It’s a little hard to know what to make of how slowly the United States has moved in using mobile phones to trace the spread of COVID-19 and notify exposed individuals. Four months ago, Apple and Google announced a privacy-protecting system to use Bluetooth for contact-tracing apps. Yet only this week did the first state—Virginia—release an exposure notification app using that Apple-Google framework.
So much of the United States response to the pandemic has been heartbreakingly, infuriatingly slow and inept that it’s possible to view this delay as further evidence of incompetence. But developing privacy-protecting systems that don’t drain people’s phone batteries, don’t rely on collecting or sharing their location data, and still provide accurate and useful information about whom they’ve been in close contact with is no small feat. And so, perhaps in at least this one circumstance, Virginia and other states engaged in similar efforts should be recognized for taking the time to do this carefully and deliberately.
The Covidwise app that Virginia launched this week uses the exposure notification API developed by Apple and Google to track when smartphones running Android or iOS came into close contact with one another without revealing unnecessary information about users’ locations or activities. The partnership between Apple and Google was first announced in April, the software was launched in May, and then, in June, Android and iPhone users began to notice a COVID-19 exposure tool in their phone settings that had been pushed out in software updates.
That tool itself does not issue any notifications, though—it merely enables other app developers to use the Apple-Google technology in their own notification apps. That was why the Virginia Department of Health paid tech firm SpringML $229,000 to develop an app for Virginia residents that would build on the Apple-Google API to actually notify users when they had been in close proximity to someone who later tested positive for COVID-19.
That’s a lot of different steps to do something similar to what it seems like other countries have already been doing for months. But as unwieldy as it may appear, there are real benefits to a carefully designed system like the one Apple and Google have laid the groundwork for with their API. For one, the Apple-Google system prioritizes users’ privacy by not collecting information about where people have been and by protecting carefully the data about whom they’ve been near. For another, it relies on Bluetooth signals that can more accurately assess when people are within very close range of one another indoors than many location tracking technologies.
The privacy protections may also have important implications for the effectiveness of apps like Covidwise, which will only work if a large number of people download and use them. If I lived in Virginia, I’d feel sufficiently confident in the Apple-Google API that I’d be willing to download Covidwise, and that trust is no small accomplishment for the officials relying on these systems to help alert people. In South Korea, where officials were much more aggressive about trying to track exposure early on, those efforts were hindered by the lack of attention to privacy. For instance, Reuters reported in May that even though clubs and bars in South Korea were required to log the names and phone numbers of their customers, many people turned out to have provided incomplete or false information, prompting the country to try to develop more robust privacy protections for its testing and tracing systems.
Whether a significant number of people will actually download and use the Virginia app remains to be seen. It’s also not clear how many other states will follow Virginia’s lead in using the Apple-Google API to develop apps since there are no current plans for a nationwide government-sponsored notification app. The Virginia app requires a six-digit PIN issued by the state Department of Health to confirm positive test results and therefore will be of very limited use to non-Virginia residents, though there has been some discussion of a shared national key server to enable different states’ apps to work together.
One of the delays that’s most frustrating in the United States is the need to wait for individual states to commission and roll out their own apps, even after the underlying API has been developed. In Europe, several countries, such as Germany and Ireland, have already launched nationwide apps that use the Apple-Google notification system. Different exposure notification apps commissioned by different states means the process will move more slowly in the United States. It also raises potential security concerns since each app will have to be vetted carefully, and the budget for the development and testing of each one will vary state by state. That’s not a process you ever want to rush, but given the circumstances, it might make sense for states to think about what, if anything, they could learn from the places that have already done this.