Can a smartphone app help stop the spread of COVID-19 in Canada?
The federal government thinks so, with the recent announcement that a new contact tracing app called COVID Alert will soon be tested in Ontario, for potential use across the country.
The app, developed by the province, Canadian Digital Service, Shopify and BlackBerry, is slated for release in early July. It’s meant to bolster the work of contact tracing, alerting people via their smartphones if they may have come into contact with someone who has tested positive for COVID-19.
The problem? Experts say at least 60 per cent of the population must download and run the app for it to be effective. And that’s no easy feat.
A similar app in Alberta, ABTraceTogether, which launched May 1, has more than 207,000 downloads to date, according to a spokesperson, in a province with almost 4.4 million people. This means just 4.75 per cent of the population has downloaded the app.
Canada isn’t the first country to launch such an app. Singapore and Australia did so before Alberta, and the Alberta app was built using open-source code from the Singapore version. Germany launched one earlier in June, becoming the latest European country to do so.
So how do these apps work? Why aren’t more people using them? And how can the government convince people to take part?
The Alberta app and COVID Alert both use Bluetooth, not GPS, meaning users’ locations aren’t tracked. Instead, when two people with the app come within a certain distance of each other, the apps communicate with Bluetooth signals, logging a “digital handshake” as proof the two phones have been near each other.
If someone who has the app contracts COVID-19, they put that information into the app, and anyone with the app who has come into contact with that person within a certain time period will be notified on their phone. In Alberta’s case, users receive a phone call, but only after consent has been given to authorities to share the information.
When someone is notified, they do not receive information about where, when or from whom the contact originated, and the app does not generally collect personal information, although the Alberta app does ask for a phone number, to be used for notifications. With both apps, all data collected is designed to be destroyed within a certain number of days — 14 in Ontario after it’s collected, and 21 in Alberta.
There are a few key differences between ABTraceTogether and COVID Alert, explained Teresa Scassa, Canada research chair in information law and policy at the University of Ottawa.
COVID Alert uses the new Google-Apple system, a partnership announced April 10 and launched May 20. Scassa said this is the most privacy-protective model.
“It collects the least amount of data and ensures that that data is destroyed as soon as possible,” she said.
COVID Alert is fully decentralized, she said, meaning the notification of COVID-19 contact comes through the app at the user’s initiation and not from a third party, such as a health official; notifications automatically come through the app once a user has notified the app that they have tested positive.
Alberta’s app is decentralized until the user contracts COVID-19 and notifies the app, at which point they can choose to consent to the government accessing their tracing data in order for an official to reach out to their contacts.
As Alberta’s app doesn’t use the Google-Apple system — it was launched before the system was rolled out — it’s difficult to use for iPhone users, who must leave the app open and running with their screen unlocked for it to work. This won’t be an issue for COVID Alert, said Scassa, as the app will be able to run in the background. (The iPhone problem could be fixed in future iOS updates.)
Scassa said when it comes to public health safety, “privacy is never an absolute right,” and users should make an informed decision about whether to download a contact tracing app. But as no country has yet to have had significant success with these apps, it’s hard to convince people to download one, in turn making it hard to figure out how effective they are, she said.
“These apps have yet to prove themselves,” Scassa said, adding that they shouldn’t be seen as a “silver bullet” but as part of a broader approach. For example, if testing isn’t widely available, the apps won’t work since they rely on test results.
Florian Kerschbaum, director of the Waterloo Cybersecurity and Privacy Institute, said when it comes to contact tracing, Bluetooth is far better for privacy than GPS.
He said COVID Alert and ABTraceTogether are very similar, except that Alberta’s app is meant to enhance manual contact tracing — done by real people, reaching out by telephone — while COVID Alert isn’t part of manual contact tracing, since notifications are automatic.
Kerschbaum said contact tracing apps are an example of something called the privacy paradox, where people are concerned about privacy in principle, but will willingly give up private information for a small reward.
That’s why many people will use Facebook or Google Maps or other apps that record data, even location data, but won’t download a contact tracing app — because the app doesn’t benefit them as much as it benefits others.
“The app is very similar to a face mask … my face mask protects you, your face mask protects me.”
Kerschbaum explained that much of the information people are concerned about sharing — location, for instance — is already in the hands of Google and Apple and other companies. Meanwhile, public health agencies have information such as people’s test results and contact information.
“All you need to do is link the two,” he said, adding that the app is essentially a “social contract” allowing this to happen.
He said he’ll be downloading COVID Alert when it’s available, but he’s less sure about the Alberta app, mostly because of the government’s approach to it.
He said transparency on the part of the government is key in developing these apps so that the public feels informed, and the Alberta app came as a surprise.
“The Alberta government has made a major mistake in not involving the public from the start,” he said.
Scassa said she’s concerned the national app won’t be able to cover the whole country, because it needs to have the buy-in of provincial health agencies, which do the testing. And if the app isn’t compatible between provinces, that could severely impact its effectiveness, she said — such as in places like Ottawa, where Gatineau, Que., is just a short drive across the border, and many people work in one city but live in the other.
For Fay Arjomandi, president and CEO of mimik technology, privacy is a major concern when it comes to contact tracing apps, and she thinks this will prevent their use. Like Scassa, she noted that in some apps, a user’s data is private until they contract COVID-19, at which point they turn their data over to the public health agency.
On May 21, Arjomandi presented to the House of Commons’ standing committee on industry, science and technology alongside Google and IBM. She said she’s trying to show the government that her company’s patented “hybrid edgeCloud” computing platform is a more secure way of deploying these apps.
With this technology, the phone acts as its own server, detecting exposure and storing the exposure log on the device instead of sending it to a central system, she said. If a user tests positive for COVID-19, instead of sending their test ID to a public health authority and allowing the authority to access their data, Arjomandi’s platform would allow the user to send out their own anonymous alerts using a token, eliminating the central third party.
“If somebody gets infected, it can initiate a … community broadcast message from the device, and without sharing any information,” she said. “I am the clou
d, I am the provider, I am the identity — and now an app can utilize this on my device.”
Like Kerschbaum, Arjomandi wants more accountability from the governments developing these apps.
“It’s important that we have a transparent conversation.”
With files from Rob Ferguson
Rosa Saba is a Calgary-based reporter for the Star. Follow her on Twitter: @rosajsaba
