth’s effective range limits the app to sensing other users within 10 meters. However, since more of the data capture and processing is done on the users’ side in active mode, the complexity of central servers required to make the matches could be reduced.

“Passive mode’s collection of GPS data, on the other hand, puts less strain on users’ batteries at the cost of producing larger files for a third party server to process.

“The app allows users to switch on both modes simultaneously in order to maximize its accuracy and effectiveness. The most important thing from a privacy point of view, though, is that users’ personal data is always kept secure, and the app only lets users themselves know that they have been in contact with someone with a confirmed case of coronavirus.”

BeepTrace has already garnered attention from researchers, private companies and governments around the world. If the first larger-scale trial on the University of Glasgow campus later this year is a success, the team hope that a final version of the app could be completed and ready for use by the end of 2020.

The University of Glasgow’s Professor Muhammad Imran leads the research group from which the BeepTrace papers are drawn. Prof Imran said: “Although we’re developing BeepTrace as a response to the COVID-19 pandemic, the underlying principles are applicable to any type of healthcare data security.

“That could be a future pandemic similar to the one we’re living through now, but it could also be used to safeguard the public’s personal data as health services move towards more data-driven interventions. Data from wearable health monitors, for example, could be uploaded and safely stored for secure sharing with GPs in the future to build a more complete picture of patients’ everyday wellbeing.”

The team’s paper on BeepTrace Passive, titled ‘BeepTrace: Blockchain-enabled Privacy-preserving Contact Tracing for COVID-19 Pandemic and Beyond’ is available at ieeexplore.ieee.org/document/9203904 .

The team’s paper on BeepTrace Active, titled ‘Privacy-Preserving Contact Tracing and Public Risk Assessment using Blockchain for COVID-19 Pandemic’ is set to be published in the next edition of the IEEE Internet of Things Magazine.