The two tech giants have teamed up to produce a universal contact tracing app. It’s a rare example of cooperation between the two fierce competitors.

Here’s what you need to know about their contact tracing app.

Why it matters

As most of the world is recovering from a lengthy lockdown and the US is still grappling with its situation, everyone is looking at ways to restart the economy without risking a surge in COVID-19 cases.

Test, track, and trace — this is the mantra of post-lockdown pandemic monitoring. You test as much as possible, you track patients’ contacts to find infection chains, and you trace the spread of the disease. If you don’t do all these things, then you risk a new wave of infections, even more dangerous than the first one. Simply put, any lockdown relaxation without ensuring these measures is a huge gamble that may backfire very quickly.

The testing part is well-established by now. First of all, testing capacity needs to be increased. Testing needs to be focused on vulnerable areas (care homes, hospitals), but mass testing also needs to be deployed. But what about tracking and tracing?

Doing this the old fashioned way (with people doing contact tracing “manually”) is still the best way to go about it, but this is most feasible at the start of an outbreak. The effort and resources needed to ensure tracing when the disease has already spread increase dramatically.

This is where contact tracing apps can help.

The very basic idea of most contact tracing apps is using Bluetooth to check other devices that are in close proximity to you. When someone tests positive for COVID-19, this is sent to the app and everyone who was in proximity to the infected person gets a notification.

That’s the gist of it, but once you look at how the sausage actually gets done, things get very complicated very fast. There are already dozens of apps like this being developed all around the world. Many of them also report the identities of the exposed people to public health authorities, which has raised privacy concerns. Others, such as PACT, BlueTrace and the Covid Watch project, take a more privacy-focused approach.

It is likely that the common Apple-Google app will be the largest player in this field, given that software owned by the two companies cover almost the entire smartphone market.

Centralized vs Decentralized apps

There are two main types of contact tracing apps: centralized and decentralized. Centralized apps take data from people’s phones and save it on an external server. That data is overseen by experts who then make decisions about who gets to see what data.

Decentralized apps, such as the one proposed by Apple and Google, puts users in control of their information. There is no third party that gets to see the data, and alerts are sent automatically. Both Apple and Google have gone as far as banning any apps that use their decentralized API from accessing the location of users and identifying them, putting user privacy at the core.

Both approaches have advantages and disadvantages. The centralized approach is almost certainly the more effective one at tracking the disease. But its advantage may be marginal, and it may be putting people’s privacy in great jeopardy. Oh, and it might also be illegal in some places — many European countries have tight privacy laws which require that people explicitly give their consent for any purpose — and even then, there are legal concerns.

Meanwhile, the decentralized approach makes it more difficult for authorities to track the people who are most likely to infect others, and leave health agencies working somewhat in the dark. Also, data is disclosed only with user consent.

Bluetooth beacons

Because Bluetooth is supported on billions of devices, it seems like an obvious choice of technology for these systems.

The protocol used for this is Bluetooth Low Energy or Bluetooth LE for short. This variant is optimized for energy-efficient communication between small devices, which makes it a popular protocol for smartphones and wearables such as smartwatches. It’s worth noting that Bluetooth can be a major battery drain, but let’s ignore that issue for now and chalk it up to minor inconveniences.

Bluetooth LE communicates in two main ways. Two devices can communicate over the data channel with each other, such as a smartwatch synchronizing with a phone. Devices can also broadcast useful information to nearby devices over the advertising channel. For example, some devices regularly announce their presence to facilitate automatic connection.

To avoid this problem, smartphones broadcast long random numbers that are changed frequently. Other devices using Bluetooth in close proximity receive these numbers and store them, but this tells nothing about the device that sent the signal in the first place — because it’s a random number. The Apple/Google app adds cryptography to this tracing key, and every 10-20 minutes, a new proximity identified is issued.

When someone tests positive for COVID-19, they can disclose a list of their daily tracing keys, usually from the previous 14 days. Everyone else’s phones use the disclosed keys to recreate the infected person’s rolling proximity identifiers. The phones then compare the COVID-19-positive identifiers with their own records of the identifiers they received from nearby phones. A match reveals a potential exposure to the virus, but it doesn’t identify the patient.

A shot in the dark

Ultimately, Apple and Google are looking at ways to implement the contact tracing automatically into phones, without the need of an app, but it’s still early days for that. The first app is set to be released in the second half of May.

If they manage to embed a disease-tracing system into millions or billions of phones, we might have the greatest virus warning system in the history of mankind — it could very well be a tipping point not only in our fight against COVID-19, but also against pandemics of the future.

Of course, no plan is perfect, and this is particularly true when it comes to contact tracing apps.

There is no precedent for this, no established science on how effective this strategy might be. It could be a complete flop. It could end up jeopardizing people’s privacy even with all these protective measures, and it could end up backfiring by opening a multitude of software vulnerabilities. The reality of it is that we don’t know. It seems that it could work, but there are many practical hurdles that need to be overcome.

It’s also important to note that contact tracing apps are in no way a replacement for social distancing measures or testing. It’s only a potential tool in what needs to be a much larger toolbox if we want to deal with the ongoing pandemic.