Communications of the ACM

Contributed articles

Delivering a Rapid Digital Response to the COVID-19 Pandemic

By Gwanhoo Lee, Jaeho Kim
Communications of the ACM, January 2022, Vol. 65 No. 1, Pages 68-75
10.1145/3484732
Comments

The COVID-19 pandemic has arguably been our era's greatest threat to humanity and the global economy.¹⁶ South Korea's first confirmed case was in January 2020, followed by an outbreak in the city of Daegu in mid-February. However, South Korea quickly and effectively contained the pandemic and became an exemplar for other countries.³

Back to Top

Key Insights

While many policies and initiatives contributed to South Korea's successful response to the coronavirus pandemic, digital technology was at the core of the endeavors.¹² As part of its 3T strategy (test, trace, and treat) for coping with COVID-19, South Korea deployed a software system that traces the contacts of infected patients and disseminates the information in a matter of minutes.¹⁹ The COVID-19 Contact Tracing System CCTS) was first released in March 2020 to the Korea Centers for Disease Control and Prevention (KCDC)—a government agency responsible for advancing public health—and was then rolled out nationally in early April 2020. The system greatly contributed to reducing the number of daily new confirmed cases from 909 on February 29, 2020 to 7.42 on average between April 29 and May 5. According to a recent Columbia University study,¹³ both South Korea and the U.S. confirmed their first case of coronavirus on the same day. However, as of March 2021, South Korea's total confirmed cases are less than 10,000 and its proportional mortality rate is 50 times smaller than that of the U.S.⁷

The CCTS helped public healthcare officials to make informed decisions and helped keep the public aware of high-risk places where there had been exposure to coronavirus. Information provided by the CCTS enabled citizens to avoid hot spots and plan outdoor activities accordingly. The most important advantage of the CCTS over the contact-tracing mobile apps that many countries and regions have adopted—such as Aarogya Setu, Coro-na-Warn-App, COVIDSafe, PrivateKit, Smittestopp, StopCOVID, and Trace-Together—is that it does not require citizens to install an app on their mobile device.^2,5 Nearly all contact-tracing mobile apps struggle with low user-adoption rates, making tracing data incomplete and not useful.¹⁴ For example, the State of Utah implemented Healthy Together, a virus-alert app to trace residents who were infected with the virus and help notify their contacts about possible exposure. However, Utah ended up shutting down the app because only about 200 people used it.¹¹ In contrast, the CCTS can trace all COVID-19 patients as it collects data directly from mobile carriers and credit card companies without requiring any actions from the user.

CCTS development required intensive collaboration among multiple public- and private-sector players, including central and local governments, wireless carriers, credit card companies, software companies, a research institute, and a university. The complexity due to multiple stakeholders and time pressures challenged the project's success. Remarkably, though, it took only one month for the CCTS project team to develop and deploy the system. As COVID-19 took us to uncharted territory, it is crucial to learn lessons from global experiences.⁶

This article aims to identify critical success factors that enabled South Korea to deliver a rapid digital response to an unprecedented challenge. We use an inductive qualitative research method based on the grounded theory approach to derive significant findings from field interviews and archival data (see How This Study Was Done sidebar.) This study advances our understanding of effectively developing software solutions to contain a pandemic and provides insights for the technological, managerial, and policy enablers that need to be in place.

Back to Top

System Development Process

The project team used Agile Scrum methodology to develop the CCTS. The first prototype of the system, built in just one week, helped the team to define concrete system requirements based on user feedback. A few iterations of prototyping and user feedback with weekly sprints took place over the next three weeks. The system was then released to target users after being tested with sample data and verified for security. The entire process, from idea generation to system rollout, took only one month, very short considering the complexity of the project, which included multiple organizations, highly sensitive data, and potential legal issues. The system replaced the previously manual process of collecting and disseminating data to trace confirmed COVID-19 patients. After the initial release, the development team used weekly sprints to continue to improve the system in response to user feedback.

The idea for developing the CCTS to help control COVID-19 came from an unexpected source. The number of confirmed COVID-19 cases in South Korea was surging in February 2020, mainly due to a sudden outbreak in Daegu. That's when the Smart City Project, a government-funded, multi-year project that aimed to build a model smart city, was about to launch a pilot study of a newly developed smart city system in the cities of Daegu and Siheung. The pilot study was eventually postponed indefinitely due to Daegu's dire COVID-19 situation. Facing this roadblock, the Smart City Project team brainstormed about how they could help control COVID-19. The project manager proposed the development of a system that traces confirmed cases by repurposing the project's resources and technological capabilities. "It was one of those 'Aha!' moments that I realized some elements of the system we developed for the Smart City Project could be reused for a contact-tracing system," said the project manager.

The idea was enthusiastically received by policymakers at the KCDC. At that time, the KCDC was using an inefficient manual process to collect tracing data of confirmed patients. For each newly confirmed case, the KCDC had to get approval from the police department and the Credit Finance Association by sending official letters back and forth, before requesting relevant data from mobile carriers and credit card companies. Upon approval, the companies would send the data via email to the KCDC in a non-standardized format. Once the data was received, it was cleaned and analyzed manually using spreadsheet software. As a result, the entire process of collecting, analyzing, and presenting tracing data was too slow to keep up with rapidly increasing COVID-19 cases as it required many human interventions and touchpoints. Government officials knew that the old manual process wouldn't work for tracing confirmed patients because it was too slow and not scalable.

Several organizations from the public and private sectors participated in the development of the CCTS. The KCDC assumed ownership of the system, and the Korea Electronics Technology Institute (KETI), a government-funded research institute, led the project. Three major mobile carriers, three software firms, and a university joined forces to develop different core components of the system. Furthermore, 16 other companies supported the project. Team dynamics were positive and cooperative, in part because these organizations had been working together on the Smart City Project. All CCTS developers and stakeholders shared a sense of urgency, which led to speedy decisions on funding, staffing, and technology as well as an unprecedented fast-tracking of audits and security certifications. The project budget was secured quickly by reallocating the Smart City Project budget. Furthermore, project team members shared a sense of social responsibility, understanding the system's social significance and impact. "I often worked on the project for more than 15 hours a day and even on weekends," said one team member. "But, ironically, more work generated more energy for me. I did not feel tired at all. I came to realize how significant my work [was] for my country."

The team greatly benefited from the existing Smart City data hub platform and supporting technologies. The data hub platform provides a technological foundation that enables seamless, realtime flows of urban data; data analysis; support for data-driven decision-making; and the creation of a secure data ecosystem. The platform's mature, proven data security module shortened an otherwise lengthy system audit and certification process conducted by government agencies.

As COVID-19 cases soared, the system needed to be released to users as soon as it was tested. Intended users included KCDC employees, local government, the police department, mobile carriers, and credit card companies. With a high level of urgency, formal user training could not be provided, although a user manual was distributed. As a result, users experienced a steep learning curve with the system. The project team received and responded to many questions from users for the first several weeks after releasing the system. However, the team understood that the system's success relied upon their ability to address these issues promptly.

One potential barrier to the development of systems such as the CCTS is information privacy.^4,15 When South Korea experienced a Middle East Respiratory Syndrome (MERS) outbreak in 2015, the government came to realize the importance of collecting and disclosing critical information about infectious diseases. It amended its Infectious Disease Prevention and Control Act and the Enforcement Decree of the Infectious Disease Prevention and Control Act to allow for the collection and conditional disclosure of relevant infectious-disease patient information. Such information included location, credit card payments, visits to healthcare facilities, entry to and departure from the country, and closed-circuit television video (CCTV) footage. Although these amended laws are subject to criticism from a privacy standpoint, they proved to be an important enabler for deploying software solutions to control COVID-19. "Privacy is a tough challenge when you develop a system that deals with personal information of the public," said one wireless carrier manager. "[But] without the new laws, we would have not [been able to provide] the locational data that the CCTS needed."

The team put substantial effort into ensuring data and system security because they understood the implications of even a single data-breach incident on the sustainability of the CCTS. It is worth noting that, even with the provision of the laws and the implementation of security control measures, some patients declined to cooperate with government authorities, in part due to privacy concerns. Indeed, to what extent private information can be collected for the sake of controlling a pandemic is a critical question to be addressed in the future.

Back to Top

Overview of the COVID-19 Contact-Tracing System

The CCTS was built as an application on the Smart City Data Hub Platform. The platform consists of several modules and standardized APIs that can be combined to support different applications, including public parking, energy management, public safety, and environmental monitoring (see Figure 1). The Hub Connectivity Module enables the platform to collect data from external systems and provides the ability to convert the data into a standardized data model. The Data Core Module stores data in the database and provides data management capabilities, such as real-time data-stream processing, data quality management, data lifecycle management, and data usage logging. The Analytics Module extracts, transforms, and loads data to generate data that meets the analyst's needs while providing analytics and machine-learning capabilities. The Semantics Module connects the data by adding metadata based on a semantic ontology. The Service Module manages various data services tailored for users and supports a data marketplace. The Security and Privacy Module ensures data security through identity management, authentication, authorization, and block-chain capabilities. The Monitoring and Management Module manages the platform's cloud infrastructure and offers integrated platform monitoring services, including a platform dashboard.

Figure 1. The modular architecture of the Smart City Data Hub Platform.

The CCTS replaced a mostly manual process previously used for collecting, analyzing, and disclosing the data relevant to newly confirmed COVID-19 patients. Figure 2 shows the system's data flow and work process. When a newly confirmed COVID-19 case occurs, the KCDC enters the information into the CCTS. An epidemic investigator then uses the CCTS to request mobile location and credit card usage data. That request is sent to the police department and the Credit Finance Association, respectively, for approval. The mobile carriers and credit card companies then retrieve the requested data from databases on their own servers and upload it onto the CCTS using standard data formats and APIs. The data is then converted, stored, and maintained in the platform's Data Core Module, which the CCTS accesses via APIs.

Figure 2. The data flow and work process of the CCTS.

Because so many people own credit cards and mobile phones, the system was able to trace most of the infected individuals. An average South Korean possesses 1.9 credit cards and uses them about 65% of the time on purchases greater than $10 USD. South Korea's mobile phone penetration rate for adults is 100%, with smartphones accounting for 95%.¹⁸ An individual's mobile location data and credit card usage data are matched and aggregated by South Korea's national identification number, which is unique to each resident. When credit card usage data is not available, only mobile location data is used for contact tracing. Table 1 depicts the simplified data models for mobile location and credit card usage (the full data models are available from the authors upon request).

Table 1. The data models.

Mobile location data comes from signals between the patient's mobile phone and mobile base stations on the network.¹ South Korea boasts one of the world's most advanced mobile computing infrastructures. It has extensive coverage of 4G networks and introduced the world's first 5G services in April 2019. The initial deployment of 5G networks has been focusing on 3.4-GHz-3.7-GHz-band base stations. In 2020, about 90% of the South Korean population was covered for 5G,¹⁰ which can provide more precise user location data than 4G networks due to the following two important technologies. First, 5G uses Ultra-Dense Network (UDN) deployments, where the distance between the outdoor base stations is only tens of meters. In a UDN, the location of a mobile device can be accurately estimated by tri-lateration, which uses the distance between the device and nearby base stations, or with statistical processing approaches that use the probability density function of the distance between the device and nearby base stations. Second, massive Multiple Input Multiple Output (MIMO) technology equips the 5G base station with dozens or more antennas that enable accurate positioning of a mobile device with angle-based positioning approaches.

However, technical issues, such as signal interference and disruption, render some mobile location data inaccurate. The mobile phone can fail to communicate with the nearest base station and may instead communicate with a remote base station. Previously, this type of error was detected and removed manually by human workers, which was extremely time-consuming. The CCTS uses a machine-learning algorithm to instantly detect and correct such data inaccuracies without any human intervention. The algorithm, based on a space velocity model, continuously calculates the speed of the mobile phone user's movement based on mobile station data. The algorithm was trained with previous datasets to reliably detect and exclude erroneous location data. The system then uses a density-based clustering algorithm to conduct a cluster analysis to further identify erroneous location data that is spatially and temporally separate from the main cluster of data. After removing those errors, the system marks the results on the map with a timestamp and a duration for each spot on the confirmed patient's moving path. Epidemic investigators reconfirm the tracing results with the patient and collect additional tracking data if necessary before disclosing the final contact-tracing information to the public through various channels, including text messages and local government websites.

The CCTS produces not only the tracking information of a confirmed case but also two additional analysis results: hot spots and a network of confirmed cases. Hot spots refer to areas that are highly vulnerable to mass infection. The system can identify hot spots by overlaying cumulative confirmed cases spatiotemporally. Hotspot information is useful for the government to deploy resources to the right communities and for citizens to avoid social activities in high-risk areas. The system can also provide a visual presentation of the routes by which COVID-19 patients became infected. For example, the infographic of the network of confirmed cases shows who infected whom and where. This information provides useful insights into how the virus spreads among certain people and places. Figure 3 shows the three types of data analysis results. The CCTS uses two-tier security measures. It requires a one-time password to access the VPN (virtual private network) and an additional credential for the system website. User accounts are tightly controlled by the KCDC. All the data stored in the data platform is encrypted and the cloud infrastructure is equipped with up-to-date security measures.

Figure 3. Data analysis results.

Back to Top

Benefits of the CCTS

The CCTS drastically reduced the time needed—from more than 24 hours to less than 10 minutes—to collect, analyze, and disseminate tracing data for a newly confirmed COVID-19 case. Further, the quality of the analysis results was higher because algorithms removed human errors. By digitizing data and documents and using proven security control measures, the system reduced the likelihood of data breaches compared to the previous manual process. The system was also much more scalable, making it possible to simultaneously trace many confirmed cases. The system traced 90.2% of all confirmed cases from May 2020 to August 2020.17 The main benefits of the system are summarized in Table 2.

Table 2. CCTS benefits.

Back to Top

Critical Success Factors

Although it remains to be seen how much the CCTS ultimately contributes to containing COVID-19, the results to date show that it clearly has had a positive impact on South Korea's response to the pandemic. Our analysis of the interview and archival data shows that the following seven factors were crucial to the rapid and successful delivery of the CCTS. We found that software practitioners can increase the likelihood of successfully developing systems such as the CCTS if these factors are taken into consideration:

Advanced mobile computing infrastructure. A software system that creates value to the public often relies on the nationwide technology infrastructure. In the case of the CCTS, South Korea's advanced mobile computing environment served as an essential foundation for the system. As discussed earlier, high 4G/5G coverage combined with high smartphone adoption rates made it possible to collect location information of nearly all COVID-19-infected patients. In the era of recurring pandemics or epidemics, the digital infrastructure of a country has become a critical prerequisite for rapid and comprehensive responses.

Data platform. The CCTS was not created from scratch; it was built upon an existing Smart City data platform. That platform provided the technical framework and APIs to facilitate the connection and integration of new data sources, such as mobile location data and credit card usage data, with proven and certified cybersecurity measures. By taking advantage of the existing data platform, the project team was able to speed up development of the new system. Besides, the quality of mobile location data and credit card usage data was high thanks to reliable mobile networks and pervasive use of credit cards. The availability of a comprehensive data platform combined with high-quality data was a great enabler for the CCTS.

Breakthrough insights. The CCTS did not result from a top-down management approach, nor was it initiated by a new, dedicated team. Instead, the idea originated from the manager who oversaw a Smart City project, and the CCTS project was undertaken by the existing Smart City team. When faced with an unforeseen roadblock to a pilot study for a new Smart City system, the team started brainstorming alternative actions. The project manager realized that many of the key ingredients required for developing a contact-tracing system were already available or could be made available through the public-private partnerships developed through the Smart City project. With this breakthrough insight, the Smart City team repurposed its resources and mobilized partnering organizations to develop the CCTS.

Dedicated software developers. All significant players in CCTS's development understood the gravity of the situation and the importance of expediting delivery of the system. South Koreans learned from their previous experience with the 2015 MERS epidemic that an outbreak of a new virus could severely harm not only the economy but also the society as a whole. This shared sense of crisis and urgency motivated software developers to make system development a top priority and work long hours, even on weekends, to get things done on time. Everyone on the team was willing to sacrifice their personal lives by working long hours and compromising their own priorities to achieve the greater goal of controlling the pandemic. Such dedication and devotion created positive team dynamics that led to the success of the system development.

Constant communication with users. Since time was essential for controlling COVID-19, the project team was rushed to deploy the system to users without enough training. Consequently, many users in the early phase of the system adoption were often confused and could not properly use the system. It was crucial for the team to constantly communicate with users to receive feedback, answer questions, and fix bugs. The team used multiple media, including email, instant messages, texts, phone calls, and video calls to communicate with users. By painstakingly addressing one issue at a time, the team earned trust from the users and identified areas for improvement in the system. User feedback and inputs led the team to start a new project to upgrade the system. Without constant communication with users, the system would have suffered low levels of usage.

Effective public-private partnership. The development of the CCTS required collaboration among many players from the public and private sectors, including central government, local government, research institutes, wireless carriers, credit card companies, software firms, and universities. This is consistent with the increasing importance of public-private partnerships in addressing global health issues.⁹ Without effective collaboration among all sectors, the system would not have been possible. It is not easy for software developers from different organizational cultures to work together due to differences in their values, work processes, skills, and reward systems. However, prior work experience helped kick off a head start and set up ground rules for collaboration, as most of the participating organizations had worked together on the prior Smart City project. The central government was instrumental in facilitating collaboration by quickly clearing up budgetary barriers so that the project could be immediately funded. Software firms brought machine-learning technology. Each participating organization focused on contributing to the system's success by leveraging their expertise and strengths instead of engaging in an unproductive turf war.

Legal framework. Thanks to changes to its laws governing infectious disease reponses after experiencing the MERS outbreak, the South Korean government was able to collect data about infectious disease patients. The amendments also allow the government to disclose data, depending on the severity of the outbreak. Without such a law in place, it would have been impossible for the full functionalities of the CCTS to be deployed. From the software developers' standpoint, it was crucial for them to understand what the law allows and what it prohibits. For example, software developers consulted with government security officials to fully understand what technical and procedural measures are required by law to ensure data privacy and security. Even a small misunderstanding of the law by software developers would have resulted in a system that generated public resistance.

Back to Top

Conclusion

We translate the findings from the case of South Korea's CCTS development into the following insights for software developers, project managers, and policymakers. Caution should be taken when applying the insights, as they may need to be modified for different contexts and environments for system development and implementation. It is also important to understand that misuse of a system such as the CCTS may raise concerns related to privacy, security, and freedom. Therefore, technological and policy measures minimizing such concerns as well as a societal agreement regarding the use of personal data must be in place.

For software developers:

• In fighting a global pandemic such as COVID-19, digital technology can be effectively used to control it. Software developers have great opportunities to make a positive impact on public health and well being. Those with advanced skills in tech firms can contribute to the development of such digital systems. Those at wireless carriers, credit card companies, mobile payment companies, and healthcare providers can provide high-quality, reliable data in a standardized format for tracing infected patients.
• When developing a mission-critical system under great time pressure, software developers may need to go the distance at a fast pace to get things done. This could mean making personal sacrifices and working overtime and weekends.
• It is important that software developers understand relevant regulations, especially as they relate to data privacy and security. Such knowledge helps them accurately assess the feasibility of a new system from a legal standpoint and develop a system that is free from noncompliance issues. Furthermore, they should strive to develop technological solutions that preserve user privacy. A good example is the Exposure Notifications System that Google developed in partnership with Apple.

For project managers:

• Project managers facing unprecedented challenges need to think outside the box to generate breakthrough ideas. They should be resourceful and creative in repurposing and combining existing resources and technological capabilities to develop a new solution. They also should be able to coordinate and orchestrate project participants from different organizations and work effectively with various stakeholders, including policymakers and citizens.
• The successful implementation of the systems that address global pandemics may create new opportunities for participating project teams and firms. As the global demand for their digital expertise and capability increases, project managers can play an instrumental role in entering previously inaccessible global markets. Project managers can contribute to their companies' bottom lines by doing good work for the public.

For policymakers:

• Developing a digital solution for a pandemic requires the participation of multiple organizations from the public and private sectors. Effective collaboration across different sectors is not achieved overnight. Government officials should seek to build and nurture public-private partnerships through various projects and initiatives. Such efforts will pay off when they deal with the next global challenge that requires strong public-private partnerships.
• A software system that quickly responds to a pandemic or other global challenge is likely to be built upon existing infrastructures of technologies and data. They include advanced mobile networks, high penetration rates of smartphones, digital platforms, and high-quality data. Policymakers should strive to support the development of advanced digital infrastructures and ecosystems for facilitating the deployment of emergency response systems.
• Systems such as the CCTS, whic use sensitive data, can be enabled or constrained by laws. Laws often fail to keep up with technological changes. Policymakers should continuously monitor technological development and update the current laws.

Back to Top

Back to Top

Back to Top

The Digital Library is published by the Association for Computing Machinery. Copyright © 2022 ACM, Inc.

---

No entries found