Contact tracing is going to be very important in the future for the spread of the coronavirus to be contained. Realizing the importance of this, Apple and Google have partnered on a contact tracing/Exposure Notification system for iPhones and Android. There are a lot of questions in the mind of people as to how the tracing feature will work and whether their location will be tracked continuously or not. Read our detailed FAQ on Apple’s contact tracing API to know everything about it.

Despite opposition from France and some other EU countries, a number of other government bodies are expected to take advantage of the exposure notification API from Apple. Until the world gets rid of coronavirus or finds a vaccine for it, contact tracing is going to play a very important role. So, it is important that you know everything about its API as well especially since there is a lot of confusion about its privacy aspect.

Apple’s Exposure Notification API for Contact Tracing FAQ

What is contact tracing? How does it work using smartphones?

Before you read about Apple’s Exposure Notification system, it is important that you first understand what contact tracing is. Since coronavirus can easily transmit from one human to another, governments and health bodies are focusing on contact tracing to stop its spread. What contact tracing basically means is tracing everyone who comes in contact with a COVID-19 patient so that they can be isolated which in turn will help stop the spread of the virus. Using a contact tracing app, governments and health bodies aim to automatically inform users when they have come in contact with a COVID-19 positive person so that they isolate and put themselves in quarantine to prevent infecting other people with the virus.

Below is an image that aptly explains how contact tracing will work using smartphones:

How does this contact tracing API from Apple and Google help? How does it work?

This is where the exposure notification API from Apple and Google comes in. The tech giants realize the importance of a proper contact tracing API which is why they teamed up to create one. With an official API, contact tracing apps from governments and health bodies will work properly on iPhones as well as on Android. There are a number of restrictions in iOS that would otherwise prevent a contact tracing app from working properly in the background thereby limiting its usefulness.

The partnership between Apple and Google is also important here since interoperability between contact tracing apps is a must for the entire process to be successful. This is perhaps the first time that Apple and Google have worked together on an API to ensure that it is interoperable between the two major smartphone platforms out there. Apple and Google are also working on integrating a broader contact-tracing platform by integrating these APIs directly into iOS and Android which should be available in the coming months. This will probably be a part of iOS 14.

It is important to note that when Apple and Google made the first announcement, they called it contact tracing tech. However, since the initial announcement, Apple has made a number of improvements to the API and it is now calling it as exposure notification system.

The API will use Bluetooth on iPhones to send anonymous identifiers to nearby devices that are within range. Other devices will also broadcast such identifiers and receive them. All such identifiers will be stored on the device itself. Whenever a user manually reports themselves as COVID-19 positive, the data is then sent to everyone who is using a contact tracing app. Their device will then go through the log of the devices that they had been within their range over the last 14 days and then inform them if they had come in contact with that COVID-19 positive person. Apple has taken a decentralized approach here as the log of devices remains stored on a user’s device.

How long does one have to be near a person to be counted as being exposed to them?

This will depend on the public health authority making the contact tracing app for your country. The exposure time will be decided based on how long the devices were within Bluetooth range and the signal strength which can be used to deduce an approximate distance. The exposure notification system itself provides a reporting time option in an increment of 5 minutes for up to 30 minutes.

Apple is not releasing a contact tracing app?

Many people are confused thinking that Apple is going to release a contact tracing app. However, that is not the case. The company is only going to provide an API to developers which they can use to create contact tracing apps. This API will only be available to government bodies and third-party app developers cannot use it.

Can your location and other personal data be tracked or collected via a contact tracing app?

No. Your personal data or location history will not be tracked via any contact tracing app that uses the exposure notification system from Apple. The contact tracing tech from Apple and Google does not rely on location tracking. It only uses Bluetooth which is more relevant here. The system will generate random Bluetooth identifiers for your device that change periodically so that a device cannot be tracked. This random identifier is also changed every 10-20minutes for security and privacy reasons.

The log of identifiers will always remain on your device. Apple is also not storing all the logged data in a centralized server, which is something that many countries in the EU are insisting on. It is only when a person reports themselves as COVID-19 positive, the log of random identifiers is uploaded to a centralized server which is then downloaded by other iPhones which then go through it to find if they had come in contact with that person. The entire matching process happens on the device itself to ensure no one’s privacy is at risk.

The exposure notification API is also disabled by default and it is only enabled when one installs a contact tracing app from the App Store. Even after that though, users will need to provide the contact tracing app with explicit permission to use the exposure notification system before it can start working.

What data is shared? And what other security measures have been implemented by Apple and Google?

Apart from using a random Bluetooth identifier, Apple has put a number of other privacy-focused restrictions with its exposure notification system. They are as follows:

• Any app using the exposure notification system must be made by an official government public health authority.
• Apple and Google will try to limit to one official contact tracing app per country, though in some countries, it can create an exception.
• The contact tracing app will need to ask users for explicit permission to use the exposure notification system.
• The exposure notification API is disabled by default and it gets automatically enabled when one installs an official contact tracing app from the App Store.
• Whenever a user reports themselves as COVID-19 positive, the app will need their explicit permission before they send this data to a central server.
• Contact tracing apps should collect only a minimum amount of information that is required for them to work properly.
• At no point will Apple or Google collect any personally identifiable information of a user.
• These apps are forbidden from using any collected information for advertising or other purposes.
• Any contact tracing app that uses the exposure notification API will not be able to access the location data of a device.
• No data will be shared with Google or Apple.
• Apple and Google can turn off exposure notification system on a regional basis when it is no longer required.

What happens if a contact tracing app is not using the exposure notification system from Apple?

A number of countries are not onboard with Apple’s exposure notification system as they want all logged data to be stored on a central server. Australia has already released a contact tracing app COVIDSafe which does not rely on the exposure notification system. While the app has been downloaded over two million times since its release last week, it is not working properly. This is because iOS does not allow apps to run in the background and log Bluetooth data which is what the app is doing. Due to this, the app stops working from time to time, and users are required to open it periodically to ensure it works properly.

France is also set to release a contact tracing app that will not use Apple’s exposure notification system.

How will a contact tracing app know that I have been tested COVID-19 positive?

One will have to manually report into the app that they have been tested positive for COVID-19. To prevent false alarms and the system from abuse, Apple and Google will require some sort of verification of the results. The verification procedure will vary depending on the region, but can include scanning a QR code in the test result or entering a unique test code. Once confirmed and reported, other users who had come in contact with the COVID-19 patient will be informed about it.

When was the contact tracing API announced? Who came up with the idea?

Apple and Google announced the contact tracing API in early April. A small group of engineers at Apple came up with the idea of a contact tracing API while brainstorming on how to stop the spread of COVID-19 in mid-March. Since then, Apple engineers have worked at lightning speed on the project which was codenamed ‘Bubble.’ A number of Apple employees from the healthcare division and location services team were working on the project, with other employees pitching in with additional time.

On the other hand, Google was working on its own contact-tracing technology codenamed “Apollo.” Google’s Dave Burke got in touch with Apple about this project and eventually, the CEOs of both companies decided to work on an interoperable API.

Can contact tracing and the exposure notification system be turned off?

Yes. The user can turn off contact tracing by simply uninstalling the app from their iPhone. They can also turn off exposure notification by going to Settings -> Privacy -> Health and turning off the exposure notifications option under COVID-19 Exposure Notifications.

When will this contact tracing API be released?

In their initial announcement, Apple and Google noted that they would release the API by mid-May. However, Apple released iOS 13.5 beta 3 along with Xcode 11.5 beta 1 towards the end of April with the new contact tracing API. The final version of the API should be available to developers with the final release of iOS 13.5 which should happen towards mid-May.

When will we see the first contact tracing app using this API become available?

Once the official API from Apple and Google is released in mid-May, we should see the first set of contact tracing apps from the public health body of a major country become available within a few weeks after that.

Have any other questions about the Exposure Notification system from Apple? Drop a comment and we will clear all your doubts!