How Apple and Google Employees Help Healthcare Officials Track Coronavirus Together

Singapore's contact tracking application, TraceTogether, used as a preventative measure against the spread of coronavirus

One of the most ambitious projects in Apple’s history was launched in less than a month, and only a few employees worked on it.

In mid-March, when coronavirus spread to almost every country in the world, a small team from Apple launched a brainstorming session on how they can help people. They knew that smartphones would be the key to responding to the pandemic, especially in countries where self-isolation would begin to weaken. To prepare for this, governments and private companies have created contact tracking applications that track the movement of people and determine whether they can make contact with the virus.

For several weeks, several dozen employees have already joined the Apple project, code-named Bubble, who were supported by two people at the level of company executives. These are Craig Federigi, senior vice president of software development, and Jeff Williams, chief operating officer, and de facto head of the health department. By the end of the month, Google officially joined the project, and about a week later the directors of the two companies, Tim Cook and Sundar Pichai, held a virtual meeting to agree on joint approval of the project.

Such a high development speed was uncharacteristic for Apple, a company obsessed with the desire to bring products to perfect condition before release. The Bubble project also called for joining forces with Google’s historic enemy, Apple, to jointly develop technology that healthcare officials around the world could use.

This program, whose task instead of “contact tracing” is now characterized by Apple and Google with a milder term, “notification of exposure”, was due to be released on May 1. In previous weeks, workers worked nights and weekends, trying to take into account all the feedback. Companies have critics, but the transparency of the work has helped them gain support from unexpected parties - including the German government, which initially did not seek to cooperate with technology giants.

CNBC talked with five people who were closely acquainted with the project to find out how it developed from the very beginning to this day [article of April 28 / approx. transl.]. Sources wished to remain anonymous, as companies did not allow them to expand on this topic.

Two approaches: Bluetooth vs GPS

Eduard Bunion, Swiss Software Architect

Traditional contact tracing has been used to slow down the spread of pandemics for many years. It all starts with how the health care system finds out about the sick and clarifies with him where he was and with whom he could contact. Then the representative of the health system monitors these people and offers them to be tested or socially isolated.

Personal devices such as cell phones can be used to digitally track contacts. Various phone technologies can be used to track places visited by the user, as well as other phones approaching him. The user is not required to remember exactly where he was and who was nearby.

Since the onset of the coronavirus pandemic, governments have begun to consider digital contact tracing as one of the possible ways to help track and slow the spread of the disease without involving a large number of staff that track people’s movement.

Some of the earliest contact tracking apps, such as TraceTogether from Singapore, use a Bluetooth signal on the phone, whose range is about 10 meters, to see if the phones are close to each other. A strong signal indicates that people are close, and a weak one means that they are far enough to be infected (although experts, in particular, Ashkan Soltani, a former technical director of the Federal Trade Commission, warnedthat this system cannot be considered ideal in any way).

If a coronavirus was found in a person, the Singapore Ministry of Health could examine the application data and notify other people recently approaching the user.

However, the application has a big usability problem.

On the iPhone, the application must always be in priority mode, because in the background it stopped working. This meant that the phones had to be worn unlocked - which would have had terrible consequences if they had been stolen - and that they would have eaten up the battery too quickly. Among the reviews on the application in the Apple App Store, there are complaints that the application does not allow you to receive notifications when working.

An alternative method is to use GPS, a system that China and South Korea have already used to track contacts. However, apps that track a user's location always raise objections from privacy advocates. One group of human rights defenders even called Chinese tracking apps "automatic tyranny."

Apple request

On March 21, Swiss professor Eduard Bunion contacted Apple's public relations team to voice some of these issues. Bunion, founder and CTO of VMWare, realized that Apple’s help would be needed for tracking apps to work well and protect privacy.

And he was not the only one. A few days later, Mung Cha, Apple’s responsible for the business strategy of the healthcare company’s team, drew attention to these problems. Chief Ch, as the chief strategist at the company’s healthcare department, is COO Jeff Williams.

Cha, along with a small team from Apple, have already studied how to use smartphones to track contacts. First, the team included Ron Juan, the manager of the location services group, and Guy Tribble, nicknamed “Bad,” one of the company's oldest developers, and vice president of software development, which the company calls the “king of privacy”. Tribble, among other things, has a medical background, and outside of Apple is known for calling for a legal right to privacy. In the Senate in 2018, he stated that confidentiality should be declared an inalienable human right.

Juan agreed to include a group of developers willing to do it on a voluntary basis. It included cryptography experts Yannick Sierra and Frederick Jacobs (Jacobs was involved in developing the Signal secure messaging application). The team began to research protocols for electronic contact tracking that were already being developed at the Massachusetts Institute of Technology and the Swiss EPFL.

The idea was to use Bluetooth to track proximity, without processing detailed travel data, as the Singapore-based application does — without the need for applications to work all the time.

Apple employees also called for a decentralized approach. Let the user's phone, the analysis of which for a coronavirus test give a positive result, anonymously send notifications to other phones located nearby, instead of uploading all the information to the server of the government or other government agencies. This will prevent governments from creating a database with detailed location or proximity information.

The Apple team also believes that any such system should be voluntary, and the person should give their consent to share information with other phones.

Cha shared such thoughts during a telephone conversation with Bunion on April 6. “From the very beginning, it was clear to me that Apple wanted to maintain the highest level of privacy,” Bunion recalls.

The team knew that she needed to act quickly. By that time, health officials in many countries were already taking the idea of ​​contact tracing seriously as a way to help complete self-isolation faster in a safe way.

A team of researchers from Oxford University has already received promising results from their theoretical model. “Our models show that the epidemic can be stopped if 60% of people use this application. And even with fewer users, we get a reduction in the number of deaths and infections, ”said Christoph Fraser, chief author of a new report from the medical department at Oxford University. Nuffield.

Google invitation

Dave Burke, vice president of development at Google during the presentation of the new Google Nexus 6P phone in 2015,

Google employees talked about similar ideas.

Key Google employees who took control of the development are Yul Kwon, senior director of privacy, former deputy director of privacy at Facebook (by the way, Kwon is known outside of Google as the winner of the 2006 television show Survivor: Cook Islands), and Ronald Ho. Senior Product Manager, working in the field of Bluetooth and other communication systems. Google has its own code name for this project: Apollo.

In the end, the team presented their ideas to Google’s vice president of Android, Dave Burke, who discussed them with Apple's Cha.

The cooperation of companies that have long been competing in the smartphone market has not been resolved. Apple co-founder Steve Jobs was sure that Android was made to simulate iOS, and the two companies fought hard in court until they settled the debate in 2014. Although today they coexist in a more peaceful mode, they remain competitors managing the two dominant smartphone platforms in the world [Android - 86.1%, iOS - 13.9% in 2019 / approx. transl.].

However, in this case, they had to cooperate. The proximity notification system needed to be able to work with all devices, otherwise large gaps would have formed in the coverage.

Formally, the two companies could not announce plans for cooperation until they were allowed to do so by their leaders. Therefore, Apple Director Tim Cook and Alphabet Director Sundar Pichai discussed this issue at a virtual meeting a few days before the official announcement on April 10.

“Contact tracing can slow the spread of coronavirus by doing this without violating user privacy,” Tim Cook triumphantly proclaimed in his announcement tweet.

Privacy situation

As a result, the companies agreed not to make the application. Instead, they published an application programming interface — an API — that is, a set of specifications that healthcare organizations can use to create their own contact tracking applications.

How does it work ? After turning on Bluetooth and allowing the user, the phone sends anonymous signals that other phones can pick up. Apple has designed the API so that an iOS application can send out signals even if it is not in priority mode.

To maintain confidentiality, companies borrowed ideas from various open source projects, such as PACT from MIT and the European DP- ³ T. Burke acknowledged that his team was especially inspired by the DP- ³ T protocol [decentralized contact tracking with confidentiality], and noted that he “provided the most important aspects of contact tracking service for maintaining confidentiality.”

One specific example born from DP- ³T is the idea of ​​using cyclically changing codes when an application distributes randomly changing cryptographic keys by tracking other phones nearby. After the user informs about the confirmed diagnosis, the application uploads to the server the cryptographic keys used to generate codes for the past few weeks. Applications of all other users will download these keys and will look for a match with those stored in them. If a match is found, the application will notify the user who could approach the diseased.

This allows the application to notify people who may have been exposed to the disease, without revealing their identities and preventing the authorities from tracking them and storing information about them.

“We are developing an application and a system that can be deployed in Europe and around the world,” said Carmela Troncoso, a privacy researcher at EPFL, one of the key developers of DP- ³ T. “A lot of people will use it, and we must be transparent for them".

Companies are constantly explaining to the public that their API will not be such a way to automatically track contacts that you could completely rely on. He must support people working in the healthcare system. Some countries are already adopting it - for example, Germany, Estonia, Singapore and Switzerland. Other countries, such as Britain and France, are still considering the possibility of more centralized approaches. In the United States, each state acts on its own.

Questions remain regarding the potential for fraud and the malicious use of technology. Companies need to think through a process to approve applications built using these APIs to ensure that developers do not take advantage of privacy vulnerabilities.

Marcel Salate, a prominent Swiss researcher and epidemiologist, tweeted in April that he was surprised at such a serious attitude to the confidentiality of these two companies, despite the fact that some governments favor more intrusive methods.

“I made some correct predictions about the coronavirus,” he wrote. “But I would never be able to predict in life that American technology companies developed a privacy protection platform designed to digitally track contacts, and European countries are trying to force them to lower standards.”