Apple and Google are teaming up to launch technology that traces the spread of the coronavirus, via apps for iOS and Android users. Despite the companies’ insistence that privacy will be “of utmost importance,” some in the security space remain wary of data privacy concerns around the newly announced technology.
Apple and Google plan to use decentralized Bluetooth technology in smartphones to help users track whether they have been exposed to someone who has tested positive for the virus — also known as “contact tracing.”
The way it works is this: Any Android or iOS user who has opted in is assigned an anonymous identifier beacon, which will be transmitted to other nearby devices via Bluetooth (this is similar to a Bluetooth signal tracing technique used by Singapore in a coronavirus tracking app called TraceTogether, rolled out in March).
When two people who have opted into the contact tracing are in close contact for a certain period of time, their phones will exchange their anonymous identifier beacons. If one of the two is later diagnosed with the coronavirus, that infected person can enter the test result into an app, such as a compatible app from a public health authority.
Then, the infected person can consent to uploading the last 14 days of his or her broadcast beacons to the cloud. Any other person who has been in close proximity to someone infected will then be notified via the phone that an exposure to someone who has tested positive for coronavirus took place.
How the API/public health app version works. Click to enlarge.
This technology will be rolled out in two phases: The first phase will be an application programming interface (APIs) released in May that public health agencies can integrate into their own mobile apps. Many such coronavirus tracking apps are already available, such as COVID Symptom Tracker and Private Kit SafePaths. The second phase will work at an operating system (OS) level and will work at an opt-in basis for Android and iOS users “in the coming months.”
“[The OS-level version] is a more robust solution than an API and would allow more individuals to participate, if they choose to opt in, as well as enable interaction with a broader ecosystem of apps and government health authorities,” said Apple and Google in a Friday statement. “Privacy, transparency and consent are of utmost importance in this effort, and we look forward to building this functionality in consultation with interested stakeholders.”
How the API/public health app version works, part 2. Click to enlarge.
Both Google and Apple stressed that they are taking extra privacy precautionary measures for the contact tracing technology. First of all, the Bluetooth-based tool is opt-in only, and explicit user consent is required. The tool doesn’t collect personally identifiable information or user location data – what’s being collected is the proximity to other devices, not the location of devices, said Apple.
The anonymous identifier beacons themselves will be random and rotating (every 15 minutes) so that there’s no way to track the device they’re associated with, Google said. The identifiers that have been collected by a phone will also stay in the phone.
The data linked to the identifier beacons “will only be used for contact tracing by public health authorities for COVID-19 pandemic management,” said Google and Apple.
Privacy Concerns
Despite Apple and Google’s emphasis on privacy, some remain concerned about its implications – particularly with the collecting and handling of sensitive healthcare data.
Sergio Caltagirone, vice president of threat intelligence at Dragos, for instance outlined his concerns with the technology in a Twitter thread, calling it “literally a real-time walking health report.” He also worried that the data would be used to “discriminate against people, as fear of coronavirus will rise as we leave large-scale quarantine.”
Here, we’re going to have health data records tied to a person tied to a phone tied to a location. It’s literally a real-time walking health report.
— Sergio Caltagirone (@cnoanalysis) April 10, 2020
The explosion of coronavirus tracking in general has left security experts wary. The ACLU earlier this week for instance released a report, called “The Limits of Location Tracing in an Epidemic,” detailing the issues with phone-location tracking as a solution to contain coronavirus – including whether data is anonymous, who gets to access the data, how the data is used and what the lifecycle of the data is.
“In this crisis, we need to seriously consider how technology might help improve public health,” said ACLU’s Jay Stanley and Jennifer Stisa Granick, in the white paper. “This investigation must be based on a realistic understanding of what technology and data can and cannot do, lest we divert attention, expertise and financial resources from other, simpler but time-tested methods that are more effective. In particular, policymakers should understand the limits of existing location data and devices for automated contact tracing.”
Despite that, one in four respondents to a Threatpost reader poll still said they were okay with sacrificing a portion of their personal privacy in exchange for some form of cellphone tracking that could – in theory – reduce coronavirus infection rates and save lives. And when asked, “If an app existed that told you who in your neighborhood was infected with the coronavirus, would you use it?” over a third (33.6 percent) of respondents said they would use it.
Moving forward, Google and Apple stress that they will continue to make their work available around coronavirus contact tracing for analysis.
Worried about your cloud security in the work-from-home era? On April 23 at 2 p.m. ET, join DivvyCloud and Threatpost for a FREE webinar, A Practical Guide to Securing the Cloud in the Face of Crisis. Get exclusive research insights and critical, advanced takeaways on how to avoid cloud disruption and chaos in the face of COVID-19 – and during all times of crisis. Please register here for this sponsored webinar.