A new phone-tracing technology could tell if you've been exposed to the coronavirus - without sacrificing privacy. 130 researchers are offering it to countries for free.

Mohammad Ismail/ReutersAn Afghan woman wears a protective face mask as she speaks on the phone next to a closed shop during the coronavirus outbreak in Kabul, Afghanistan, March 29, 2020.

• The novel coronavirus excels at spreading because it's contagious when there are few or no symptoms.
• That's why governments are resorting to lockdowns, travel bans, and other economy-crippling restrictions.
• A team of 130 volunteer researchers just rolled out a technology framework that aims to help people return to work using an epidemiological principle called contact tracing.
• Pan-European Privacy-Preserving Proximity Tracing would use Bluetooth low-energy (which nearly all smartphones have) to anonymously detect close encounters with infected users and warn those who were exposed.
• The group says it built the framework with anonymity and privacy as a cardinal rule.
• Visit Business Insider's homepage for more stories.

Dana is engrossed in the music piping through her Bluetooth headphones on her commute to work - a grocery-store worker, her job is considered essential - when a man sits down behind her on the bus.

She doesn't notice that he's come within 6 feet, and she doesn't hear him cough into his elbow.

But days later, a free app on Dana's smartphone alerts her to news she'd been dreading since installing it: She was likely exposed to someone with COVID-19.

Dana got the alert because the man on the bus saw a doctor, tested positive, and was given a special code to type into the same free app. Once he did, his phone uploaded a list of encrypted codes to a central server - strings of letters and numbers that anonymously represent every close interaction he's had with other app users over the past 21 days. The server then notified all the users that generated those codes of possible exposure, including Dana.

This is the future envisioned by a team of more than 130 European scientists and technologists. On Wednesday, after three weeks of near-continuous volunteer work, the group unveiled a framework (and a nonprofit organization) to support the scheme, called the Pan-European Privacy-Preserving Proximity Tracing project, or PEPP-PT.

The project scientists believe their initiative can get people back to work with minimized risk by using smartphone-to-smartphone wireless signals to detect who has been exposed to someone with COVID-19 and alert them. PEPP-PT relies on Bluetooth low energy, or BLE - a common mobile wireless technology - to perform what epidemiologists call "contact tracing." The process involves figuring out who came into contact with a sick person, then instructing those people to quarantine themselves.

"We all live in a global world, or we used to live in a global world, and we need to get back there if we don't want to break our livelihood completely," Hans-Christian Boos, an artificial-intelligence and computer-science researcher who helped organize the effort, told Business Insider.

PEPP-PT's teams focused on building an anonymous, easy-to-implement, internationally scalable, and essentially free phone-based approach that would not sacrifice privacy in the same way as other tracing initiatives used in countries like China, Israel, Singapore, and South Korea.

"We said, 'We need to do something, but we can't do it the way that China has done it.' Because if we did, we would at the same time just throw away freedom," Boos said.

Why anonymous digital contact tracing may help fight the pandemic

REUTERS/Brendan McdermidHealthcare workers wheel the body of deceased person from the Wyckoff Heights Medical Center during the outbreak of the coronavirus disease (COVID-19) in Brooklyn, New York City, New York, April 2, 2020.

The coronavirus can spread before infected people show any symptoms at all.

Marcel Salathe, a digital epidemiologist who helped develop PEPP-PT, said outsmarting that pernicious risk factor is key in curbing the spread of the virus.

"The first SARS virus, from 2000 to 2003, didn't have that, which is why it was easy to contain - 'easy' in quotes - because it was sufficient to just isolate people who got sick," Salathe told Business Insider. "Most countries are still thinking along those lines: 'Oh, we just have to isolate this sick people, and then we get the problem under control.' But that is not sufficient, because by the time they get sick, they may have passed it on."

Asymptomatic spread also makes traditional contact tracing, in which epidemiologists manually track down infected people to retrace their steps, inadequate, according to a recent study in the journal Science.

"We conclude that viral spread is too fast to be contained by manual contact tracing, but could be controlled if this process was faster, more efficient and happened at scale," the University of Oxford-based research team behind the study wrote.

That is the core idea behind PEPP-PT. Its founders say they did not create an app, but rather a whole ecosystem of technologies - servers, source code, and an international data exchange - that will make it easy for developers to build country-specific PEPP-PT apps, then publish them for people to download and use. Presumably, app users could then resume some movement outside the house, and self-quarantine only if they're alerted to exposure.

Boos said PEPP-PT as an organization (pending donations) is prepared to build and provide servers for free to states, countries, and other large-scale providers. If those entities pass validation by PEPP-PT - and don't "inject something nasty" into the source code to, say, funnel off private information, Boos said - they can join a data exchange.

A group in Germany - led by Ulf Buermeyer, a lawyer and information-technology expert who co-founded the country's Society for Civil Rights - recently described a similar model in a post at Netzpolitik.org.

Buermeyer told Business Insider the PEPP-PT framework seems to be "a privacy-compatible way of tracking people by Bluetooth," though he emphasized the group has yet to roll out its open-source code for the world to scrutinize.

"There are people who question that it is possible at all. I would say that it is possible," he said. "It's an approach that has strong upsides and I hope its implementation is successful."

How to track coronavirus exposure without sacrificing user privacy

Maxim Shemetov/ReutersPeople travel in a metro train during a partial lockdown imposed to prevent the spread of coronavirus in Moscow, Russia, April 2, 2020.

Some countries are already using technology-based contact-tracing systems. But they sacrifice significant amounts of their citizens' privacy to do so: Those apps analyze credit-card purchases, GPS location data, surveillance camera monitoring, and other information to follow the infected and alert the exposed.

Such approaches do seem to be working to curb the virus' spread, though. South Korea, for example, dropped from a peak of 909 new COVID-19 cases reported on February 29 to just 74 new cases reported on March 16.

"What might seem anathema to the US in ordinary circumstances now seems more tolerable in these extraordinary times," Sarah Kreps, who studies surveillance and cybersecurity at Cornell University, said in a recent press release. "On the one hand, giving up some privacy to save lives and regain some freedom of movement, commerce, and expression seems like a straight-forward calculation. On the other, historical experience suggests that once governments gain additional powers, they are loath to give them up, which could have lasting, adverse implications for civil liberties."

Boos says he fears greasing the wheels for an Orwellian future, but is convinced Draconian privacy-killing measures aren't actually necessary.

Bluetooth low-energy, or BLE, is already extremely popular - it's a primary way we connect our smartphones to wireless headphones, speakers, watches, TVs, and more. And it already offers a proximity sensing or "electronic leash" capability: it can broadcast a "hello" signal while also listening for such beacons from other devices.

By logging the strength of those wireless signals, distances between devices can be approximated measured. This is the foundation upon which PEPP-PT built its framework.

When a person downloads an app built on the scheme, they are automatically assigned an ID known only to a central server, anonymizing them. Their app then generates random codes tied to that ID and, using Bluetooth, broadcasts them. All the while, the app listens for similar random numbers from other smartphones.

"If they're close enough, within 6 feet, and for a long-enough time - more than a couple of minutes - we decide basically, on what the epidemiologists tell us, to record the random number," Thomas Wiegand, a leader of PEPP-PT and an electrical-engineering researcher at the Technical University of Berlin, told Business Insider.

When two people's phones save the other's random numbers, they do so in an encrypted log that not even a phone's owner can access. Six feet was chosen because that's the distance at which the coronavirus can spread via droplets from coughing, sneezing, or breathing, according to the US Centers for Disease Control and Prevention.

Logging encounters does not require internet service. Each anonymous record of contact is kept in a user's phone for 21 days, and older entries get deleted on a rolling basis. Three weeks is a generous amount of time for how long it takes a COVID-19 infection to become obvious and a test for it to come back. An option in a PEPP-PT app would allow a user report they have tested positive and upload their 21-day history of contacts, though it's not as simple as that.

"You don't want the trolls to post that they're infected if they aren't," Boos said.

Claudio Furlan/LaPresse via APTo ensure only positive-test users can report an infection, a doctor or lab would give a special access code that allows a person to upload their contact history. No one can do so otherwise - so it remains on a phone indefinitely, in encrypted form, if a person doesn't test positive.

"In Germany, hopefully 80 million apps will ask the server every two hours: 'Anything happen?' And they do this in the background, completely automatically. The server will reply to most of them, hopefully, 'nothing happened' in encrypted form," said Wiegand, who's also executive director of the Fraunhofer Heinrich Hertz Institute. "Those where something happened will be prompted a message, 'You may have been in contact with an infected person, and there's a risk of exposure. Here's how you can follow up.'"

In this way, the privacy of infected people would remain protected, as would that of anyone they had a close encounter with.

"It's an entirely closed system, meaning that we can't read the input and output. It's completely anonymous," Wiegand said.

Buermeyer said that from his assessment, the app tries to minimize how much data is gathered.

"What is gathered is basically anonymous IDs. Data that you don't acquire and store can't be hacked," he said. "It's also the most promising approach from a technical perspective - BLE allows you to scan for close contact. That is what it puts it way ahead of GPS or satellite."

The end result is that days or weeks of human epidemiologist work on a single case could be boiled down to a couple of hours, prompting exposed people to self-quarantine sooner.

PEPP-PT would have to be as popular as WhatsApp to be effective

John Lamparski/Getty ImagesA man enters the 23rd Street subway as New York City attempts to slow the spread of coronavirus through social distancing on April 1, 2020.

However, it remains to be seen how many people would actually use such apps.

In a perfect world, the project's creators say, at least 60% of a given population would have capable devices with a PEPP-PT app installed and Bluetooth turned on. That number is what Salathe says would sufficiently reduce the disease's R0, or R-naught - a measure of how many people, on average, one infected person spreads the disease to. The coronavirus so far has an average global R0 of between 2 and 2.5.

If an R0 dips below one, the disease loses steam and - at some point - vanishes. Brute-force methods like lockdowns are effective in reducing the spread, but badly damage economies. PEPP-PT may be able to achieve a similar effect without keeping most workers home.

"If you captured a contact before they can then spread it to the next round of people, that's how you actually really stop the whole thing," Salathe said. "That's where this 60% number comes from. If 60% participates, then that measure on its own should be sufficient to bring the reproduction number below one."

There's no question that Bluetooth is popular and pervasive: In 2019, more than 2 billion phones, tablets, and PCs with the standard were shipped, according to a 2019 market report by Bluetooth SIG, which developed the core technology.

"BLE was introduced in 2013 and has been used by Apple since iOS 7 and on the iPhone 4S," Steve Shepperson-Smith, a spokesperson for Vodafone, told Business Insider in an email. "Vodafone Germany data indicates that more than 95% of Android devices in Europe use BLE."

Laura Lezza/Getty ImagesA worker sanitizes the Piazza dei Miracoli near to the Tower of Pisa in Pisa, Italy, on March 17 2020.About 80% of the US population (kids included) has a smartphone, according to Newzoo. Germany and the UK also have an adoption rate of about 80%. But smartphones are less common elsewhere: In Italy, about 70% of people have one, and India, about 25% of people do.

Still, Europe is a promising place to start, according to Avi Greengart, a market analyst who researches device and technology adoption.

"Over 75% of Europeans had smartphones at the end of 2019," Greengart told Business Insider in an email, adding, "If a sizeable percentage of the group that does have an iPhone or modern Android phone runs the app, it should generate a rich trove of data and could be used to trace infection points."

But device adoption and compatibility aside, getting three-fifths of a population to do anything is still a challenge.In the US, 60% is a typical turnout of eligible voters during a presidential election, according to FairVote.

"The bigger issue is if you can convince enough people to use the app, and that will vary by country. Surveys show that Germans are extremely privacy-wary, while other nationalities are less so," Greengart said.

He added: "government mandates could undoubtedly trump these concerns."

'It is useful even if just 1% of the population installs it'

Feature China/Barcroft MediaMasked passengers ride a subway train in Nanjing in China's Jiangsu province on February 19, 2020. Passengers are called upon to scan QR codes of every train carriages and buses on a mobile phone app so that when a new COVID-19 patient is found, those who shared the same rides can get alerted.

Still, the creators of PEPP-PT (and other experts Business Insider interviewed) say that even without the ideal adoption rates, the framework can still make a significant dent in controlling the spread of coronavirus.

"Even if, say, 40% of people participate, it's going to have quite a strong impact on the epidemic," Salathe said.

Buermeyer was even more forgiving of low adoption: "It is useful even if just 1% of the population installs it, but it gets more useful as a larger percent of people install it," he said.

PEPP-PT's creators are also aware that the coronavirus can spread via contaminated surfaces, and they don't feign to address that. They simply see the project as one potentially major new tool in a toolbox of approaches.

"You won't capture everything with a system like this, but what you manage to capture is probably the dominant route through droplets. That's what we're going for. It's definitely not a catch-all solution," Salathe said. "The vaccine is the end game."

For PEPP-PT to work as an intermediate solution, though, fast, low-cost, and widespread tests are a must - otherwise users can't alert the system to their infection. But some countries, notably the US, still lag in providing sufficient testing.

This story has been updated.

Do you have a personal experience with the coronavirus you'd like to share? Or a tip on how your town or community is handling the pandemic? Please email covidtips@businessinsider.com and tell us your story.

And get the latest coronavirus analysis and research from Business Insider Intelligence on how COVID-19 is impacting businesses.

NOW WATCH: The coronavirus could affect the accuracy of the 2020 census - and that could decide who gets a vaccine