I often use this column to warn about the dangers of apps that track you. This time, I’m going to recommend you actually install one.
There’s a new kind of app that uses your smartphone’s Bluetooth wireless signals to figure out when you’ve been in contact with someone who has been diagnosed with covid-19. It pops up the world’s most stressful-yet-helpful notification: “You have likely been exposed.”
For about a week and a half, 35 Washington Post staff members have been helping me test America’s first exposure-notification app using technology from Apple and Google. It’s called Covidwise, and works in the state of Virginia. Made by state health departments, similar apps are also now available in North Dakota (Care19 Alert), Wyoming (also called Care19 Alert), and Alabama (Guidesafe). In total, 20 states and territories are developing apps that will cover nearly half the U.S. population.
My takeaway: Despite its eerie power, this type of app isn’t a privacy invasion. It never records your location or shares who you come in contact with. But it’s also possible apps like Covidwise aren’t very effective – in our team’s first 10 days of testing, we didn’t get a single exposure alert.
To really discover the potential of this tech, lots and lots of us would need to use it. You’ve not got much to lose, and there’s a lot we could all gain.
Exposure notification apps may be 2020′s biggest tech debut, and also its most misunderstood. A number of governments, and even some businesses, have tried making coronavirus contact-tracing apps with pretty mixed results. In April, Apple and Google announced they were working together on a way to track exposure with iOS and Android that would be less of a privacy invasion. Health authorities expressed doubt about the usefulness of their system, and months passed without much progress.
A big part of the problem has been trust. A poll by The Post and the University of Maryland found most Americans were not willing or able to use an app to track coronavirus infections. When it comes to privacy, the government and tech companies have done little to earn our faith. Edward Snowden showed us the government has few qualms about spying on citizens. CEOs like to say we’re “in control” of our data when we’re so clearly not.
Nobody was more surprised than me that this new generation of apps actually seems to take privacy seriously. I put Covidwise under a microscope – tracing the flow of its data and grilling its maker – and found little reason to take it off my own phone.
Like wearing masks, to benefit from using this kind of app, people around you need to be using them, too. Exposure apps are off to a slow start in other countries, and some experts estimate up to 60 percent of a population needs to be using exposure apps for them to be effective. For Virginia, that could mean 5 million volunteers; in its first week, Covidwise got 357,000 downloads.
The state, for its part, hasn’t articulated a goal. “We just think that for every download, you’re bettering the chances we can slow the spread of covid-19,” Julie Grimes, Department of Health spokeswoman, said.
Here’s what you need to know before you install an exposure-notification app yourself.
– It’s pretty easy to use. Covidwise, like other exposure apps using Apple and Google’s new tech, is free. Installation takes under a minute, and it runs in the background so long as you leave your phone turned on.
You will need a compatible smartphone and need to possibly update your operating system. Any Apple phone since a 2015 iPhone 6S should work, or most Android phones able to run Android 6 – that goes back to 2014’s Samsung Galaxy S5.
Look for two things when you download: First, the app should be made by your health department. Second, there’s a subtle distinction in what these apps are called. “Exposure-notification” apps like Covidwise keep you anonymous. “Contact-tracing” apps help health authorities track the spread of the disease but could share more of your information with the government.
– There’s no national system (yet). The most confusing part of exposure-notification apps is that every state is making its own.
What if you travel between states? Virginia’s app continues to operate when you’re elsewhere, but can only interact with other phones also running Virginia’s app. But the Association of Public Health Laboratories has announced it’s working on a system that would support all states and allow people to receive alerts even when they travel.
Late last week, the popular safety app Citizen launched its own Bluetooth exposure-warning system called SafeTrace. I haven’t had a chance to test it yet, but I would warn that it doesn’t use Apple and Google’s framework and requires you trust Citizen with personal data.
– It won’t kill your battery. A few of our testers on Android phones reported a small decrease in the daily battery life of their phones, but for the most part we didn’t notice much of a hit.
These apps take advantage of a special Bluetooth capability in recent updates to iOS and Android. It allows phones to send out little wireless chirps a few times per second – and also listen out for them for four-second stretches every two and a half to five minutes. Bluetooth signals don’t require nearly as much power as cellular signals.
– It won’t spy on you. This part is key: Covidwise and apps like it don’t collect your phone’s location. Instead, they use a clever system that helps phones remember who you were around without knowing where you were.
To put it another way, a random weather app you downloaded is likely doing far more to put your privacy at risk.
Here’s how it works: Covidwise listens for those Bluetooth chirps from nearby phones, which contain random codes. They change frequently, and don’t contain any personal information about the people you meet. Your phone stores the codes you encounter for 14 days, just in case one of those people tests positive for coronavirus. After two weeks, it deletes them.
If someone using Covidwise does test positive, the patient can report their diagnosis in the app by entering a six-digit code provided by their health department. That gives Covidwise the permission to alert phones that have their own records of encountering the patient’s codes – without sharing anything about his or her identity.
It’s possible, in theory, that police could seize your phone and look at the codes it has saved and try to match them up with the codes on someone else’s phone. But that would require physical access and a lot of technical hassle.
“Apple and Google have done a pretty good job of balancing the privacy risks,” said Bennett Cyphers, a staff technologist at the Electronic Frontier Foundation. “If I lived in Virginia, I think I would try it, mainly out of curiosity.”
The bigger challenge may be that the focus on privacy also means health officials get almost no useful data from these apps. They can’t be used for contact tracing – all they provide is anonymous nudges to individuals who should get tested. In fact, even you won’t learn where or exactly when you might have been exposed.
– We don’t know how well it works. In our first 10 days, none of our Virginia testers got any exposure warnings. That could mean our testers were all practicing safe social distancing, or that there are just too few people using the app. But it also could mean the app is bad at measuring exposure.
Covidwise defines “exposure” as being within six feet of someone for 15 minutes. (It doesn’t have to be a contiguous 15 minutes – it would still count if keep running into someone in short bursts at the grocery store.) Of course, it has no idea if you or the people around you are wearing masks or what the airflow was like.
At best, it’s a rough estimate. To figure out if you come within six feet of someone, the app measures the strength of the Bluetooth wireless signal coming from his or her phone. But Bluetooth was developed for taking calls and listening to music, not measuring distance. And as anyone who’s owns a pair of AirPods knows, Bluetooth is flaky and lots of things can interfere with it.
I couldn’t independently test exactly how the Covidwise responded to real-life situations – it doesn’t provide a live report on devices it senses. But Bluetooth, which has a natural range of 30 feet, can go through some windows and walls, depending on their materials.
You can visualize this by walking with your phone away from a Bluetooth speaker and seeing when it conks out. Or for a fancy science experiment, download an app such nRF Connect or BT Inspector, and look to see how the signal strength of devices changes as you move away.
– Even if these apps are a flop, your risk is low. What’s the worst thing that could happen if you use Covidwise? You could get a false positive alert, like from a neighbor on the other side of a wall. That would stress you out and also make you take a coronavirus test you didn’t need – but likely not hurt anyone.
Perhaps a bigger problem: You could get no results, which might lead you to be more reckless or wrongly assume you hadn’t been exposed.
“That’s what we really don’t want to have happen,” said Andrew Larimer, an engineer at a company called SpringML that made Covidwise for Virginia’s Department of Health. New research on Bluetooth signals, he said, helped the app developers calibrate their software, which was designed to err more toward false positives.
“It’s one of the reasons our system doesn’t say, ‘You have been exposed.’ It says, ‘You have likely been exposed,'” he said.
There are society-wide concerns, too. Some security experts say, in theory, a hacker could sow discord – or even mess up election day – by hijacking Bluetooth signals and sending out a whole bunch of false alerts.
Virginia’s system combats hackers by permitting only state health department workers to hand out the codes needed to unlock a positive diagnosis in the app. If someone types in too many unlock codes, or the system gets too many codes at once, it shuts down.
– It’s not magic. Other countries have forced people to use coronavirus tracking apps to prove they’re obeying quarantine, or as a passport to enter certain buildings. I think being voluntary is core to Americans’ willingness to trust these apps – even if it makes it much, much harder to gain critical mass.
But even if they catch on, exposure apps aren’t a magic bullet for America’s deeper pandemic challenges. The function of Covidwise is premised on people having access to testing that turns out results quickly enough for the information to be useful.
Apps are also no replacement for the hard work of human contact-tracers, who help provide warnings to everyone, regardless of whether they’re using an app or even have a smartphone. Nor can they replace the measures we already know are effective at fighting the coronavirus: staying at home, wearing masks and washing your hands.
– – –
The Washington Post’s Seth Blanchard contributed to this report.