Tomas Pueyo’s articles on the Covid-19 pandemic have become widely read and endorsed. The most famous of these, The Hammer and The Dance, outlined the overall strategy he thinks governments should take: heavy suppression (the Hammer) to quickly reduce transmission, followed by more targeted measures to keep the virus under control while relaxing restrictions (the Dance).

He is now writing a series of follow-up posts, Learning How to Dance, on exactly how we can safely come out of lockdown. Part 1 asked what we can learn from other countries. Part 2 looked at some cheap, easy ways of reducing transmission. Part 3, on testing and contact tracing, is the longest post yet (~40 minutes’ reading time) so I figured people might appreciate a summary. This one has about 1500 words; if that’s still too much, you can just read the one-paragraph summary from the original text (pasted below), and/or the key points in bold.

Pueyo’s summary

“We can reopen the economy again if we do a few things right, including testing and contact tracing. We need to test all people with symptoms and their contacts, which means at most 3% of our tests should turn out positive. We need to identify as many infected as possible, and 70% to 90% of their contacts, to isolate or quarantine them. If we do all of that really fast (within a day or so), it might be enough to control the epidemic. We should hire lots of people to do that, and also use technology. The technology has some privacy tradeoffs, but they are really reasonable. Most of the bluetooth contact tracing apps built today are amazing pieces of technology that will be useless unless they get some fundamental changes.”

Terminology

Testing finds out who is infected, and they are isolated.
Tracing finds contacts of infected people, and they are quarantined (or isolated if they test positive)

This article examines testing and tracing; Part 4 looks at isolation and quarantine.

Testing

Countries with high transmission rates (e.g. the UK and USA now) should focus on suppression, not widespread testing.
- They only need to test sick or high-risk individuals (e.g. healthcare workers), so that they can be isolated and/or treated.
- But they need to massively ramp up testing capacity to prepare for coming out of lockdown.
Countries with low transmission rates (e.g. Taiwan, Vietnam and South Korea now, and other countries after some more time in lockdown) should test more widely: sick patients, contacts, travellers, and others who may be infected – ideally the whole population every week, if we have enough tests.
- Successful developed countries only have 1-3% positive test results
Testing and isolating only symptomatic cases is not enough to get R below 1
- About 45% of transmission is from pre-symptomatic infections and 10% from the environment (see graph below)
- Tracing and testing contacts catches pre-symptomatics, which in theory can reduce R by 85% (but in reality it is much less due to time delays)

3 factors are critical:

- 1. The % of infected we identify and isolate
- 2. The % of contacts we trace and quarantine
- 3. The speed at which we do both
According to a paper from Oxford University: With a delay of just 1 day, if we isolate 50-60% of cases we need to quarantine 60-80% of contacts
- Any longer than one day, and we cannot realistically rely on this group of measures alone.

Until universal testing is available, we need to prioritise testing the symptomatic, then their contacts – and for that we need good tracing methods.

Contact tracing

Who should we trace?

Contact tracers try to find everyone who has been in close proximity to a confirmed case over the last 14 days.
The definition of a “contact” varies, and they can be split into categories with different associated actions, e.g. in Canada:
- High risk contacts (e.g. housemates) must self-isolate
- Medium risk contacts (e.g. carers using proper protective equipment) must self-monitor for symptoms and avoid contact with vulnerable people.
- Low risk contacts (e.g. walked past in the street) are not required to take any actions beyond those required for the general population.
According to one paper: To bring R below 1, we need to trace roughly 70-90% of contacts
- The figure depends in part on R0, which is uncertain.
According to another paper, this translates to about 20 to 30 contacts per case.

How should we trace them?

Manual tracing (e.g. interviews, CCTV) is very slow, expensive, and inaccurate
- Labour estimates vary widely, from about 4 to 15 person-days per case.
- It relies on the sick patient’s cooperation and memory.
South Korea has been successful by using technology
- Tracers use data from GPS, credit/debit cards, gyms, buses, etc as well as CCTV and interviews
  - GPS etc helps cases remember where they went and who they met
- They also publish where cases went and at what time, so others can get tested
  - People can download that data and match with your own location history, so they know if they were near an infected person.
- SK approved special legislation after the 2015 MERS outbreak to allow this
There are no special privacy concerns relating to confirmed Covid-19 cases
- Most countries already have laws limiting the privacy and freedom of people with certain diseases
- If Covid-19 has notifiable disease status (as in the UK), authorities can use existing powers to track and isolate known cases (including phone and credit card data).
The privacy of traced contacts is a trickier issue, as they are not a proven threat to others.
GPS is largely privacy-preserving but has limits
- Mobile operators already know your position of your phone, and they could record whenever 2 people “match” (e.g. within 2 metres for >10 minutes).
- Government could be given location data for the infected and just a list of contact information (without location data) for the contacts. This seems to impinge very little on the privacy of contacts.
- But GPS is not very precise and cannot detect elevation (people on different floors of the same building may appear to be in the same place).
  - We need more research on the circumstances in which it would be sufficient, e.g. maybe only in low-density areas?
Bluetooth apps are better in principle
- They can record which other phones with the app installed come within a certain distance, when, and for how long.
  - This information can be shared with tracers, who get in touch with potential contacts...
  - ...and/or users can automatically be notified when someone they have been near tests positive.
- They don’t record location, which alleviates some privacy concerns.
- Apple and Google are collaborating to make it easier for both Android and iOS phones to do this.
But current versions are unlikely to be very helpful due to low take-up
- E.g. Only ~25% of Singaporeans have downloaded TraceTogether
  - Even if they all used it perfectly, it would only capture roughly 25%*25% = 6% of contacts
  - And in reality it will be far less:

Even current plans by Google/Apple won’t be enough, as they require users to install updates and opt in to the tracing and info-sharing
But it could work if it is made largely automatic*
- Apple and Google should push the update to all compatible phones
  - i.e. no user involvement required
- Have an opt-out system
  - i.e. participation is the default setting, and opting out can be made inconvenient (e.g. frequent requests for confirmation)
  - There is very good evidence this will make a huge difference
- OR: make use mandatory to enter buildings
  - i.e. you can only opt out by not entering
- Automatically share contact history when diagnosed with Covid-19
  - At that point they have a notifiable disease so we don’t need to worry about privacy

Alternatively, require people to scan QR codes when they enter a building, room, etc. (e.g. Zerobase).
- Must be mandatory, so you can only opt out by not entering
- Would still need mandatory uploading of places/contacts after a confirmed infection.

So overall, mandatory QR codes or mandatory bluetooth apps (to enter buildings) seems best**

How should we think about privacy?

People are scared, and this could lead to bad decisions, e.g. Hungary has just become a dictatorship.
There should be limits to the data gathered:
- Types of data: For infected people, we should only gather their whereabouts, who they met, where, and for how long. For their contacts, just that there was a contact, where, and for how long.
- Time period: Only for the three previous weeks.
- Access: Only the Ministry of Health or equivalent.
- Security: Personally identifiable information should be protected in the same way as medical data.
- Exit criteria: We need this data only during the epidemic, which should be clearly defined, e.g. it ends when >70% of population is immune.
- Due process: People must have recourse to the courts if the government has used data in a way that was unintended, or if the conclusions reached by investigators are unfair or inadequate.
- Transparency: All the information collected should be made explicit and public, after extracting all personally identifiable information.
But we are probably worrying too much about privacy
- Infected people already have limited legal rights; it doesn’t matter in principle whether we gather data from interviews or from GPS, credit cards, etc.
- Governments and companies already have most of this information, and a lot more.
- We have already lost our health, economy, and freedom. Is it not worth sacrificing a little privacy to get them back?

*Chart 27.d seems very optimistic to me. This paper claims only 64% of smartphones in the UK would be compatible with the necessary update. And if, as appears to be the case, it would be distributed as a regular update, it seems that only around half of users would take the necessary action within the first month. I’m trying to find out whether (a) the update could/will be made available for old operating systems, and (b) it could be pushed without user interaction – please leave a comment if you know the answer. But in any case, coverage should certainly be much better than with existing apps.

**I’m not sure these would be better than an opt-out bluetooth app, as that would presumably have greater usage when visiting friends, family, etc.

This summary was written by Derek Foster. Opinions in Pueyo’s article are not necessarily shared by Derek or his employer, Rethink Priorities. Thanks to Tomas Pueyo and Peter Hurford for reviewing drafts.

Pueyo: How to Do Testing and Contact Tracing [Summary]