Much of the world is in lockdown due to the spread of COVID-19, commonly known as coronavirus, which has prompted perennial tech rivals Apple and Google to join forces.
Several weeks back, the two tech titans announced “a joint effort to enable the use of Bluetooth technology to help governments and health agencies reduce the spread of the virus”. Now, with the recent release of iOS 13.5, this technology is now publicly available.
But how does it work, and what are the privacy implications?
What is meant by ‘contact tracing technology’?
First, it’s best to be clear that ‘contact tracing’ and ‘exposure notification’ are essentially the same thing. The first sounds a little ominous, so you’ll see the latter used more often – but we’ll use the two interchangeably in this article. Either way, it’s a way to anonymously keep track of those you come into close contact with, so you can be notified if you’re exposed to a virus carrier.
COVID-19 is chiefly transmitted by close contact with infected people. Scientists and health experts have found that one of the most effective ways to monitor the spread of the disease is by tracking the history of direct person-to-person contact for a newly infected individual.
This process is known as ‘contact tracing’, and it enables health authorities to inform people that they may also be infected and should take steps to limit further spreading. Apple and Google’s partnership, then, will yield software that enables a more efficient form of contact tracing to take place across iOS and Android.
What form will this technology take?
Apple and Google aren’t making a standalone app here. Rather, they are building a platform for public health services to bolster their contact tracing efforts through iOS and Android phones. This takes the form of new APIs for health organizations to use in their apps, as well as core changes to iOS and Android.
With these measures in place, any two iOS or Android phones will be capable of communicating with one another over Bluetooth, and in turn notifying their owners if they have come into close contact with a person who is, was, or went on to be infected with COVID-19. Anyone diagnosed with COVID-19 will have the option of uploading their status to a positive diagnosis list via their local health authority app.
Crucially, that means if you pass someone in the street without visible symptoms, who is later diagnosed with the virus, you will be informed. And vice versa.
Why is this necessary?
The traditional method of contact tracing is both laborious and time-consuming, requiring multiple public health workers to track down and interview multiple individuals – all of whom may have an unreliable and incomplete recollection of their contact history. Apple and Google’s initiative will alleviate these issues and assist regular contact tracing methods rather than outright replacing them.
The ultimate goal of the exposure notification system is to keep people informed so they can make smart decisions. If the system says you’ve been exposed to the virus, that means you can make the choice to self-isolate for two weeks to avoid passing it on.
How and when will Apple and Google’s solution arrive?
It will roll out in two stages. First, both Apple and Google will release APIs that enable iOS and Android to communicate via Bluetooth through any contact tracing app provided by public health authorities. You’ll need a software update to get these features – grab iOS 13.5 now if you haven’t already – and you’ll need to download the designated exposure notification app for your region. Some governments are building their own apps for this purpose, but without support from Apple and Google’s API these apps won’t be nearly as effective. That’s because apps in iOS generally aren’t allowed to trigger Bluetooth activity in the background.
Sometime in the coming months, Apple and Google will build this communication ability directly into iOS and Android. This will mean that you won’t need to download a third-party app to be notified that you’ve come into contact with an infected person. But for now, investigate how your region is tackling the problem and search out an official exposure notification app from your health authority if you want to take part.
What does this mean for your privacy?
Apple’s involvement means privacy is at the core of the experience. Nothing is on by default – it’s an explicit choice for you to turn on this technology in the first place, and you can disable it at any time.
When active, the Bluetooth beacon that your phone sends out will be random and constantly changing, and it won’t be tied to your identity or location. Any time two phones exchange these beacon keys, they’ll only be recorded locally on each device.
Consent will be required for any positive COVID-19 diagnosis to be added to a central database, and the diagnosis will have to come from a medical professional to reduce the risk of false positives. Neither your identity nor your location will be recorded or shared with any other people. You will not be tracked at any stage of the process, and Apple and Google will not have access to any of your information.
When it comes to those third-party applications, Apple and Google state that “only public health authorities will have access to this technology and their apps must meet specific criteria around privacy, security, and data control.”