Apple-Google contact tracking app is technology’s latest attempt to fight coronavirus

Apple and Google are one month away from rolling out a series of updates to their smartphone operating systems that will use Bluetooth signals to track down potential cases of coronavirus. This week, companies confirmed to Recode that contact tracking technology will disappear when the pandemic occurs, which should ease some privacy concerns. But as two of the world’s technology superpowers prepare to incorporate new surveillance features into their devices, skepticism increases. Will the joint effort of Apple and Google to fight the virus have unintended consequences?

When the contact tracking tool was announced, there was no indication that the software required to make it work was temporary. The fact that it involved changes to mobile operating systems actually made it seem more likely that it was a permanent feature. Apple and Google have said that this deep integration was the only way to enable the continuous tracking necessary for the contact tracking tool to work properly. However, the permanence of this tool could cause its features to be used for other purposes, once its intended use is no longer necessary. Therefore, it seems a relief that Apple and Google plan to suspend the contact tracking tool at the end of the pandemic, although details on what software features will go away and what qualifies as the “end of the pandemic” still need to be explained.

By pledging an expiration date, Apple and Google have addressed a primary concern for privacy advocates, some of whom have been unusually susceptible to certain types of tracking during the pandemic. But many more questions remain. How will Apple and Google prevent governments from accessing their tool? How will companies ensure that contact tracking systems remain optional for smartphone users? Will the tool be effective enough to guarantee the privacy commitments it requires?

“This is an extraordinary moment,” Bennett Cyphers, staff technology for the Electronic Frontier Foundation, told Recode before the time limit was announced. “It means we would accept some pretty extraordinary things that EFF would normally never endorse. But that has to come with some kind of limit on how it can be used and for how long it can be used. “

Although they appear to have answered the “how long” question, Apple and Google have so far provided limited information about the tool itself. The companies have released some white papers showing how the system works, and have answered some questions from the media. But that is all. Beyond confirming that the tool would end, neither Apple nor Google have responded to Recode’s requests for comment.

The tool could leave a dangerous door open

The new Apple-Google tool sounds miraculous at first glance. Starting in mid-May, the companies plan to release software updates that will allow iOS and Android phones to exchange anonymous keys via Bluetooth to any other phones nearby. This feature will allow interoperability between iOS and Android phones, and public health authorities will exclusively create applications based on an application programming interface (API) created by Apple and Google. If a user tests positive for coronavirus, they will inform the app, which will then alert people who have been close enough to the infected person for their phones to switch Bluetooth keys. The alert will tell them that they have been in contact with an infected person, without revealing the person’s identity.

Although this talk about track and trace may sound daunting, the Apple-Google tool does include specific privacy protections, such as the use of anonymous keys that change every 15 minutes to prevent someone from tracing a specific key to an individual; store data on users’ devices instead of on a central server; using proximity detection instead of location data; and making the whole program subscribe. Apple and Google have said that privacy and user trust were at the forefront of their collective minds when developing the tool.

Not everyone believes that these good intentions can be sustained. Apple and Google’s privacy promises sound empty to people who have seen how both companies have built on the basis of privacy commitments, many of which were made without consumer knowledge.

“Two corporations, Apple and Google, have come to dominate the smartphone software ecosystem, and have spent years spying on users and enabling consumer surveillance in their app stores,” said Michael Kwet, visiting member of the Project Yale Law School Information Society. Recode “In the world we build, we now have to weigh the fate of our lives and economy against trust in Apple and Google, the ad technology industry they support, and government intelligence agencies. … This is a nightmare.”

Just look at how well hidden tools can track you in many apps available through the Apple and Google markets. And Google has trackers installed on the Internet, which collect first- and third-party data about potentially everything you do online. One way or another, everyone from location data brokers to law enforcement can access a large amount of their data through these companies’ devices. Apple and Google have made various efforts to combat some of these intrusions, but such intervention only shows that companies cannot foresee all the unintended consequences that their innovations may have. They can only answer them after the fact.

We also don’t know which countries, states, or cities will participate in the Apple-Google contact search effort. We know that the API will be available only to public health authorities in those governments, although it is unclear whether companies will take steps to prevent authoritarian governments from using the technology unintentionally.

In that sense, although users should opt for the contact tracking function, we do not know if the health authorities will be able to create applications on Apple-Google technology that could allow more invasive monitoring. We have already seen systems like this in other parts of the world. The Chinese government, for example, created an application that assigns a health code to users, who must then display a healthy code to move freely. The Apple-Google tool does not do this, but it could be used to perform a similar function.

“I think there is a very real possibility that companies could, for example, require their employees to show proof of ‘no infection’ before they are allowed to return to work, voluntarily of course,” Ashkan Soltani, a former trader Federal The Commission’s chief technologist who has written about privacy concerns and Bluetooth tracking told Recode.

Soltani also wondered what Apple and Google will do to prevent developers from adding identifiers in applications they create using the Contact Tracking API, such as location information and names.

On Thursday, the European Union released a list of privacy requirements for member states developing contact tracking apps, suggesting that the EU has some privacy concerns regarding the Apple-Google tool. The list includes “urgent commitment to the owners of mobile operating systems” to ensure that the tool is “compatible with the common EU approach”. Meanwhile, the UK National Health Service was looking for ways to identify supposedly anonymous users of the contact tracking app it is developing. The NHS plans to integrate the Apple-Google tool into that application, according to the BBC.

It is not inconceivable that something like this could happen in the United States, where there are already instances of public health authorities that share positive evidence of coronavirus with the police. Senator Richard Blumenthal, advocate of data privacy legislation, said in a statement that “he urgently wants[ed] to learn how Apple and Google will ensure that consumers’ privacy interests are strongly balanced with the legitimate needs of public health officials during the coronavirus pandemic, “adding,” A public health crisis cannot be a pretext for violate our privacy laws or legitimize technology’s collection of intrusive company data on American’s personal life. “

Bluetooth technology may not be up to the job

Privacy and security are top concerns with the Apple-Google tool, but there are also issues with the technology itself. Although they are more accurate than GPS, Bluetooth signals may not be good enough to determine the proximity of other devices with the precision necessary for contact tracking. The accuracy of these signals may depend on several factors, but some estimates suggest that the technology may have difficulty with the 6-foot social distance recommendation. If a Bluetooth signal can only determine your location within 30 feet, for example, you will receive a notification that you were close to an infected person when in fact it could be at a safe distance. (It is unclear exactly how far the coronavirus can travel in the air.) These false positives could happen in a densely populated place so often that they lose their meaning.

Bluetooth signals can also travel through physical barriers, so the Apple-Google contact tracking tool could get confused if there is a wall between two devices. That means you could get a notification about coronavirus exposure when you and the other person are actually in two separate apartments. The opposite could also be true: you could no Receive notification when you have been exposed in a way that the Bluetooth based system did not register.

“False negatives are the ones that concern me the most,” Susan Landau, a professor of cybersecurity and politics at the Fletcher School at Tufts University, told Landeu.

False negatives can happen in many different ways. The infected person may not be using the tool or may not have their phone when they approached you. Or someone with the virus can sneeze or cough more than 6 feet from you. They won’t trigger the proximity alert, but it could still have been exposed. In the meantime, if governments use this information to justify lifting shelter-in-place ordinances, any inaccuracies could be very costly.

“Basically it will give us a false sense of security and at the same time it will infringe on people’s rights,” said Soltani.

Voluntary participation may not be enough

Finally, assuming that privacy issues don’t lead to any sinister results and that Bluetooth technology works, Apple-Google’s contact tracking tool could fail due to statistics. There is a minimum percentage of the population that will have to participate in the monitoring of digital contacts to be effective. An Oxford University study puts the low at about 60 percent. And while having it integrated into the vast majority of smartphone operating systems (an estimated 3 billion people worldwide own an Apple or Android smartphone) is one of the best ways to encourage it, it still leaves thousands of millions of people who do not have smartphones.

Even in the United States, where 81 percent of adults own smartphones, mass adoption will be difficult from both a cultural and practical perspective. Smartphones are even less accessible to low-income people and seniors, populations that have been particularly affected by the pandemic and will increasingly lag behind. Those with phones will need to download the latest software updates (and have newer model phones that can support the updates), download the app from the appropriate public health authority, take their phones everywhere, and want to get involved first. . The entry bar could simply be too high for too many people.

“We cannot solve a pandemic by coding the perfect application,” said the Electronic Frontier Foundation in its report on such digital contact tracking tools. “Difficult social problems are not solved by magic technology, among other reasons because not everyone will have access to the smartphones and infrastructure necessary for this to work.”

Even if the Google-Apple tool achieves the necessary widespread adoption, it alone may not be enough to eliminate or reduce the spread of the virus. Michael Osterholm, director of the University of Minnesota’s Center for Infectious Disease Research and Policy, said in a recent panel discussion on the Government Oversight Project that contact tracing was only a “somewhat superficial and inconsequential” solution.

“When your house catches on fire, there is no way to keep track of contacts,” Osterholm said. “[Coronavirus] it’s everywhere … All we know will really work is a primary shutdown. “

This is especially true when you consider that many people who have the virus and are contagious are asymptomatic, which means that they are never tested. According to experts, only a massive testing program will allow people to safely stop social estrangement. We need to significantly increase our testing capabilities for this; estimates range from 750,000 tests per week to 35 million per day. We’re still not close to the bottom end, and there are many factors preventing us from achieving it anytime soon, from a shortage of basic materials like test swabs to questions about test accuracy.

Landau, the Tufts professor, pointed out that even if Apple and Google use the tool only during the pandemic, we don’t know how they will define the end of the pandemic, and no one knows when that will be.

“It is tempting to say that after a certain time, the application will die,” he said. “We don’t know how long that will be. We don’t know if we will have a vaccine. We don’t know what percentage of the population will respond to that vaccine. There are all kinds of unknowns.”

Even assuming Apple and Google have the most altruistic intentions, their tool probably won’t be the silver bullet against the pandemic we all want. If we don’t know what will solve this problem, it is more difficult to justify the additional problems it will create. Altering the operating systems of your phones, even if that change is temporary, is a big problem. We can only hope that the ends justify the means.

Open source It is possible thanks to the Omidyar network. All Open Sourced content is editorially independent and produced by our journalists.

Support Vox explanatory journalism

Every day at Vox, we aim to answer your most important questions and provide you, and our audience worldwide, with information that has the power to save lives. Our mission has never been more vital than it is right now: empowering you through understanding. Vox’s work is reaching more people than ever, but our distinctive brand of explanatory journalism requires resources, particularly during a pandemic and economic downturn. Your financial contribution will not constitute a donation, but will allow our staff to continue offering free articles, videos and podcasts with the quality and volume required at this time. Please consider making a contribution to Vox today.