Google and Apple announced a joint effort to create a Bluetooth-based contact tracing solution for iOS and Android. This initiative aims to provide a tool to fight the spread of the COVID-19 virus by alerting participants who have been in contact with someone who has been positively diagnosed.
Since COVID-19 can be transmitted through close proximity to affected individuals, public health organizations have identified contact tracing as a valuable tool to help contain its spread. A number of leading public health authorities, universities, and NGOs around the world have been doing important work to develop opt-in contact tracing technology.
The idea of creating a solution for contact tracing to fight COVID-19 is not new. Indeed, last March, Singapore launched a mobile application called TraceTogether, while the EU started looking for a similar solution with the additional constraint of being compatible with EU stringent privacy regulations. Several research institutions, too, have been working on privacy-preserving contact-tracing solutions, including the University of Toronto, Pennsylvania, MIT, and others. MIT researchers, in particular, have created a system called PACT that looks very similar to what Apple and Google are aiming for.
According to the joint announcement by the two companies, in May they will release a new API to enable apps to use Bluetooth LE to keep track of contacts between devices that come closer than 30 feet. This API will be accessible to apps to build contact-tracing based solution to alert people potentially at risk of being infected. But Google and Apple's plans do not stop here. In a second phase, indeed, they will extend their platforms to make use of the new API to provide a full solution for COVID-19 contact tracing.
This is a more robust solution than an API and would allow more individuals to participate, if they choose to opt in, as well as enable interaction with a broader ecosystem of apps and government health authorities.
Apple made available three specifications for a new privacy-preserving Bluetooth protocol, a cryptographic key scheduling mechanism, and an application-level API.
According to those documents, Apple and Google's contact tracing solution would use two cryptographic keys, one Tracing Key unique to each user that will never leave a device and a Daily Tracing Key that is generated each new day based on the former. The Daily Tracing Key is used to generate a Rolling Proximity Identifier, which is the information actually exchanged over Bluetooth in case users give their authorization to do so. That information is guaranteed to be non-relatable to the Tracing Key, thus ensuring data privacy.
When a user is positively diagnosed with COVID-19, they can additionally authorize their Daily Tracing Keys to be transferred to a centralized service. Once centralized, along with the day numbers they refer to, Daily Tracing Keys are collectively known as Diagnosis Keys. Clients will frequently fetch the list of Diagnosis Keys and use them to derive all relevant Rolling Proximity Identifiers. By cross-matching these Rolling Proximity Identifiers with those found through Bluetooth scanning, it will be possible to detect a potential COVID-19 contact.
As reported by Wired, according to Google and Apple representatives, implementing contact tracing at the OS level will make apps using it more effective and energy efficient. Furthermore, to make the solution really effective, Apple is required to lift the restriction of Bluetooth access for background apps. An additional challenge comes from the fragmentation of the Android platform and Google's lack of control on how carriers update their devices' systems. Google plans, though, to make the contact tracing framework available through Google Play Services to all devices running Android 6.0 and newer.
Speaking of privacy, Matthew Panzarino, reporting for Tech Crunch, says the American Civil Liberties Union (ACLU) appears to be cautiously optimistic about Apple and Google's approach. ACLU’s surveillance and cybersecurity counsel Jennifer Granick stated:
To their credit, Apple and Google have announced an approach that appears to mitigate the worst privacy and centralization risks, but there is still room for improvement. We will remain vigilant moving forward to make sure any contract tracing app remains voluntary and decentralized, and used only for public health purposes and only for the duration of this pandemic
Google and Apple's contact tracing is still in its early stages, while COVID-19 is spreading across the world. InfoQ will keep reporting on this and related technological efforts to tackle the infection as new information will become available.