Coronavirus Modeling from a Cyber Security Engineer

The Elephant in the World

Over the course of the last 30 days, much of the world has changed due to the largest Pandemic the world has seen in over 100 years. There is an incredible amount of uncertainty, turmoil and strife. All of us should be sitting at home, attempting to ride out this storm as best we can. I recommend everyone stay inside as much as possible and go out only when absolutely mandatory and for as short a time frame as possible. Follow the guidelines that are being sent out. They aren't done for any nefarious reason; it's designed to keep you and your family out of a hospital that may or may not have the means to save you depending on their case load. The more people that ignore this, the longer stay at home continues.

This will likely be the only article I write on this site that is not primarily Cyber Security related but I feel an obligation to do so. This is a once in a lifetime crisis and may very well be the single largest medical and economic disaster since the middle ages. Wayne Dyer used to say "Don't die with your music still inside you.". I try to do that with providing cyber security education but in this case, I want to share my opinion on where we go from here.

This is my take on the situation at hand using the data that we have available on the Pandemic as a whole. For the record, I am not a doctor, a medical professional, attorney or financial advisor. I can only offer my opinion coming from the perspective of a Cyber Security Engineer using what we do daily in terms of risk mitigation, risk assessment and threat modeling, I will try and paint a picture as to what the statistics are saying we can expect down the road. This is by no means gospel and the further out into the future we look, the less likely the data holds relevance but what I am about to share is statistically sound, particularly in the next 7-14 days.

Before I begin, I want to express my condolences and heartfelt sympathies for anyone who has lost a friend or family member to this pandemic and our thoughts and prayers go to anyone who is still fighting for their life as a result of this virus.

The Current Virus Metrics

One of the jobs we have in Cyber Security is that of a Penetration Tester. This is a professional who's job is to play the role of a malicious attacker who's is attempting to hack into a network and then provide feedback to the company in an effort to prevent an actual criminal from doing the same. The first step of that process involves performing reconnaissance on the network you wish to infiltrate to better understand the target. That is what we will do with this situation by taking a look at the pandemic in terms of historic values.

The site that I am using for Corona virus stats is https://www.worldometers.info/coronavirus/

This site is updated daily and has been exceptionally accurate with virtually country in the world with sources included. We will use this to evaluate the situation in the US.

The first metric I want to share is the number of cases we see per day:

There are a couple of things to note here. We are steadily seeing more and more cases per day as time goes on which can be attributed to two factors. First, we are seeing more and more people getting tested, which by nature, would net more people testing positive for the virus. The second answer is rather simple; the virus is spreading in other populated areas beyond just the New York/New Jersey area. As that continues, we will see this number increase daily.

This is not particularly good news as there will be a demand for PPE, Ventilators and medical personnel in multiple major cities in the US at cascading intervals foreseeable future. The degree upon which that demand is needed will depend on how bad things are now versus how well the people adhere to the stay at home mandates, social distancing adherence and how well people are performing hand washing and face guarding tasks.

The next stat I want to share is the percentage of increase in cases per day on average over the last 7, 14 and 21 days:

What this is showing is that over the last 7 days, we increase the new patient count by about 7.6% each day. The weeks prior added significantly higher percentages relative to the previous day. This is showing non exponential but steady increases in infection rate. This is showing that many cities across the US are indeed taking the social distancing mantra seriously. Overall, this is encouraging news. It's still huge numbers of people being diagnosed every day but this is far better than seeing this number staying around 16-20% for each category which would indicate massive volumes of people ignoring the warnings and even larger numbers overall. These numbers are also boosted by the volumes of testing we are doing:

As of this writing of this article, the US has tested almost 1.7 million people which is nearly double the next closest country in Germany. The more people we test, the more cases we will uncover and the faster we can triage the situation as a whole. This will improve week by week as more and more areas have access to more testing. The more people we test and know have the virus, the faster we recover.

Another statistic I want to provide is the geographic distribution of Corona Virus in the US.

As you can see, over half of all corona virus patients in the United States are located in New York, New Jersey and Michigan and nearly three quarters of all patients are located in 8 states with large metropolitan cities accounting for the vast majority of those cases. This can mean a couple of potential things. The first major revelation from this data is obvious. It means the situation in New York and New Jersey should be the primary location of triage and support at this venue. That area is in serious peril. The case load increases daily there so we still have yet to see the apex and that in and of itself is scary. Second, the fact that Michigan is third and Louisiana is fifth indicates that New Orleans and Detroit are likely the next two major metro areas to get hit hard. Louisiana in particular is an outlier because it ranks 25th in US population yet still ranks above places like Texas and Florida. Other major metro areas across the country have relatively moderate case loads based on their population and places like Philadelphia, Boston and LA are likely on the countries radar for further growth. Something good to extrapolate from this data is that it does mean that a large group of major US cities are doing reasonably well with the social distancing and stay at home orders and that is an encouraging sign.

The final statistic I want to unfortunately mention is the death rate that Covid-19 is producing.

This chart shows the US death rate for Covid-19 each day for the last 21 days. As you can sadly see, this is increasing despite the increase in case volume due to testing, which would theoretically reduce the death rate, assuming most people recover. This increase is likely a result of the following factors. The biggest ones being in New York where the city's healthcare infrastructure is at it's breaking point. There will be shortages of required medical equipment including PPE and ventilators. There will be burnout. You cannot have doctors and nurses working 140+ hours per week with no weekend breaks and have them doing that for what could be months concurrently without a drop in their well being. There will be front line health care workers who get seriously ill with the virus, which will lead to a shortage of medical professionals. And at least presently, we see increases in New York where higher numbers of people are testing positive every day keeping this cycle going. There is no denying that the death rate will increase as these issues persist in the area that is by far the hotbed of the Pandemic.

This still does not account for what happens in places like Detroit, New Orleans, Philadelphia and Boston which are also not at the apex of the crisis. Assuming the same problems to a lesser scale, we likely continue to see an increase before it drops.

And finally, there is an inherent lag time based on case duration as to the case rate increase versus the outcome of that case. An increase of new cases now does not necessarily impact the cases that have been ongoing for 2-3 weeks. As such, these stats don't always line up.

So what does all of this mean?

To review:

** We are seeing a steady increase in daily cases, not exponential, but steady increases of daily cases of 7.6% each day. This percentage is dropping each week, which does show some results from mitigation measures such as social distancing, hand washing and stay at home orders but the numbers of actual patients are increasing. In other words, we have not hit the apex of the pandemic but our mitigation strategies have helped.

** The bulk of the cases are in 8 states with large metro cities that host the bulk of the cases. New Orleans and Detroit are definitely next in line with Philadelphia, Boston and LA on the radar. Other major cities will follow but the stay at home orders and social distancing seem to be preventing this from spiraling out of control in every major US metro concurrently.

** Nearly 1.7 Million Coronavirus tests have been given in the US with the vast majority of those in high population zones of New York, New Jersey, California and Florida. More testing will provide a steady flow of new cases for the immediate future.

** The mortality rate is increasing and likely will continue to creep up as the systems in New York, Detroit and New Orleans are pushed.

The Model for the Future

In Cyber Security, we make risk assessments and provide feedback to leadership or receive that feedback from our teams and make decisions based off of the likelihood of that risk versus the cost. This is what I will attempt to do here.

Based on all of this information, this is my opinion as to what we can expect in the next several weeks and when we can potentially expect to start integrating back into daily life.

A Model for the case load based off of the math provided above:

This predicts over 1.5 Million Cases in the US by the end of May. With a 3% mortality rate, which I believe is probably best case, that is over 45,000 people who will lose their lives. A tremendous volume but a number that could be worse if the mortality rate is closer to 4. Then you are looking at over 60,000 people. That mortality rate plays a massive role in mitigating deaths. The more support to NY/NJ in particular, the better. The bulk of the case load will likely come from there.

1. New York and New Jersey hit their Apex between 4/12 and 4/19 with 4/15 being the sweet spot. The numbers show a decrease the increase of daily patients into the system. Once we hit a point where fewer people are testing positive for the virus than the day before in New York, we will see things drop down daily beyond that.

2. New Orleans and Detroit will hit Apex approximately a week after New York does. New Orleans in particular is concerning but both places will have infrastructure issues albeit not as bad as what we are seeing in New York City.

3. If we hit Apex in New York by around 4/15 as the math is telling us, it means a gradual curve flattening over the course of the next 6-8 weeks, assuming no other major US city explodes the way New York has. Other major US cities will hit apexes as well but fortunately the current numbers are showing nothing to the degree of cases we are seeing in New York. At present, it predicts a controlled and steady increase, like what we are seeing in Philadelphia. This will cascade over all major US metros between now and mid May.

4. The Mortality rate worldwide for Covid-19 at the time of this article is 5.4% which is largely inflated by Italy, Iran and Spain. The current US mortality rate is 2.7% but as shown earlier is increasing. Expect this to be between 3.2 and 3.7% by the end of May.

5. Expect a gradual removal of Stay at home orders throughout May. It won't be in all parts of the country at once but it will be in places where the case load is at managed levels so if an increase does occur, the healthcare system can handle it. Expect the places hardest hit now to be the first ones to be integrated.

6. Anticipate continued social distancing indefinitely. This includes even after stay at home orders go. Expect things like spaced out restaurant seating and stadium seating capacities cut in half at least for this year once things do get back to some degree of normality. Life will not be quite the same after this hits. Until we have a vaccine, Covid 19 can come back in the fall. Precautions will extend throughout the rest of the year as no one wants to relive this. Ever.

7. My best guess for the country as a whole to hit a point of reasonable normality is Early to mid June. This will allow a point where if someone does get Covid-19, and please understand that people will, the healthcare system can adequately handle the case if that person requires intensive care. The numbers right now are not all tallied on a state by state basis but I can say the Pennsylvania numbers reported today show approximately 10% of those who get ill from Covid19 require ICU care and about 2% of all patients require a ventilator. Once we get to a point where the majority of our system can handle a load such as this in addition to its normal input, the economy will reopen. Then the country can begin the next task at hand; recovering from the greatest economic disaster of our lifetimes.

If you have made it this far, thank you for reading. Any questions, concerns or feedback is always welcome. Please keep in mind that these are best estimates based on math. It is not infallible. It is just the best guess I can provide using the data we have.

Stay safe. Stay at home. Things will improve. God speed.