Hi-tech system to trace Covid-19 contacts still being built

More than a month into the national lockdown, the health department’s bid to use cellphone technology to track Covid-19 carriers is yet to get off the ground.

Authorities are in a race against time to track and trace those infected with the coronavirus and those they have come into contact with, with the number of infected people in SA rising to 3,953 on Friday.

But the department said it has not tracked a single person using the technology, because the IT system to process data from cellphone service providers is still under construction.

“We are finalising the data linkages to receive the information, and this is not fully operational as yet,” health spokesperson Popo Maja told the Sunday Times.

“We have been continuing with our current method of contact tracing until the IT system is fully functional.” 

He said the development of the system is on schedule and that further information on the project will be made available when everything is in place.

Vodacom has already made the location and movement data of 800 Vodacom subscribers who tested positive for the virus available for use.

But cellphone tracking analysts and cybersecurity experts said the plan is fundamentally flawed.

Danny Myburgh of Cyanre Digital Forensic Lab  said not only is the method of tracking too inaccurate for the task, but it will also produce mountains of data. 

The bold plan to track Covid-19-positive people using their cellphones’ location data was announced by communications minister Stella Ndabeni-Abrahams on April 2.

The government gazetted regulations allowing health workers to request location and movement data from cellphone  networks “of anyone known or reasonably suspected to have contracted Covid-19”.

The regulations also allow them to demand the data of “any person known or reasonably suspected to have come into contact” with an infected person.

The department planned to build a database using this information, and provide weekly reports to retired Constitutional Court justice Kate O’Regan, who was appointed to safeguard the system from abuse.

Vodacom spokesperson Byron Kennedy said the network   provided the location data, as well as the date and time of calls made and received, of 800 Covid-19-positive subscribers,   after a request from the health department.

“But Vodacom has no historic data available to place subscribers who placed a call at a specific location in that cell coverage area. It is therefore not possible to determine the proximity of subscribers in that cell coverage area to the location of the Covid-19-positive subscriber,” he said.

MTN spokesperson Jacqui O’Sullivan would only say the data it has  handed to the department is  in line with the regulations.

Cell C and Telkom Mobile did not respond to requests for comment.

Myburgh said that cell tower triangulation could pin down someone’s location to within 100m — but this depends on network coverage. 

“In rural areas this goes into the kilometres.  It would be impossible to track who these people have come into contact with accurately.”

A veteran police cellphone analyst, who spoke on condition of anonymity, said that just interpreting the data would be a massive undertaking. “With effort you could see how many handsets attached to a particular tower, but it would be an investigation with massive scope. You would need teams and teams of people to analyse the data, and the capacity is simply not there.”

Dominic White, of cybersecurity firm SensePost, said a tracking solution could be found abroad.

Apple and Google, he said, have announced a plan to turn phones into opt-in Covid-19 tracking machines, using a smartphone’s Bluetooth capability to log the people the phone’s user has come near, while keeping people’s identities and locations anonymous. A similar system has been used in Singapore.