How the COVID-19 alert apps work

Are you on the front lines of the coronavirus? Help us report on the pandemic.

Pennsylvania just released a COVID-19 alert app that will tell users if they’ve been in close contact with someone who has tested positive for the new coronavirus. Delaware launched its app last week, and New Jersey has one in the works.

The hope is these apps will help with contact tracing, which up until now has relied on locating people who come into contact with someone else who tests positive for the virus.

Contact tracing works if you know the people you’ve been close to. But it doesn’t work if you’re around strangers, or you forget who you have been close to, or you just don’t respond to contact tracers’ attempts to reach you.

Pennsylvania Gov. Tom Wolf said that around 75% of people will respond when contacted by a contact tracer. The thinking is that with the app, more people will be aware if they have been close to someone who has tested positive.

Pennsylvania and Delaware are part of a collaboration with the Association of Public Health Laboratories, so someone who travels to a different state does not need to download a different app to get exposure notification alerts. The contract for the app in Pennsylvania is $1.9 million in federal grant dollars. New Jersey announced last week it would use a similar app, but would first pilot it on a few college campuses.

But the app will be effective only if people are willing to download it and upload positive COVID-19 test results, so Pennsylvania and Delaware health authorities are promoting the privacy protections.

How does the app work?

The Pennsylvania and Delaware apps use a Bluetooth platform from Apple and Google that sends out random strings of numbers, called chirps, that other smartphones with the app can hear and record. Those numbers change every 10 to 20 minutes.

If someone tests positive, the app on that person’s phone can upload all the random numbers the phone has sent out to other phones in the past 14 days. Another person  with the app can download that list of numbers, and that person’s phone can match the list against the numbers it has come into contact with. Because the matching is done on the user’s phone, not a government database, only the user knows if the phone has matched with another one.

If there’s a match showing you have been in close contact with someone who tested positive, you can choose to get tested. If you get a positive result, you can put that into the app to alert the other app users you have been close to. Close contact means being within 6 feet of another phone for at least 15 minutes.

By design, all those steps require someone using the app to actively do something, said Marc Zissman, who worked on the app. He’s the associate head of the cybersecurity and information sciences division at the Lincoln Laboratory at MIT.

“Let’s look at how private that is,” Zissman said. “I was a sick person, what did I do? I uploaded all the chirps that I sent over the past two weeks, but those chirps, they had nothing about me in them.

“You, as the person who is the contact, all you did was you downloaded all those chirps and you compared them to find that you were close to somebody who was sick. It didn’t tell you it was me that you were close to, it just told you that, ‘Hey, you’ve been near somebody who was sick.’

“It’s up to you whether or not you even want to call your public health authority and let them know you have gotten one of these warnings or not,” he said. “I suppose you can just quarantine yourself for two weeks … it would be better if you let the public health authority know, but you don’t have to do that.”

Zissman said the team behind the app chose to focus on privacy because they wanted a system that could work in other countries.

“Not every country is a liberal democracy … we wanted to be sure that it protected the privacy of people around the world, not just in places where we have a good Bill of Rights.”

He added that the source code for the app, from the Irish developer NearForm, is available online, so people can see exactly what it does.

Why are people worried about privacy?

Some have expressed concern about privacy issues with COVID-19 exposure notification apps.

Last week, when Delaware released its app, it encouraged all state employees to download it. A public school teacher told WHYY News that she originally considered it an “invasion of privacy” and was skeptical that the app would not gather information such as location data. After she learned how the app works, she is reconsidering.

Part of her hesitation came from reports that health authorities in Norway had to suspend their app and delete all their data because the data protection authority there said it intruded on people’s privacy. Norway’s app does not use the Bluetooth framework from Apple and Google and transmitted both Bluetooth and location data to a central server.

Last month, TechCrunch reported that a small liberal arts college in Michigan asked students to download a contact tracing app from a private company, which tracked students’ locations and had a security vulnerability that could lead to an attacker inferring a student’s COVID-19 status. Parents started a petition to make that app optional. Bucknell University in central Pennsylvania also uses that app, but the school says students can choose to turn off location tracking.

How much data a COVID-exposure notification app gathers is a trade-off between user privacy and easy contact tracing.

Some countries chose tracing. For instance, Australia does not use the Apple and Google model because authorities there want contact tracers to have access to information about people who may have been exposed to the coronavirus. Singapore made the same decision. The foreign minister explained in June that Apple and Google’s approach is less effective and does not give authorities information about how and when people were infected.

Can an app really help with contact tracing?

It’s too early to say for sure. Switzerland was the first country to adopt an exposure notification app using the Apple and Google platform, and, in research that has yet to be peer-reviewed, researchers say there is some early evidence that it does help.

Privacy protections actually make this hard to study. The Swiss researchers note that “restriction of information to users’ devices means that data needed to evaluate the effectiveness” has to be gathered elsewhere.

Also, the app depends on whether people can easily get tested.

“It’s a way of supplementing traditional contact tracing — it’s not a silver bullet, it doesn’t stand by itself,” Zissman said. “But it is a way using technology to maybe do a little bit better in this pandemic than we’ve been able to do before.”

Will people use it?

Switzerland and Ireland were early adopters of the Apple and Google exposure notification technology, and people there are at least downloading the app.

As of August, around 33% of the Irish population had downloaded that country’s app. A national survey in Ireland that has yet to be peer-reviewed showed that more than 80% of people surveyed would be willing to download an exposure notification app, with the major reason being that it would help family and friends.

The app in Switzerland was downloaded 1.6 million times in July, but the number of active users has been dropping since.

As of Sept. 23, more than 56,000 people had downloaded the Pennsylvania COVID alert app, and more than 25,000 people had downloaded the app in Delaware.