This is part II of our blog post on Exposure Notification. Our original blog on Exposure Notification was published August 30^th.

Let’s look at the Background

Public Health Agencies around the world and especially in US have had little success with using mobile phones based technology to monitor the spread of Coronavirus and to warn users proactively.

Some public health agencies in the United States and around the world wanted to build mobile apps that would help them track the spread of the virus, through a process known as “contact tracing.” Due to the slow moving government apparatus, legal and procedural requirements and the logistical challenges, few of such program could take off. The contact-tracing apps that were initially launched did not function properly because of certain limitations, primarily the concerns around privacy and collection of data.

Apple and Google announced a surprise partnership at the start of this pandemic in April. When Apple and Google announced their work together on the COVID-19 Exposure Notification API, the companies put behind years of rivalry to join hands to help people and Public Health Authorities fight this massive battle. Apple and Google announced two phases of the Contact Tracing project. During the first phase, which is what came with iOS 13.5, laid out that that users first download an app from their public health authority and then opt-in to Exposure Notifications. The process of Exposure Notification System works through sharing anonymous Bluetooth beacons with nearby devices running the same software, tagging those that suggest extended and close contact associated with coronavirus spread, and saving the last 14 days of these records.

At the same time, Apple and Google also indicated start of work on the second phase, which would reduce the reliance on contact tracing app from public health authorities while bringing the core functions of the COVID-19 Exposure Notification technology directly into iOS and Android. This is essentially what Apple and Google announced on Tuesday, 1^st September.

So what is new in the second phase of Exposure Notifications

Apple and Google announced on 01^st September that their joint program, contact tracing Exposure Notifications System, can inform people of potential exposure to COVID-19 without a dedicated Exposure Notifications app. The second phase of this program, the companies announced, re-launches the warning software in a new and better Avatar, so that state public health agencies can participate without having to create customized apps. This app-less functionality is called Exposure Notifications Express and is only available when a Public Health Authority (PHA) supports it.

The two partners, Apple and Google are introducing new tools that benefit both the public and public health authorities, making it much easier for public health authorities to implement digital exposure notification, while reducing a step in the process for the general users. For public health authorities, now they do not need to worry about the need for developing and maintaining their own individual contact tracing application. Apple made this breakthrough via the iOS 13.7 system update, released 01^st September to general public, while Google is implementing it with an automatically generated application on Android 6.0, upcoming later in September, taking a little longer because of the very different method through which it manages system services and OS updates.

For public health authorities, the new changes bring significant ease of operation as the process of adopting Exposure Notifications Express by users is significantly streamlined compared to adopting the existing Exposure Notification API where users first had to download the contact tracing application. Public health authorities simply provide a configuration file that includes their name, logo, criteria for triggering an exposure notification, and information and protocol that is displayed to users following an exposure. The existing way of Exposure Notification API demanded that users download the contact tracing application from their public health authority first before proceeding with other steps. This was a major headache for public health organizations who were required to maintain their own infrastructure and software application.  Further it was an additional and often confusing step for users. Now that part is completely eliminated benefiting both public health authorities and users.

Further Apple and Google say that they will use the information provided by the public health authorities to offer a fully operational Exposure Notification Systems on behalf of the public health authority directly integrated into their respective operating systems, in case of Apple this is iOS 13.7.

Crucially, Public health authorities still have full control over the system, though, and there are no additional privacy or data related concerns. The Public Health Authorities still dictate and control the process of triggering notifications, what is the language and structure of the advice, and guidance on the next course of action for exposed individuals.

iOS 13.7 changes

With the new Exposure Notification Express, which forms the second phase of Exposure Notification System, the system removes one of the key barriers to adoption that led to a slow start to the software. Once users update iOS 13.7, users can now enable COVID-19 Exposure Notifications directly in the Settings app on their iPhone. This new process is called Exposure Notifications Express. The process is as simple as enabling user preferences in any other application and just takes a few taps, including agreeing to the public health agency terms and conditions of service. Additionally, users will also be able to opt-in to receive a push notification when their local public health authority adopts Exposure Notifications Express.

Once an user enables exposure notifications in the Settings, their iPhone will begin monitoring with Bluetooth to log possible exposures so the user can be notified of a potential COVID-19 exposure based on the guidelines set by the local public health authority. The process of monitoring and triggering Exposure Notification System works without any changes, through sharing anonymous Bluetooth beacons with nearby devices running the same software, tagging those that suggest extended and close contact associated with coronavirus spread, and saving the last 14 days of these records.

At least in the United States, many people haven’t had the option of participating, as states have been slow to create apps. Now, with “exposure notifications express,” states will have less work to participate. Through this simplification pf approach, Apple and Google hope that adaption rate of the Exposure Notifications Express system will dramatically increase, at both levels, from users and public health authorities. The first public health authorities in the United States to adopt the Exposure Notification Express system will be Maryland, Nevada, Virginia, and Washington, D.C.

Users who live in states that participate in the software may get a pop-up notification, prompting them to opt into the program. By following simple steps, they can share their Bluetooth data and receive notifications if they come in contact with another participant who has tested positive. For states that already have a contact tracing application standalone application using the COVID-19 Exposure Notification API, those apps can still exist and operate on their own. As of right now, Apple and Google say that 25 states and territories, representing more than 55% of the population, are exploring Exposure Notifications System solutions.

Finally, Apple and Google emphasize that all of the original privacy protections of the Exposure Notification API also extend to the Exposure Notifications Express. Users must explicitly enable exposure notifications, nothing is enabled by default. No location data is shared and the system does not share your identity with other users, Apple, or Google. All matching is done on-device and users have full control over whether they want to report a positive test.

“I would say this is an improvement,” said Jeffrey Kahn, director of the Johns Hopkins Berman Institute of Bioethics. Kahn, who has been studying the use of technology to fight the virus, said states have been hamstrung by indecision around which technology vendors they should use to build their apps, among other issues. He said this may help speed up adoption, but shouldn’t be considered a magic bullet.

“Public health agencies are carrying an extraordinary load in managing the novel coronavirus response,” said Scott J. Becker, head of the Association of Public Health Laboratories, in a statement provided by the companies. “The easier we make it for state and territorial public health agencies to develop and deploy, the sooner we can expand COVID-19 exposure notification in our communities and help end the pandemic.”

Image Credit: University of South Florida

Exposure notification and Contact Tracing: Essential tools

As the Novel Coronavirus or COVID-19 pandemic has gripped the world, Governments, Organizations and People all over the World are trying desperately to break the vice like grip of this deadly pandemic. With more than 830,000 people dead and 25 million directly infected, and the disease showing little signs of slowing down, the nature of the crisis is unprecedented and unmitigated.

The software development communities across the World have contributed since the start of the pandemic in 2019 by developing apps, data collection programs and frameworks to assist the medical communities and local, state and national or federal governments in their attempt to fight against this pandemic. The indefatigable spirit of doctors and nurses across the world required a solid backing and the tech community came forward unselfishly.

According to Wikipedia, the Exposure Notifications System, originally known as the Privacy-Preserving Contact Tracing Project, is a framework and specification developed by Apple Inc. and Google to facilitate digital contact tracing during the COVID-19 pandemic. Contact tracing is a technique used by public health authorities to contact and give guidance to anyone who may have been exposed to a person who has contracted COVID-19. The project’s aim was to produce a framework to do a digital trace of COVID-19 cases so if one happens to be near someone or in contact with someone who is later diagnosed with COVID-19, one can get a notification and take the appropriate steps to self isolate and get medical help if necessary. Think of it as an Early Warning System for those who came in contact with known or unknown COVID-19 positive people. The reason behind this close collaboration is evident – just like the Novel Corona-virus doesn’t differentiate between people, any efforts to digitally trace the spread of infection must transcend the very human boundaries of technology, software and hardware.

The announcement of this unprecedented collaboration project, a first of its kind among two arch rivals, immediately stoked fears of unreserved data collection and many people started voicing their concerns and feedback started flowing in. The people at large had genuine cause to worry. Tech companies after all have a less than acceptable track record of masking data collection activities while aggressively repudiating any efforts to control their massive arsenal of data-collecting apps.

Exposure Notification makes it possible to combat the spread of the coronavirus — the pathogen that causes COVID-19 — by alerting participants about possible exposure to someone they have recently been in contact with, who has subsequently been positively diagnosed as having the virus. There are three broad parts to this COVID-19 Exposure Notification system. The first part is defining the users. The second part is the feature of communication standard used to communicate between devices. And the third and final part is the contact tracing app developed by the local or state health agencies.

They process of Exposure Notification System woks through sharing anonymous Bluetooth beacons with nearby devices running the same software, tagging those that suggest extended and close contact associated with coronavirus spread, and saving the last 14 days of these records.

The first contact tracing app, Virginia’s COVIDWISE, debuted Aug. 5. North Dakota and Wyoming shipped their Care19 Alert Aug. 13, Alabama launched its GuideSafe app Aug. 17, and Nevada introduced COVID Trace on Monday. The University of Arizona is testing Covid Watch Arizona, with a statewide release expected soon.

So now lets look at the first part. According to Apple, there are two primary user roles identified within the Exposure Notification framework.

So who are the Users?

Affected user -: When a user has a confirmed or probable diagnosis of COVID-19 (as defined by the Health Authority), the framework identifies them as affected and shares their diagnosis keys to alert other users to potential exposure.

Potentially exposed user -: To assign a user the potentially exposed role, use the framework to determine whether a set of temporary exposure keys indicate proximity to an affected user. If so, the app can retrieve additional information such as date and duration from the framework.

How does the Exposure Notifications System work?

The second part of the project concerns with the actual working of the feature and communication.  The Exposure Notification Service is the vehicle for implementing exposure notification and uses the Bluetooth Low Energy wireless technology for proximity detection of nearby smartphones, and for the data exchange mechanism.

The Exposure Notification system is made up of few components, namely Bluetooth keys, an API to communicate, and an app typically distributed by the local public health authorities.

First up, an API or Application Programming Interface is a software intermediary or bridge that allows two applications to talk to each other. Each time some uses an app like Facebook, or sends an instant message, or check the weather on phone, the application is using an API to fetch and display the data.

Apple and Google developed the underlying APIs and Bluetooth functionality, but they are not developing the apps that use those APIs. Instead, the technology is being incorporated into apps designed by public health authorities worldwide, which can use the tracking information to send notifications on exposure and follow up with recommended next steps.

• Contact tracing app download by users – Users download the contact tracing app provided by local public health authorities that are compatible with ENS (Exposure Notification System)

• User opts in to the ENS (Exposure Notification System)

Image Credit: Macrumors

• ENS (Exposure notification system) generates a random ID for user’s device. To help ensure these random IDs can’t be used to identify the user or user’s location, they change every 10-20 minutes.

  

Image Credit: Nevada Health Response

• The user’s phone and the phones around user work in the background to exchange these privacy-preserving random IDs via Bluetooth. The users do not need to have any app open or opt-in or opt-out for this process to take place.

Image Credit: iunera

• User’s phone periodically checks all the random IDs associated with positive COVID-19 cases against its own list.

• If there’s a match, the app will notify the user with further instructions from their public health authority on how to keep user and the people around them safe.

Image Credit: CGTN

Finally, what about Privacy

The Exposure Notifications System was designed with users’ privacy and security at the center and essentially everything else floating around the need to keep contact’s identity secure. An user’s identity is not shared with other users, Google, or Apple. Even a cursory read of the document produced by Apple and Google detailing the specifications and working details of the program reveal that the concerns around privacy may afford to be relaxed at least in the case of this feature. Here’s a look at the top privacy concerns.

• The APIs have been created with privacy and security in mind, and app usage is opt in rather than mandatory.
• User decides whether they want to use Exposure Notifications—it’s off unless user turns it on.
• ENS doesn’t use location data from your device.
• User’s identity is not shared with Google, Apple or other users.
• Only public health authorities can use this system.

Phase 1 of Exposure Notification System

The first phase, released by Apple through iOS version 13.5 on 20 May, 2020 required that users first download an app from their public health authority to opt-in to Exposure Notifications.

iOS 13.7 lets you opt-in to the COVID-19 Exposure Notifications system without the need to download an app. System availability depends on support from your local public health authority. For more information see covid19.apple.com/contacttracing. This release also includes other bug fixes for your iPhone.

This method makes contact tracing significantly easier for public health authorities who won’t have to waste critical time or spend valuable money on developing an app.

So What’s coming

The Exposure Notification System or ENS allows public health authorities to develop apps that augment manual contact tracing efforts while preserving the privacy of their citizens. As of today, public health authorities have used ENS to launch in 16 countries and regions across Africa, Asia, Europe, North America and South America, with more apps currently under development.

Apple likely made the change to use Exposure Notification service without the need for a contact tracing app to quietly encourage more public health departments to use its service. Only a handful of states in the United States and a few countries worldwide are using Google and Apple’s mobile technology. Most health departments still use an old fashioned contact tracing method that relies on in-person interviews and phone calls to locate those individuals who came in contact with an infected person.

Recently, Nevada Department of Health and Human Services started offering its own contact tracing app to use the ENS (Exposure Notification Service) to keep people safe.