The Canadian government officially released COVID Alert, its exposure notification app, on Friday. Ontario is the first province to use it with plans to implement it in the Atlantic provinces and B.C. in the near future (other provinces may follow). I posted several tweets about the app, including one that received hundreds of likes and retweets indicating that I have installed it (the tweet included links to the Apple and Android versions of the app). Given the interest, this post expands on the tweet by explaining what the app does and doesn’t do and why I think the government has done a good job of addressing many associated concerns.
There has been enormous attention on the use of apps to assist with countering virus spread in recent months (I wrote a column on the issue in March, was part of the CIFAR group that reported to the National Science Advisor, and I featured podcast episodes on the issue with Lilian Edwards and Alberta Privacy Commissioner Jill Clayton). Many of the initial concerns focused on:
- technological concerns (using GPS rather than Bluetooth, which raised doubts about accuracy and collection of location data)
- effectiveness (using an app to replace conventional contact tracing and testing)
- government surveillance (centralized data collection that could be misused)
- mandatory use of the app (claiming that a voluntary effort would not work or requiring installation as a matter of employment)
- insufficient review or independent oversight
- decommissioning strategy for ending the use of the app
Since many other countries have already introduced apps, some of the issues were addressed elsewhere. A consensus quickly emerged that Bluetooth should be used for these apps, that the technology should not be viewed as a replacement for other essential tracing and testing activities, that app use should be voluntary, and that a decentralized approach in which data resides on the user’s device was preferred.
The Canadian COVID Alert app is ultimately as notable for what it doesn’t do as for what it does. The voluntary app does not collect personal information nor provide the government (or anyone else) with location information. The app merely runs in the background on an Apple or Android phone using bluetooth technology to identify other devices that come within 2 metres for a period of 15 minutes or more. Obviously, the distance and timing are viewed as the minimum for a potential transmission risk. If this occurs, a unique, random identifier is stored on each person’s device for a period of 14 days. After the 14 day period, the identifier is deleted from the device.
The identifier does not identify a specific person or location information, and is not sent to any centralized database. If a person tests positive for the virus, they are given a key code to input into the app. Once the key code is inputted, anyone that was identified as being potentially exposed over the prior 14 days receives a notification that this has occurred and they should consider testing and/or self-isolating.
From a privacy perspective, this is very low risk. Indeed, the government’s position – confirmed in the Privacy Commissioner of Canada’s analysis – is that there is no collection of any personal information and therefore the Privacy Act does not apply. The Privacy Commissioner rightly points out this raises some concerns about the state of the law (arguing it should be sufficiently robust to allow for reviews of this kind), however, the use of random identifiers ensures that identification of individual is very unlikely. Moreover, the Privacy Commissioner’s review concludes that “there are very strong safeguards in place” with security of the data, commitments limiting use, independent oversight, and a pledge to de-commission the app (including deletion of all data) within 30 days of the Chief Public Health Officer of Canada declaring the pandemic over.
The Ontario Information and Privacy Commissioner was also engaged in the review process. Her recommendation letter points to commitments for potential ongoing issues, including ensuring that the app is effective, that there is monitoring of third party components such as the Google-Apple Exposure Notification System, and public transparency associated with the app and its use.
While the app passes legal muster, its introduction reinforces the problems with social inequities that COVID-19 has laid clear. Much like the connection between socio-economic status and infection risk, the app itself is only accessible to those who can afford newer Apple and Android devices. That obviously means that those with older phones or no wireless access at all are unable to use it. While I don’t think that is reason to abandon the initiative, the government should be exploring alternatives to allow all citizens to implement these safeguards.
Moreover, while some have warned against “technology theatre” and the emphasis on contact tracing apps as a substitute for broader policy approaches, the Canadian experience suggests that those warnings have been heeded. The relative ineffectiveness of contact tracing apps elsewhere surely influenced the decision to adopt an exposure notification app which raises fewer privacy concerns and is more effective for its limited goal of notification rather than tracing. Further, the introduction of app months after the emergence of COVID-19 allowed for public study and reports, the use of open code, and the emphasis on the app being only a part of a much larger strategy to deal with a health pandemic.
Yet these reasons were not justification enough for me to install the app. Rather, it is the safeguards combined with the public health benefits that swayed me to do so. Necessity and proportionality are one of the top issues raised by the privacy commissioners. The federal commissioner notes:
While exposure notification apps are new and untested, we believe that in context, the governments of Canada and Ontario have sufficiently demonstrated that COVID Alert is likely to be effective in reducing the spread of the virus, as part of a larger set of measures and subject to close monitoring for effectiveness once the app is in use. The relevant context includes the fact that COVID-19 is novel, has resulted in hundreds of thousands of deaths worldwide, and therefore requires consideration of new mitigation responses with reasonable prospects of success.
The commissioner also called for continuous review of effectiveness and that “the Government of Canada decommission the app if its effectiveness cannot be demonstrated.” In other words, an independent review has found that the privacy risks associated with the app have been addressed and that it is likely to help reduce the spread of the virus. That was reason enough for me – and hopefully many others – to install it.
But is it a battery sucker?
Constantly running in the background and using bluetooth are hallmarks of battery draining apps.
I’ve had it installed since it was available last week and I have seen no difference in battery life for my Pixel 2. Also, this is supposed to use BLE (Bluetooth Low Energy) which uses even less energy and since the phone is technically not connecting to anything with BT the battery is not being used as much. BT is only a battery hog when it’s connected to an actual device like headphones, trackers, etc.
Pingback: #surveillance ##surveillanceCapitalism https://www.michaelgeist.ca/… | Dr. Roy Schestowitz (罗伊)
This app will not work on my iphone. My OS is 12.4. Several other people have the same problem either with Apple or Android phones. This will likely affect pickup since many of us are not going to spring for a new phone just to use the app. And many people do not have new phones in their budget right now either. Even iphone 6 does not work.
Pingback: Canadian privacy watchdogs support COVID-19 exposure app - The News Signal
Hi – thanks for article. I have a couple of questions:
How does the infected persons iPhone (when they enter the code after they have found out that they are infected) let the other persons phone know about the infected person? There must be a link somehow (not just Bluetooth)
We’re you able to do a code review of the app itself?
When a person tests positive, they can choose to upload their random codes to the government server.
Each night, everyone’s phones downloads the complete list of positive codes from the internet and checks to see if any of them match codes it has seen itself.
If there’s a match, the user is alerted to the exposure possibility, and given information on what to do next.
That is the first simple explanation I have seen.
Thanks
Pingback: Canadian privacy watchdogs support COVID-19 exposure app | Canada News & Travel
Pingback: Canadian privateness watchdogs assist COVID-19 publicity app - GossipUM
Might want to read the app’s privacy policy…
Server logs kept for three months?! That seems excessive.
Pingback: Canadian privacy watchdogs support COVID-19 exposure app – Super Health Post
As Canadians in the dark, you need to know this.
BY PROXY MEDICAL CRIMES
This is the Ontario Supreme Court case against Teresa Tam that also names Bonnie Henry, with all of them guilty of participating in medical corruption BY PROXY using foreign influence and funds from people like Gates and foreign groups like the WHO.
Once Bonnie is sued here in BC she will face trial for also colluding BY PROXY with foreign interests to run the first of 2 fake pandemic “simulation” exercises in BC. The second simulation is coming in the fall and will be even harsher to completely destroy what’s left of our economy and groom Canadians to accept forced vaccination laws.
https://m.youtube.com/watch?v=vUZe8aSVDkg&feature=youtu.be
Pingback: Ontario’s COVID Alert app « Quotulatiousness
Pingback: As Michael Geist Touts Contact Tracing App, Problems Are Emerging
Pingback: The COVID Alert App and Privacy Panic – Jonathan Crowe
Pingback: News of the Week; August 5, 2020 – Communications Law at Allard Hall
Pingback: Canada's COVID Alert app is a case of tech-driven bad policy design - The Global Centre for Risk and Innovation
Pingback: Canada’s COVID Alert app is a case of tech-driven dangerous coverage design – Plantingwell
Pingback: Canadas COVID Alert app is a case of tech-driven bad policy design - The Conversation Canada
Pingback: Canada's COVID Alert app is a case of tech-driven bad policy design | Philippine Canadian Inquirer
Pingback: #AxisOfEasy 159: Microsoft Waited Two Years To Fix 0-Day It Knew Was Being Actively Exploited « AxisOfEasy
Pingback: Exposure Notification Technology is Ready for Its Closeup - G20 Intel
Pingback: EFF: Exposure Notification Technology is Ready for Its Closeup | tgh318
Pingback: Exposure Notification Technology is Ready for Its Closeup – SoftMachine.net
Pingback: Publicity Notification Know-how is Prepared for Its Closeup – Plantingwell
Pingback: Exposure Notification Technology is Ready for Its Closeup
Pingback: Exposure Notification Technology is Ready for Its Closeup | GOVfeasance
Pingback: Govt.-Backed Contact-Tracing Apps Raise Privacy Hackles | Threatpost
Pingback: US Govt.-Backed Contact-Tracing Apps create Privacy Concerns – Cyber News Group
Pingback: Govt.-Backed Contact-Tracing Apps Raise Privacy Hackles | Threatpost - CyberSigna
Pingback: Exposure Notification Technology is Ready for Its Closeup – EFF
Hello. It seems to me that when creating this application, they did not think about the owners of old phones or outdated models, as already mentioned in this comment. I, too, do not have a completely new Iphone 6 and I just can’t install the application on my phone. In addition, Bluetooth discharges my battery very much. If I could even install this application, then I had to go constantly with a power bank
They definitely did think of this. There were simply technological constraints that prevented them from doing so.
One alternative would have been a GPS-based device that didn’t respect privacy as well, and was much less accurate. In this respect, they chose correctly, as most countries that went that route have pivoted to this method.
The only other alternative would have been to not implement any app at all.
As for the battery life argument, that hasn’t been my experience at all. I’ve been running the app since launch, and I haven’t noticed any effect.
Is there any way to see the date that i had a potential exposure? I received a notification, and of course got tested, and am now waiting in isolation for my results. I am wracking my brain trying to figure out when I was with anyone…
I looked in the settings a looked at exposure logs, but they only go back a couple of days
Thoughts?
Does this not have potential of people figuring out who exposed them to covid and possibly reacting negatively
Responsible people will isolate if they are tested positive. The application will not notify you if you isolate when get sick. Irresponsible people will never install the application. Therefore the app cannot tell you if you are near irresponsible person.
What is the effectiveness of the app to catch a responsible person who will never put other at risk.
The app retroactively notifies all the people that those “responsible” people have been in near in the prior two weeks, when those people were possibly pre-symptomatic but contagious.
It’s assumed that if you’re positive, you’ll isolate yourself properly. The app doesn’t do anything for that time.
Pingback: Canadian privacy watchdogs support COVID-19 exposure app – My e-Records