Apple and Google detail COVID-19 contact tracing program, focus on privacy [u]

Apple and Google on Monday provided further detail on their upcoming contact tracing technology, noting the program will remain voluntary and that only public health organizations will be able to create apps built on the platform.

On Friday, the Silicon Valley giants announced a new cross-platform Bluetooth technology that could help track and ultimately reduce the spread of coronavirus.

Contact tracing solutions are designed to track virus propagation by building a comprehensive history of who an infected or potentially infected person came in contact with over a set period of time. Apple and Google seek to digitize, and thereby largely automate, what is traditionally a manual process.

The system, which will work across Android 6.0 and iOS 13 devices, will be released in two phases. First, Apple and Google will issue developer APIs that public health organizations can use to build contact tracing apps. A second phase will see that functionality baked deeper into the iOS and Android operating systems, foregoing the need for an app. OS integration could also save battery life by minimizing background processing.

Across each phase, Apple and Google said that the system is being built out on principles of "privacy, transparency and user control."

An illustration of how and when users will receive a notification from the system.

When implemented, the technology will use a device's onboard Bluetooth hardware to keep tabs on who the owner comes into close proximity with. Specifically, Bluetooth identifiers are exchanged and saved locally.

If a participant later tests positive for COVID-19, and agrees to share that information, their device will send 14 days of contact keys to a central server. Phones periodically download positive broadcast beacons, or beacons of users who reported testing positive for COVID-19, and look for matches among a list of locally stored, anonymized identifiers. If a match is found, an alert is displayed with links to critical healthcare information.

Apple and Google have built the system from the ground up to respect strong privacy policies. No location data or personally identifiable information is collected as part of the system, and each device's Bluetooth identifier will change periodically to prevent unwanted tracking.

The companies also confirmed on Monday that the system will require explicit user consent at multiple stages and that only public health authorities will be able to use it to manage and track the ongoing pandemic.

Additionally, the list of people a user comes into contact with is only stored locally on a device and isn't shared unless they opt to share it, such as after a positive diagnosis. The actual identities of people who test positive for COVID-19 aren't revealed to Apple, Google or other users, and the companies can disable the system on a regional basis when it is no longer needed.

To combat the potential for abuse or false positives, it also appears that notifications will only go out if a public health authority confirms a diagnosis.

Apple and Google said that the first phase of the contact tracing rollout will occur in mid-May, with the operating system update arriving "in the coming months."

Update: Apple and Google in a statement to TechCrunch said the contact tracing project will support Android 6.0 and iOS 13 devices.