Image Credit: University of South Florida

Exposure notification and Contact Tracing: Essential tools

As the Novel Coronavirus or COVID-19 pandemic has gripped the world, Governments, Organizations and People all over the World are trying desperately to break the vice like grip of this deadly pandemic. With more than 830,000 people dead and 25 million directly infected, and the disease showing little signs of slowing down, the nature of the crisis is unprecedented and unmitigated.

The software development communities across the World have contributed since the start of the pandemic in 2019 by developing apps, data collection programs and frameworks to assist the medical communities and local, state and national or federal governments in their attempt to fight against this pandemic. The indefatigable spirit of doctors and nurses across the world required a solid backing and the tech community came forward unselfishly.

According to Wikipedia, the Exposure Notifications System, originally known as the Privacy-Preserving Contact Tracing Project, is a framework and specification developed by Apple Inc. and Google to facilitate digital contact tracing during the COVID-19 pandemic. Contact tracing is a technique used by public health authorities to contact and give guidance to anyone who may have been exposed to a person who has contracted COVID-19. The project’s aim was to produce a framework to do a digital trace of COVID-19 cases so if one happens to be near someone or in contact with someone who is later diagnosed with COVID-19, one can get a notification and take the appropriate steps to self isolate and get medical help if necessary. Think of it as an Early Warning System for those who came in contact with known or unknown COVID-19 positive people. The reason behind this close collaboration is evident – just like the Novel Corona-virus doesn’t differentiate between people, any efforts to digitally trace the spread of infection must transcend the very human boundaries of technology, software and hardware.

The announcement of this unprecedented collaboration project, a first of its kind among two arch rivals, immediately stoked fears of unreserved data collection and many people started voicing their concerns and feedback started flowing in. The people at large had genuine cause to worry. Tech companies after all have a less than acceptable track record of masking data collection activities while aggressively repudiating any efforts to control their massive arsenal of data-collecting apps.

Exposure Notification makes it possible to combat the spread of the coronavirus — the pathogen that causes COVID-19 — by alerting participants about possible exposure to someone they have recently been in contact with, who has subsequently been positively diagnosed as having the virus. There are three broad parts to this COVID-19 Exposure Notification system. The first part is defining the users. The second part is the feature of communication standard used to communicate between devices. And the third and final part is the contact tracing app developed by the local or state health agencies.

They process of Exposure Notification System woks through sharing anonymous Bluetooth beacons with nearby devices running the same software, tagging those that suggest extended and close contact associated with coronavirus spread, and saving the last 14 days of these records.

The first contact tracing app, Virginia’s COVIDWISE, debuted Aug. 5. North Dakota and Wyoming shipped their Care19 Alert Aug. 13, Alabama launched its GuideSafe app Aug. 17, and Nevada introduced COVID Trace on Monday. The University of Arizona is testing Covid Watch Arizona, with a statewide release expected soon.

So now lets look at the first part. According to Apple, there are two primary user roles identified within the Exposure Notification framework.

So who are the Users?

Affected user -: When a user has a confirmed or probable diagnosis of COVID-19 (as defined by the Health Authority), the framework identifies them as affected and shares their diagnosis keys to alert other users to potential exposure.

Potentially exposed user -: To assign a user the potentially exposed role, use the framework to determine whether a set of temporary exposure keys indicate proximity to an affected user. If so, the app can retrieve additional information such as date and duration from the framework.

How does the Exposure Notifications System work?

The second part of the project concerns with the actual working of the feature and communication.  The Exposure Notification Service is the vehicle for implementing exposure notification and uses the Bluetooth Low Energy wireless technology for proximity detection of nearby smartphones, and for the data exchange mechanism.

The Exposure Notification system is made up of few components, namely Bluetooth keys, an API to communicate, and an app typically distributed by the local public health authorities.

First up, an API or Application Programming Interface is a software intermediary or bridge that allows two applications to talk to each other. Each time some uses an app like Facebook, or sends an instant message, or check the weather on phone, the application is using an API to fetch and display the data.

Apple and Google developed the underlying APIs and Bluetooth functionality, but they are not developing the apps that use those APIs. Instead, the technology is being incorporated into apps designed by public health authorities worldwide, which can use the tracking information to send notifications on exposure and follow up with recommended next steps.

• Contact tracing app download by users – Users download the contact tracing app provided by local public health authorities that are compatible with ENS (Exposure Notification System)

• User opts in to the ENS (Exposure Notification System)

Image Credit: Macrumors

• ENS (Exposure notification system) generates a random ID for user’s device. To help ensure these random IDs can’t be used to identify the user or user’s location, they change every 10-20 minutes.

  

Image Credit: Nevada Health Response

• The user’s phone and the phones around user work in the background to exchange these privacy-preserving random IDs via Bluetooth. The users do not need to have any app open or opt-in or opt-out for this process to take place.

Image Credit: iunera

• User’s phone periodically checks all the random IDs associated with positive COVID-19 cases against its own list.

• If there’s a match, the app will notify the user with further instructions from their public health authority on how to keep user and the people around them safe.

Image Credit: CGTN

Finally, what about Privacy

The Exposure Notifications System was designed with users’ privacy and security at the center and essentially everything else floating around the need to keep contact’s identity secure. An user’s identity is not shared with other users, Google, or Apple. Even a cursory read of the document produced by Apple and Google detailing the specifications and working details of the program reveal that the concerns around privacy may afford to be relaxed at least in the case of this feature. Here’s a look at the top privacy concerns.

• The APIs have been created with privacy and security in mind, and app usage is opt in rather than mandatory.
• User decides whether they want to use Exposure Notifications—it’s off unless user turns it on.
• ENS doesn’t use location data from your device.
• User’s identity is not shared with Google, Apple or other users.
• Only public health authorities can use this system.

Phase 1 of Exposure Notification System

The first phase, released by Apple through iOS version 13.5 on 20 May, 2020 required that users first download an app from their public health authority to opt-in to Exposure Notifications.

iOS 13.7 lets you opt-in to the COVID-19 Exposure Notifications system without the need to download an app. System availability depends on support from your local public health authority. For more information see covid19.apple.com/contacttracing. This release also includes other bug fixes for your iPhone.

This method makes contact tracing significantly easier for public health authorities who won’t have to waste critical time or spend valuable money on developing an app.

So What’s coming

The Exposure Notification System or ENS allows public health authorities to develop apps that augment manual contact tracing efforts while preserving the privacy of their citizens. As of today, public health authorities have used ENS to launch in 16 countries and regions across Africa, Asia, Europe, North America and South America, with more apps currently under development.

Apple likely made the change to use Exposure Notification service without the need for a contact tracing app to quietly encourage more public health departments to use its service. Only a handful of states in the United States and a few countries worldwide are using Google and Apple’s mobile technology. Most health departments still use an old fashioned contact tracing method that relies on in-person interviews and phone calls to locate those individuals who came in contact with an infected person.

Recently, Nevada Department of Health and Human Services started offering its own contact tracing app to use the ENS (Exposure Notification Service) to keep people safe.

Image Credit: Techcrunch

In an industry which is not limited by any conventional restraints, Apple® has once again proven to the thought and market leader in promoting what it’s users want. It is not however what Apple® has promised to do, as its customer and user-centricity is quite legendary, rather it’s the timing of the changes that is quite interesting.

During the Worldwide Developers Conference (WWDC) held remotely for the first time, Apple® announced some new privacy and security features for iOS. Apple®’s 31st Worldwide Developers Conference 2020 was a digital-only event kicked off June 22. WWDC is Apple®’s annual Worldwide Developers Conference where developers can attend sessions and meet with Apple® engineers and this year’s event witnessed Apple®  debut iOS 14, iPadOS 14, macOS Big Sur, tvOS 14, and watchOS 7. The online event typically allows millions of developers worldwide to get close proximity access to future versions of iOS, iPadOS, macOS, watchOS, and tvOS, as well as engage and network with Apple® engineers and community through engineering sessions, one-on-one lab appointments, and the revamped Apple®  Developer Forums. The event for the first time had no physical gathering in California due to the ongoing global health crisis, making everyone sorely miss the Networking and touch and feel of events like this.

During this year’s event, Apple® provided a full digital WWDC experience with online keynote, a Platforms State of the Union for developers, technical and design-focused engineering sessions, Apple® Developer Forums with Apple® engineer participation, and one-on-one developer labs. Apple® also hosted a Swift Student challenge, though winners received a jacket, pins, and virtual one-on-one lab sessions with Apple® engineers rather than free admission to WWDC.

Image Credit: appleinsider

With the new changes Apple® announced, publishers need to quite very much overhaul their entire value offering to stay compliant. As compared to the earlier practice of virtual free for all, publishers will now be required to provide information about their app’s data collection practices while explicitly seeking permission from their users to track the users’ shadow across apps and websites owned by other companies. This is a major change for the industry players, since thus far, users were required to opt-out if they wanted from sharing their data and identifiers with third party networks. To aggravate the matters, the opt-out process itself in most cases was not straightforward, with self-regulation and delayed actions in most cases giving no real out to the users. This gave the publishers of the app a virtual free rein to use the users’ implied consent in any way the publishers deemed fit. That all is set to change as now with the new changes, users will have to explicitly opt-in within their apps to allow tracking or sharing of their data.

The updates mean that you can limit how much location information is shared with apps — only allowing it approximate data rather than your precise whereabouts. Apple® also introduced recording indicators through an orange dot on your status bar that will tell you when your camera or microphone is activated. Apple® also introduced labels for app permissions to inform people how much data an app requests before they download them. The feature will show people those labels in two categories, on “Data Linked To You” and “Data Used to Track You.”

The last few years have seen an entire new industry segment open up which specializes in driving users to download an app, accessing user information, sometimes with consent, sometimes without, then tracking users across apps, collecting data and then selling the data, a process leading to shortcut of app monetization. Instead of charging user to use the app, the app pays itself through tracking, collecting and selling user data. While users complained, and while the more privacy minded users combed through the fine print of legal agreements and terms of conditions or terms of services for each app they installed, most users even those who were concerned, just shrugged and moved on. Most users just took it as the cost of using apps.

An important point to note here is that apps don’t exist in isolation or in silos. There is almost a complete app ecosystem, and as with any ecosystem, the app ecosystem requires continuous sustenance. From App development to app launch and promotion, to making the app stick with target audience, then capturing and tracking of data, and finally utilizing the data, are key parts of the ecosystem. On the technical side, or for the more technically minded, Apple® uses something called an IDFA, the Identifier for Advertisers (IDFA), which is a random device identifier assigned by Apple® to a user’s device. Advertisers use this to track data so they can deliver customized advertising. Each IDFA contains no personal identifying information, or PII, instead serving to measure and identify user interactions with ad campaigns, installs, and in-app activity. Some industry insiders put the value of app driven advertisements in iOS in excess of $45 billion dollars.

Just looking at the app development itself, unarguably the first step towards launching an app, there can be no mistake in gauging the potential of the industry. Skipping all the factors in cost breakdown, a median price to create an app by specialist agencies was found to be $171,450, while many online app cost calculators provide a price tag between $200,000 and $350,000 for an app with dozens of features. Small apps generally cost much less – apps with few basic features could cost between $10,000 and $50,000, indicating there’s an opportunity for any type of business to make a decent ROI. Needless to say, this potential saw anyone and everyone jump headfirst in to the fray.

Aided with technological advancements like microservices and APIs, it is no surprise that making, launching and monetizing apps has become big business. For a while, it really seemed to be the Wild, Wild West, with no real control, oversight or accountability.

Image Credit: cnet

The above is however set to change in a big, yet unprecedented way in near future. The upcoming changes will make it harder for app publishers, advertisers and marketers to track and target users across apps, creating a level of uncertainty on how that industry will work from now on. The changes are expected to improve transparency on users’ privacy, but they will also have an impact on the current app’s economy and how apps monetize. Some of the most important players in that space such as ad networks and attribution networks will be immediately affected.

According to a recent survey of iOS and Android users, 68.3% of iOS and 67.5% of Android users will likely deny tracking permissions if they are requested in-app to opt-in. With Android sure to follow, this is definitely good news for privacy minded and not-so-privacy-minded users alike as the move spearheaded by Apple^® will strengthen the privacy laws in the entire marketplace.

Some critics do feel that it’s not big tech or app developers pushing back, it’s the GDPR in Europe that is forcing companies like Apple^® to announce such measures. Coupled with an increasing awareness of the privacy violations that have been suffered by average consumer over the last decade or more, firms are bound to act sooner than later. While this may be partially true, there is no denying that the end result is what privacy advocates have always wanted.

To summarize, the upcoming privacy changes in iOS as announced in WWDC are forecasted to have a significant impact not only on how apps monetize their audience and how advertising and attribution networks work, but also the entire app ecosystem. The study showed that a large proportion of the users will not allow themselves to be tracked, a crucial step in effectively running and attributing ad campaigns in the apps space at the moment. Similar findings were also revealed with Android users. Privacy seems to be a key concern among users in the mobile space and providing them with more transparency and choices seems to change the current app landscape dramatically.