With the quiet launch of the beta test of a federally-approved COVID-19 exposure notification app for beta testing, developers hope it will answer typical questions of any early release software: Will it break, and will it scale?
UPDATE, July 24 – The beta test was quickly subscribed with over 5,000 requests and is no longer taking applications. The test runs until Sunday July 26th. “Our comprehensive review process and usability testing ensure that we take the time necessary to address any issues prior to launching this critical tool to help Canadians reduce the spread of COVID-19,” said a federal spokesperson.
But Ottawa and the provinces also want to know two other things: Will it be useful to health authorities doing manual contact tracing, and will a large number of people use it?
A global survey by a U.S.-based legal policy review blog called Lawfare suggests that so far, few contact tracing and exposure notification apps have been widely adopted, and there’s little evidence they are useful.
For example, Australia was one of the countries that developed an app, Lawfare notes but after a month failed to detect a single coronavirus cast that manual trackers hadn’t already found.
Whichever model these apps use (centralized or decentralized) they have one thing in common: They try to use GPS or Bluetooth to collected anonymized ID codes from mobile devices that are nearby for a specified length of time, often 15 minutes. The idea is if a user tests positive for the virus the codes can be used to contact those people and recommend they see a doctor for testing. In short, the apps are a supplement to people remembering who they were recently near for a length of time and who they might have spread the virus to.
However, the Lawfare article notes evidence that questions the ability of some apps to consistently and accurately collect these ID codes, an essential capability. Reception may vary on whether a smartphone is sitting on a table or in a person’s pocket. Canada’s beta test will be crucial to ironing out this feature.
“Anxiety about privacy persist” around the world, the authors add, and “technical shortcomings in the apps deserve the lion’s share of the blame.” These shortcomings would appear to be in apps that so far don’t run well on Apple devices, with complaints that they always have to run in the foreground and consume a lot of battery strength.
Related:
Expert says Canadian leaders have to get behind app for wide adoption
Many of these apps were developed early in the year and use a centralized model, with data collected being uploaded to a central server overseen either by governments or health authorities. Alberta’s ABTraceTogether is one of them, built on code developed by Singapore for its TraceTogether app.
In releasing her privacy impact assessment Alberta’s privacy commissioner said there is a security risk to ABTraceTogether on iPhones because to be active all the time, it has to run always in the foreground. To do that, the iPhones have to be unlocked, which increases risk if the device is stolen or lost.
The Lawfare article notes that so far, Alberta’s adoption rate of the app is four per cent of its population.
Canada’s exposure notification app uses the decentralized Apple/Google framework, which was released in May. (This app is separate from the federally-approved COVID-19 Self Assessment Tool, built by Vancouver’s Thrive Health, which only helps users track symptoms and receive COVID-19 news.)
A spokesperson for the Canada Digital Service, the federal agency helping oversee the app’s development with Ontario, said the exposure notification app will run on Android devices and iPhones (but not tablets or iPads). On iPhones, iOS 13.5 or above will be needed. The app won’t include any built-in trackers such as Google Firebase Analytics, Google CrashLytics or Facebook Analytics. The spokesperson said there may be an option for voluntary reporting analytics, but it would be voluntary to app users and require user consent.
Apple and Google tout that their framework doesn’t collect location data, nor does it forward the ID codes collected from nearby mobile devices with an app to a central authority. The companies stress apps using their framework should be called “exposure notification” apps and not contact tracing apps because no data goes to a central authority.
Countries using this framework started later than nations using the centralized model, so their experience so far is more limited. Oklahoma, Alabama, South Carolina and Virginia are the only U.S. states planning apps on the Apple/Google model, notes Lawfare. None have yet been released.
Lawfare says Latvia became the first country to launch an app with the Apple-Google framework tool when its “Apturi Covid” launched on May 29. Switzerland’s SwissCovid launched on June 25. Germany got 6.5 million downloads on its “Corona-Warn-App” within 24 hours of launch. But Italy, which resorted to the Apple-Google framework only after a failure in testing other trackers had 2.7 million downloads out of the country’s population of 60 million by mid-June.
According to Lawfare the Republic of Ireland, also in the Apple-Google camp, appears to have produced one of the region’s most successful apps. After launching July 6, it was downloaded 1.3 million times in eight days, making it the fastest-downloaded app in Europe.