The app is currently being developed by Birmingham-based tech company MotionMobs, in collaboration with the Alabama Department of Public Health and the University of Alabama at Birmingham. It would notify users if they spent about 15 minutes or more within 6 feet of someone who later tested positive.
The app will use Bluetooth signals to determine whether other cell phones have been in close proximity, but will not record or store users’ locations or identify the users, according to Dr. Selwyn Vickers, Dean of UAB School of Medicine and chair of the re-entry task force for the University of Alabama system.
“It has no location identity, it has no tracking capacity,” Vickers said. “It's a voluntary tool and it really will build itself on a culture of individuals valuing the power of the information to help keep a community safe or a school safe.”
Alabama is one of four states so far to announce that it will work with Apple and Google to develop an app using their API (application programming interface), which includes limits on what the app can and cannot do in order to protect users’ privacy.
“This is actually the most private and secure option for contact tracing that exists,” said Emily Hart, director of consulting and marketing for MotionMobs, which is building Alabama’s app. “The app does not track your location. If the app were to attempt to access your GPS, it would get rejected from the [app] store."
"It does not ask for your name, or your email address, your birthday, or ask for any personally identifiable information. It also cannot access any other data on your phone.”
Sue Feldman, associate professor and director of UAB’s graduate programs in health informatics, is leading UAB’s efforts to develop the tool. She said the companies’ privacy safeguards were an important consideration in selecting an app.
“One of the reasons why we went with the Google-Apple app is their strict privacy concerns,” Feldman said. “There are other applications that do the same thing that are out there, but they disclose too much information, and we just felt like that was not appropriate for our state.”
How it Works
The app, once installed, will allow phones to broadcast a unique “key,” a chain of characters that serves as an identifier to other cell phones within close proximity through Bluetooth signals.The app will automatically change your phone’s key every 10-20 minutes to a new random string of characters but will record the keys of associated phones that you come in contact with. Later, if a person tests positive for COVID-19, they can voluntarily enter that information into the app.
The app will then send an alert to phones that used those unique “keys” over the past 14 days, advising that they may have come in contact with a person who tested positive. The log of “keys” will be deleted after 14 days.
“The app really functions like a little black box,” Hart said. “It just sits there, it distributes its keys and it collects its keys, and there is nothing else that the app knows how to do.”
Hart said the keys are the only information exchanged, and even a list of keys would be of little use in tracking a person without knowing all the different keys a phone used.
“Because those keys are randomized, anonymous, and they change so frequently, even if somebody were to try to intercept keys, they're not personally identifiable,” Hart said. “And because the keys are then bundled and encrypted, it's a worthless package. It doesn't tell you anything about the user. It doesn't tell you anything about where they've been. It is meaningless data, unless you are evaluating it through the exact same, secure algorithm.”
The notifications would only occur once per day, and only after someone reports a positive test, so users will not be alerted immediately when they enter in the proximity of someone who has tested positive.
“I think one of the misunderstandings is that if I'm at the supermarket, and somebody in front of me has been diagnosed with COVID-19 that I'm going to get an alert on my phone,” Feldman said. “That's just not how it works. It's completely anonymous. You never know the location [where you encountered a person who reported a positive test], you never know the person [who reported a positive test].
“We're trying to change the messaging so that people understand what it truly does and what it really is, and what it doesn't do as well.”
That basic framework will apply to all states who design an app to use the interface released by Apple and Google, but the states will be allowed to set their own thresholds for what constitutes close contact.
This setting is one of the more important and delicate customization options in the app.
If the app is too sensitive, and reports every passing contact, a large number of people will get mobile alerts who in reality have little danger of having contracted the disease. Too lax and the app may miss people who have a greater chance of being exposed.
In Alabama, the sensitivity settings are being configured with consultation from ADPH and UAB, based on a number of factors, including the distance between the phones and the length of time they are in close proximity. Hart said that generally speaking, the app will focus on notifying people who are less than six feet apart for at least 15 minutes.
Other Options
While Alabama and three other states have announced they will use the Apple-Google API and conform to its privacy protection standards, other states have used separate apps that do not have those privacy protections in place.Utah uses an app that can transmit information about symptoms to the state’s public health agency and allows public health workers to use location data for contact tracing, if the user opts in.
North and South Dakota used an app called Care19, which was found to be violating its own privacy policies by transmitting users’ location data to a third party company.
One reason is the immediate availability of those apps which have already been running for weeks, and the fact that apps that use location tracking data can offer more features than the more limited Apple-Google apps. Those apps could also help state health departments do contact tracing, as Utah’s app does, or provide more feedback on where infected people have traveled.
Alabama’s app is being called a contact tracing app, but it will not send data to the health department to help with contact tracing. It will only notify individual users who may have been exposed so that they can voluntarily limit their contact with other people, especially those who may be vulnerable due to age or health conditions. This early warning could be particularly useful with COVID-19 since people can transmit the virus before they develop symptoms, or even if they only develop mild symptoms.
Feldman said a less invasive tool with more users would be more helpful than a stronger tool that was less widely used.
“When we think about trying to mitigate exposure and contact during a pandemic, we want more people using it,” Feldman said. “So the risk of having fewer features and more people using it, it's worth that risk, because the value is in the people using it, not really in the features.”
The American Civil Liberties Union released a white paper highlighting privacy concerns associated with these apps, stating that the Bluetooth apps compatible with Google and Apple were preferable to those that use GPS location data, and that the Bluetooth apps “could be even more privacy-preserving than traditional contact tracing,” because no direct contact or identifying of an infected person is required.
“I think, with all due respect about the concerns of being tracked and monitored, this is our best tool,” Vickers said. “Realizing that, no one wants undue invasion of privacy. We certainly don't and we don't believe Apple or Google do either.”
What’s Next?
Feldman said the team expects the app to be finished next week, with testing being performed once the updates to the operating systems are rolled out.“Apple and Google have to update all of our operating systems on our phones,” Feldman said. “Once they do that, then we'll be able to do some [quality assurance] checks and make sure that everything is still working and behaving as intended. Then we'll be able to put it up to the Apple, Google markets for people to download.”
Once the app is available, the ADPH, UAB and other institutions will try to get as many people to register as possible. Vickers said the UA system will strongly encourage students and employees at UAB and the Tuscaloosa and Huntsville campuses to participate.
UAB has also reached out to private employers like Regions in Birmingham to encourage participation. Regions spokesperson Evelyn Mitchell said the company has been in communication with UAB about the app, but had not currently developed plans to use it.
“We are encouraged by the progress being made to develop a contact tracing application,” Mitchell said. “However, at this time, we do not have specific plans in place to use the application.”
Vickers said that while the app has limitations and concerns, it represents the best tool available to limit spread of the virus through reopening.
“I think it gives us our best chance for actually surviving through this without undue damage and havoc,” Vickers said. “And having a chance to move into a future where we may eventually get a vaccine."
Feldman said the desire to protect themselves and others from the virus will be a key motivation for downloading the app.
“Historically, in times like this, people want to help,” Feldman said. “They want protection and they want to protect others and so I agree that it will be a culture change, but I don't think it's going to be as hard as we had anticipated [to encourage adoption].”
Vickers agreed, citing people who are afraid to go to the hospital for fear of being infected or become concerned when they see others not wearing masks.
“I think there will be a small vocal few who say, ‘I don’t want my privacy invaded,’ but I think there will be a big majority who will endorse this to say ‘We want to do all we can to protect our community,’” Vickers said.
©2020 Alabama Media Group, Birmingham. Distributed by Tribune Content Agency, LLC.
