This Week’s Topic — The Tech Behind the COVIDaware MN App
There’s been a lot of recent coverage on the COVIDaware MN app developed to help slow the spread of COVID-19 in Minnesota by anonymously notifying users if they’ve been in close contact with the virus.
While this technology has been embraced by many (myself included), KSTP reported in mid-December only 7% of Minnesota’s estimated 4.4 million cell phone users have downloaded the app, and Minnesota’s IT Commissioner Tarek Tomes says this number needs to be between the 10-15% range to maximize effectiveness of slowing the spread.
Obviously, the more people who download and use the app, the better it works, but the app has met resistance from people concerned about privacy.
Understanding how the technology works (and how it isn’t a form of contract tracing) can help clear the air about its safety and importance.
How does the technology behind the COVIDaware MN app work?
The app uses Bluetooth Low Energy (BLE) technology to notify you if you’ve been near someone who has a positive test for COVID-19.
BLE is the same technology that powers many of the smart devices you may use today. Headphones, watches, heart rate monitors, speakers, washing machines… you get the picture.
When you install the COVIDaware MN app, the app uses BLE to frequently check for other COVIDaware MN app users. Think of it like a lighthouse out at sea: the app is constantly sending out signals saying, “Here I am!”
At the same time, the app is also listening for other users who are sending the same signal.
Using that metaphor, when two devices can “hear” each other, they exchange a small bit of information. This information comes in the form of a secure, unique “key.”
As you continue to pass next to other people, the app continues to collect these “keys” and tracks how long and how close you were to the other user.
Now, let’s say you’ve tested positive for COVID-19. When you test positive, the lab reports that information to the state’s public health department. The department reaches out to you to discuss next steps regarding your diagnosis. During this call, they give you a “test verification code.” You are then able to go into the app and enter this code.
Once you’ve entered the code, the app takes the key you’ve passed to other users over the last couple weeks and sends a message to a central list of keys saying, “Hey, just a heads up, this key is associated with a user who has a confirmed positive test.”
Let’s say your co-worker that you’ve been in close contact with also has the app. Remember how we talked about the app constantly sending signals out and receiving them? One of the signals it receives doesn’t come from BLE, but it comes over the internet from that central list of keys discussed in the previous paragraph.
When their app receives an update of new “exposed” keys, it goes through all the keys they’ve collected over the past two weeks and looks for matches.
If it finds a match, it does a check on the device to determine how long they were exposed to that key. If they were closer than 6 feet for more than 15 minutes, the app sends them a notification letting them know they were exposed and information on what to do next.
How does the COVIDaware MN app differ from contact tracing?
I’ll emphasize this later, but keep in mind that COVIDawareMN is *not* a contact tracing app.
Contact tracing takes this whole process a step further by logging location information. A contact tracing app remembers every place you’ve visited in a certain period of time.
Let’s envision a different app that does use contact tracing. If a user received a positive test, a central health department could pull up a list of all the places that person visited in the past 14 days and let those establishments know that they were visited by a person who tested positive.
This can be a much more effective way of stopping the virus because it allows health officials to directly reach out to establishments and notify patrons who might not have the app installed.
However, there are clear privacy concerns in a case like this. Would you feel comfortable giving the government a list of each and every place you have ever visited? Would you feel comfortable giving anybody such a list?
Engineers at Apple and Google felt the same way, so they designed their exposure notification systems to account for this concern. COVIDaware MN takes advantage of these specially designed systems to ensure they never actually track your location. It only tracks who you’ve come into contact with via those randomly generated keys.
What about privacy? Does the app share my personal information or location?
Some cell phone users have expressed concerns about the app’s safety, fearing it’s a way for the government to track citizens. In reality, no personal information is shared with the State of Minnesota.
The app’s tracking is done anonymously using exposure notification technology developed by Apple and Google.
When a COVIDaware MN app user comes into close contact with another COVIDaware MN app user, the phones exchange Bluetooth keys that are randomly generated by the app. No personal data or location information is collected, stored, or exchanged.
Even if an individual tests positive for COVID-19 and consents to uploading their positive test result into the exposure notification system, no personal information about the user is collected. The app anonymously sends a notification to any Bluetooth keys it’s collected in the last 14 days to warn them they may have been exposed to the virus.
This is best summed up by Shashi Shekhar, a University of Minnesota computer science professor who has studied the use of these apps in the pandemic.
“It’s a pull-in app, which means the data can come to your smartphone but nothing of value leaves your smartphone,” Shekhar said. “The only thing that leaves your phone is a random number, which cannot be traced back to the phone that generated it.”
The app can be used in English, Spanish, Somali and Hmong and is available on the App Store and Google Play Store. If you have friends, family, or neighbors concerned about how the app works, share this article with them. The COVIDaware MN site does a really good job of addressing concerns and answering questions on its FAQ page.
More About Our Sponsor
This week’s FAQ Friday is sponsored by The Jed Mahonis Group. The Jed Mahonis Group helps businesses strategize, design, develop, and deploy custom iOS and Android mobile applications. The company has partnered with many startups and large brands over the years to deliver software that is used by millions of people around the world, including companies such as Great Clips, Green Mill, VSI Labs, and Kwikly.
Meet Our FAQ Expert
Tim Bornholdt, Partner at The Jed Mahonis Group | @timbornholdt
Tim got his start in web development in the first grade, so he’s been building websites and apps for more than 20 years. In addition to being an accomplished software developer, Tim is also an award-winning videographer and podcaster. He currently edits the C Tolle Run podcast hosted by Olympian Carrie Tollefson, and he hosts the Constant Variables podcast where he breaks down complex mobile app development topics for entrepreneurs and product managers.
Looking for more Android development tips and information? Ask Tim and The Jed Mahonis Group team questions on privacy and more on Twitter at @timbornholdt.