Apple Inc and Google said they are putting stronger privacy protections in their upcoming contact-tracing tool for Covid-19 and that an early version will launch for developers next week.
The companies said the system’s tracking keys — a string of characters linked to a user’s device — will be generated in more random ways, and that Bluetooth data will now be encrypted, making it more difficult for individuals to be identified by hackers. Apps using the tool will also now limit the recording of the time people are exposed to an infected person to a maximum of 30 minutes.
The companies said they made these changes after discussions with governments and public health app developers. The technology has been criticized for potentially sharing too much private health information, while France has asked Apple to relax some privacy protections.
The system, unveiled two weeks ago, will add technology to the iOS and Android operating systems that alerts users if they have come into contact with a person with Covid-19. The companies are now calling the technology Exposure Notification, a term they said more accurately describes the functionality.
The first phase — tools for public health apps to add contact tracing — will launch publicly in mid-May after an early beta version of the software is released to developers next week. In the coming months, the technology will be embedded more deeply into the Apple and Google operating systems to be less reliant on apps.
The companies also explained that if a person inputs that they have tested positive for Covid-19 into the system, they will be added to a positive diagnosis list so the system can notify other people they have come into contact with. They reiterated that the system doesn’t reveal a user’s identity or location to Apple or Google.
In a Frequently Asked Questions page, the companies said public health authority apps “will be able to access a list of beacons provided by users confirmed as positive for COVID-19 who have opted in to sharing them.”
A beacon is a wireless signal that can be broadcast and picked up by smartphones. At least once a day, Apple and Google’s system will download a list of beacons belonging to people who tested positive and shared that with their public health authority. Each device will check the list of beacons it has recorded against the list downloaded from a server maintained by the companies. If there’s a match between the beacons stored on the device and the positive diagnosis list, the user may be notified and advised on next steps.
This approach, which requires the second phase of the project to work, means smartphone owners can be alerted without telling health authorities that specific people have come into contact with infected individuals.
The companies are also adding new features for public health developers to build contact-tracing apps. The system will give apps data on the strength of Bluetooth signals so the distance between devices can be more accurately estimated. Developers will also be able to specify distance and time to determine what constitutes Covid-19 exposure for their apps. The tool will also determine how many days since a person has been exposed.
Apple said that the software update to enable the system will work on devices released in the last four years. Google said the tool will work with Android 6.0 or higher, which covers about 2 billion gadgets.
