Small infectious-disease outbreaks are hard to detect, especially when governments and society are unprepared and untrained. To reduce outbreaks of severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), governments can act early and swiftly when the outbreak is small (Fig. 1), or are forced to respond late and harshly when the virus has furtively made good use of crowds, handshakes and door knobs. There is hardly a middle way; the virus is novel (that is, humanity is susceptible to it) and highly infectious (infected people can transmit it before they become symptomatic), and hence its exponential spread can be rapid: in the absence of adequate public health measures, the average number of people that a carrier goes on to infect raises significantly above 1, with the actual effective reproduction number depending on demography and crowdedness. Letting the virus spread naturally would be inhumane, as its infection fatality rate — 0.5–1% as per the best estimates from early serology surveys — implies that millions would die1 before transmission slows down (rather than stopping) when herd immunity is reached; for a basic reproduction number between two and three, this would happen when 50–66% of the population has been infected.

Fig. 1: Selected countries with smaller COVID-19 outbreaks.
figure 1

Reported confirmed cases and deaths (14-day rolling numbers) for countries that acted earlier and tested more widely (Singapore and Taiwan, which have never reached ten deaths within any two-week period, are outside the graph’s range). For some of them, geographical insularity may have also helped slow the spread. Early large-scale serology studies suggest that the actual number of infections is 10–20 times the number of reported cases. After turning a corner, bringing cases and deaths down takes many more weeks that it took for cases and deaths to reach a peak. Infection fatality rates, which depend on demographics, cultural factors, the capacity and quality of healthcare systems, public health measures and mitigation measures, are estimated to be 0.5–1% — a multiple of that for seasonal flu in the United States (0.1%). Data updated 11 May 2020. Individual data points can be affected by reporting errors and delays, and by location-specific definitions (and changes to them) for confirmed cases and deaths. Data sources: European Center for Disease Control and Prevention13 (cases and deaths); Our World in Data6 (tests). Additional updated graphs are available14.

The only plausible way to achieve herd immunity is through mass vaccination. This will take longer that many expect because the time needed to carefully test a vaccine (which requires regions with ongoing outbreaks) and to produce billions of doses of it (a risky early investment) cannot be massively shortened. Unfortunately, finding effective vaccines for COVID-19 is not a given. As with naturally acquired immunity to other coronaviruses, vaccine-induced immunity may be fleeting (lasting only a few months), partial (reducing the severity of symptoms) and population-dependent (elderly populations in particular may not generate sufficient levels of neutralizing antibodies or of memory B cells and T cells). Yet even if yearly vaccine doses are needed and only reduce disease severity, such a vaccine will allow the world to turn a corner.

Further outbreaks are unfortunately inevitable, as the largest serosurveys indicate that, on average, approximately 95% of the population remains susceptible to the virus2. And if history is any guide3, uncontrolled second outbreaks can be deadlier. The best feasible path forward is, therefore, to effectively suppress recurrent outbreaks. What does such sustained suppression entail? Continued physical distancing outside the home, mass testing, isolation of cases, the tracing of contacts who may have been exposed and their quarantining for two weeks. These involve a range of societal changes, public health measures and government actions (https://preventepidemics.org). Testing for the virus’ RNA should be wide and frequent4 (with at least 2% of a country’s population being tested every day5), prioritizing the highly exposed (healthcare and frontline workers) and the vulnerable (the elderly and those with significant comorbidities). This is a tall order, yet achievable; in Iceland, 40% of the population has already been tested6. The scale of polymerase chain reaction testing has been limited by the availability of swabs and reagents (for the latter, sample-pooling strategies should mitigate the problem). In future, testing may be boosted by sufficiently sensitive and rapid tests for viral antigens (on 8 May 2020, a lateral-flow immunofluorescent sandwich assay became the first nasopharyngeal antigen test authorized by the United States Food and Drug Administration (FDA) for emergency use7), by sensitive tests that detect early antibodies (of the immunoglobulin M isotype) in blood and by CRISPR-based tests for viral RNA (on 6 May 2020, the FDA approved the first such swab test8). Still, even if testing could be massively deployed with send-and-swab kits, false negatives owing to inadequate sampling and to lower levels of viral load in the nasal and buccal cavities (in particular, in asymptomatics and in those who have already cleared the infection from the upper respiratory tract) makes a strategy largely based on testing insufficient. Antibody tests, in particular lateral-flow assays, have so far been insufficiently specific to be of use for individuals. For example, the outcome of tests with a typical false-positive rate of 5% in places where the prevalence of COVID-19 is less than 5% would be akin to a coin toss; a lower prevalence would make positive tests less likely to be so. Even tests with over 99% specificity, such as some laboratory immunoassays, will not make immunity passports useful until we know whether — and for how long — the antibodies detected are neutralizing. And even then, societal and ethical implications would have to be determined.

Because infected people can spread the virus when pre-symptomatic, and because testing cannot be sufficiently fast and accurate, it is imperative to trace potentially exposed contacts. The human effort of trained contact tracers involves highly laborious interviewing jobs that are difficult to scale. Yet they can be aided by apps that make good use of Bluetooth technology to trace at-risk contacts on the basis of time-bound sustained proximity. These apps would also help infected cases recall and log where they have been (and with whom).

Apps for proximity tracing and exposure notification should preserve privacy to earn user trust, so that they have any chance of being used by a large majority of the population. First, they should employ Bluetooth beaconing rather than location; second, the user’s daily random exposure key, which generates the frequently changing (say, every 5 minutes) broadcasted proximity identifiers should be kept on-device; third, the data should be decrypted only when a user tests positive and has given consent (which should be granular in time, to preserve the privacy of contacts at home, for example), at which point their exposure keys are uploaded into backend servers which act as storage and communication systems; and fourth, the matching of exposure keys should be done by each phone locally (via the daily downloading of the keys from people with confirmed infections). Moreover, the apps should run in the background and avoid draining phone batteries, the codes be open source and thus open to scrutiny, and all identifiers and keys stored only for as long as necessary (typically, 14 days). These considerations are advocated by the decentralized privacy-preserving proximity tracing (DP3T) system9, supported by an international consortium of technologists, legal experts, epidemiologists and engineers, and are met by the exposure-notification framework10 being jointly implemented by Apple and Google. Interview-based contact tracing aided by exposure notification technology needs to find around 60% of at-risk contacts (the estimated level of herd immunity) to be effective, so that they can self-quarantine and be tested before potentially infecting others. This will require interoperable systems and apps, and transparent communication to the public. Still, solid evidence that they can be effective is currently lacking and should be generated11. Also, false positives (such as neighbours on the other side of the bedroom wall) would need to be managed. And false negatives (such as a sneezing passer-by or the odd ‘superspreader’ at the back of the bus) are sufficient reasons to mandate the public use of masks, especially in places where many confirmed cases remain.

Beyond testing and proximity-tracing technology, healthcare apps that allow people to self-report symptoms and confirmed infections anonymously could aid public health systems to find blind spots of disease transmission. Future privacy-minded apps that share data from smartwatches (elevated resting heart rate and sleep duration helped detect influenza-like illness in real time12, and the DETECT study (https://detectstudy.org), which has now enrolled over 20,000 people, might eventually do the same for COVID-19) could also help to detect early spots of disease to then target them with increased testing efforts and public health measures. Lockdowns are buying the world time for that. Yet technology can only go so far; agile action requires epidemiological surveillance and preparedness. These should also be sustained.