Apple and Google Develop Covid-19 Contact Tracing Tool

Apple and Google have announced that they’re working together to create a Covid-19 contact tracing framework for mobile devices. In this piece, we’ll tell you what you need to know about this important new technology.

What is it?

The joint project is aimed at developing a Bluetooth-based contact tracing system that will alert iOS and Android users if they’ve come into contact with someone who has been diagnosed with Covid-19.

When will it be available?

The system is being deployed in two stages. In May, Apple and Google plan to release APIs (Application Programming Interfaces) that will provide the functionality needed to create cross-platform tracing apps. The apps themselves will be developed by various public health authorities, and will be made available in the relevant local app stores for both platforms. The two companies will then begin to integrate contact tracing functionality at the OS level, which will allow for greater participation by individuals and health authorities. 

Why is it needed?

Contact tracing is one of the most effective ways to slow the spread of a contagious disease. By identifying people with whom an infected person has had contact, and then following up with testing, treatment, and isolation, doctors can prevent those people from continuing to spread the disease. However, given the scale of the current pandemic, thorough contact tracing is going to be hard to carry out using traditional methods like in-person interviews. 

By leveraging the power of technology and the ubiquity of mobile devices, Apple and Google are hoping to automate the process (at least partially), giving public health authorities a new weapon in the fight against Covid-19.

How does it work?

Bluetooth is a short-range wireless communication protocol that uses radio to send and receive data. It is designed to enable quick connections between nearby devices, which is what makes it ideal for jobs like pairing your AirPods to your iPhone or sharing photos with your cubemate via AirDrop. 

All modern mobile devices come equipped with Bluetooth transmitters and receivers. In theory, every time you pass someone with a compatible smartphone in their pocket, it’s possible to establish a Bluetooth connection between your device and theirs, which is the basis of Apple and Google’s proposed contact tracing system. What follows is a somewhat simplified explanation of how it works (if you’d like full technical details, Apple has published draft versions of the Bluetooth, cryptography, and API specifications). 

If you opt in to the system, your mobile device will create a unique Tracing Key, which will stay on your device and will never be shared with anyone else. Using a one-way cryptographic algorithm, your device will then generate Daily Tracing Keys — a new one every 24 hours — which will stay on your device unless they are needed (more on this later). The fact that a one-way cryptographic algorithm is used means that even if someone had one of your Daily Tracing Keys, they still wouldn’t be able to use it to figure out your primary Tracing Key. Daily Tracing Keys, in turn, are used to cryptographically generate Rolling Proximity Identifiers — a new one of these every 15 minutes. Rolling Proximity Identifiers are anonymized identifiers which your device broadcasts via Bluetooth, and which can be detected by other nearby devices.

If you are in close physical proximity to someone with a Bluetooth-equipped device, and you’re both using the contact tracing system, here’s what happens. Your device broadcasts its current Rolling Proximity Identifier, which is detected and logged by the other person’s device. Your own device, in turn, detects and logs the other person’s current Rolling Proximity Identifier. Once again, this is anonymous: Because these identifiers are generated with a one-way cryptographic algorithm, there is no way for you to figure out the Daily Tracing Key that was used to generate any particular Rolling Proximity Identifier captured by your device. Similarly, although the other person now has one of your Rolling Proximity Identifiers stored on their device, they can’t use it to compute your Daily Tracing Key — or tie it to you personally. It’s also important to note that location data is not recorded during any part of this process: Devices simply log Rolling Proximity Identifiers, timestamp them, and retain them for 14 days.

So how do you know if you’ve been in contact with someone who has Covid-19? If someone goes to the hospital and tests positive for the virus, they can consent to having their Daily Tracing Keys anonymously uploaded to a centralized database. At this point, those keys become “Diagnosis Keys”. Your device will be checking in with the database periodically. It will use each Diagnosis Key to compute a list of possible Rolling Proximity Identifiers which could have been generated with the key, and then check that list against its own log of the Rolling Proximity Identifiers which were actually encountered. If it finds a match, your device will let you know that you may have been exposed to Covid-19, which will allow you to take the necessary precautions. What exactly that means will vary by jurisdiction, but for many people, it will likely entail a period of self-quarantine, self-monitoring, and testing. No matter what your device discovers, it will not share the information with the administrators of the central database: Any evidence of a possible exposure will stay on your device.

Will it work?

In order to be effective, experts estimate that a mobile-based contact tracing system would need to be used by around 60% of the population. That’s a pretty significant number of people, and so only time will tell whether or not enough users download the tracing apps for the system as a whole to be worthwhile. In addition, the success of Apple and Google’s system will depend upon widespread, accessible testing, the lack of which is a major challenge facing healthcare workers at the moment. Hopefully, fast, accurate testing will become more readily available in the coming weeks. How many people will actually use a tracing app remains an open question, but the involvement of privacy-focused Apple may drive adoption, especially among more skeptical users.

Is it secure?

The question on everyone’s mind is whether or not it’s smart — from a privacy perspective — to install tracing software on our mobile devices. In the end, people will have to decide whether or not they’re comfortable with the idea, but there are some reasons to think that this system is being implemented responsibly.

For one thing, Apple and Google are being transparent about the development process, publishing their draft technical documentation even though their work is still ongoing. The involvement of Apple — a company that has gone head to head with the FBI over user privacy issues before — is also encouraging. In addition, the system is being implemented with privacy in mind, at least as far as anyone can tell based on the available technical information. Lastly, people would have to opt in to using a tracing app, and those testing positive for the virus would need to consent to sharing their Daily Tracing Keys publicly, which means that the system, at least as envisaged by Apple and Google, puts the most important privacy decisions squarely in the hands of the user.

As with so many digital privacy issues, individuals will have to weigh the potential risk to their privacy against the possible benefits of data sharing, and will need to think carefully about whether or not they trust the people behind the system. While everyone has to make these choices on their own, we hope that the information provided in this article will allow you to make a more informed decision when the time comes.