National Department of Health on Matters of Citizen Surveillance for COVID-19 Tracking and Tracing

Meeting report

Presentation by the National Department of Health on Matters of Citizen Surveillance for COVID-19 Tracking and Tracing
Ms Milani Wolmarans, Chief Director: Policy Coordination and Strategic Planning, National Department of Health, made an oral presentation to the Committee on the topic of citizen surveillance. She said it is important to distinguish between citizen surveillance for contact tracing, and contact tracing itself. There was extensive engagement with the Provincial Health Department on contact tracing.

Using individual cellphone data to curb the spread of Covid-19 in South Africa is enabled. This was done through regulations enacted on 25 March 2020. The regulations were amended on 2 April 2020 to allow the National Department of Health to create a COVID-19 tracing database.  Essentially the Department must maintain a national database. The database will trace people who had Covid-19 or are suspected of contracting Covid-19. Under the amended regulations, the National Department of Health has access to information from mobile network operators about citizen movement until the State of Disaster came to an end.

The Covid-19 database is to be kept confidential. It will include:
Names
Surnames
Identity Numbers (ID) Numbers
Addresses
Cellphone Numbers
Outcomes of the Covid-19 tests
Details of Suspected Contacts

The system announced by the President is a digital contact tracing system. It moves away from the current manual contact tracing which completely overwhelms health workers. It is a process to assist contact tracing in a digitised format. It is being launched and rolled out to all provinces in the country. The proof of concept was tested in the Western Cape.

The National Department of Health is not involved in a digital system where it monitors the movement or location of any citizen within the country. During the period 17 April - 14 May 2020 it collected data from mobile networking operators. Meanwhile, the database and all data it received is demolished. It only has the details of individuals who it collected data from. It published this according to the regulation six weeks, after the Disaster Management Act concluded.

It had several engagements with Judge O’ Reagan who was appointed as the judge to oversee compliance with all the privacy rules. Judge O’ Reagan received the report of the individuals who the Department received data from during the period of 17 April - 14 May 2020, in an encrypted form.

Regarding violating citizens’ rights by tracking movement and location, Ms Wolmarans said it is not a system implemented by the National Department of Health. Rather, the system considered is the bluetooth solution which works on the bluetooth platform. These are opt-in systems. It allows participants a choice of to opt-in and participate or not.

Discussion
The Chairperson asked if the database being set up exists already or not. If it does, she wanted to know what kind of information and whose information is in the database. She wanted more information regarding the types of safeguards put in place to make sure the information is held safely.

She asked if audit trails to monitor things such as whom and for what purpose, had access to the database. She also asked for information around if there are any breaches to the database.

She wanted an explanation as to what kind of information is provided by the mobile operators to the Department of Health.

Lastly, she sought information regarding if there is any parliamentary oversight contemplated in the collection of information, or if it is only subject to judicial review.

Mr R Mackenzie (DA) asked if there is another presentation which can be emailed to the Committee, as Ms Wolmarans did not show the presentation, and spoke of another.

Ms P Lekker (ANC) asked if there are any other methods used to correlate the data provided by mobile network companies. Regarding compliance with the private sector, she asked what exactly the aspects are which it looks into.

Mr B Herron (GOOD) wanted information regarding the scale of the system. He asked if it is effective or useful for contact tracing, especially as provinces and authorities deal with the pandemic.

Mr P Marais (FF+) asked why the Department initially called it surveillance and not contact tracing in the first place. He wanted to know why it destroyed the very information it attempted to get in the first place.

Ms Wolmarans replied, the regulations were published on 26 March and then again on 2 April. Normal contact procedures were followed according to the guidelines of the Communicable Diseases Surveillance. Very strict protocols were put in place and no breaches on any of those occurred. Judge O’ Reagan said if the Department continues with the data, then an external person should have been brought in to look at the security protocols. This is to ensure there are no illegal attempts to get into, or hack the database.

You can use technology to find people. During the period 17 April - 14 May 2020, the Department worked on developing a proof of concept using the technology available in South Africa.  Judge O’ Reagan said, according to the table of effort, an investment must go into changing technology. It cannot guarantee people's privacy can be predicted.

On security and data governance, the Department works with all data rules which are best practices. According to Ms Wolmarans knowledge, there are no breaches or leaks in security. The data is encrypted. All that is left are the names and contact numbers. The information from the data received would be published six weeks after the Disaster Management Act ended.

What the President announced on Sunday is basically the digitisation of contact tracing. The current manual process of contact tracing will be replaced by the digitised system through technology. The digital process facilitates a 75% digitisation of the current manual process. This is not only to improve contact tracing but also the overall efficiency around it. The information it receives during this period is the Regulation of Interception of Communication Act (RICA) information, which led to huge privacy breaches. Regarding citizen surveillance, there are a number of other countries making use of a bluetooth platform to surveil its citizens.

The Department is working to create an application (app) platform where citizens can download the app and move around as wished. If the person gets in contact with someone or if the person tests positive, the app will register who the individual was in contact with for the last ten days.

Further discussion
The Chairperson asked how it is determined who to collect information from. She asked if she is correct to assume there is no single database, but rather multiple databases. She also asked for information regarding the revised role of Judge O’ Reagan in the revised system of operating by the Department. She wanted more information about the proof of concept piloted in the Western Cape, and asked if it is successful.

Mr A van der Westhuizen (DA) said various successes are achieved in various countries. He asked which models are the best models of practice for South Africa to follow.

Mr Marais wanted to know if information is shared across the border with neighboring countries, if information is shared. He asked if there are secrecy clauses.

Mr Mackenzie wanted to know about the composition of the team.

Ms Wolmarans replied that the Department had problems on a daily basis. National received the line list from the National Institute for Communicable Diseases of South Africa (NICD) regarding the positive cases in an encrypted format.

The information is secured by cyber security, through a secure park and an API, which was transferred for the Department into a data lake. This is also secured. She said it is technology developed in a laboratory development environment. It was tested firstly with dummy data before the Department looked at and used real life data, the tested period was from 17 April - 14 May 2020.

The contact tracing system is currently operational in all provinces. It will be officially launched soon, by the National Minister of Health, Dr Zweli Mkhize. The key is to motivate and inform citizens, once it receives a specific message regarding Covid-19, it is not a hoax, but rather a real message. It can be used for communication purposes and contact tracing.

There are a number of different countries with different successes. Singapore was the first to officially launch its contact tracing system using bluetooth technology on digital phones. The Singapore contact tracing system saw only a very small percentage of the population actually opt-in to the whole issue of contact tracing.

The higher the uptake the better the results will be. There is a huge responsibility to engage with everyone around the whole issue of its specification. There are a number of applications and solutions out there. It is important the government system be authenticated by Government itself and communication must be sent to citizens regarding it. If not, people will believe it is a hoax or something.

Regarding anonymized movement, Ms Wolmarans said she is aware the Centre for Scientific and Industrial Research (CSIR) collected completely anonymized movement data of individuals. This is basically to complement other analytics to determine possible hotspots or areas of possible outbreak in certain areas of the country. Regarding cross border information sharing, she is not aware of it occurring. However, she does not wish to say it does not happen, and be accused of misleading the Committee. Border control is very in depth and strict screening occurs for anyone who not only enters the country, but leaves the country as well.  She said she is formally delegated to look at the engagements and prepare the reports which are submitted. The documentation is available to, and was handed to Judge O’ Reagan. It was signed off by the Acting Director-General of Health.

Regarding the other presentation, she said she just had a very short one describing the digital contact tracing system according to the uptake in the Western Cape. The Department of Health in the Western Cape gave a positive response. They worked together on refining the system.

Mr Mackenzie asked if Ms Wolmarans is the only one on her team who worked with Judge O’ Reagan. He asked if state security or another agency worked as a third party with Judge O’ Reagan.

Mr Marais accepted the Ms Wolmarans reply that she cannot give further information regarding cross country border sharing of information. He asked if there is anyone who can report to the Committee as it is something which will affect the Western Cape. This is because most people crossing borders settle in the Western Cape.

Mr van der Westhuizen wanted to understand how the data is collected in South Africa. He asked if the process regarding the online and automated responses works. He asked if it alerts to say when someone is suspected of being in the vicinity of someone who has Covid, and therefore individuals need to go into isolation for two weeks.

Ms Wolmarans said regarding the team, it receives assistance from the Council of Scientific and Industrial Research. The patient related data collected over time, is part of the master patient index work. It is hosted in a database with triple security certification. The data flows from the image into the secure space and is then destroyed. All verifications were done to ensure data was destroyed. The data reported to Judge O’ Reagan also moved from a secure space with an encrypted password protected by a double security protection. The Department’s team comprises of various individuals. These individuals have different expertise and qualifications, and are supported by people from the CSR as well as data scientists, data analysts, and system engineers.

There are various complexities in using the technology which it found. Regarding the contact tracing system deployed in the country, it is an automated system which makes use of machine learning as well as party computing and chat bots. It is a fully automated system. It will send a message to the individual with a list of questions, if the person receives the tests and tests positive, it will ask this person to share the contacts of individuals the person was in contact with in the last seven to ten days. It will then automatically send a message to the contacts provided to say that person was in contact with an individual who tested positive for Covid-19. That person will know he or she must go into self-isolation and be tested. All messages on the system are ethically approved to make sure all ethical considerations are covered. Contact tracing is still at an early stage. However, it seemed to be showing a positive result regarding work being done.

The Chairperson thanked Ms Wolmarans for answering the Committee’s questions. Ms Wolmarans was excused from the meeting.

Members were asked to forward any feedback or possible questions which Members may have to the Procedural Officer to compile it and send it off to the Department for further feedback.

The meeting was adjourned.