Apple and Google today independently released guidelines public health authorities must follow to distribute contact tracing apps on Google Play or App Store for Android and iOS respectively. Guidelines for automated decentralized contact tracing apps to fight COVID-19 include a prohibition on location data collection, a limit of API use to one app per country, and no use in targeted advertising. The Exposure Notification API relies on Bluetooth Low Energy only, but contact tracing apps in some parts of the world collect GPS data.
Existing apps will be able to continue, but apps being made to use the Exposure Notification API will not be allowed to use Location Services, an Apple spokesperson told reporters in a call today. Apple and Google spokespeople said the limit of one API use per country is to reduce fragmentation and increase adoption, but the companies said they will be flexible to work with countries where state or regional approaches are taken.
The guidelines also emphasized requirements that apps be created by or for government public health authorities, seek user consent before sharing test results and Diagnosis Keys associated with a device, and perform data collection only for COVID-19 response efforts, previously mentioned by Apple and Google.
The companies also jointly introduced user interface and sample reference code today for public health authorities around the world developing apps that use the Exposure Notification API to combat COVID-19.
As many governments and public health authorities consider ending shelter-in-place orders, a number of governments and public health authorities have been in touch with Apple and Google, an Apple spokesperson said in a call with reporters today.
The news today comes about a week after the CDC released preliminary criteria for public health authority use of contact tracing apps, which recommend decentralization for apps using Bluetooth for contact tracing via the TCM Protocol or PACT Protocol. The CDC also recommends that solutions using GPS follow an approach like the kind makers of Private Kit: Safe Paths developed at MIT; however, a number of privacy advocates have cautioned against use of geolocation data due to the difficulty involved with anonymizing that data.
Both TCN Protocol and PACT Protocol members say they advised Apple and Google in weeks before the companies joined forces last month in an unprecedented partnership. Decentralization is generally recommended by privacy advocates to ensure information only leaves a device with user consent and no central repository of user data.
Apple and Google introduced initial versions of its API for public health officials to begin testing apps last week. The companies also introduced more control for public health officials and a formal change of the API’s name to Exposure Notification instead of Contact Tracing in a previous update.
Among sample UI imagery shared today, Apple and Google shared the user interface with use of diagnosis keys — a code that confirms diagnosis following a positive test.
In an ideal circumstance, codes can be dispensed following a diagnostic test. In a call with reporters last month, an Apple spokesperson said a positive test result won’t become a requirement for Exposure Notification API use in order to serve areas where access to testing becomes an issue and verification comes instead from something like a clinical assessment. To ensure public confidence when a person gets a notification that they’ve come in close contact with a person with COVID-19, COVID Watch executive director Tina White told VentureBeat people should only be allowed to send alerts following a diagnosis by a health professional or public health authority.
Apple and Google have repeatedly emphasized that any app to help combat COVID-19 requires public trust, and indeed trust may be a major hurdle for adoption for COVID-19 contact tracing apps using the Apple-Google solution. A Washington Post-University of Maryland poll released last week found that a majority of U.S. adults are unwilling or unable to use the Apple-Google solution.
You can't solo security COVID-19 game security report: Learn the latest attack trends in gaming. Access here