Here’s How Apple’s Coronavirus ‘Exposure Notification System’ Will Protect Your Privacy

A couple of weeks ago, Apple and Google announced a landmark partnership to build contact tracing features into their respective mobile operating systems so that just about every smartphone on the planet could be readily equipped with the technology needed to help track the spread of the novel coronavirus.

While Google’s involvement may have been enough to make a few people wary, there’s little doubt that Apple’s track record when it comes to privacy should offer a solid veneer of confidence that whatever the two companies come up with, it’s gong to put privacy first.

In fact, Apple already made this pretty clear in the original technical papers it put out, noting some of the meticulous steps it would be taking to ensure that even those who opt-in for the feature — and make no doubt that it’s going to be completely voluntary — won’t have to worry about giving up their privacy.

For example, first and foremost there’s nothing in the system that requires location data. Even your individual iPhone (or Android phone) won’t be recording your locations and storing them locally for these purposes, much less giving them up to some kind of scary SkyNet government database. However, the steps that Apple — and even Google — are taking go far beyond that, and the two companies have now provided even more details on this ambitious project via a series of technical documents.

‘Exposure Notification’

Firstly, Apple and Google are now referring to the project as “exposure notification” rather than “contact tracing” — a term that’s both more technically accurate and a bit less alarming when it comes to what it will actually do.

The system is not intended to “trace” or “track” people. As we noted above, it doesn’t use locations at all, but instead relies on Bluetooth proximity to create a list of devices that you have come into contact with during the course of your normal daily routine. The primary purpose of the system isn’t to notify health authorities if you’ve come into contact with an COVID-19 infected person, but rather to notify you.

Of course, you’ll have the option to share that information with health authorities, augmenting the broader contact tracing efforts that are already ongoing, but whether you choose to do that or not remains completely under your control. Apple and Google — and health authorities — are simply hoping that most people will choose to participate in order to help out the larger community.

Bluetooth

The entire system relies on Bluetooth proximity, and doesn’t involve GPS at all, or even Wi-Fi. However, it goes beyond simple Bluetooth tracking by taking steps to ensure that identifiers, metadata, and keys are encrypted and randomly generated using very sophisticated algorithms.

In practical terms, this means that you won’t be able to use this information to identify somebody or persistently track their phone, since keys that identify the phone will be regularly regenerated. The system also won’t measure any one person’s contact with another for more than 30 minutes at a time, in order to reduce the possibility of reverse-engineering people’s identities based on how much longer they’re in contact with each other, such as families living in the same household, or people who regularly work together during specific hours.

The method is actually very similar to the very clever way in which Apple has already engineered its own crowd-sourcing device location features, which are presently used to help users locate lost MacBooks, iPhones, or iPads — even when they’re switched off — and will almost certainly form part of the technology in Apple’s upcoming AirTags as well.

Data Storage and Government Access

The data collected by the exposure notification system is stored on your device and remains there unless you choose to share it. It’s only processed on your device, and there are no cloud servers involved at all.

In fact, there’s not even any way to get the data off your device except through an approved app that comes from a recognized public health authority. You’ll need to install one of these apps, and then use it to share that data with those authorities, but the data you share won’t identify you personally. Instead the health authorities will get a series of random identifiers of devices that have been in contact with each other, including information about relative signal strength, which can be used to determine proximity, as well as how long each group of devices were near each other.

If the random identifiers that you share happen to intersect with the identifiers from somebody who has tested positive for COVID-19, you’ll be notified that you have potentially been exposed, although it will be up to health authorities to determine the threshold for this. However, you won’t be told who you were exposed to or how, because even health authorities won’t have that information available.

When Is This All Coming?

Apple and Google are expected to release the contact API this week — possibly as soon as tomorrow — in beta form so that developers can begin working with it. This will likely come in the form of a minor iOS 13 update, which means it will only support devices going back to the iPhone 6s.

However, it’s important to note that since the system relies entirely on third-party health apps to operate, it won’t actually start functioning in any real capacity until public health organizations begin releasing their own apps, which aren’t expected to arrive until at least next month, at the very earliest. Once that happens, if you want to participate you’ll need to download the appropriate app from your local or regional health authority and opt in. On the other hand, if you don’t want to participate, you don’t need to do anything at all.