Eliminating Community Spread of COVID-19 Through Data Innovation & Public Partnership
A Multifaceted Problem
The COVID-19 pandemic is an expansive, multifaceted challenge that cuts across society, government, the economy and science. It needs to be tackled by leaders from a range of fields, in partnership with the global public.
Responses to the COVID-19 pandemic have varied significantly around the world, particularly in the way they have incorporated data and technology. China has mandated the use of facial recognition and body temperature scanning technology to identify infected people, and issuing colour codes to its citizens based on their risk. Taiwan is using location based technology to track compliance with quarantine orders, while other countries including Germany, the UK and Australia are leaning more on Bluetooth technology and manual contact tracing. A range of technologies have been deployed - but how do we effectively combat COVID-19 while still protecting our privacy?
The following whitepaper focuses on stopping the spread of COVID-19 using data innovation to enhance our ability to trace and contain the spread of the disease, while keeping privacy at the forefront.
Can we remove restrictions?
Infection data shows that Australians have done an excellent job so far of arresting the spread of the virus, as social distancing measures have seen the number of active cases peak at a much lower figure than first anticipated, and then begin to drop.
We are now entering the next phase: planning to resume some aspects of our normal lives, while still moving decisively to eliminate the spread of the virus.
Easing restrictions comes with an increased risk of reigniting the pandemic if not done properly and with appropriate mitigation strategies in place.  The virus still has the potential to be in our society for a long time, as very few people are immune to it (it is still not known to what extent COVID-19 imparts immunity from the coronavirus), and no vaccine is predicted to be available for at least several more months.
Projected Active Cases
90 Day LockdownNo measuresSome measuresSmart measures10000800060004000200060150Active CasesDays
These model outputs* illustrate hypothetical rates of infection following a 90-day lockdown if we a) rush back into normal life with no restrictions whatsoever; b) put some measures in place, but they are reactive instead of preemptive, and are ultimately insufficient to control the virus; or c) put smart, proactive measures in place which are sufficient to curb the potential pandemic ahead of us.
Here, we can see that both a rush back to our old way of life, or a partial return with insufficient management strategies, will likely reignite the spread of the virus - and potentially to a level far beyond what we have recently experienced.
*This graph shows the outputs of an epidemiological compartmental model called SEIR, which incorporates best known information on the properties of the virus and allows for modelling of different intervention scenarios. This information is constantly being updated and interventions are subject to change, so this illustration represents different simulated possibilities and should not be taken as predictions.
To facilitate a progressive reopening of our society and economy, we need to implement the very best tracing and containment capabilities - harnessing the latest technology.
DATA sits at the heart of this capability.
What follows is our plan for health authorities to partner with the public in developing the capability to effectively trace, contain and eliminate COVID-19.
This capability will require the handling of some detailed data to be truly effective.
Conversations regarding the use of data to effectively eliminate community spread of COVID-19 have rightly centred on concerns regarding data privacy and government overreach.
However, we don’t need to choose between retaining our privacy and eradicating the virus. We can do both.
To achieve this, the following governance foundations will need to underpin an advanced tracing and containment capability:
These will enable an effective capability to be created while ensuring the public and their privacy rights are protected and prioritised.
currently in place
Some measures are already in place that allow contact tracing of infected cases.
When a person tests positive for COVID-19, they are interviewed in order to learn where they’ve been, with whom they’ve interacted and for how long. This allows officials to contact people who are at risk of infection, and advise them on what to do next (be tested, self-isolate for a period of time, monitor symptoms etc.), potentially stopping new clusters from emerging.
Bluetooth Tracing
The COVIDSafe app was released by the Australian Federal Government on 26th  April 2020 and, as at 4th May 2020, has seen nearly 4.5 million downloads.  It works using similar technology (leveraging some of the same source code) to Singapore’s TraceTogether app; that is, detecting who has been in close proximity to an infected person on the basis of exchanged Bluetooth signals (or ‘handshakes’) between their mobile phones.
These measures will continue to help greatly in the containment effort of COVID-19. However, we should be aware that they are not a panacea for the challenge of contact tracing and containment:
  • Time is of the essence to prevent further infections, and there is evidence that manual contact tracing may be too slow to contain the virus;
  • Manual contact tracing is also ultimately limited by peoples’ memories and health authorities’ ability to get in touch with contacts. This poses a particular challenge in getting in touch with those with whom an infected person was in contact, but doesn’t know personally - e.g. with whom they’ve shared public transport or office space;
  • While Bluetooth tracing is a valuable leap forward in contact tracing capability, it requires very high adoption rates to be successful (40-60% according to various models). As of 4th May 2020, Singapore’s adoption rate is less than 20%. This means, given that the Australian COVIDSafe app has not been made mandatory to download, it cannot be used alone to control the outbreak;
  • In addition, Bluetooth apps only detect proximity between pairs of phones, which means it can miss infection events:
    • The virus can be contracted from a shared surface after a person has left an area, something that would not result in a Bluetooth ‘handshake’
    • Environment and activity-based factors can lead to the virus transferring across larger distances than those detectable via Bluetooth. For example, in the United States, a choir practice was deemed a ‘superspreading event’ despite social distancing rules being followed to the extent that it is believed that no close contact would have been identified via Bluetooth
  • Bluetooth also works on a device-to-device basis and has no geo-tagging or location data attached. While this helps ensure privacy, it doesn’t provide a geospatial picture of potential virus spread which could be useful in informing preemptive responses in specific places.
Due to these limitations, there is a need to capture more information to better trace and contain the virus.
improving tracing
Adding selected (consent-driven) personal data points and aggregated data can help fill some of these gaps and allow for a more complete and detailed view of the virus’ spread, prior to the emergence of new infections.
Consent Driven Personal Information
Personal data from consenting patients can be used to provide more detail as to their whereabouts while they’ve been infectious. This may reveal other potential infected contacts and at-risk areas not identified during manual tracing interviews or from the Bluetooth app. This can include data from a range of sources - such as public transport travel, rideshare trips and credit/debit card tap locations.
Aggregate Population Behaviours
Aggregated movement data will help complete the geospatial picture of the virus’ spread based on where movement and congregation has been seen throughout cities. This would allow identification of potential high-risk areas prior to them recording new infections. Aggregated and anonymised public transport, private transport and Telco data, amongst other data assets, have the capacity to drive this enhanced predictive capability.
How this WOULD work
An infected patient is interviewed by health officials in order to learn where they can remember being, and who they can remember being in contact with. This enables the health official to get in touch directly with these contacts and give them advice as to how they should proceed (be tested, self-isolate etc.)
Bluetooth tracing unveils connections between infected and potentially infected people, helping to further complete the picture of who the patient has been in contact with, beyond just those that they can remember.
✅ After Consent
Personally identifiable information will only be collected from COVID-19 patients and will be done with explicit and informed consent at all times.
New COVID-19 patients are asked for consent to unlock a small selection of relevant transaction and movement data that can further help to understand where they’ve been, and where the highest risks of subsequent infections are. This can include device movement data collected from cell phone and in-building cells, public transport trip data, geo-tagged credit card transactions, rideshare trips, etc. from their infectious period.

Only the minimal necessary information is collected, and this is done with a focus on the paramount importance of individual consent and transparency. Patients are closely consulted in relation to what information was collected from them and exactly what it was used for.
Aggregate Population Behaviours
Aggregate behavioural data, which reveals high-level movement and activity trends across cities (such as public transport and telco data), would also be incorporated into the data stack. This would enable interventions, such as testing / treatment resources and movement restrictions, to be implemented in higher-risk areas ahead of time, according to where the data suggests it might be needed. For example, a large movement of people from an area with a major outbreak to other areas could inform health interventions in those specific areas.
The physical patterns of infection are driven by peoples’ movement throughout our cities.  Having a data-driven picture of movement will help to:
  • Integrate a geospatial lens into epidemiological compartment modelling so that it can become ‘spatially aware’- breaking cities down into separate regions (such as local councils) to model and predict which are likely to experience spikes in infections in the near future
  • Construct density and throughput analysis of the movement of infected people, providing a granular view on specific locations that have had a high degree of exposure to the virus
  • Inform more sophisticated algorithmic modelling, such as agent-based simulations, machine learning and AI based solutions*, to track and forecast the geospatial spread of the virus
  • Map disease clusters based on co-location analytics
This analysis will potentially allow for allocation of testing and treatment resources to be done dynamically and ahead of time- rather than in response to virus outbreaks. This information would be constantly updated in accordance with the data, allowing us to stay on the front foot in containing the virus (through the placement of targeted movement restrictions and wide scale testing / treatment provisions in relevant areas).
*For example, ML-based predictive algorithms such as gradient-boosted decision trees and artificial neural networks could be used to evaluate the risk of outbreaks occurring in specific areas on the basis of historical data and current movement patterns.
With a comprehensive data-driven tracing and containment strategy in place, it should be possible to substantially reopen large parts of society while still controlling the prevalence of COVID-19 and preventing a future pandemic outbreak.
This will allow many to return to a life more closely resembling one from before the pandemic. It will also mean that the specific areas that need to remain under restrictions can receive more direct support and resources (financial aid, testing and treatment), driving better outcomes for everybody.
Deploying governance foundations within the contact tracing and containment capability will ensure it effectively protects the privacy of the public.
Per new regulations associated with CovidSafe, data is only to be used by health officials for the purposes of contact tracing (or related activities necessary for the functioning and integrity of the capability), with detailed data only being visible to health staff who have direct involvement in a patient case. Data cannot be shared with law enforcement or any other government departments, and cannot be used as a tool to enforce individual compliance to social distancing rules. Personal data is deleted after 21 days and the collection of personal data is ceased once the COVID-19 pandemic has concluded. Only high-level learnings, infrastructure and aggregate data are retained to be used in the event of a future outbreak of COVID-19 or another pandemic.
Personal data collected to understand patient movement is only done with explicit and fully-informed consent freely given by each patient. Consent may not be obtained through coercion- per COVIDSafe regulations, it would be a criminal offence to use non-consent as a basis for any adverse action or discrimination against another person. Consent is given on a dataset-by-dataset basis (meaning a patient can choose which datasets they allow health authorities access to) and can be revoked at any time, prompting the immediate deletion of any personal data from the capability
Eradicating COVID-19 is not a service that will simply be provided by government, but a partnership between government, industry, academia and the public. As such, the public need to be treated as full partners in the tracing and containment process...
This partnership will be demonstrated by showing new levels of transparency - both to the public at large (explaining in simple and clear terms how expanded tracing and containment measures will work) and to participating patients who share their data (who will be notified via a secure messaging service of exactly which data points have been used in analysis and how)
The health department analysts using the data will be accountable to specially appointed supervisors who monitor data use (including automated logging) - ensuring all analysts comply with strict usage and privacy requirements. Purpose-built regulation will mandate severe repercussions, such as jail terms (as is already the case for those working with COVIDSafe data) for non-compliance.
In creating this capability, it is essential to bring the public on the journey as fully informed and consenting partners.
The data stack will be assembled containing consent-based data sets linked to a specific case (both passively and actively collected - e.g. device credit card tap locations during times of high infectiousness vs in-person interviews by health staff); and aggregate behavioural data (e.g. people movement as revealed by public transport and telco data).
Accountability and audit mechanisms ensure all use of patient personal data is monitored by dedicated teams - guarding privacy rights of the individual and confirming all data is being used only for contact tracing and containment purposes.
While only small amounts of personal data will be collected, robust cyber security protocols - including modern data encryption (applied to data at rest and in transit) and other critical protections - will be deployed to protect the capability from both data breaches and unwanted interference.
The challenges presented to us by COVID-19 are some of the biggest our societies have faced in modern history. Only by deploying the most innovative approaches, in partnership with the public, can we reclaim our way of life.

But we need to get moving now.
In the press
Smash Delta Managing Director - Ben Morley-John appeared in the CEDA livestream alongside Google’s Director of Government Affairs & Public Policy and the Chief Data Scientist for NSW to discuss this approach. Watch a recording of the livestream here.
This work was also featured in the Australian Financial Review. Read the full article here.
Smash Delta is a Data Strategy firm - an advisor to government and enterprise in solving the most pressing problems and driving capability through the ethical use of data, analytics and artificial intelligence.
Our work with government includes the generation of predictive capability for smart city solutions, the deployment of mobility data partnerships and the generation of multi-agency data strategies. We have hands-on experience in deploying all the data assets mentioned in this whitepaper - including credit-card transactions, telco movements and public transport trip data.
To learn more about our capabilities and strategies for defeating COVID-19, reach out to us at or visit our website
© Smash Delta 2020