How Google & Apple’s COVID-19 Transmission Tracing Initiative Actually Works Nicoló Follow Apr 11 · 5 min read

Photo by Dennis Kummer on Unsplash and remixed by the author

The coronavirus pandemic has brought out the best in people all over the world. The fight to contain the ever-spreading virus has set in motion a level of forgiveness and honour never seen before in many of the world’s most competitive industries. Whether it is the big-pharma companies setting aside their differences and joining forces to find a vaccine against the virus, or Apple and Google now collaborating to control the COVID-19 spread, the level of solidarity and unity has been tremendous.

Of course, on the surface level, a collaboration between the two most prominent tech companies in the world could sound sinister and, unfortunately, there has been an excessive amount of speculation on how the system will really work in reality. This article should hopefully help to calm these suspicions by explaining the information provided by both companies in their technical specifications documents in a way that is more accessible to everyone.

To be clear, I think it is essential to highlight all the key privacy points before explaining the process in detail. Without these details, this program could seem like a privacy disaster when, in fact, this could be the difference between containing this pandemic or allowing it to ruthlessly infect millions of other people.

Firstly, you need to explicitly tell Apple or Google (anonymously) that the owner of a specific iOS or Android device is infected with the novel coronavirus. This data will never be tied to your name and is simply tied to a very specific (purpose-built) key on your device, which changes every 15 minutes.

Secondly, this technology works over Bluetooth, so it does not need to collect any accurate location data as it works with the same technology that Airdrop does.

Thirdly, the full list of people (identified only by their keys) never leaves your phone and is only stored locally, i.e. Google or Apple never see this list. This list will only ever be used for the purpose it was designed for.

Google’s Tech Specs Document (page 1)

The technology works in the following way:

You explicitly enable the technology on your iOS or Android device and start going about your daily life. You may bump into friends when going to the grocery store or stand a little bit too close to someone in a line. While you are doing this, your phone is quietly exchanging your temporary keys with every other phone within a certain radius around you so that everyone has a list of every key they have been in contact with other the past couple of weeks.

Google’s Tech Specs Document (page 2)

If you suddenly start to feel ill one day and test positive for COVID-19, you can explicitly choose to tell your phone that you have been infected. Your phone will then upload your list of keys to the cloud and will start to alert every person you have been around for the past two weeks that they may have been in contact with an anonymous COVID-19 infectee. These people will then be told how to proceed and will then hopefully completely self-isolate and seek medical assistance more proactively.

Google’s Tech Specs Document (page 3)

The rollout will happen in stages and begins next month. The first stage will involve an API (application programming interface) which official apps released by public health authorities on the iOS and Android app store will be able to integrate into their apps. During this first stage, you will need to install one of these apps to participate in the program, so your permission will be very explicit. This will perhaps serve as a bit of a beta test before rolling this technology out to the whole world. The second stage will be a little bit more widespread. The contact tracing will slowly become a core iOS and Android feature. This part is currently a bit vague, but I would assume it would just become an opt-in setting in your phone without having to install a third-party app.

The Bluetooth Low Energy capability has been around on iOS since the iPhone 4S in 2011 and has been supported on Android since 2012, so unless your phone is prehistoric, you will probably be able to use this contact tracing technology.

It goes without saying that there are definitely still a couple of technical queries that have not been answered, such as how the technology will know which keys to download if it is not storing at least some location data. Additionally, this tech certainly has the potential to set some very Orwellian precedents and allow for the fast-tracking of global mass-surveillance. While Apple and Google may not ask for your precise location history; regional governments may start to add this as an additional requirement in the name of public health. However, on the whole, the solution seems quite bulletproof and could go a long way towards stopping the spread of the deadly virus if governments and institutions don’t use this as a chance to invade our privacy.

For reference, you can find both Apple’s and Google’s precise technical specifications in the aforementioned links.

If you liked this story and are interested in receiving more of my content, sign up by clicking this link so you can be the first to know when I post new content :)