Frequently Asked Questions

About Contact Tracing

What is contact tracing?

Symptoms for COVID-19 may take 5 to 14 days to be visible. So someone who take a COVID tests after the symptoms are seen and tests positive may have been spreading the virus to others in the past. Contact tracing attempts to identify all individuals that this COVID positive person has come into contact with the in past to test and/or quarantine them. This is vital to limit the spread of the disease.

Who are primary and secondary contacts?

Individuals who come directly in contact with a COVID+ person are called primary contacts. Those who come into contact with a primary contact are called secondary contacts. Such contacts should consider the time of interaction, i.e., a secondary contact happens can happened only after a primary contact has happened. Similarly, there can be tertiary contacts of people interacting with secondary contacts too.

E.g., Anu meets Bala for coffee on day 1, and on day 2 Anu has lunch with Chandra. Chandra meets David at a meeting on day 3. David takes a walk with Irfan on day 4. Say Chandra develops COVID symptoms on day 5 and is tested COVID positive on day 7. Anu and David are primary contacts of Chandra. Irfan is a secondary contact of Chandra through David. Bala is not a contact since Anu met him before interacting with Chandra.

Why is it important to trace both primary and secondary contacts?

When a COVID+ interacts physically with someone, i.e., a primary contact, there is a small chance that they will pass the virus to the other person. This chance depends on the duration of interaction, distance between them, whether they are wearing masks, etc. When the primary contact interacts with other secondary contacts, then there is further small chance that they would have caught the virus and passed it along.

Typically, this risk may decrease as the contact distance from the COVID+ person increases, but depends on various factors. E.g., if you had an hour-long lunch sitting close to someone who later tests COVID+ and were not wearing protection, and then attend a closed-door meeting for 2 hours with a dozen of your co-workers without practicing social distancing or wearing masks, then both you (primary) and your co-workers (secondary) have a reasonable chance of having caught the virus.

What is digital contact tracing?

Digital contact tracing uses a smart phone App to keep track of individuals you were close to and uses this to identify primary and secondary contacts. It uses Bluetooth (BLE) technology to broadcast a unique ID that is assigned to your device. This can be detected by other contact tracing apps that are within 10-15 feet of your phone, i.e., close by to form a potential contact. The App keeps broadcasting and scanning repeatedly, typically every minute, and makes a note of the other unique IDs it has detected and the timestamp. You can think of this as a local diary that the App maintains on the phone of other nearby devices having the App that you have seen.

Later, if a person is detected as COVID+, their unique ID is shared with other App users. Your App then checks its diary to see if this unique ID was seen in the recent past. If so, you are a primary contact. You can report yourself to a COVID Control Center to take necessary precautions or get tested.

Why is it important to do digital contact tracing?

Say we expect someone to closely interact with 10 other people in the past 14 days despite precautions, then the number of primary contacts from a single COVID person is expected to be 10, the number of secondary contacts is expected to be 100, and tertiary contacts is expected to be 1000. This number can grow large.

Depending only on the memory of the individuals to recollect whom they met with in the last 14 days is unreliable. There may have been several individuals you interacted with at some public place but whom you do not know. Identifying the primary contacts, finding and talking to them, and then identifying the secondary contacts can take days. Meanwhile, the virus could be spread by several of them.

Digital contact tracing attempts to improve the reliability and reduce the time taken to identify these contacts by automating this process.

Will digital contact tracing solve the pandemic?

No. It is just one of many parts of a solution to help contain the pandemic.

Digital contact tracing is not perfect. There can be false negatives and positives. Bluetooth broadcast and detection are not 100% reliable and depends on the phone, OS, battery levels, signal strength, etc. So a valid contact may be missed. Similarly, people in two adjacent cars waiting at a traffic signal may be identified as contacts by the App but may have no practical chance of transmitting it the virus.

Digital contact tracing requires a high degree of usage within a closed group to be effective. It is better to have 90% of users within a single campus where people spend most of their time rather than 10% of usage across the city.

Prevention is the most effective way of containing COVID-19. This means avoid all physical interactions with others; practicing social distancing and wearing masks if you have to be with others; and washing hands regularly and avoiding touching your face.

About GoCoronaGo

There are many contact tracing and COVID apps available. Why should I use GoCoronaGo (GCG)?

Many apps from the Government of India and other institutions have been released. These include India's Aarogya Sethu, Singapore's TraceTogether, MIT's Safe Paths and PACT, the contact tracing protocol from Google and Apple, etc. There is one key distinction from GCG. These apps keep the device ID contact data that are detected locally on the phone. When a person is diagnosed COVID positive, they upload their device ID to a central database. The Apps periodically check this database to see if those device IDs are present in their local contacts, and if so, they are a primary contact.

This offers a high degree of privacy since the user's contact data is kept locally on the phone (except for COVID+ users' device ID)> But this also means that the users are limited to knowing only about their primary contacts. In places where test kits are not widely available, a primary contact may not be tested immediately while they await symptoms to appear. Meanwhile, it is possible that they are infected and may have passed COVID to secondary and tertiary contacts.

Instead, GCG reports this anonymized contact trace data to a central database and stitches these together into a contact network - a temporal graph of contacts over time. This helps rapidly identify multi-hop contacts from a COVID positive user. It also helps provide risk measures such as centrality scores to warn people who may be at a high risk of getting infected, or passing the infection on. This can help reduce the probability of contracting COVID in the first place, rather than inform you after a possible contact has happened. So prevention is a priority.

What are the risks of this approach? How does GoCoronaGo protect my privacy?

The model of collecting the contact trace data centrally does come with a lower level of privacy, compared to the alternatives that retain the data only on the phone.

Though the device IDs are generated at random and do not carry any personally identifiable information, prior knowledge of an individual (which we don't have) may potentially reveal their identity based on their interaction patterns. The presence of IDs of Bluetooth beacons at well-known locations in the contact trace, optionally sharing your GPS location or having a contact with someone else who is sharing their location may also expose the location of a device ID at a certain time.

GCG is aware of these risks, and we do our best to reduce them and respect your privacy.

1. The project is governed by ethical research guidelines at IISc. An Advisory Board, consisting of senior faculty, student representatives, doctors, security experts and senior administration officials, oversees the use of the data collected by the project and limits it to research, development and management of COVID-19.
2. We are in the process of getting Institutional Review Board (IRB) approval, which is an independent ethics committee constituted according to the Indian Council of Medical Research (ICMR) guidelines on biomedical research on human participants. We are advised by a bio-ethicist in this regard.
3. It is optional for you to directly share any personally identifiable information such as telephone number or GPS location with us. If shared, these are kept encrypted and will only be decrypted and used if there is a medical emergency that is reported by a health agency and it is approved our Advisory Board.
4. The contact trace data collected by the project will not be used to decipher the personal identity of individuals, unless it is a medical emergency that is reported by a health agency and approved by our advisory board.
5. Coarse GPS data (150 m x 150 m), if shared, is used to generate heatmaps of your neighborhood showing the density of app users who are sharing their GPS location. This helps with social distancing.
6. When users do not share any personal information, alerts sent to the App will be the primary means by which the device will be contacted with risk scores, etc.
7. Data that is collected will be kept internal to the project at IISc and will not be shared with any third-parties. These are described as part of our Informed Consent statement and have to be explicitly understood and agreed by you.

Why do you optionally ask for my Phone number?

Providing your phone number is voluntary. There are two benefits to this. One, if you uninstall and reinstall the App at a later time, your phone number will be used to restore your earlier contact trace history. Two, if you uninstall the App and you were later identified as a primary contact with a COVID positive user, your Institution's COVID control center may reach out to you over phone to inform you to take precautions.

If you are unfortunately are placed under mandatory quarantined or are tested COVID positive, you should self-report and call your Institutions' COVID Control Center. In such cases, you are required to provide you phone number through the App before that. Once they confirm, this will initiate an updated risk scores for your primary, secondary, etc. contacts to help keep them safe.

How do I get the invitation code for using the app?

Invitation codes will be emailed to you by your institute's IT team and a master list that maps invite codes to email IDs may be maintained by your IT department. GCG team will not have access to this mapping and will only maintain a mapping from the invite codes to the device IDs. These mappings may be used by your health center only to reach out to contacts of a positively tested individual.

My invitation code has expired. What do I do?

Please contact your IT department for a new invite code.

What is the PIN number used for?

The invitation codes are meant for one-time use. In case you reinstall the app, you can use your PIN number instead of requesting a fresh invitation code. Please make a note of the generated PIN number or take a screenshot of it. In case you forget it and happen to reinstall the app, contact your IT department. The PIN can be used for re-installation ONLY if you have a phone number registered with the GCG App at the time of uninstalling. You can register your phone number at the time of installation, or later under Settings. If you delete your registered phone number, you will not be able to re-install with the PIN.

Why do I need to enable my GPS if I don't want to share my GPS location?

This is a side-effect of how Bluetooth scanning works in Android. It needs both Bluetooth and GPS to be enabled to scan for other Bluetooth devices. Since there is a risk that your location might be indirectly revealed using Bluetooth, e.g., by the presence of Bluetooth beacons in the scanning, Android wants you to be aware that this possibility exists.

Even though the GPS is enabled, we DO NO detect or collect GPS location data unless you have given explicit consent. This is visible through the GPS icon in the main screen, and can be enabled/disabled under the Settings tab of the app.

How do you use the GPS location data if I voluntarily share it?

First off, you do not need to share GPS location for the basic contact tracing to work. Providing your GPS information is voluntary. If provided, GPS location is used to estimate coarse-grained user density in your neighborhood so that you can choose to avoid visiting populated regions. Location data is aggregated at 150m x 150m granularity for this.

Later, we may use this data to identify the movement of users who were later diagnosed as COVID positive to warn those who may have been in the same place and time with them, even though they are not GCG App users. This will be with the approval of the relevant health agency and our Advisory Board.

Why is the App only available to Institutional users and not the general public?

Contact tracing apps are effective only when a large fraction of users within a certain region use it. Institutions that have campuses with 1000's of students or employees are well suited to benefit from such contact tracing Apps. Having 8000 GCG users in a campus of 10,000 is better than having 80,000 GCG users in a city of 1,000,000. This can help the Institution to respond proactively to COVID situations if positive cases are detected. It also makes it feasible to interface the App with their COVID control center for a quick response.

At this time, we are exploring deployments at a few academic and industry campuses in Bangalore.

Should I start using the App immediately? Or should I wait till I feel sick?

COVID symptoms may take 5-14 days to appear after someone is infected (and sometimes, people may not even show symptoms). It is important to continuously keep track of your contact history since someone who tests positive in the future may have come in contact with you in the past when they were still infected. GCG goes back in time in your contact trace history to see if you crossed paths with them and if so, sends alert messages to you. This is also reflected as updated proximity scores for multi-hop contacts.

Even in the absence of any COVID positive individual, the App provides a social distancing score that checks tells if you are physically away from others (good!), besides reminders on good health practices.

GoCoronaGo Technical Details

Is it safe to keep Bluetooth and GPS turned on all the time?

When you turn on Bluetooth, the App periodically broadcasts its random device ID. This is similar to the SSID sent from a WiFi router. This allows Bluetooth Low Energy (BLE) devices to discover each other. The GCG App DOES NOT connect to any other devices, called "pairing", which will require you to enter a passcode. Even though GPS is on, we DO NOT collect your GPS location data unless you have enabled it in the App. You can verify this in the App's main screen, which will show a GPS icon, and it is also available under the App's Settings.

However, keeping Bluetooth and GPS on allows other Apps you have installed in your phone, and to which you have given permission, to make use of Bluetooth and GPS. These may be intrusive. So please check and limit the permissions for other Apps that use Bluetooth and GPS.

If I switch off Bluetooth or GPS, will GoCoronaGo continue to trace contacts?

No. The app requires both Bluetooth and GPS to be switched on to work. In case, you've switched them off, the App will automatically remind you to enable your Bluetooth and GPS in the notification bar on the top. Make effective to use of the app when going out of your house to locations with other people in your campus.

How do I know if the App is working and recording my contact trace?

When GCG is working correctly and recording your contact trace, there will be a permanent alert in your Android notification bar that says "GoCoronaGo: Scanning for nearby devices". You will also see a progress bar in the main screen of the App that increases over the day. Try and hit 100% every day!

If the notification alert is not visible, just open the app once and it should be restored. If the alert shows "GoCoronaGo: Scanning stopped", then please make sure that your Bluetooth and GPS are enabled.

Do I need to have to have Internet connectivity for the app to work?

No, Internet connection is not required all the time. GCG will continue to detect and record contacts locally on the phone even without Internet as long as Bluetooth and GPS are on. It will push the contact data to our secure servers once you are connected to the Internet, and delete the local data.

How much Internet data will you use for sending the contact information to your servers?

Typically, the amount of data collected and uploaded will be less than 1MB per day. Of course, if you have many contacts around you (which is bad for social distancing), and it may be a bit higher. The data you download depends on the plots and analytics you view, but will also be under 1MB per day for typical usage.

Will keeping on Bluetooth and GPS drain my battery?

Both Bluetooth and GPS consume energy only they are actively used. Bluetooth Low Energy (BLE) is designed to use ultra-low power even when on all the time. In practice, we see under 10% of battery usage even when GoCoronaGo is scanning for the whole day. We also reuse cached GPS values when possible rather than activate the GPS frequently. This also minimizes battery usage.

Of course, the more you view the app for statistics, maps, plots, etc. more is the consumption due to the screen being turned on. You can check the battery usage of GoCoronaGo in your Android Settings->Battery->Usage.

How do you keep my data secure?

Data from the App is collected and stored on virtual machines on the Cloud, in data centers present within India. These Cloud data centers follow industry best practices and ensure physical integrity of the servers.

All network connections between the App and the backend servers are protected by HTTP Strict Transport Security (HSTS). This ensures that the network connection is always encrypted and there are no man-in-the-middle attacks through server spoofing.

Data that is collected by our web-facing servers are moved to internal virtual machines that are not directly connected to the Internet. Personally identifiable data, such as phone numbers and fine-grained GPS location (if shared), are kept hashed and encrypted using PKI. The decryption keys are kept offline and to be used only on approval.

Analytics are performed only on the contact network that is created from the anonymized device IDs.

• Enable permissions to install apps from unknown sources. Navigate to Settings and search for "Unknown Sources". This location of this setting varies across phone brands. E.g., Settings > Security or Settings > Apps > Click on Menu or Settings > Additional Settings > Privacy.
• Try downloading and installing your .apk file again in case the file was corrupt or the download was incomplete. For verification purposes, the size of the file for v0.4 should be 3,387,080 bytes (3.39 MB).
• Temporarily disable Android antivirus or other security features that may incorrectly identify the GoCoronaGo app as an invalid one.

Starting from GCG v0.6, clicking on the progress bar on the main screen of GCG will show you two plots: Hourly Contacts and Hourly Scan Status.

The hourly contacts shows 24 bars, one for each hour in the past 24 hours. You can swipe left and right to pan. The height of the bar shows the number of other GCG users who were within Bluetooth range in that hour. The color indicates the duration for which those many users were within Bluetooth range. This duration falls in 3 buckets: <10mins; ≥10 but ≤20mins; and >20mins.
Note that these bars do not consider how close those users were to you. For that, we shows a line plot overlay which indicates the number of GCG users who were estimated to be within 2 meters of you for a cumulative of 15 mins or more in that hour. Keep this number low.
Note that both the contact counts and the distances can both over- and under-estimate. Sometimes, users can be detected even 20+ feet away, while scans may be missed from even nearby users. We use the signal strength of Bluetooth advertisements from other phones running the GCG App to approximate distances. While the signal strength typically attenuates with distance, it is also affected by factors such as phone model and hardware, casing, reflective surfaces, surroundings, etc. Bluetooth advertisements can also be picked up when two nearby phones are separated by a physical partition such as wall.
We are researching on estimating these distances more accurately in lab settings. Please let us know if you find these estimates to be grossly inaccurate.

Starting from GCG v0.6, clicking on the progress bar on the main screen of GCG will show you two plots: Hourly Contacts and Hourly Scan Status.
The hourly scan shows 24 bars, one for each hour in the past 24 hours. The height of the bar should be about 60, reflecting Bluetooth scans that happen every 1-minute for each hour. You can swipe left and right to pan. Clicking on a bar/color will show a popup.

If a bar is fully Green and at height 60, then proximity scanning is working well for that hour. Keep it up for all the 24 bars!

If some or all of a bar is Yellow, then you have disabled Bluetooth for part or all of that hour. Please enable your Bluetooth for proximity scanning to work.

If some or all of a bar is Orange, then you have disabled GPS for part or all of that hour. Please enable your GPS for proximity scanning to work. This is required by Android even to do Bluetooth scanning. Note that we do not collect location information unless you have enabled it under GCG Settings.

If some or all of a bar is Red, then you have disabled both Bluetooth and GPS for part or all of that hour. Please enable Bluetooth and GPS for proximity scanning to work.

If some or all of a bar is Blue, then you have disabled location permissions for GCG in Android for part or all of that hour. Please go to Android Settings, App Manager, GoCoronaGo and enable Location Permission for proximity scanning to work. Note that Android refers to Bluetooth permission as Location Permission.

If some or all of a bar is Grey, then your phone OS is preventing GCG from running in the background for part or all of that hour. This can be due to GCG not being allowed to auto-start and/or being suspended due to power-optimization options. The solution to this depends on the phone brand. Please see our Tech Support page for common solutions.