SEOUL (Reuters) – When a man in Seoul tested positive for the new coronavirus in May, South Korean officials were able to confirm his broad movements inside and outside the city in minutes, including five bars and clubs he visited on a recent night out .
ARCHIVE PHOTO: People in personal protective equipment climb a flight of stairs while South Korean job seekers (in the background) participate in an examination carried out outdoors amid social distance measures to prevent the spread of coronavirus disease (COVID-19), Seoul, South Korea, April 25, 2020. REUTERS / Kim Hong-Ji / Archive photo
The quick response – well ahead of many other countries facing outbreaks – was the result of merging South Korea's already advanced methods of collecting information and tracking the virus into a new data sharing system that gathers cell location data and credit card records.
The Epidemic Investigation Support System (EISS), introduced in late March, effectively removed technological barriers to sharing this information between authorities, based on the country's "Smart City" data system.
This platform was originally designed to allow local authorities to share urban planning information, from the population to traffic and pollution, by loading data into Excel spreadsheets and other formats. Now, it is the basis of a data clearinghouse that has fueled South Korea's response to the virus.
Although personal location and credit card data have been available for use by South Korean health researchers for years, previous systems required physical documentation to request the data before being loaded into the analytical software. It took the investigators about two to three days to gather a patient's personal data to track his contacts.
The new system digitizes the entire process, including requests, and can reduce that time to less than an hour, officials say. Researchers can use it to analyze transmission routes and detect likely points of infection.
The system had some initial problems and drew criticism for privacy reasons, but it has been a major factor in the East Asian country of 52 million, keeping virus infections at a relatively low number of 11,122 on Thursday, at just 264 deaths.
He did his first test with an outbreak in May, located in Seoul's Itaewon district, known for its nightlife, which ended up infecting at least 206 people.
"Faster epidemiological research means faster discovery of potential patients, which helps to stem the spread of the virus, even when there is a large set of infections or asymptomatic people, as we saw in the nightclub outbreak," said Yoon Duk-hee , director of infectious disease management in Gyeonggi province, a densely populated region near Seoul.
Yoon said she and other officials used the EISS to track the movements of the first person detected in the Seoul nightclub outbreak, while visiting several places, including two nightclubs and three bars.
The system still depends on humans who operate it to approve and upload data, which can lead to delays. And in some cases, privacy and security concerns have led to access being so restricted that some local officials said they had to rely on outdated methods.
When another infected person – a 25-year-old man, known as Patient Incheon 102 – told health officials he had no job, city officials said they went to the police because the information they wanted to check was not available in a timely manner. way in the EISS.
The phone's location data showed that he was a professor at a private academy, where subsequent screening and contact tests revealed that at least 30 other people were infected, including some of his students and parents.
"There were limitations to the system," said an official at the Centers for Disease Control and Prevention in Korea (KCDC), on condition of anonymity, because he was not authorized to speak to the media. "We are now trying to resolve them after the Itaewon outbreak."
The EISS was jointly developed by the KCDC and the Ministry of Land, Infrastructure and Transport, with the help of the Korea Institute of Electronic Technology (KETI). Many details of how the system works and some limitations of the program have not been previously reported. A scientific article about the system was published in a public health journal only on Wednesday.
The authorities' power to obtain information was established by a 2015 law called the Infectious Disease Prevention and Control Act, introduced after the country was struck by the Middle East Respiratory Syndrome (MERS).
The law allows South Korean health officials to access a wide range of personal data, including cell phone location information and credit card transactions, without a court order.
While many countries are struggling to develop smartphone apps that can track patients' contacts without revealing detailed personal information, South Korea has moved forward with a more invasive approach.
The EISS allows an authorized investigator to log in to a secure web portal and submit requests for information on specific confirmed cases. Law enforcement agencies must approve requests for location data from three telecom operators, while the Credit Finance Association handles the approval of information from 22 credit card companies.
When a request is approved, designated company employees receive alerts on their phones and computers. They then load the individuals' data into an Excel spreadsheet.
The investigator has temporary access to the information to perform the analysis. There are generally more than 10,000 location data points for each person in a typical 14-day period being analyzed, according to the KCDC.
An EISS portal, seen by Reuters, showed an interactive map showing patients' movements, with each location data point indicating whether it was collected via credit card or cell phone.
The government says access is restricted and authorized investigators must log in via a virtual private network (VPN) and use two-factor authentication to prevent security breaches.
Officials told Reuters that the system's developers considered using surveillance images and even facial recognition as part of the data the system could access, but decided against it for privacy reasons. Although CCTV is not accessed or uploaded to the EISS portal, health researchers still use these images widely to track cases.
"We spent more time anguishing privacy than developing the system," said Park Young-joon, director of KCDC.
Still, the system raised concerns about the use of private data.
"It represents a rare non-judicial and non-consensual acquisition of location data, without judicial supervision of the data collected," said Deborah Brown, a digital rights researcher at Human Rights Watch, based in the USA. "There is a concern that the door is open to abuse."
FOUND WITH CALLS
South Korean officials told Reuters that data from almost everyone confirmed to have the virus is entered into the system to allow cross-referencing and analysis of likely hotspots. The KCDC declined to say how many people were collected in total.
People have no choice whether their data is collected and accessed, but officials have told Reuters that authorities notify anyone whose information is collected and that all data will be deleted when the virus is contained.
"This information should only be used for crises like infectious diseases," said Gyeonggi provincial governor Lee Jae-myung. "But fortunately, our people understand that it is inevitable to fight the pandemic."
At the national or global level, life is more important than personal privacy, said a 64-year-old South Korean woman who asked only to be identified by her surname Jang. "Personal privacy is important, but preventing an infectious disease is even more important."
Some local health researchers said access to the EISS was too restricted or too slow, so they went back to traditional ways of requesting data.
An Incheon health official told Reuters that the city did not initially use the EISS on Incheon Patient 102, because it took too long to register the person.
Since then, these concerns have been addressed by changes that will allow local agencies to register their patients themselves, rather than waiting for the KCDC, said Kim Jae-ho, director of KETI.
Travel information and medical records can be added to the system, two people working on the project told Reuters. South Korean Health Ministry official Yoon Tae-ho said in a briefing that they are also studying the use of Bluetooth and QR codes to register places that people visit – such as nightclubs.
There was "an inertia in the administrative process," the first KCDC official told Reuters. "But now I am flooded with calls from local governments about how to use the system."
Reporting by Hyonhee Shin, Hyunjoo Jin and Josh Smith in Seoul; Editing by Jonathan Weber and Bill Rigby