Maryland health officials rolled out the MD Covid Alert system on Tuesday, a new cellphone program jointly launched by Apple and Google, in an attempt to improve the state’s contact tracing operation. The software, already available in similar forms in other countries and in some states, enables users who opt in to receive notifications if they have come into contact with someone who has tested positive for COVID-19, the disease caused by the coronavirus.
The Exposure Notification Express software, which would be automatically built into iPhones and could be downloaded via app for people with Google phones, gives those who agree to its terms a series of unique “keys,” or identification codes. If a person with the software or app tests positive for COVID-19, the keys of other individuals the person has come into contact with within a 14-day period via Bluetooth would be uploaded to the digital server. Those individuals would then receive notifications about possible exposure.
But experts in information systems and bioethics said the apps might not be launched in a timely enough fashion to make a significant difference and that a critical mass of users would be needed for full efficacy. And, some said the app’s data collection processes could go too far — or fall short.
Here’s what you should know about the Exposure Notification Express software.
How exactly will it work?
Suppose Person A opts in to the software or downloads the app, and then comes into contact with someone who then tests positive for the coronavirus.
Assuming both parties have opted in, Person A will get a notification about possibly being exposed to COVID-19 only if Person B gets tested and reports the positive result to his or her local health department. The system will then send “exposure notifications” to all the people who have been near Person B in the past 14 days without identifying Person B as the exposure source. The system only holds 14 days’ worth of contacts at a time.
[ How to add your voice to our coverage of COVID-19 in Maryland ]
It’s then up to Person A to get tested and report his or her result to a health department to keep the chain of transmission knowledge going.
It’s not clear how close people have to be to one another or how long they need to be in proximity to qualify as contacts.
This system does not factor in people without smartphones or those who do not opt in. In that sense, the “digital divide” between the technologically equipped and the ill-equipped persists. Those without smartphones or who do not participate will be subjected to state-run contact tracing operations.
It’s unknown how many people need to opt in for it to work
In an “ideal” world, everyone with a smartphone would have the ability to enable the software to run on their phones. But since only so many people have smartphones — and only a subsection has iPhones — and not everyone will choose to be included in the notification system, a chunk of the population will be left out no matter what.
Apple and Google building a platform outside a traditional app for iPhone users to install means that the companies want to make it as easy as possible for swaths of people to opt in, said Jeffrey Kahn, director of the Johns Hopkins Berman Institute of Bioethics. Having to download an app and create enough storage space to do so could reduce mass inclination to join the ranks.
And, without the typical alpha and beta testing phases, much remains unknown about the software’s capability in a limited environment, Kahn said.
[ Here are the known cases of coronavirus in Maryland [GRAPHICS] ]
“How widely adopted would this need to be to be widely effective? We don’t know yet,” he said.
Dobin Yim, an associate professor of information systems at Loyola University Maryland, said other countries such as South Korea and China have had some success with cellphone systems, but did not tend to have problems establishing a critical mass due to those countries’ attentiveness to public welfare at the expense of privacy starting at the highest levels of government. That success might not be replicable in the United States.
“Are we willing to make that sacrifice in the interest of maintaining public order and lessen the impact of pandemic, or does that cost too much because it collides with the fundamental understanding of what this country is about?” he said.
Representatives from Maryland Gov. Larry Hogan’s office did not respond to questions about the effectiveness of voluntary software or downloadable apps.
Concerns about privacy could be overblown
By allowing people to opt in (and out) of the system at their own discretion, Apple and Google have “put user privacy at the forefront of this exposure notification technology’s design,” according to a joint response form designed for frequently asked questions.
They also outlined a series of other steps meant to discourage people from having concerns about privacy, including giving people randomly generated keys multiple times every hour to reduce tracking capabilities; allowing people to opt in and give consent before their COVID-19 test result is shared with a public health official; and eliminating the companies’ abilities to use location data or other identifiers to locate or name individuals.
[ Maryland coronavirus updates ]
Google and Apple have also pledged not to monetize the data — meaning they will not sell it.
“Consistent with well established privacy principles, both companies are minimizing data used by the system and relying on users’ devices to process information,” according to the FAQ response form.
Still, software developers have, in the past, faced data breaches and problematic leaks, Yim said, and that remains a possibility with every app and system that launches. That possibility “may or may not be real” or impactful with this specific system, he added.
Kahn said the minimal amount of nonspecific data collected with the Exposure Notification system may limit the degree of severity that could result from a breach.
He said since the software works with Bluetooth data and not GPS or location data, tracking a person’s whereabouts would be nearly impossible if just assessing the information in the server alone. A person can agree to get notifications about their possible exposure but is not required to get tested or report those results to health departments, which could leave gaps in the chains of transmission.
Breaking News Alerts
Phones using Bluetooth are also not intelligent enough to discern whether two people are far enough apart to avoid exposure through aerosolized particles or whether there’s a barrier between two people — or sufficient mask-wearing — that could lead to false conclusions, Kahn said.
“It doesn’t trace contacts or report to public health authorities, so in that sense, it’s really limited,” Kahn said. “This was built in the most privacy-preserving way, but is that the best approach to serving public health needs?”
It’s important to remember that the system is called a notification system, not a contact tracing one, he added.
“This was not meant to replace humans, but to augment an impossibly large requirement for contact tracing,” Kahn said.
Patrick Mulford, a spokesman for Maryland Department of Information Technology, said state officials do not see an enhanced risk to privacy by using the application.
“That being said, we will be testing the application to make sure that it is up to our data privacy standards before it is rolled out to the public,” he said in an email. He said there was not yet a time frame for when the system could be made public to Marylanders.