Many contact-tracing apps have popped up since the Coronavirus Disease 2019 (COVID-19) pandemic began. Discover how their technologies influence how they operate.
Contact tracing has been used for years to combat infectious diseases. It involves asking each infected person who they have been in contact with and then reaching out to those individuals so they can be isolated and tested. Although contact tracing helps break an infectious disease’s chain of transmission, it is very time- and resource-intensive.
Contact-tracing apps were developed to ease some of the burden. They automate parts of the contact-tracing process. How they work depends on the underlying technology being used. Commonly used technologies include Quick Response (QR) codes, location tracking, and Bluetooth Low Energy (LE).
QR Codes
Some contact-tracing apps rely on users scanning QR codes to create digital logs of the places they visit. For example, after installing New Zealand’s NZ COVID Tracer on their phones, users scan the QR codes posted at the locations (e.g., stores, restaurants) they visit. Each time a QR code is scanned, the app enters the location in a log and adds a timestamp. Participation in New Zealand’s contact tracing program is voluntary for both the people who scan the QR codes and the establishments that post them. If a business does not have a QR code posted, app users can manually add an entry to the log. Any entry older than 31 days is automatically deleted from the log, which resides on users’ devices.
Users can choose to receive contact alerts from New Zealand’s Ministry of Health through the app. If a user is notified that they came in contact with someone infected with Coronavirus Disease 2019 (COVID-19), they get to decide whether or not to share their log with the Ministry. If the user agrees to share it, it is encrypted before being sent to the Ministry. The information in the log is not anonymized after the Ministry decrypts it.
Location Tracking
To track a person’s whereabouts, some contact-tracing apps use the location data that mobile devices already generate. Phones typically ping Global Positioning System (GPS) satellites and cell towers to produce the location data.
Contact-tracing apps that use location tracking include Iceland’s Rakning C-19. Like with other contact tracing apps that use location tracking, users must allow Rakning C-19 to access the location data on their phones. Once this permission is given, the app runs in the background, saving the phone’s location several times per hour. These entries are encrypted and stored on users’ phones. Entries older than 14 days are automatically deleted.
App users diagnosed with COVID-19 might receive a request to share their data with the contact tracing team at Iceland’s Department of Civil Protection and Emergency Management. This request, which is sent through the app, is sent only if the team feels a user’s movements prior to the diagnosis need to be traced. If the user consents, their location data is sent in encrypted format to the team’s database. It is deleted from the database 14 days after the user uploaded it.
Bluetooth LE
Bluetooth LE is a wireless technology standard developed to exchange small amounts of data over short distances. Bluetooth LE’s communication range is similar to that of classic Bluetooth, but Bluetooth LE uses considerably less power, making it well suited for mobile devices. Because Bluetooth LE connectivity is native in nearly every smartphone, it is a good technology to use for contact-tracing apps.
Contact-tracing apps that use Bluetooth LE work differently than those using location tracking or QR codes. If you are using a Bluetooth LE-based app, it keeps track of who you have had contact with rather than tracking the places you have been. How the app does this depends on the specification or protocol used by the app’s developer. The Apple-Google Exposure Notification System (ENS) specification is commonly used. As the name suggests, Apple and Google worked together to create it.
Virginia is the first US state to roll out an app that is based on the Apple-Google ENS specification. Here is how this app, which is named COVIDWISE, works: After a user installs the app and explicitly opts-in to receive coronavirus exposure notifications, the app will start running in the background. It generates a random Bluetooth key (which is string of numbers) and broadcasts it via a Bluetooth LE connection. Because the key is randomly generated, it does not contain any personal identifiers or any location data. Plus, a new key is generated every 10 to 20 minutes, further protecting the person’s identity.
When the app user comes in close contact with another user of the COVIDWISE app, their keys are exchanged. The contact’s key is then stored in the user’s phone for 14 days, after which it is automatically deleted.
When anyone tests positive for COVID-19 in the state of Virginia, the laboratory that conducts the test is required to submit the result to the Virginia Department of Health. The department then contacts the infected individual to discuss recommended next steps. During that discussion, the department will provide the individual with a randomly generated six-digit code if he or she is using the COVIDWISE app. This code is used to prevent false reporting in the app.
The infected user has the option of entering the code in the app. This triggers an upload of the infected user’s Bluetooth keys (i.e., the keys randomly generated and broadcast by his or her app) from the past two weeks to a server, provided the user consents to it. A list of Bluetooth keys for infected users is created every day. It does not include any personally identifiable information.
At regularly scheduled intervals, the COVIDWISE app downloads the list of Bluetooth keys for infected users. The app then compares that list against a list of contact keys currently being stored on the user’s app (i.e., the keys acquired during exchanges with contacts in the past two weeks), looking for matches. If a match is found, the app determines whether the exposure meets a risk threshold established by researchers. If the risk threshold is met, the app will display a notice that he or she has possibly been exposed to someone who has tested positive for COVID-19 and given guidance on what to do.
Same Name, Different Technologies and Approaches
Although all these programs are referred to as contact-tracing apps, how they operate differs significantly based on the technology they use. So, if you are interested in using the contact-tracing app being offered in your region, you will need to do a little research on how it works.
smartphone app flickr photo by TheBetterDay shared under a Creative Commons (BY-ND) license
