#.Overview
Cerco Solidario was a community-driven contact tracing application developed in response to the COVID-19 pandemic and offered to the Panamanian government. The solution leveraged Bluetooth Low Energy (BLE) technology to create a privacy-focused, lightweight approach to identifying potential exposure to COVID-19, aiming to help contain the spread of the virus while preserving user privacy and minimizing battery consumption.
#.The Challenge
During the height of the COVID-19 pandemic, governments worldwide sought effective ways to track and contain the spread of the virus. Traditional contact tracing methods were:
- Labor-intensive, requiring large teams of human contact tracers
- Often delayed, with exposure notifications coming days after contact
- Limited in scale and difficult to implement nationwide
- Privacy-invasive when implemented through GPS tracking or similar methods
Panama, like many countries, needed a solution that could:
- Effectively identify potential exposure to COVID-19
- Scale to the entire population without massive infrastructure
- Respect user privacy and data protection principles
- Work on a wide range of devices, including older smartphones
- Minimize battery consumption and data usage
- Function without requiring constant internet connectivity
#.Solution Design Process
#.Initial Concept and Research
The development began with extensive research into various contact tracing methodologies being implemented globally. After analyzing the approaches from countries like Singapore (TraceTogether), Germany (T-App), and the UK (NHS COVID-19), we identified that a decentralized, privacy-preserving model using Bluetooth Low Energy would best address Panama’s specific needs.
#.Technical Approach
We designed Cerco Solidario with the following principles:
- Privacy by Design: No collection of personally identifiable information
- Decentralized Architecture: Exposure matching happens on users’ devices, not central servers
- Minimal Data Collection: Only anonymous identifiers are shared
- Open Standards: Following emerging contact tracing protocols
- Energy Efficiency: Optimized for minimal battery impact
#.Development Methodology
The project followed an agile development approach with compressed sprints to respond to the urgency of the pandemic. Close collaboration with health authorities ensured the solution would integrate with existing pandemic response systems.
#.Technology Stack
#.Mobile Application
- Frontend: React Native for cross-platform (iOS/Android) compatibility
- Bluetooth: Custom BLE implementation for proximity detection
- Local Storage: SQLite for secure storage of anonymous contact data
- Encryption: AES-256 for securing transmitted identifiers
#.Backend Infrastructure
- Server: Ruby on Rails (Ruby), Node.js (JavaScript)
- Database: PostgreSQL for storing anonymous identifiers
- Authentication: JWT-based secure access for health authorities
- Deployment: Docker containers on cloud infrastructure for production and development environments
#.Security Measures
- Rolling proximity identifiers that change every 15-20 minutes
- No geolocation data collection
- All communication over HTTPS
- Server-side encryption of uploaded identifiers
#.Implementation Details
#.BLE Proximity Detection
The core functionality of Cerco Solidario relied on the Bluetooth Low Energy protocol, which offered several advantages:
- Low power consumption: Critical for an app that needs to run continuously
- Reasonable proximity detection: Effective within 10-15 meters, which aligned with guidelines for potential viral transmission
- Widespread availability: Supported on most smartphones manufactured after 2012
The application used a custom implementation that:
- Generated temporary encrypted identifiers (changing every 15-20 minutes)
- Broadcasted these identifiers via BLE
- Simultaneously scanned for and stored identifiers from nearby devices
- Maintained a local database of encounters, including approximate proximity and duration
#.Privacy-Preserving Architecture
When a user tested positive for COVID-19, the process worked as follows:
- Health authority provided a one-time verification code
- User voluntarily entered the code in the app
- App uploaded only the temporary identifiers broadcast during the infectious period
- Other devices periodically downloaded the list of “positive” identifiers
- Local matching on each device determined potential exposure
- If a match was found, user received a notification with guidance
This approach ensured that:
- No location data was ever collected
- No personal information was transmitted
- Even the central server could not identify who was exposed to whom
#.User Experience Design
The application was designed with simplicity in mind:
- Minimal onboarding process with clear permission requests
- Background operation requiring no user interaction
- Clear, actionable notifications in case of exposure
- Simple reporting mechanism for COVID-positive users (privacy-preserving)
- Multi-language support (Spanish, English)
#.Key Features
- Passive Operation: Once installed, the app worked automatically in the background
- Exposure Notifications: Immediate alerts when potential exposure was detected
- Health Authority Integration: Secure verification system for positive cases
- Privacy Controls: Users maintained complete control over their data
- Low Resource Requirements: Minimal impact on battery life and data usage
- Offline Functionality: Core functions worked without constant internet connection
- Accessibility: Designed to work on older devices and for users with limited technical knowledge
#.Challenges and Solutions
#.Technical Challenges
Challenge: Reliable BLE detection across different device manufacturers Solution: Implemented adaptive signal strength interpretation and cross-platform testing
Challenge: Battery drain on older devices Solution: Optimized scanning intervals and transmission power
Challenge: False positives from signals through walls Solution: Combined signal strength with duration metrics and implemented signal attenuation models
#.Adoption Challenges
Challenge: Public hesitancy around privacy concerns Solution: Open-source code, transparent documentation, and educational campaigns
Challenge: Digital divide limiting access Solution: Minimized technical requirements and provided alternative reporting channels
#.Results and Impact
While the full nationwide implementation was ultimately a policy decision, the Cerco Solidario project demonstrated several important outcomes:
- Successful technical proof of concept validated through controlled testing
- Privacy-preserving architecture that met both health objectives and privacy requirements
- Low-cost, scalable solution that could be deployed rapidly
The project also contributed to the global body of knowledge around privacy-preserving contact tracing during public health emergencies.
Additionaly, many newspapers and media outlets covered the project, including:
#.Conclusion
Cerco Solidario represented an innovative application of simple technology to address a complex public health challenge. In fact, this was the first time that a contact tracing application was implemented in Latin America.
By leveraging Bluetooth Low Energy in a privacy-preserving architecture, the solution offered an approach to contact tracing that balanced effectiveness with fundamental privacy principles.
The project highlighted how thoughtful application of existing technologies can create solutions that respect both urgent public health needs and individual privacy rights.
What set this approach apart from many others was its commitment to minimalism—using the simplest effective technology rather than the most advanced, focusing on wide accessibility rather than cutting-edge features, and emphasizing privacy by design rather than as an afterthought.
#.Lessons Learned
- The importance of privacy by design
- The importance of using the simplest effective technology
- The importance of focusing on wide accessibility rather than cutting-edge features
- The importance of emphasizing privacy by design rather than as an afterthought