Apple and Google’s joint contact tracing technology has officially gone live as of Memorial Day weekend, allowing public health agencies to begin building apps for it should they so desire. Early commitments to it are limited, however, amidst questions about how trustworthy the tech giants are and whether the apps would even be suitable for use.
Entities in 22 countries have expressed interest in the technology, but only three states in the US have thus far committed to including it in their public health strategies.
The Apple-Google contact tracing technology; no apps, just APIs
Apple and Google’s contact tracing technology consists of a shared application programming interface (API) that works with both Android and iOS and is pushed to user devices through an operating system update. Apple device users will get a more standard OS upgrade, while the Android update will be pushed in the background via the Google Play Store (a technique frequently used by Google to get security updates onto older devices that are no longer supported by their manufacturers).
The two companies are not providing contact tracing apps; it will be up to individual public health agencies to develop their own apps that make use of the API, which should (at least in theory) be interoperable with other apps that are also using it.
The API makes use of the same sort of Bluetooth contact tracing technology that has either been announced or is already in place throughout Europe and Asia. User data is anonymized to make it very difficult to match a contact tracing ID with an actual person’s identity, but participants can still be contacted by health officials when they have spent time in a “hot zone” or in extended close contact with a known infected party.
The system relies heavily on voluntary opt-in and ongoing participation to work. When individuals receive a Covid-19 diagnosis, they are asked to report it to public health officials so that they can be flagged as a carrier. All participants are asked to keep their phones on and the app active at all times while they are outside the home. Research by epidemiologists estimates that somewhere between 60% to 80% of the population will need to participate for the method to be effective.
Health agencies hesitant to accept
Health agencies in 22 countries have thus far requested access to the API, but there are few public commitments as of yet. In the US, only three states have thus far formally announced that they are adopting the Google-Apple contact tracing technology: Alabama, North Dakota and South Carolina.
Given that nearly every smartphone on the market runs one of the two operating systems, Google and Apple are uniquely positioned to roll out this technology. However, the companies find themselves in a difficult position as they field scrutiny and skepticism from both sides. Google in particular has a checkered past when it comes to surreptitious data collection and protection of personally identifiable information; this has led the companies to implement very stringent privacy safeguards in the API, such as decentralizing data collection and vowing to not monetize the information that is collected or use it for any other purposes.
Regardless of the strong privacy protections put into place, the companies face a battle in terms of getting the public to sign on. Ironically, the added safeguards they have put into place have also caused some governments to reject the API for being too restrictive to be useful.
With this initial release, the exposure notifications technology is not at system level. That means that the end user will have to have an app from a public health agency open to receive notifications. System-level alerts would go out to any mobile user with the API on their phone. Google and Apple are currently in talks with numerous government health agencies about the features they would like to have available at system level, with an expected rollout sometime later this year.
Though a number of public health authorities are showing interest in the Google-Apple contact tracing technology, it also conflicts with a number of apps that are already under development. One factor that is putting off some health agencies is that the existing plans call for the storage of data on a central server, something that Apple and Google will not participate in. Some governments believe that central processing is necessary to effectively determine transmission rates and where hotspots are developing.
Forced to play ball?
One technical issue that may drive some health agencies toward Google and Apple is that both of the tech companies forbid apps using Bluetooth from running in the background for security reasons, which means that the contact tracing app needs to be active and the phone needs to be unlocked for it to work. The tech giants might be able to carve out an exception to this for contact tracing technology in future updates, but health agencies would need to get on board with their new API to use it. The low voluntary adoption rate of Singapore’s TraceTogether app is at least partially thought to be due to the fact that the app monopolizes the phone and drains the battery.
Another issue is that some countries are already experiencing problems securing their own home-grown contact tracing technology. For example, India’s Aarogya Setu app can be manipulated to see how many infected people are within a certain radius of any given GPS location and to always give users a “safe” rating. And Australia’s COVIDSafe data is reportedly stored on Amazon AWS servers, which are always one configuration error away from a breach.
Regardless of the direction in which health agencies decide to go with their contact tracing efforts, voluntary acceptance and proper app use will remain as significant barriers to success. Another inherent problem with this contact tracing technology is that not everyone is going to have the equipment for it. About 81% of Americans now have smartphones, but it is impossible to determine how many of those are too old to update or run health agency apps. That and improper use could get things below the 60% minimum threshold before voluntary adoption rates are even factored in.
