In April 2020, Google and Apple jointly announced a contact tracing system to curb the transmission of the novel Coronavirus. Virginia is now rolling out the ‘COVID-19 exposure notification app’ dubbed COVIDWISE which is built on the guidelines specified by Google and Apple.
Google CEO, Sundar Pichai tweeted in April:
To help public health officials slow the spread of #COVID19, Google & @Apple are working on a contact tracing approach designed with strong controls and protections for user privacy. @tim_cook and I are committed to working together on these efforts.https://t.co/T0j88YBcFu
— Sundar Pichai (@sundarpichai) April 10, 2020
COVIDWISE can alert the public if they come in contact with a person who has tested positive for the virus. What makes this application stand apart though, is the fact that any personal or location data will not be collected, stored, or transmitted to the Virginia Department of Health (VDH).
So how is the system going to work? Apple and Google’s Exposure Notification System allows smartphones to exchange anonymous keys using Bluetooth technology. These keys will change every day to ensure that the person’s privacy is secured. Every user will have a collection of his daily anonymous keys. Each key will be stored in the user’s smartphone for 14 days before being refreshed.
Let’s picture the scenario. When two people come in contact with each other for a time period which is deemed risky by the VDH, their smartphones will exchange the anonymous keys and each phone will save the key of the other. In addition to the confidential key, phones will automatically estimate the risk level by exchanging the date, time, and duration of the contact. The strength of the Bluetooth signal will also give an approximate measure of the contact distance. This contact risk estimator will alert a user of potential exposure to the virus, and the details will not be shared with anyone else.
When a person tests positive, the hospital will submit the test results to the VDH. The VDH will then contact the individual who will also be provided with a pin to register the results in the app. This pin will ensure that there is no false reporting. Regarding the information pertaining to the positive cases, it boils down to one’s conscience as he will have the freedom to choose whether he registers the test results in the app or not. On reporting the positive results, the app will send all of the user’s anonymous keys from the past 14 days to a server. This will happen only if the user gives consent to the application.
Let us assume that a person agrees to share his data. For every other user, the app will compare the list of keys belonging to those tested positive with the user’s set of anonymous keys (which represents the contacts of the user in the last 14 days). This matching will be done on the device and not on the server. If the contact meets the criteria of the risk threshold, the user will be notified. VDH also notes that “COVIDWISE only uploads a user’s anonymous tokens for the day of and the 14 days prior to the user submitting a positive report. It will not continue to upload any information unless the user tests positive again and submits another report.”
As promising as the COVIDWISE app sounds, a lot of factors are contingent upon how many people download the app, how many choose to log their test results, and ultimately, how many actually choose to share this data. This is a classic case of privacy versus health. Both public health and privacy will be secured only if everyone chooses to co-operate.
It is important to note that the installation of the app has not been made mandatory. The Government of India, on the other hand, has mandated all persons commuting to work to download the Aarogya Setu app.
The spokesperson of the Virginia Department of Health (VDH), Julie Grimes stated: