Could an app help track the spread of COVID-19 in Canada? Many experts agree that such an app might be useful, but contact-tracing and exposure notification apps are still in their early stages.
Here is how Canada’s COVID Alert app plans to tackle the problem.
How does it work?
The COVID Alert app itself guides users through the basics of the app’s functionality. While enabled, the app sends out Bluetooth signals to all other devices close enough to receive them.
Those signals contain codes, refreshed approximately every 15 minutes, based on a random key that the device generates every day. The app saves each signal that it receives, in addition to the daily keys that it generates, for a maximum of two weeks.
When a person tests positive for COVID-19 in Ontario, they can get an official “diagnosis key” with their COVID-19 test results, which they can then input into the app. Upon entering the diagnosis key, their device sends all of the daily keys it has generated over the past two weeks to a central server.
Participating devices periodically fetch the list of keys that have been uploaded to the server and check them against stored signals they have received from other devices in the past two weeks to find possible matches.
The signals also contain some basic data about the hardware of the device from which they’ve been sent. These can be decrypted when a match is found, and used to determine how far away a pair of devices were when they exchanged signals.
If a stored signal meets Health Canada’s guidelines for close contact — 15 minutes within two metres of each other — then the app alerts its user that they have been in contact with someone infected with the virus and they need to get tested.
It is important to note that every step taken within the app — downloading it, enabling it, and entering a one-time key — requires active consent from the user.
Who built the app?
COVID Alert’s lineage can be traced directly back to the COVID Exposure Notification Framework put out by Apple and Google earlier this year. The framework provides app developers the tools they need to send out the required Bluetooth signals without having to run the app constantly in the foreground of the device.
The Apple-Google framework dictates a lot of the app’s basic structure, and many of the privacy measures in the app are actually enforced at the level of this framework.
“Apple and Google deliberately designed the framework that is included in their devices’ operating systems to resist state-driven mass surveillance,” Christopher Parsons, a senior research associate at The Citizen Lab at the Munk School of Global Affairs & Public Policy, said in an interview with The Varsity.
“The companies recognized that the framework could be used by countries such as Canada, as well as more repressive or authoritarian governments.”
“To this end, the Canadian and other governments are restricted in the information their apps can obtain and disclose,” Parsons continued. “Specifically, [they] cannot and do not collect information pertaining to location or the identity of those who have been proximate to the app’s user.”
The app currently being published by the Canadian government was originally developed by a group of Shopify volunteers, who designed it to integrate with Ontario’s public health system. It is being further developed, maintained, and adapted to the health care systems of other provinces and territories by the Canadian Digital Service (CDS).
Misuse of the app
A lot of the most frequently asked questions about the app have to do with its treatment of privacy — but privacy is actually one of the app’s strongest points. In its review by the Office of the Privacy Commissioner of Canada (OPC), the technical measures taken by the app to protect users’ privacy held up well under scrutiny.
The CDS has also made a concerted effort to make the app as transparent as possible about its use, or lack thereof, of users’ information. For the app to work, it requires public buy-in, and many users are understandably wary about installing an app on their phone that seems to track their contacts.
“It’s one thing to not collect something,” Emily Kuret, a member of the CDS design team, said in an interview with The Varsity. “For us it wasn’t just about making sure that it was private; it was about telling that story and making sure that people really understood it.”
The app also tries to make it very clear to users that its use should be voluntary. However, there are currently no legal ramifications in place for organizations denying service based on app results, or requiring employees to run and download the app as a condition of their employment.
Other countries, such as Australia and France, have passed legislation banning practices that might coerce users into using a contact-tracing app against their will. The Canadian government has declined to pass any such legislation, and instead claims that it will “provide messaging to the effect that individuals should not be required to use the app, or to disclose information about their use of the app,” according to the OPC’s report.
Not only would such a practice be an infringement on users’ privacy, it would likely be ineffective as a measure of their actual COVID-19 status. A possible exposure as detected by the app does not automatically mean that a user has COVID-19. Similarly, an all-clear from the app just means that the user has not come in contact with anyone who has elected to upload their diagnosis key into the app.
Parsons worries that using individuals’ COVID Alert status as a barrier to entry in certain places may lead to practices akin to carding. If security services and law enforcement start checking individual’s COVID Alert status as a barrier to entry in public places, he’s worried they may be more likely to single out and detain racialized individuals or lower-income individuals.
Who the app benefits
It’s important to note that, by itself, COVID Alert can only do so much to prevent individuals from getting COVID. “The COVID Alert app… can be thought of as just one tool from a broader toolbox; just as we wouldn’t attempt to build a house with just a hammer, we can’t expect the COVID Alert app on its own to mitigate the spread of COVID-19,” said Parsons.
Among other things, the app can only work properly when individuals, upon receiving a notification of possible exposure, have the capacity to take time off to get tested and self-quarantine — something that may not be an option for all users. If COVID Alert is to work, it must be paired with appropriate programs that will allow its users the economic freedom to act on its advice.
Users with older phones may not be able to access the app at all. The framework put out by Apple and Google requires phones to have low-energy Bluetooth capability, as well as some cryptography software tools that are only built into the latest versions of iOS and Android, so phones that are more than five years old won’t be able to run the app.
Despite the app’s accessibility concerns, the CDS is adamant that it could still be useful. The government has ruled that the app will only stay in use as long as it proves to be effective.
Starting in the fourth quarter of the year, the Canadian government and the OPC will audit the app to determine whether it’s actually making a significant difference to the government’s health response. The OPC has not yet published the benchmarks by which it will measure the app’s performance, but Health Canada says that it’s tracking — among other things — the size of the app’s user base.
