Apple and Google Answer Questions About Their Covid Contact Tracing Plan

They are at least admitting it is not entirely fool-or-privacy-proof. And no one is required to use it. JL

Zack Whittaker and Darrell Etherington report in Tech Crunch:

The opt-in system uses Bluetooth to transmit a randomized and anonymous identifier to nearby devices. A user can then choose to upload their anonymized data, which is then broadcast to other devices. If a match is found based on time spent and distance between nearby devices, a user will be told that they may have been exposed to a person — whose identity is not shared. You have to trust that Apple and Google built a system that can withstand abuses. But no system is foolproof or immune to abuse.

 Apple  and Google announced a partnership that will soon let users opt-in to a decentralized tracing tool, designed to help determine if a person has come into contact with someone who tested positive for COVID-19.

The opt-in system uses Bluetooth to transmit a randomized and anonymous identifier to nearby devices. A user can then choose to upload their anonymized data, which is then broadcast to other devices. If a match is found based on time spent and distance between nearby devices, a user will be told that they may have been exposed to a person — whose identity is not shared — with the virus.

It’s a similar system to one conceived by MIT researchers, which also uses Bluetooth to anonymously inform others of potential infection. The system, like Apple and Google’s new effort, also sidesteps the use of location data.

Contact tracing has proven somewhat effective in some parts of the world, helping authorities understand hotspots of infections. But privacy groups and security experts are concerned that privacy would take a backseat over people’s individual rights in an effort to contain the spread of the virus. Apple and Google  said the service is privacy-focused. The system doesn’t use location data, the user’s randomized identifiers change every 15 minutes to prevent tracking, and any data collected is processed on the device and doesn’t leave a user’s phone unless they choose to share it.

But security and privacy experts were quick to point out the possible flaws in the system. Former FTC chief technologist Ashkan Soltani warned of false positives but also false negatives. Moxie Marlinspike, founder of the Signal encrypted messaging app, also expressed concerns that the system could be abused.

TechCrunch joined a media call with Apple and Google representatives, allowing reporters to ask questions about their coronavirus tracing efforts.

Here’s what was discussed on the call.

Which versions of iOS and Android will get the feature update?

Apple said it’ll roll out the update to the broadest number of iOS devices as possible. More than three-quarters of iPhones and iPads are on the latest version of iOS 13 and will receive the update. Google said it will update Google Play Services, a core part of Android, with the feature so that the contact tracing system can run on the entire fleet of Android devices (running Android 6.0 or newer) and not just the most recently updated devices.

When will this tracing system be available?

Apple and Google said they will roll out software updates in mid-May to begin support for contact tracing. Public health authorities will incorporate the contact tracing API into their apps, which can then be downloaded from the Apple and Google app stores. The companies said they will bake the contact tracing feature into iOS and Android in the coming months, so that users won’t even have to install an app. The companies said this would help get more people using the system.

Even when the contact tracing feature is baked into the OS at the system level, any detection of a positive match would still prompt the user to download the relevant public health app for their region to receive more information about what the COVID-19 contact tracing process is, and next steps.

Can anyone else use the API?

The companies said only public health authorities will be allowed access to the contact tracing API.

This limited API use will be restricted in the same spirit that you restrict individual healthcare to licensed medical professionals like physicians. In the same way, use of the API will be restricted only to authorized public health organizations as identified by whatever government is responsible for designating such entities for a given country or region. There could be conflict about what constitutes a legitimate public health agency in some cases, and even disagreements between national and state authorities, conceivably, so this sounds like it could be a place where friction might occur, with Apple and Google on tricky footing as platform operators.

Will any of the data be stored in a central database?

Apple says the data is processed on a user’s device and that data is “relayed” through servers run by the health organizations across the world, and will not be centralized. The tech giants said that because the data is decentralized, it’s far more difficult for governments to conduct surveillance.

Does that mean Apple, Google or the public health authorities can access the data?

Apple and Google admitted that no system is completely secure — it’s a widely known concept in cybersecurity that nothing is “unhackable.” Servers can get breached and data can get lost. But in decentralizing the data, it makes it far more difficult for anyone with malicious intentions to access the data, they said.

How are you preventing people from producing false reports?

The companies said they’re working with different public health organizations to confirm diagnoses, like public health authorities, to do the validation. Apple and Google said they want users to trust the system, and that includes users knowing that the system is reliable.

How is a confirmed COVID-19 case identified?

Apple and Google point out that while a positive test result is likely the best means of identifying a case, it isn’t necessarily the only way. It’s true that a diagnosis by a medical professional doesn’t actually require a confirmed positive test result specifically identifying the presence of the virus — theoretically, a public health agency could set a lower bar, requiring just a diagnosis based on symptom presentation, for instance.

Both tech giants concede that for contact tracing to be effective, there needs to be a high degree of case identification within a population, but left the door open to the possibility that a high degree of case identification doesn’t necessarily translate one-to-one to widespread testing, should other means of identifying cases be deemed reliable enough by local health authorities in any given area.

Should you trust this system?

There’s no easy answer. It seems like Apple and Google have made a system that’s better than nothing, but it’s a system that requires considerable user trust. You have to trust that Apple and Google have built a system that can withstand abuses — either from themselves or governments. But no system is foolproof or immune to abuse. If you don’t trust the system, you do not have to use it.