In keeping with the global trend of using technology to try to stem the tide of Covid-19 infections, the government recently launched an app that lets YOU know if you have been exposed to another person with the novel coronavirus.
But many people have been sceptical about the tracing app, called “COVID Alert SA”. And justifiably so: in the age of the internet, where governments and corporations seemingly have access to every detail of our digital lives, is an app like this safe to use?
Let’s unpack it!
The verdict (and we must stress that this is a tentative one) is… the app is fairly safe. That’s because it doesn’t actually collect any information about you. Rather, it uses an anonymised code to alert anyone you’ve been in contact with over the last fourteen days if you’ve tested positive for Covid-19. And you’ll get an alert too, if someone you’ve been in contact with in the last fourteen days has tested positive. (More on this below).
The app is completely anonymised and your information is not stored anywhere – not a database, not some old cabinet in a dusty government office or in a hacker’s computer.
Murray Hunter, a data privacy researcher told explain that the app addresses the main privacy concerns “fairly well”. The main privacy concerns, of course, would be that the app would be used to spy on people’s movements. But the COVID Alert SA app does not collect information about your location, identity or contacts.
“The privacy infrastructure is generally good on this, the government and health authorities have no idea who’s who and it kind of relies on the honour system for each of us to correctly report our Covid status, so our contacts can be duly notified”, Hunter said.
So, I’m not being tracked?
The app appears to be far less invasive than similar apps seen abroad. Many of those proved hugely problematic, because they allowed governments access to users’ personal data, leading to concerns that these governments could spy on their citizens. Singapore and South Korea, for example, who developed smartphone Covid-19 apps before South Africa, have even developed tracing tokens and tracking bracelets to contain the spread of the virus (but that’s a story for another day).
Australia too has its own digital contact tracing app, called COVIDSafe, which according to The Guardian collects a person’s name, number and contact details and stores it for 21 days. Then there’s the Chinese app, which allows the government to know where you’ve been and who you’ve been in contact with, in real-time.
How does the South African one work?
It uses a function, developed by Google and Apple in June, which is already installed on your phone. This framework laid the groundwork for separate contact tracing apps to be developed by different governments. They call it the Exposure Notification System.
The actual app uses that infrastructure, as well as our phone’s Bluetooth signal. Random codes are generated and exchanged with other app users within a 2-metre radius. They call it a “digital handshake” 🤝. The codes are the only thing that is stored – things like your name, number address and other personal information are not recorded.
So, when you come into contact with another app user for more than 15 minutes with a 2-metre radius, the phones will exchange a code that will be stored on your device for two weeks and when you notify the app that you have tested positive, it will match with the codes you connected with, and drop those people a message.
What do I have to do?
- Download the app from your Google or Apple App store ( it’s free but needs WiFi or data to download).
- It will run in the background as long as your Bluetooth and location settings are on. (It will remind you every so often if you have switched it off).
- If you contract Covid-19, you have to notify the app (otherwise it does not work). It will anonymously send out a notification to all the people you shared the code with in the last two weeks.
- Once you send or receive the notification, the app provides guidelines on how to protect yourself after being exposed.
How did contact tracing work until now?
Until now, contact tracing in South Africa has mostly been done manually. It’s been a human-driven task, with government contact tracing teams literally picking up the phone or going door-to-door to screen people for Covid-19. Digital contact tracing is not as laborious, risky or time-consuming. Plus, the information obtained through digital means can be more reliable and accurate than relying on people’s memories to get the same information. And it’s quicker. But digital tracing does not replace manual tracing; it complements it, if anything.
Before the app, the government launched a Covid-19 contact tracing database, which sought to track people who were known or were suspected to have come into contact with persons known or suspected to have Covid-19. Mobile phone operators, like Vodacom, MTN and Cell C, were then used to obtain the geolocations of possible Covid-19 cases, so that their contacts could be traced, tested and isolated if necessary. The database stored individuals’ details from name, number, to Covid status, according to this statement by lawfirm Bowmans. If the system picked up, through your phone’s geolocation, that you had been in contact with someone with Covid-19, a health worker was meant to notify you and you’d have to isolate for 14 days. The government said then too that the information was kept confidential, and former Constitutional Court judge Kate ‘O Regan was appointed to ensure that the data harvested was indeed kept private.
But as far as we know, according to Hunter, the government has stopped making these location requests from cell phone operators because the locational information wasn’t accurate enough to be used for contact tracing*. We asked a government spokesperson, via the government’s official communication channel, the Government Communication and Information System (GCIS), whether the contact tracing database that was running with the cell phone operators has been scrapped, and why. GCIS had not responded by time of publication, but we will update this story if and when they do.
There was also the COVIDConnect platform, developed by the Praekelt Foundation in July. The platform allowed a user to declare the details of persons which they may have come into contact with if they tested positive for Covid-19. Users could provide the names and phone numbers of these individuals, and an automated SMS would be generated to notify them of possible exposure. Some ethical and privacy issues were raised, and not many people caught wind of this function. Read more about it here.
Are there any caveats to the app?
Hunter (our data privacy expert) said one concern about downloading apps like these in general is that they CAN create a false sense of security. He said that if people do not get notifications, they might think they are clear of Covid-19, when in reality they could have been exposed. The bottom line: we can’t just rely on the app to assume we are safe from Covid-19. We still have to keep our masks tightly on, and keep that 2 metre distance from others, wash our hands and sanitise!
Lastly, Hunter told explain that for the app to be effective, enough people will have to download it. But the government also needs to be more transparent about how many users need to adopt the app before it becomes an effective tool, he said.
“I do think that a lot more information needs to be made public about the role the app is playing in public policy and how many people are needed to use it before it becomes effective. That information has not been provided and it’s important if people are to wrap their heads around this.”
He added that, right now, it’s not clear how many people will need to download the app before it can really be effective. Government hasn’t made its target for this public. But based on international research published on the app’s site, these apps tend to work when 60% of people in the country have downloaded them.
“As yet, Google Play reports downloads in the tens of thousands, so there’s quite a way to go,” Hunter said.
explain reached out to a government spokesperson for more information on the app’s policy. We will update this piece as soon as we get a response.
*In the original version of this story, we said that the reason government stopped making location requests was because of concerns around the “app’s accuracy”. This has been clarified to reflect that the concerns were that the locational information wasn’t accurate enough to be used for contact tracing. We regret any confusion caused.