It may be recalled that in a rare show of bonhomie, the two large technology rivals Google and Apple have joined hands to launch a contact tracing app for the novel coronavirus. This app will be an extension of the apps created by various government agencies where if some person affected by the virus gets closer to another person with the app, there will be a warning or notification on the second person’s mobile that he or she is close to an affected person and precautions should be taken.
However, there have been a lot of concerns expressed on the security aspects of the app, especially after the pandemic crisis is over and done with. The two companies have now jointly released a document to explain the whole process including how the apps can be disabled after the crisis is over, as per a report in LiveMint.
Interestingly, the companies are now calling it exposure notification instead of contact tracing.
The bottom line is the app can be uninstalled or turned off, by the user of the device once he or she feels the notification app is no longer required.
As far as the security angle is concerned, it has been clarified that the companies have chosen the Advanced Encryption Standard (AES). The previous thinking was that the Hashed Message Authentication Code (HMAC) encryption method was to be used. To address the concerns of the users, the system envisaged will have the Bluetooth metadata also encrypted.
The paper published by Google and Apple gives detailed explanation on how the app they are developing (the app is likely to be launched by May, 2020) will work and is meant to be a tool to help the health authorities around the world quickly trace people who have come into contact with COVID-19 affected persons so that further spread can be prevented.
They have addressed a separate paragraph on security. It says the user has the authority to turn the technology ‘on’ or ‘off’. Similarly, the sharing of location data is not automatic; the approval of the user has to be obtained before the data can be shared. Tracking of the device is prevented by the Bluetooth beacons being changed every 15-20 minutes.
Finally, Google and Apple can disable this system once there is no need for the contact tracing. There is also the assurance that there will be no monetisation of the data by either Apple or Google.
The paper has been presented in the form of a FAQ addressing most concerns people can have on the data privacy and security aspects.