How Apple and Google coronavirus contact tracing will work

Here's how our iPhones and Android smartphones will track us in an attempt to work out if you've been exposed to COVID-19.
Written by Steven Vaughan-Nichols, Senior Contributing Editor

Dr. Anthony Fauci, director of the National Institute of Allergy and Infectious Diseases, said, "We have the capability of mobilizing identification -- testing -- identification, isolation, contact tracing" to finally get a grip on the coronavirus

The first three we know about, but what's contract tracing?

What is contact tracing?

Contact tracing is just what it sounds like: It tracks who you've been in contact with -- physically close enough -- to have potentially caught the virus.  While we haven't used this technique much in the US, it's been a key way that South Korea and Singapore have managed the COVID-19 pandemic better than most countries.

Now, Apple and Google are bringing coronavirus contact tracing to the US via our iPhones and Android smartphones. Specifically, starting in May, Apple and Google will launch APIs and operating system-level technology. This will enable contact tracing applications, which can work between Android and iOS devices.

Usually, Apple and Google have no love for each other. Their smartphone fights go on forever. But the coronavirus is bigger than billion-dollar companies. So, the two are working together. 

How exactly will this work? 

First, it's not as easy as you might think to implement. Yes, we use GPS, Wi-Fi, and cell-tower location tracking all the time on our phones for map apps, but location technologies aren't precise enough for contact tracking. We need to track people who are within that now-famous six feet of each other.

For that level of precision, we must use low energy Bluetooth beaconing for close-proximity tracking. There are many ways of doing this, but the basic idea is always the same. A tracing app would broadcast a unique Bluetooth ID from your phone. At the same time, the phones of those around you are doing the same thing. 

These SHA-256 cryptographically secured IDs are unique to each phone. These keys also change every 10 minutes. The idea is to make them as secure as possible from third-party tracking. 

When two people using an app based on Apple and Google's code are near each other, the distance between them is estimated by their Bluetooth signal strength. If they're within six feet of each other for enough time, the apps exchange identifiers. 

This data exchange, according to Apple and Google, doesn't include any personally identifiable information or location data  Instead, it just keeps your unique list of phone session IDs -- and thus their users -- that you've been near. This information is kept on your phone, it's not shared or stored in a third-party database.  

People who test positive are not identified to other users, Google, or Apple. Instead what happens is that when your neighbor Joe discovers he's infected with COVID-19, he enters that information into the app. 

Then, and only then, is his last two weeks of encounters data sent to a cloud-based database. Once there, the data that he's sick and his ID keys are sent to others using the app. When there's a match, you're informed that you may have been exposed to the virus, but not by whom, and you'll be given instructions on what to do next. 

That's how Apple and Google describe the apps. But, they're not, at this point, actually making the apps. For now, all they've done is start creating a simple application programming interface (API), which will enable apps to do what I just described above. 

Others must build the actual apps

For example, a team led by MIT researchers is working on apps with the new Private Automated Contact Tracing (PACT). MIT's methodology is compatible with Apple and Google's API. In short, Apple and Google are giving public health institutes the tools they need to build these apps. They'll need to build the apps and the required databases for this new coronavirus approach to work. 

The next step for Apple and Google is they'll build the API's functionality into the next minor updates of iOS and Android. The soonest we can expect this to happen will be in early summer. "This," the companies state, "is a more robust solution than an API and would allow more individuals to participate, if they choose to opt-in, as well as enable interaction with a broader ecosystem of apps and government health authorities." 

Other countries, such as China, South Korea, and Israel are already deploying contract tracing applications. For the most part, they've placed health concerns ahead of privacy concerns. For example, Singapore's TraceTogether requires all users to share their contact information in a government database. When someone comes down with the virus, the government looks up who might have been exposed and contacts people directly via phone numbers or email addresses. 

To make all this work, you need to explicitly permit the app to work. It also presumes that we finally have widespread testing. If people don't know if they have the virus, being able to track encounters is pointless. 

There are other problems as well. Not everyone uses Bluetooth, and it tends to drain the battery quickly. The ACLU also worries that Bluetooth isn't accurate enough to be to be truly useful in tracking the virus. 

You also must get people to download and use the application in the first place. That's not easy. In the first weeks that TraceTogether launched, only one in six people in Singapore installed it.  

Even if they did, Singapore's national development minister Lawrence Wong recently said, "If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, no."

Still, it's better than nothing. That said, the technology is still weeks, more likely months, away from deployment. Until early summer, testing and self-isolating remain the most useful things we can do to try to curb coronavirus infections.

Editorial standards