In February 2021 it was a pleasure for me to moderate an expert panel, discussing how Linux Foundation Public Health (LFPH) is building, securing and sustaining open source software to help public health authorities. The webinar ran at an Asia Pacific-friendly time to inform interested parties in the region about the work being done by the LFPH community and to encourage them to join the fight. Here is a deep dive into that conversation.
The Linux Foundation’s public health initiative – LFPH – is working with public health authorities, tech companies and developers to combat COVID-19 and help prepare health authorities for future challenges. The open source initiative is making major technology contributions to COVID-19 exposure notification and verifiable vaccination credentials and is examining further areas to support health authorities and their tech partners.
On a webinar update for the Asia Pacific region on 2nd Feb 2021, LFPH Executive Director Brian Behlendorf described the initiative’s overarching goal as meeting the needs of public health authorities through open source software, capacity building and collaboration with the private sector.
Behlendorf says LFPH’s open source community has made great progress in helping public health authorities combat COVID-19 and he encourages health authorities, tech companies and individual developers to join the community.
LFPH launched in 2020, as the world began to realize it was facing a COVID-19 pandemic. “Quickly the open source community was thinking about how they might contribute to the fight,” Behlendorf says. “The Linux Foundation has always been about open source software, solving problems at scale. We decided we needed to develop relationships with public health authorities, around what they need and how to ensure the public could trust the technology.”
COVID-19 Exposure Notification
LFPH Director of Programs Jenny Wanger says LFPH quickly identified exposure notification as an area in which it could contribute. LFPH helps health authorities deploy an app implementing the Google Apple Exposure Notification (GAEN) system. It hosts two exposure notifications projects, COVID Shield and COVID Green, which are available for health authorities and their IT partners to use and customize.
COVID Shield was developed by Shopify as a volunteer effort to combat COVID-19. Canada has deployed it nationwide, with implementation by the Canadian Digital Service. COVID Green was developed by NearForm as part of Ireland’s response to the pandemic. The app has also been deployed in several US states.
Exposure notification is when phones that are in proximity to each other log the fact that they are nearby. If later an individual who owns one of those phones tests positive for COVID-19 they upload their key, and that notifies the other people that they may have been exposed.
“Using Bluetooth technology allowed us to have notifications go out in a privacy preserving way, where the data is held on the user’s phone, there’s no centralized database, there’s no location data involved,” Wanger says.
“It’s remarkable the speed at which exposure notifications got together. That’s a testament to the power of open source. We had such a big community, all working on this one problem together.” Hundreds of millions of people across the world can now access exposure notification on their phones.
“We’ve hosted events that have got the community together and developed relationships with public health authorities around the world to help them figure out how to navigate this space,” Wanger adds. “For many of them, it’s their first time participating in an open source project. So we’ve provided things like security audits, best practices in terms of rollout, all of these different pieces.
“With open source software, it’s a lot more than just downloading the code and pressing go. We’ve been able to provide support for, at this point, around 26-27 countries. That’s been a total delight for LFPH.”
How One Public Health Authority is Working with LFPH
New Zealand’s Ministry of Health is one of the public health authorities working with LFPH, deploying COVID Green and contributing back to the project. The ministry, like many public health authorities, is essentially a “policy shop”, with no previous experience of developing or delivering direct-to-consumer digital apps and services.
“A key driver for us adopting the COVID Green platform was to accelerate the plans that we already had,” says Patrick Hindmarsh, Principal Architect, Data & Digital, with the NZ Ministry of Health.
“We’ve got a thriving tech industry in New Zealand but ultimately there’s a lot of engineers around the world who are doing great stuff, and we don’t need to spend our energy and effort reinventing wheels that have already been invented.
“Open source is quite new for the Ministry. But now we’ve got more projects coming up in the future and we’re considering how open source plays a role within all of the work that we do.”
Behlendorf notes that although open source technology is very common many people and organizations, such as public health authorities, might not realize its prevalence.
“90% of the average software stack that’s sitting in everything from android phones to cars, to big servers and systems is open source,” Behlendorf says. “LFPH found that the degree to which public health authorities even have technology teams versus outsourcing entirely to consultants or trying to buy software products off the shelf varies quite a bit.
“LFPH wants to meet the broad set of (public health authority) needs and that means being able to engage public health authorities directly as technologists or mediated through technology partners that governments are used to working with.”
Hindmarsh explains that, as the NZ Health Ministry began examining how to best launch an exposure notification program, they saw the open source approach at LFPH and contacted the initiative.
“I got in touch with Jenny (Wanger) and she invited us to join the LFPH Implementers Forum on slack, which was an amazing wealth of information,” Hindmarsh says. “We got connected with the folks in Ireland and the team at NearForm who did the development on COVID Green, and a bunch of others who were working on it.
“That allowed us to start building out proof of concept work to integrate with our internal technology and then pilot our assumptions and test our assumptions on how it worked.”
The NZ Health Ministry has contributed back to LFPH, which is a key part of the success of open source initiatives. “We’ve identified a couple of issues in our production deployment (of COVID Green). We’ve been able to identify a few things that we can enhance and we’ve contributed those back upstream so it’s been a really good experience for us,” Hindmarsh says.
The LFPH community has been excited to get the NZ Health Ministry’s contributions back to the project “because they can now go and deploy those, so it’s really this global collaboration that we’re seeing,” Wanger says.
Another benefit to using LFPH open source software has been substantial cost savings. “One of the things we’re hearing from public health authorities around the world is that using this open source software is costing them a fair bit less than it would to do some sort of customized private implementation, because there’s so much that’s already there and already built,” Wanger says.
COVID-19 Verifiable Credentials and Vaccination Records
LFPH’s second area of focus is verifiable credentials and vaccination records, with the COVID-19 Credentials Initiative (CCI) joining LFPH in December 2020 to lead development in this area. LFPH is also looking at COVID-19 test credentials, including being able to show which tests a person has taken and their results.
LFPH founding member, Dr Alexander Ng, Vice President of Tencent Public Healthcare, believes the LFPH open source movement on vaccine credentials could be tremendously helpful to many countries.
“Given the open source movement, you start with a codebase but as each country develops use cases and develops their new functionalities, they will say this is 80% of what I wanted, I don’t need to reinvent the wheel,” Dr Ng says.
“This is a really powerful force, that we can come together to get this going and to me, as a former clinician where I’m used to working in a very siloed system with zero interoperability, just imagining a significant part of the world where there’s one simple tool that is interoperable, to allow exchange of data and in a privacy preserving manner, that is hopefully the start of something beautiful for public health.”
Currently, most countries issue citizens with paper confirmation of COVID-19 vaccination. Many expect that in the future individuals will need to show proof of vaccination before being able to travel to some countries, enter certain places or participate in certain events.
“So you get there, you present this paper card and you present some form of ID with it,” Wanger says. “But what if you lose that card, what if your toddler spills something all over it, what if you were at the doctor’s office and said can I get a second card and you give that one to a friend who then writes their name in on it.
“There’s all sorts of things that can happen that make these paper cards not very reliable. Also this card has additional details that aren’t relevant, and you have to also give over ID. So it’s not particularly good for preserving privacy, it’s not particularly good for proving vaccination.
“What we’re looking at with verifiable credentials is based on the idea that you control your data, that the data is on your device and it’s not centralized.
“You go to the clinic, get your shot, the provider has a mechanism by which they can give you a credential onto your phone. You can present this credential wherever you go. It’s essentially a QR code that’s going to get scanned so it’s not going to have additional information and you have a lot more control.
“You’ve got a digital ID that is very hard to forge, that is attached to you, that you can’t lose. The verifiable credentials are a great way to show vaccination status and also COVID test results.”
Behlendorf says LFPH is interested in collaborating with technologists working in this area. “We’d like to have the same impact here as we did with exposure notification, in terms of coming up with reusable, rebrandable libraries for holding credentials, issuing credentials, verifying credentials,” he says. “Also weaving that into public health authority systems, such as immunization registries and the devices that might be running at the clinics where vaccinations are being distributed.”
LFPH sees potential for digitally verifiable credentials in other areas of healthcare, to put more control over the way that health data is handled into the hands of individuals.
COVID-19 Credentials in Asia Pacific
Dr Ng notes that the Asia Pacific region has largely taken a different approach from much of the Americas, Europe or Africa in combating COVID-19, with technology, policy and practical implications.
“Asia Pacific countries in general have taken the quarantine approach to controlling the pandemic,” Dr Ng says. “In order to fully open up borders some form of credential will be required. And I think interoperability across countries in this region is even more important than in others.
“Coming together with an interoperable, mutually recognized vaccine credential is important, but we also need to understand the limitations of this,” he adds. “It can only verify whether you have been vaccinated correctly with a certain vaccine. What it won’t have is what if a vaccine that has been approved in one country is not approved by another country, then what do you do, that’s a policy issue.
“Most of the vaccines now only have data to show that it protects us from severe disease, not infection and not transmission. Now, when we take a lockdown approach, we are basically saying, not even one drop of virus can come into the country.
“But when you have been vaccinated you can still have that low theoretical chance of transmission, then what do you do, how do you actually change the policy?
“So while it is important for the technical side, it’s also important for us to come to a common understanding and be able to work on this together. It’s important to start engaging on policy development and with the regulators on what it means.
“We need to understand the limitations of the digital tool right at the beginning, rather than thinking that this will be the solution that everybody’s looking for, because I don’t think that is helpful towards the true adoption of what is such a valuable tool in this region.”
What’s Next for LFPH?
Dr Ng sees an exciting future post-pandemic for open source technology to support public health authorities and global public health. He says this pandemic has offered the opportunity to fast track the development of and public education in digitally enabled healthcare. “That will actually make my job as a physician or as a public health specialist much easier,” he says.
Behlendorf identifies data analytics and public health analytics as an area where open source technology can contribute. “There’s a lot of challenges managing the data still at this late stage of the pandemic,” he says. “What testing looks like, what availability of vaccines looks like, what hospitalization rates and available ICU beds looks like, those sorts of things.
Behlendorf notes that there could be work for open source technology development to continue on COVID-19. “Unless we were to succeed in eradication, unless (COVID-19) were to go the way of polio and smallpox, we will have to live with mutations, we will have to live with impacts on health from people who do catch it,” he says. “There’s going to be a need to continue to try to tamp this down and keep the next pandemic from happening. And I think that’s an important role for us to play with our software.
“In contact tracing there’s more that might be possible to try to harmonize some of how contact tracing, behind the scenes, behind the app, works.
“And a lot of the frame for this is recognizing that public health has been under-resourced for a long time and that does not end when this pandemic ends.”
Wanger adds that public health infrastructure could be a future area of focus for LFPH. “There are a lot of different health applications out there and they don’t talk to each other,” she says. “We need to enable them to interoperate and communicate.”
How to Get Involved
All are welcome to join the LFPH open source community. Ways to get involved include joining the LFPH slack, at slack.lfph.io, or signing up for LFPH newsletters on its website, www.lfph.io. LFPH has private channels for health authorities to have confidential discussions.
You can message Jenny Wanger jwanger@linuxfoundation.com or, in Asia Pacific, contact LFPH regional VP Julian Gordon at jgordon@apac.linux.com.