Exposure notification apps curb COVID spread, not user privacy
A new mobile app could make smartphones one of Minnesota’s best tools for curbing the spread of the coronavirus pandemic—and it could do so without sacrificing people’s privacy.
Late last month, the state of Minnesota unveiled COVIDawareMN, an app designed to provide exposure notifications to users who have recently been close to someone who tested positive for COVID-19. The app is one of many based on open-source software by the PathCheck Foundation with support from Apple and Google that aim to quickly and efficiently alert those who may have been exposed to the virus without collecting data that identifies who that person is or that tracks where they go.
It could take until mid 2021 for all Americans who want a vaccine to receive their doses. Not every American is likely to get vaccinated, and the potential for virus mutations and additional future outbreaks create the need to complement vaccines with additional forms of defense. Using mobile apps for exposure notifications can help prevent people from unknowingly spreading COVID-19 by letting them know when it may be time to self-isolate or seek testing. By helping limit the spread, such apps could ease the strain on communities’ hospitals, clear the way for parts of the economy to reopen, and—most importantly—limit suffering and death among those who contract COVID.
The more Minnesotans who download the app, the more effective it will be in slowing the virus’s spread, said Shashi Shekhar, PhD, a McKnight Distinguished University Professor of computer science and engineering in the College of Science and Engineering.
“If many downloaded this app, a very large fraction of exposures to the virus would be caught,” said Shekhar, who advocated for the use of mobile devices to curb COVID-19’s spread back in March. “But even if we only get 15 to 20 percent adoption, we will still see an effect.”
The idea of figuring out who may have been in contact with an infected person and notifying them to prevent further spread, often called contact tracing, has been a public health tool for over 100 years, he said. Experts might, for example, interview people hospitalized from food poisoning to pin down the source of foodborne illness and prevent anyone else from eating that food.
The introduction of mobile technology addresses several of the limitations that traditionally come with contact tracing. While interviewing all of those with COVID would require a huge staff and also depend on the COVID-positive individuals remembering everyone they recently came into contact with, mobile technology automates most of the work and can more accurately “recall” all of the individuals who might have been exposed.
A version of the technology debuted six years ago, when it was effectively put to use to combat the spread of Ebola virus in West Africa. With the coronavirus, mobile tracing apps have already been implemented all over the world, though countries have adopted the technology at different rates.
How it works
To use COVIDawareMN, you would first download the app for free from either the App Store (for iPhones) or Google Play (for Android). Once you open the app and agree to the notification system, it will automatically run in the background of your phone and will not require any more input from you.
The app works by generating anonymous numbers to represent your phone. Think of these numbers like pseudonyms your phone goes by, but ones that have nothing to do with your name, your cell number, or any other identifying information. As you go about your daily activities, the app keeps an eye out for other devices within a short distance that also have COVIDawareMN installed. When it finds one, the devices make a note of each other’s anonymous numbers.
When someone in Minnesota tests positive for COVID-19, they can choose to open their app and allow a public health professional to record their phone’s anonymous numbers. The professional will add these numbers to a state list that represents all confirmed cases.
Then, once a day, your phone will download this list and check to see if any of the anonymous numbers it has “met” over the last two weeks appear on it, and whether that device was close enough to you for long enough to possibly allow COVID to spread. If so, your phone will notify you that you may have been exposed, and will provide guidelines from the Minnesota Department of Health about the next steps (e.g., self-quarantine) to take in monitoring your health and keeping those around you safe.
For your app only
While the app is a powerful tool for limiting the spread of COVID, many may reasonably question whether it will share data about them or otherwise intrude on their privacy—a concern that Shekhar said is valid when it comes to mobile technologies.
“Smartphone locations have been abused in some places around the world for surveillance and to prosecute vulnerable groups, so there is good reason to be cautious,” he said. “The main debate that started in March was around the question: ‘How can we do this in a privacy-centered manner?’ If the purpose is primarily contact tracing, let’s do it in a way that people cannot abuse for some other purpose.”
Shekhar said he approves of COVIDawareMN and related apps because they were designed to protect privacy. One key feature of these apps is that they avoid two commonly used technologies on mobile phones: GPS, which is designed to show exactly where in the world a device is, and WiFi, which can do the same when a signal is available. Using either technology could record all of the places a mobile phone has been, essentially mapping a person’s every movement.
Instead, these apps rely on a low-energy version of Bluetooth, which can only transmit wireless data to and from another device at a very short range. As you may know from pairing your phone to a car, smart watch, or wireless speaker, Bluetooth connections will often drop when one device moves more than about 30 feet apart. Bluetooth doesn’t know where you are in the world at any point, just whether you are close enough to another device for a signal to transmit.
The apps also ensure privacy through the use of the anonymous numbers, which cannot be traced back to your phone or linked to your identity. This is an example of what computer scientists call a one-way function, Shekhar said, where programs are designed to easily start at point “A” and compute their way to “B,” but find it extraordinarily hard to do the opposite and go from “B” to “A.” In this case, that means there’s no feasible way to generate identifiable data based on anonymous numbers alone.
Because your phone downloads the list of confirmed COVID cases before checking to see if one of the devices it has “met” is on it, no one besides you gets notified that you may have been exposed, and no one has any way to contact you about it—not even the app developers or the state of Minnesota. Furthermore, the app requires a code from public health departments to verify positive test results to protect against pranks.
Finally, those with experience in software coding can choose to verify these privacy measures directly. Since COVIDawareMN and related apps are based on the PathCheck Foundation’s open-source platform, anyone can freely pore over the code and scrutinize what each portion does.
“A large number of precautions have been taken to protect privacy,” Shekhar said. “If anybody has a doubt about what the app is doing, they can read the code.”
What you can do
By the middle of December 2020, less than 10 percent of Minnesotans had downloaded the COVIDawareMN app. Shekhar urged residents across the state to download the app soon and encourage friends and family to do the same, especially for those gathering even in small numbers to celebrate any of the year’s remaining holidays.
“Civic leaders and educational institute heads have already started to set examples by downloading the app and asking their followers to do the same,” he said. “We ask leaders of businesses, nonprofits, and religious organizations, as well as traditional and social media leaders, to encourage their followers to download the app and spread the word via public outreach and education. COVID-19 is a formidable opponent and it will take a united and determined effort to manage it in coming weeks, months and years.”
Written by Kevin Coss for Office of the Vice President for Research.