Photo by Ryoji Iwata on Unsplash

Apple and Google can save us from this lockdown. Will they?

Proper contact tracing might be impossible without Apple and Google’s support.

Update: “Apple and Google Partner on Contact Tracing!” 🔥

Every day, more governments around the world are realising that testing potential COVID-19 patients and tracing anyone they were in contact with when tested positive is key to suppressing the SARS-CoV-2 virus — or at least key to returning to even a small part of “normality” in society. Many governments are looking at Singapore where apps are playing a crucial role in finding contacts who may have been infected. This enables infected people to be isolated early, before they potentially infect many others.

Numerous initiatives have already sprung up to develop apps to anonymously track who you have been in contact with. Most seem to be focussing on using Bluetooth to scan or connect with nearby devices and keep an encrypted log on the device of all people (specifically, device IDs) they have been in close proximity with. Whenever someone tests positive, their anonymous ID is posted to a central database, with their permission. All phones do a daily check to see if any of the device IDs they have locally stored match with the ID of a known infected person in the central database.

This seems to be one of the best, most privacy-friendly solutions, if we can make it work — but doing so without Google and Apple’s help may be impossible.

Bluetooth

Bluetooth LE (Low Energy) is a great technology to use because of its low-energy usage and accuracy, especially if combined with other sensors in your device. It can tell how far away another phone is, unlike GPS and Wi-Fi.

Unfortunately, third-party developers are limited in how they can use Bluetooth — especially as of the release of iOS 13 and Android 11, which contain enhanced restrictions on location and Bluetooth access. An extreme case is illustrated by the contact tracing app used in Singapore: iPhone users are told to keep the app running in the foreground, with the screen on.

You might trust yourself to keep the app open when walking through the city or meeting with your colleagues, but do you trust everyone else to do the same? For many months to come?

While there may be ways to enable anonymous tracking without having the app constantly open, developers will run into technical barriers which limit the potential of the app. It will also be difficult for individual developers and governments to build an app that works well on most devices. Implementing this on a system level has the best chance for success.

Distribution

Contact tracing with apps will only work if a large part (likely >60%) of the population has this actively running on their phones. Otherwise, it’s worthless. Apple and Google (and other Android manufacturers) are in a unique position to push an update to all users and provide a prominent option to opt into these programs.

Apple, for example, could make contact tracing a feature of HealthKit. Looking at how they implemented “Find My,” we are confident that they can do this while still respecting everyone’s privacy. Google could choose to add a feature to Google Fit on Android, which could be pushed to Android phones with a single app update.

Advantages of Big Tech

A collaboration between Apple and Google would have several advantages over apps run by national governments:

1. Apple and Google have far more options to utilize Bluetooth than they allow third-party developers access to.
2. Apple and Google could push an update to most devices, making it easy for people to enable the option in their phone’s settings.
3. Their solution would work across borders, eventually allowing us to travel again without having to download the local apps from various governments.
4. We trust them to disable the feature when it’s not needed anymore (more than we trust various governments).
5. Apple and Google have a lot of experience with keeping sensitive data secure, likely far more experience than many individual developers or even governments have.

We would even go so far as to highly recommend both Google and Apple make this an open-source project. This would ensure the following:

1. From a security and privacy perspective, it would enable entities like the FCC and the EU to check if it adheres to their laws and regulations.
2. It would enable security firms to help make this as secure as possible.
3. It would allow for rapid development, given enough central control, as many people could join and work on the effort.

Ideally, the app would also contain a screening tool like Apple already made available, and if you get sick it would give you the ability to let doctors know your vital signs remotely.

The question is: Will @tim_cook & @sundarpichai get this done?

@jelleprins, @jasperhauser

Special thanks to @ow, @wbroek, @rvandijke, @thijsniks, @roelandp, @warpling, @klaaspieter, @doney, @richardchirino, @dirkgroten and Ginger for helping us.