App Planning, MotionMobs Talk

Why privacy is a must with contact tracing

Contact tracing is a term that is already becoming commonplace. What’s important to note about the use of tech in contract tracing is it’s voluntary. The technology will only activate on your phone with your consent. The purpose of opting into this system is to help with conventional contact tracing (telling public health authorities where you’ve been and whom you’ve been in contact with). For instance, the University of Washington and the state of Utah already have created apps with this focus.

The combination of contact tracing and technology speeds up notifying people if they’ve been in contact with someone who’s tested positive for a virus, including those who didn’t exchange names or contact information in their interaction.

Privacy is a significant concern in this discussion, but the way Apple and Google intend their technology to be used is to avoid tracking location and randomize the identity of people who are opt in to the system.

What is contact tracing?

By definition, contact tracing works by monitoring people who have been infected with a virus and notifying anyone in contact with that person.

Who has access to any information collected?

Only public health officials who have designed the app in your region will be able to access any of the information on the apps being built. However, the apps themselves do not store or spread information about the identity of users. It’s unnecessary to reveal who specifically tested positive, because that’s protected health data. Users only need to know whether or not they have been exposed so they can get tested.

Neither Apple or Google are monetizing this information as it’s anonymous. You can turn off access to the contact tracing apps whenever you would like.

How does contact tracing work with technology?

Apple and Google have released APIs (application program interfaces) that allow developers to build apps that focus on contact tracing. These apps are suppose to have a privacy focus, but will require at least 60% of the population to participate in order to be effective, according to studies completed by the European Union.

To use these apps, users will be asked to opt in. 

What is being tracked?

The contact tracing system developed by Apple and Google operates on a system of randomized keys to protect user data privacy, both in personally identifiable information (PII) and location data. A user’s device will use bluetooth to broadcast an identifier beacon with a frequently changing key (every 10-20 minutes), and other devices that come within a defined radius of the device and remain for a set period of time will collect the key.

The device’s broadcast keys and any keys detected within range are stored locally for a rolling 14 day period.  When a user self-reports a positive COVID-19 diagnosis that is confirmed by a health authority, the user’s app uploads to the temporary cloud store all of the keys the user’s device has broadcast over the past 14 days.

Other users’ apps access the list of the keys associated with a positive test, and if that user has one of those keys stored in its 14-day history of contacts, the app sends a local notification that there has been an exposure.

Why location isn’t tracked

The priority of contact tracing isn’t to know where a user is at all times – it’s to understand what users have been in contact with each other in a manner that may allow transmission of COVID-19. As a result, it’s unimportant and a violation of user privacy to keep track of where a user goes. The only thing the system needs to track is when two users come into vicinity of each other, regardless of where that happens.

When are keys released?

Keys are stored locally and only released for comparison when a positive test result is entered. The keys are meaningless without an exposure, so there’s no reason to store those keys where a government or health organization may access them at will.

When can I expect to start using these contact tracing apps?

Apple and Google released beta versions of their APIs, so you can expect to see contact tracing apps from your regional public health authorities rolling out in the next few weeks. You will need to check the App Store and Play Store accordingly to find apps for your area. 

Since these apps are voluntarily, each one will look different based on who builds them, but there are samples of what to expect. By using these apps, we are informing public officials of how the virus is spreading and keeping our communities healthier.

Sign up to be notified when the app will be released here.

By Emily Hart