Apple, Google Wants to Protect Your Privacy Even With Covid-19 Contact Tracing Apps

Apple Inc and Alphabet Inc’s Google on Friday updated technical details of the coronavirus contact tracing system they plan to release next month, saying new features would strengthen privacy protections and give health authorities more detailed data. The system announced on April 10 will use Bluetooth technology to let authorities build apps to alert people who have been in proximity with those who have tested positive for the novel coronavirus.

The technology does not employ GPS location data and stores most sensitive data in a decentralised way on users’ phones. The approach opened a rift with European governments planning systems that would store data on centralised servers. Without the Apple-Google technology, apps built by those governments will face limitations such as needing a phone’s screen to be unlocked to work properly.

Health and privacy researchers also cited privacy concerns that the companies addressed on Friday by making it harder to use system-generated data to track people. The numbers that identify users will be randomly generated, and so-called “metadata” such as Bluetooth signal strength and users’ phone models will now be encrypted along with primary data about who they have been near. “Exposure time,” or how long two phones have been near each other, will be rounded to 5-minute intervals, to prevent using detailed time data to match up phones to people.

The companies also sought to address health researchers’ concerns that the system would be ineffective. Since Bluetooth signals can penetrate some walls and can be detected even when brief and faint, researchers worried about false alerts from neighbors in apartment buildings or passers-by in public spaces.

Apple and Google will now provide data about Bluetooth power levels to better estimate how close two phones came to each other and for how long, letting authorities set their own thresholds for when to alert people. The companies also said they would provide data on how many days had passed since the last contact with an infected person, to help authorities notify users about what steps to take.