Contact Tracing
What is contact tracing?
Contact tracing is a technique used by public health officials to identify people who are exposed to an infectious disease in order to slow the spread of that illness within a population.
When a patient is admitted to a hospital and diagnosed with a new, communicable disease, they’re interviewed by health workers to learn who they’ve interacted recently. Any contacts whose interactions with the patient are then evaluated, and if they’re diagnosed with the disease, the process repeats with their known, recent contacts.
What are Apple and Google proposing as a solution?
At a high level, Apple and Google are proposing a common standard for how personal electronic devices (phones, tablets, watches) can automate the process of contact tracing.
Instead of health workers chasing down contacts on the phone — a process that can take hours, or even days — the proposed system could identify every recent contact and notify all of them within moments of a confirmed, positive diagnosis.
Hardware
Bluetooth organizes communications between devices around the concept of services.
A service describes a set of characteristics for accomplishing a particular task. A device may communicate with multiple services in the course of its operation. Many service definitions are standardized so that devices that do the same kinds of things communicate in the same way.
For example, a wireless heart rate monitor that uses Bluetooth to communicate to your phone would have a profile containing two services: a primary Heart Rate service and a secondary Battery service.
Apple and Google’s Contact Tracing standard defines a new Contact Detection service.
When a contact tracing app is running (either in the foreground or background), it acts as a peripheral, advertising its support for the Contact Detection service to any other device within range. The Rolling Proximity Identifier generated every 15 minutes is sent in the advertising packet along with the 16-bit service UUID.
Software
Your device stores any Rolling Proximity Identifiers it discovers, and periodically checks them against a list of Positive Diagnosis Keys sent from the central health authority.
Each Positive Diagnosis Key corresponds to someone else’s Temporary Exposure Key. We can derive all of the possible Rolling Proximity Identifiers that it could advertise over the course of that day (using the same hmac algorithm that we used to derive our own Rolling Proximity Identifiers). If any matches were found among your device’s list of Rolling Proximity Identifiers, it means that you may have been in contact with an infected individual.
Suffice to say that digital contact tracing is really hard to get right. Given the importance of getting it right, both in terms of yielding accurate results and preserving privacy, Apple and Google are providing SDKs for app developers to use for iOS and Android, respectively.
All of the details we discussed about cryptography and Bluetooth are managed by the framework. The only thing we need to do as developers is communicate with the user — specifically, requesting their permission to start contact tracing and notifying them about a positive diagnosis.
ExposureNotification
When Apple announced the
Contact framework on April 10th, all we had to go on were some annotated Objective-C headers. But as of the first public beta of iOS 13.5, we now have official documentation under its name: Exposure.Calculating Risk of Exposure
A contact tracing app regularly fetches new Positive Diagnosis Keys from the central health authority. It then checks those keys against the device’s Rolling Proximity Identifiers. Any matches would indicate a possible risk of exposure.
In the first version of
Contact, all you could learn about a positive match was how long you were exposed (in 5 minute increments) and when contact occurred (with an unspecified level of precision). While we might applaud the level of privacy protections here, that doesn’t offer much in the way of actionable information. Depending on the individual, a push notification saying “You were in exposed for 5–10 minutes sometime 3 days ago” could warrant a visit to the hospital or elicit no more concern than a missed call.
With
Exposure, you get a lot more information, including:- Days since last exposure incident
- Cumulative duration of the exposure (capped at 30 minutes)
- Minimum Bluetooth signal strength attenuation (Transmission Power - RSSI), which can tell you how close they got
- Transmission risk, which is an app-definied value that may be based on symptoms, level of diagnosis verification, or other determination from the app or a health authority.
Apple Contact Tracing Framework -
https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ContactTracing-FrameworkDocumentation.pdf
