6 make-or-break questions about Google and Apple’s COVID-tracking tech

I don’t know if you’ve heard, but hell hath officially frozen over. And you know I have to be serious, because I used the word “hath.”

Yes, indeedly: Google and Apple, better known as Valjean and Javert (or maybe vice-versa, depending on your perspective), have set aside their differences and set out to work together — on a contact-tracing system for this current COVID crisis of ours.

The effort will introduce a standard programming interface to both Android and iOS that’ll be capable of tracking what devices you come in contact with during the day (and/or night, if you’re still being wild). Then, if someone you’ve been near identifies themselves as being sick with COVID-19, the system will alert you that you may’ve been exposed.

The cross-platform concept was revealed last Friday, and I’ve been trying to wrap my head around it ever since. It’s surprisingly complicated and multifaceted — and now, nearly a week after its announcement, I’m finding myself facing more questions than answers about how it’ll work in the real world and what we should make of it.

I often find that thinking through such questions — even those that don’t yet have entirely clear answers — is an effective way to process something and gain a deeper understanding of what we need to watch as it progresses. So fasten on the nearest pondering cap (after thoroughly sanitizing it, of course), and join me for a friendly mull.

1. How many people will opt in to the contact-tracing process?

One core component of the Google-Apple contact-tracing system is the fact that it’s fully optional — and that your phone will be involved only if you explicitly decide to opt yourself into the process. For the foreseeable future, that’ll mean both enabling the system itself and then downloading a third-party app from a public health agency to control it.

So riddle me this: How many people are actually gonna opt in, let alone download an app, to be a part of this?

It’s an important question to consider. In Singapore, where a similar system was put into place, a mere 12% of people reportedly opted in and used the software. Twelve percent! If only 12% of the population is participating, it sure seems like the system would have a tough time giving us any meaningful information about the spread of this virus, doesn’t it?

The answer to that part is an unequivocal yes. For perspective, the Stanford-connected Covid Watch organization — “a group of over 100 academics, public health experts, and technologists” — estimates that a contact-tracing system would need a 60% adoption rate in order to make a consequential impact. Can you imagine 60% of Americans (a) agreeing to opt into this sort of system, (b) actually following through with it, and (c) then using the app accurately and effectively?

And speaking of accuracy and effectiveness…

2. How effective will Bluetooth be for this?

The entire Google-Apple COVID contact-tracing system revolves around Bluetooth — yup, that same technology you curse daily for disconnecting your headphones or failing to connect correctly to your car. And there are all sorts of questions about how well it’ll work for these purposes.

The basic idea is that if someone passes within six feet of you and then later determines they have The COVIDs, they can pass that diagnosis along to the app on their phone. That’ll cause their app to transmit its identifying code to a central server somewhere. Your phone will then check in with that server, as it does periodically, and will detect that you’ve had some manner of contact with the infected person, since the same code from the server would be stored locally on your device. And so it’d then alert you to that risk, ideally with an obnoxiously loud 90s-era “Hello, Moto” jingle.

But, well, a few things. First, Bluetooth can detect connections from distances of much greater than six feet — so the fact that the software logged contact between you and the infected person’s phone doesn’t necessarily mean you were exposed in any worrisome way.

Beyond that, Bluetooth can detect connections when you’re passing by a room or a building, where an actual wall is separating you from the other person and thus there is no physical contact. Could it consistently determine the difference between that kind of interaction and the kind in which a person is standing in your face and breathing on you for seven minutes?

What about the difference between someone passing you briefly on the street, five feet away, and someone standing over your shoulder for 10 minutes (the latter of which, suffice it to say, seems likely to put you at a much higher risk of contamination)? It sure doesn’t seem like it’d account for that kind of contrast — nor does it seem like it’d have any way of discerning the difference between a rapid pass near someone wearing a mask and a prolonged point of contact with someone panting on your patella (hey, I don’t know what sorts of shenanigans you get up to).

In a different but not entirely unrelated scenario, people in Israel have reported receiving notices of potential exposure after having only distant contact with an infected person — something as minimal as waving to them from outside of an apartment building.

All considered, it’s probably still better than nothing. But is it truly going to be effective? It’s tough to say.

On a similar note:

3. What’ll it take to report a positive case to the system, and how often will we see such reporting — or, on the flipside, false reporting — actually happen?

For now, at least, this system seems designed to rely on people self-reporting diagnoses to an associated app on their phones. The specific details of how exactly that’ll go down are apparently still being worked out, but the general goal seems to be that a public health agency would give out a special code following a diagnosis, and it’d then be up to the diagnosee to input that code into their app to begin the alerting process.

That makes me wonder: How many people, even after they’ve opted into the system, will actually follow through with reporting an infection? It’s easy to imagine someone simply failing to remember to do so, particularly in the midst of such a diagnosis and everything that surrounds it. It’s equally easy to imagine someone opting against active reporting for fear of being ostracized in some manner (despite the fact that no actual identifying information is being shared as part of this system, as we’ll discuss more in a moment).

At the same time, while the use of the health-agency-provided codes is clearly designed to prevent misuse and reporting of false positives, you know there are gonna be some obnoxious miscreants who make it their business to crack said codes and try to wreak havoc just for the hell of it. Will they be able to succeed? And will the code-dependent system be a permanent part of this system or just a short-term element for its early days?

The answers are still somewhat murky — as is this:

4. What about people who are COVID-positive but not showing symptoms?

As we’ve all surely read a zillion times by now, the scariest part of this mess is the potential for people who have the virus but haven’t been tested and aren’t showing symptoms to unwittingly pass it on to others. And particularly with the barely-there testing being done in the U.S. right now, Google and Apple’s contact-tracing system will have no way of identifying such carriers.

For perspective: Data from the Covid Tracking Project indicates that roughly 3 million COVID-19 tests have been performed in the U.S. as of Tuesday. That’s less than a single percent of all Americans. All other questions about the system aside, a contact-tracing plan can only be as effective as the data it has to work with. And here in the States, that data is still next to none.

5. How long will it take for the full OS-level implementation to arrive?

Google and Apple’s tracing system is coming in two separate phases: First, sometime in May, both companies will put out the operating-system-level programming interfaces that allow the health agency apps to tap in and start offering their services. Then, sometime “in the coming months,” that’ll be followed by an expanded setup in which the actual contact-tracing function is built directly into both Android and iOS.

That second phase will still be an opt-in affair, but it won’t require you to download a separate app in order to receive alerts — and the less friction involved with a process, the more people are bound to participate.

As those of us who follow Google closely know, though, “in the coming months” can mean almost anything. And right now, we have no real indication of when this higher, more-likely-to-be-broadly-adopted level of functioning will actually arrive.

6. Should we be worried about privacy?

You can’t talk about something like contact tracing without talking about privacy. After all, by its very nature, contact tracing is technically a form of surveillance. And there’s certainly going to be some level of concern about how much information we’re giving up and what sorts of precedents we’re accepting in exchange for this service.

Here’s what we can say right now: First, the fact that the system is totally opt-in alleviates much of the immediate worry along the lines of “Egads, my phone is suddenly tracking me without my knowledge!” Second, it’s important to understand that the system doesn’t collect any manner of actual location data — just relative proximity data between your phone and other devices enrolled in the effort.

It’s also designed to use constantly cycling anonymous keys to establish those connections and to avoid transmitting or maintaining any sort of master list of connections. Instead, it leaves it up to each individual phone to calculate and track its own interactions.

What’s more, Google and Apple have both pledged to use this system for COVID-related contact only — not for advertising or for any other business purpose. And they’ve both explicitly promised to dismantle the network entirely once this current threat has passed. But even so, some folks are raising concerns about the potential implications of opening this door and the possibilities, slim as they may seem, of the data being hijacked and manipulated in a disconcerting way. And there are bound to be people who feel wary of any manner of tracking-related activity, regardless of what’s involved.

All in all, it’s heartening to see two tech companies that are typically at odds teaming up to try to do something positive on this front — but with all the unanswered questions and the asterisks surrounding ’em, it almost feels more like building a foundation for the future than creating something likely to have any measurable, immediate impact.

Still, even if that’s the only tangible result from this, it could be worthwhile — so long as the limitations of our current situation don’t cause the system to create a false sense of security or a counterproductive panic.

For now, all we can do is watch carefully, wait anxiously, and keep asking questions.

Sign up for my weekly newsletter to get more practical tips, personal recommendations, and plain-English perspective on the news that matters.

[Android Intelligence videos at Computerworld]