iOS 13.5 dropped Wednesday, introducing a slew of upgrades — including, most notably, the API for Apple’s coronavirus contact-tracing tool, developed in conjunction with Google.
But, despite what you might hear online, this is neither an “app” or an update that means downloaders are being tracked without their knowledge. Let’s correct a few popular misconceptions.
An app or an API?
The contact tracing system developed by Apple and Google works by using Bluetooth “chirps” to register physical interactions between smartphone users, regardless of whether they are using an Android or iOS device. If a person discovers that they have been infected with coronavirus, they can opt to share this information. The system then notifies other smartphone users who’ve come into close proximity with them. The hope is that this system could help slow the spread of the disease by warning people of potential infections.
The important thing to note is that this new iOS 13.5 feature is not an app. It is an API, meaning that it’s a set of tools that developers can use for building apps. These apps will be built by governments, either on a state or national level. Google and Apple’s approach simply provides the groundwork to power these apps should authorities wish to adopt them. Not every country will. The UK, for instance, is supposedly developing its own. Their disagreement with Apple concerns a decentralized vs. centralized approach to contact tracing. In the U.S., three states have already committed to using Apple and Google’s API: Alabama, North Dakota and South Carolina.
That hasn’t stopped this from being reported as an Apple and Google app, though. The UK’s Guardian newspaper, for instance, today features a headline reading “Apple and Google: Companies release phone app to notify users of coronavirus exposure.” Seemingly having been clued in that this is inaccurate, the article now reads “Apple and Google release phone technology to notify users of coronavirus exposure” — although, at time of writing the home page reflected the old headline. Only clicking through to the article itself corrected the record.
No, iOS 13.5 is not tracking you
Apps that use the API developed by Google and Apple don’t — and can’t — track you. Instead they collect randomized tokens, exchanged via Bluetooth, that are not personally identifiable. The system can tell you if you encountered someone who tested positive. However, it does not track who or where that happened.
But there’s nonetheless plenty of concern about tracking. Late Wednesday, Juli Clover, editor at MacRumors tweeted out what appears to be a DM. It reads: “Hey, so I heard if you download the newest iOS you will be automatically tracked for [COVID-19]. I even googled it and I just want to know if it’s true. Says Google and Apple are working together for tracking the virus.”
(Perhaps needless to say, but the API developed by Apple and Google does not diagnose cases of COVID-19. While some researchers are developing tools which claim to spot symptoms based on coughs, that is not the case here.)
Fears about surveillance
A search of Twitter shows a number of other people freaking out over iOS 13.5. One Twitter user highlights the part of the release notes relating to contact tracing, and then writes: “What the actual hell?! I’m not a parcel to be tracked and traced.” Others raise similar concerns about Apple pushing users to download an iOS update that contains tracking tools.
Fears about surveillance are not to be dismissed. Plenty of very smart people have raised very valid concerns about how contact tracing could open the door to new types of surveillance. However, when it comes to iOS 13.5, it should be stressed that tracking users is not something that happens just because you download an update.
The new API feature, which can be found by going to Settings > Privacy > Health > COVID-19 Exposure Logging, remains turned off until users install approved apps from public health authorities. As Apple and Google have stressed with their privacy focused approach, engagement in contact tracing is voluntary. Users are not being tracked without permission just because they have downloaded iOS 13.5.
Technology can help health officials rapidly tell someone they may have been exposed to COVID-19. Today the Exposure Notification API we created with @Google is available to help public health agencies make their COVID-19 apps effective while protecting user privacy.
— Tim Cook (@tim_cook) May 20, 2020
Representing contact tracing honestly
A lot of this confusion is understandable. A few months back, barely anyone was having to familiarize themselves with the different approaches to contact tracing or the the ethical dilemma posed by ventilators. The media isn’t infallible. The difference between an API and an app, for instance, isn’t immediately clear to a lot of people. But proper wording is crucial when it comes to a potential healthcare crisis.
In many cases, problems in technology emerge because companies are, either purposely or accidentally, vague about what they are doing. When Apple introduced a new battery throttling feature as part of iOS in 2017 it did so not as a sinister tactic to prompt upgrades, but rather to stop older lithium-ion batteries from unexpectedly shutting down. Unfortunately for Apple, it did this without properly making the public aware of what it was doing. It failed to articulate why this was necessary — and give users a way to stop it — and suffered a backlash as a result.
In this case, Apple and Google have been consistent with their messaging since the start. The problem frequently comes down to governments (particularly political point-scoring) and the media. But it shows why Apple and Google must be vigilant and continue to be as open and explanatory about the technology as they can.
It’s not yet clear whether contact tracing can and will work. But, in the interests of a well-informed public, voices with public platforms must make sure that they represent the tools available as best — and accurately — as they can.