Politicians are asking IT giants to make public the data of sick people to effectively combat the pandemic
In April, Apple and Google announced that they were working together on ExposureNotification, a technology that would enable the tracking of contacts of COVID-19 patients via Bluetooth. On May 4 the companies presented the intermediate results of the work: they have sent developers a sample code for embedding this technology into mobile applications for iOS and Android, and also disclosed the terms of its use. Apple and Google emphasize that there will be no forced surveillance – the system works only with the consent of users and collects a minimum of information. However, in several countries, the authorities have asked IT companies to relax measures to protect user privacy, arguing that it is more effective in the fight against the pandemic. “Meduza” tells how digital surveillance can help to defeat the spread of the virus.
All Medusa materials about the coronavirus are open for distribution under a Creative Commons CC BY license. You are welcome to reprint them! Photos are not covered by the license.
How it will work
Google and Apple’s plans to create technology to track people who have come into contact with COVID-19 patients became known April 10. This is the first major collaboration between the two companies: in a joint press release, they stressed that “there has never been a more important time to work together to solve one of the world’s most pressing problems.”
The technology, as conceived by the companies, will work as follows: iOS and Android mobile devices in the vicinity exchange with each other via short-range Bluetooth special “beacons” that include identifiers. The devices transmit their “beacon” to the devices around them, and they also record the “beacons” of all gadgets in the vicinity. At least once a day, a smartphone or tablet will download information from the server about the “beacons” of devices whose owners have tested positive for COVID-19 and check it against their list of “beacons. If a match is found, the user will receive a notification that they have been in contact with the new coronavirus, as well as advice on how to proceed.
The companies have said that the rollout of the tracking system will take place in two phases. First, Apple and Google will provide tools to embed the technology into the official mobile apps of health organizations in different countries, then embed it directly into Android and iOS operating systems so that users don’t have to download separate apps.
“The use of the API to track contacts of individuals infected with the new coronavirus will be limited to a single app for each country to ensure high adoption and download rates by users and to avoid fragmentation,” the companies said in a joint statement.
In late April, Apple and Google began testing the system they conceived. For example, Apple released a third beta of iOS 13.5 and iPadOS 13.5, which contains the code needed to run apps created using the contact-tracking API. The company also released a beta version of Xcode 11.5, which contains a preview of developer tools with the new API. At the same time, Google released a beta update of Google Play Services with an API for tracking contacts of people infected with the new coronavirus and an accompanying SDK.
On May 4, the companies gave developers creating mobile apps for healthcare organizations new tools: user interfaces and sample code for embedding COVID-19 patient contact tracking technology into iOS and Android mobile apps. In addition, the companies released data usage rules that developers will have to follow when distributing their apps.
According to these documents, mobile applications with the patient contact tracking system can only be created by a country’s public health authority and must request users’ consent for their work. In particular, to transmit their device identifiers to the local Ministry of Health in order to send a notification of a positive test for COVID-19 to those who had contact with a sick person. In addition, apps must collect the minimum amount of data required and use that data only to counter the spread of COVID-19. Any other use of user data, including targeting ads, is prohibited, Apple and Google said in the documents.
The companies emphasize that a key principle of the new technology will be the privacy of user data. People who receive a notification of contact with a sick person will not have their identity disclosed. In addition, medical applications using this function, according to the rules of both companies, are prohibited from requesting permission to access geolocation – they should not record the location of the user, but only collect “beacons” from the mobile devices surrounding him. In this case, the device identifiers, which will be “saved” in these “beacons” will be generated from a random set of numbers and change every 10-20 minutes for security purposes, and will be tied only to the device itself, not the identity of its owner, the two companies emphasize.
When Apple and Google implement COVID-19 contact tracking directly into their mobile OSs, users will need to enable it themselves in settings. Finally, there will be no centralized data storage under this system – all information will be stored only on users’ devices.
At the end of 2019, the number of smartphone users worldwide was 3.2 billion, with 99% of them iOS and Android devices.
What Politicians Want
The system announced by the companies has raised a number of questions from politicians around the world. U.S. President Donald Trump pointed to the “big constitutional problems” associated with the implementation of this technology, and explained that his administration is consulting with experts on its use.
At the same time, even before the announcement by Google and Apple, several American states had launched their own mobile applications to track the contacts of those sick with the new coronavirus. For example, in North and South Dakota there is the Care19 app, in which more than 40,000 local residents have already registered, and in Utah – the Healthy Together app. At the same time, both apps use geolocation and store data about the location of citizens, which is prohibited by Apple and Google rules in the development of such applications. Authorities in both states are now persuading technology companies to allow health authorities to collect data from GPS systems, which would allow them to “identify virus transmission hot spots.”
“Some people are totally against invasion of privacy, but the younger generation already shares their location on dozens of apps,” notes North Dakota Governor Doug Burgum.
Similar concessions have been requested in France, where they have also developed their own StopCOVID app, but so far have experienced problems with its ability to work on iOS. French digitalization minister Cédric Oh urged Apple to loosen user privacy protections and expand the list of information that its medical apps will be able to collect. The French government promises that the data will only be stored on its own servers, with the local health authority acting as data operator.
A government mobile app to track contacts of coronavirus patients has already been developed in the UK, too, with an official statement from the country’s national health service (NHS) noting that they intend to update it so that people have the option of agreeing to share additional information with the agency, particularly geolocation. This is necessary “to identify the hot spots and trends of the virus,” but is expressly prohibited by Apple and Google regulations.
In Germany, a scandal erupted around the creation of a similar app. On April 1, it was announced the creation of the nonprofit organization Pan-European Privacy Preserving Proximity Tracing (PEPP), whose activities are overseen by the German Fraunhofer Institute for Telecommunications. More than 130 experts from eight European countries joined the organization to develop digital solutions to combat the coronavirus pandemic, according to an official announcement. The contact tracing protocol created by PEPP, like Apple and Google’s technology, is based on data exchange between devices via Bluetooth, but allows all information to be collected and stored centrally on government servers.
As a result, the Helmholtz Center for Information Security, based in Germany, pulled out of the PEPP consortium on April 20, citing a lack of transparency and clear governance as well as data protection issues in the development of the protocol. A number of other academic institutions have since withdrawn from the organization. Apple, too, did not agree to cooperate with the German government on this development, refusing to give the app the Bluetooth control function it needed in the background.
Can we do without digital surveillance?
In many countries, the first wave of the new coronavirus epidemic is now coming to an end, so authorities are gradually lifting restrictions on the movement of citizens and allowing businesses to operate. German epidemiologist Christian Drosten warns that a hasty return to normalcy could bring the second wave of the epidemic closer, since no major population has ever become group immune to the new coronavirus. “To achieve group immunity, we need 60 to 70 percent of the population to have antibodies to the virus. Test results show that in Europe and the United States, the number of COVID-19 antibody holders is a few percent,” says Drosten.
The new coronavirus is mostly transmitted from people who have recently been infected themselves and do not yet have symptoms. So identifying all those who are infected is an organizational challenge. A group of scientists from Oxford University notes in their study that digital contact tracking could be just the thing to play a crucial role in getting countries out of quarantine and preventing the reintroduction of restrictive measures. “A mobile app benefits the entire community as well as individuals by reducing the incidence of disease while enabling people to live in a safe and informed environment,” the researchers say.
The Oxford scientists note that the virus is spreading too quickly to be contained by “manual” contact tracing. “But its spread can be controlled if the contact tracking process is faster, more efficient, and more extensive. If enough people use an app that notifies them of contact with an infected COVID-19, it could help gain control of the pandemic,” the study says.
One of the most successful examples of using an app with such features is China. Citizens without the app installed on their smartphones could not use public transportation and various services in many cities and provinces, including the city of Wuhan. In addition, services were also denied to those to whom the app sent “red” and “yellow” codes indicating recent contact with a COVID-19 infected person or someone who was only suspected of having the disease. South Korea has also achieved a sustained suppression of the epidemic using a cell phone app to track mandatory quarantine compliance, the Oxford researchers note in the study.
What are the drawbacks of this approach
Asian countries, where COVID-19 mobile contact tracing apps have become widespread, have been heavily criticized for violating privacy principles and collecting data from users’ smartphones.
In South Korea, for example, the government made COVID-19 patient data freely available to private sector developers, who immediately began using it to create their own products. One widely used South Korean app is “Corona 100m”: it shows the location of the person infected with the virus, the date the infection was confirmed, their nationality, gender and age. The app also alerts users when they get within 100 meters of a place previously visited by an infected person. Disclosing such detailed data about infected people was deemed unacceptable by many.
China is the only major country that has made the installation of a contact tracing application mandatory in a number of regions and provinces. In addition, the authorities have achieved great coverage by partnering with major local technology companies Alibaba, Tencent and Baidu, whose products are widely used by the population. As a result, contact tracking functions were built into the messenger WeChat, the payment system Alipay and a number of other popular applications in China. At the same time, the country’s authorities were criticized for the necessity of obligatory installation of the application for moving around the city, lack of transparency in its work, unclear volume of data collected from smartphones and provision of the information obtained, for example, on violations of mandatory quarantine, to local law enforcement authorities.
At the same time, the approach of Singapore and India, where the installation of a mobile contact-tracking app was voluntary, has largely shown to be unsuccessful. For example, only about 20 percent of Singapore’s population has installed the TraceTogether app on their smartphones, while in India, only about 4 percent of the country’s population has done so. Such a low penetration rate makes the digital contact tracking system ineffective. An Oxford University study suggests that stopping the pandemic is possible if about 60% of the population uses the contact tracing app.
Beyond the ethical, there are also technical issues. The range of Bluetooth Low Energy, which Apple and Google claim will be used to exchange “beacons” between devices, is about 100 meters, but depends on many factors – the thickness of walls, the settings of devices, etc. Some variations on the use of this technology, such as for wireless headphones, allow for a much shorter range. The question – what distance between devices would be considered “contact” – remains open.
“What is ‘contact’? There is no exact answer to this question, so there can be no accuracy in defining the circle of contacts,” says Alexander Babaev, technical director of Redmadrobot SPB, which develops mobile applications. – You can only try to reduce the number of false positives and alerts with the help of various technical tricks. On the other hand, even if a few “extra” people do the analysis or sit in quarantine, it seems like a reasonable measure. Certainly more reasonable than quarantining entire countries.”
Another question is how to verify whether a person actually has COVID-19 before sending out notifications of possible infection to all citizens who have come in contact with them. Ross Anderson, a professor of computer security at Cambridge University, notes that these kinds of apps will be “wide open to trolling.” “Artists will strap their phone to their dog and let it run around the park, the Russians will use the app to spread panic, and little Johnny will report symptoms of the coronavirus to avoid going to school,” Anderson speculates.