QRONITON covid-19 tracing service developed at TUM

Contact tracing while protecting privacy

“The data are stored centrally on a server,” says Georg Carle. “However, they are encrypted in a form that cannot be read by the server operator, and which the authorities can access only in the form of subsets – and even then, only with the consent of the concerned parties.” If an infection with the novel coronavirus SARS-CoV-2 is reported to a public health authority, it will provide a personal authorization code to the infected individual. The authority can access data on the places visited and the direct contact persons only if the infected person enters the code in QRONITON. “The principle of data minimization was very important to us,” says Johann Schlamp. “The system captures only a telephone number and a postal code. The latter is used to determine which authority can access the data in case of a concrete infection risk.”

QRONITON is a browser-based tool, which means that the user does not need to install an app. It also means that users can be sure that data are not being collected in the background. They can decide themselves whether or how often they wish to scan QR codes. The developers also had users without smartphones in mind: These users can print out a personal QR code to be scanned by restaurants and other places they visit.

In recent weeks, the system was tested and optimized at TUM. QRONITON QR codes are already posted at numerous locations in the Mathematics and Computer Science Building. “During this test phase we found out which features are useful and were able to optimize the system to run on as many smartphones as possible,” says Schlamp. The project was closely monitored by researchers at the TUM Munich Center for Technology in Society (MCTS), who focused in particular on issues surrounding the acceptance of such systems. They also helped to ensure that QRONITON is compatible with the German General Data Protection Regulation.

“The system is now ready to be rolled out for everyday use,” says Prof. Carle. “We're also in touch with the public health authorities and the Robert Koch Institute. The Munich District Administration Office, along with the public health authority responsible for Garching, already has access to the system. I would like to see our proposal taken up by politicians to create the conditions for widespread adoption. Implementation would be useful in any location where large numbers of people gather and where there is a chance of a coronavirus infection. Along with restaurants and hair salons, this would include fitness studios, cinemas, public spaces and churches.”

Jens Spahn, the German federal health minister, will soon introduce an official coronavirus warning app. It will use Bluetooth technology to determine when app users come within a certain distance of each other. “A decentralized Bluetooth-based solution like that one and our QR code system both have individual strengths,” says Georg Carle. “The Bluetooth app makes sense for sending out individual warnings and will work without users having to actively scan codes. What we want to do is make contact tracing easier for public health authorities while offering restaurants and other facilities as well as their guests an easy way of meeting their documentation obligations, while complying with data protection regulations – and perhaps to encourage others to offer a voluntary tracing tool.”