Apple, Google Bring Forward Virus Tracing Tech Amidst Privacy Row

Apple and Google are planning to offer their jointly developed coronavirus contact-tracing technology to developers on Tuesday, after initially saying it wouldn’t be ready until mid-May.

Automated contact-tracing tools are expected to be critical tool in reopening economies shut down by the Covid-19 pandemic, with most Western countries opting for an approach that uses Bluetooth signals, rather than satellite location data, for greater privacy protections.

But dissention has emerged between countries including France and Germany that want to store the apps’ data on central servers, and others that favour a more decentralised method that keeps all tracing logs on mobile devices.

Contact tracing apps run on a mobile device and keep track of other devices running a compatible app that the user comes into contact with.

Personalised alerts

When a user is diagnosed with Covid-19, the app alerts those who have come into contact with the infected individual, allowing them to take action.

The Bluetooth-based systems are designed to be voluntary in nature and to operate without using location data, while preserving users’ anonymity.

That’s in contrast to approaches in some other countries, such as South Korea, where authorities have made aggressive use of mobile phone location data to track down and isolate those who have been exposed to the virus.

Apple said the joint contact tracing application programming interface (API) would only run on devices with an updated version of iOS 13.

That operating system can’t run on devices older than the iPhone 6S, released in September 2015, meaning those older devices will not be able to use the tracing technology.

Google said the API can run on devices running Android 6, released in October 2015, and later without an update.

Technical changes

The companies have made changes to their initial plans, for instance, the technology will now collect information about devices’ Bluetooth power levels to help developers estimate how far two devices are from one another.

Developers will now be able to decide for themselves how close two devices need to be and for how long to be considered an exposure risk, and apps will be barred from logging any meetings as having lasted longer than 30 minutes.

Data about phones’ transmission power will now be encrypted, in order to prevent people from using the data retrospectively to determine which phone models were involved, while the AES encryption algorithm will now be used in order to reduce battery consumption.

‘Trust’

France and Germany last week both criticised Apple and Google for refusing to work with the countries’ contact-tracing approach, with France saying the companies were holding European countries “hostage”.

“The European states are being completely held hostage by Google and Apple,” said an unnamed senior French official involved in developing the country’s StopCovid app, Reuters reported.

Germany said Apple was effectively forcing European states to adopt its approach, and called for Apple to support the contact-tracing architecture being developed by research group Fraunhofer HHI for Germany’s federal Robert Koch Institute.

German government spokeswoman Ulrike Demmer told a press conference that the government trusts Fraunhofer’s more centralised approach, while “with a decentralized system, you have to trust Apple and Google”.

Apple normally places restrictions on the way apps can use Bluetooth while running in the background, meaning that unless an app uses the companies’ upcoming API, its effectiveness would be severely limited.

‘Privacy principles’

Apple said it had no plans to lift the Bluetooth restrictions, with Gary Davis, Apple’s global director of privacy and law enforcement requests, calling them “fundamental minimum privacy principles that are needed to make this work”.

Germany has been basing its contact-tracing approach on an architecture developed by the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) group, which involves a centralised database, but Google said it prefers a competing approach called Decentralised Privacy-Preserving Proximity Tracing (DP-3T), which keeps all data on individual devices.

DP-3T was developed by Swiss researchers and Switzerland plans to launch an app based on the technology on 11 May.

Estonia said on Friday it is also planning a DP-3T-based app, while Austria has said it may upgrade its existing contact-tracing app to use DP-3T.

In a blog post outlining its commitment to privacy, the NHS said it has been “working with Apple and Google” on its upcoming contact-tracing app, but stopped short of confirming whether it would be using the companies’ API.