Letter to the Editor: The Latest on Contact Tracing Tech at Harvard

To the editor:

Thank you for advancing the discussion about contact tracing technology on Harvard’s campus in the editorial, “Five Privacy Measures to Justify Wi-Fi Contact Tracing” (September 8), and its dissent, “Dissent: Wi-Fi Contact Tracing Is An Unacceptable Violation of Privacy” (September 8). Both articles focused on the earliest version of one technology. The current versions of the MyDataCan and TraceFi technologies address most concerns raised and provide thought leadership to contact tracing technology on college campuses.

The Data Privacy Lab partnered with Harvard University Health Services and Harvard University Information Technology to design, develop, and assess two different systems – MyDataCan and TraceFi – for use during the pandemic. They jointly led 15 town halls with the community in August, conducted limited pilots, and made continuous improvements based on those experiences.

MyDataCan is an opt-in platform for mobile applications that puts individuals in control of their own data. My prior work showed that almost half of popular mobile apps share a user’s locational information with a multitude of unknowable recipients and not the user. MyDataCan changes the paradigm. Each app affiliated with the MyDataCan apps platform stores a copy of the user’s locational information in the person’s private storage on MyDataCan. The person can then view, share or use their information at will. During the pandemic, the last 14 days of a person’s location information can be made available to a contact tracer on a need to know basis for a specific case.

TraceFi, in contrast, does not use apps. Instead, TraceFi runs on custom-built sensors, not access points on Harvard’s Wi-Fi. Sensors capable of accurate close-proximity measurements are placed in the physical environment with overt signage. An important aspect is the ability to opt-out: The sensors will not capture information from opted out devices and the devices can continue to use Harvard’s Wi-Fi. Data in TraceFi are not kept for longer than 14 days. From July 9 to September 9, a limited TraceFi pilot ran in two lab locations using the earliest version of TraceFi.

Data in TraceFi and MyDataCan are stored at Harvard’s Level 4 security protection and only available to contact tracers when a person tests positive to COVID-19. In that scenario, the contact tracer can only retrieve data on the person and those who were near the person while they were considered to be contagious. Data access is reviewed monthly and reported to the University Electronic Communications Policy Oversight Committee, which prepares public reports of aggregate information.

Contact tracing is vital to help keep our campus safe. When a person on campus tests positive for COVID-19, a human contact tracer from Harvard University Health Services will interview the person to identify others, who may have been exposed, and contact them so that they can go into quarantine. The ideal timeline is 12 hours for the contact tracer to notify all likely infected people. According to papers published in the American Journal of Infection Control and the Journal of Medical Internet Research, a positive-tested person provides about half his critical contacts. Real-time location systems like TraceFi and MyDataCan have the potential to double the number of contacts and allow the human contact tracer to notify others, even if the positive-tested person does not know their names.

Details about the current versions of MyDataCan and TraceFi appear on covidtech.harvard.edu. We will continue to keep this website updated with the latest information.

Latanya A. Sweeney is the founder and director of the Data Privacy Lab and is a Professor of the Practice of Government and Technology in the Government Department and in the Harvard Kennedy School.