Apple Lays Groundwork for Coronavirus Exposure Notification API in iOS 13.5 Beta 3 and New Xcode 11.5 Beta [Updated]

[MacRumors]

Apple is today releasing the third beta of iOS 13.5 for developers along with the first beta of Xcode 11.5, laying the groundwork for the release of its opt-in exposure notification APIs that will be used by public health apps to create coronavirus contact tracing tools.

iOS 13.4.5 has been bumped up to iOS 13.5 to include the code that's necessary to run the first apps built using the exposure notification API, while Xcode 11.5 includes a new version of the iOS SDK with the exposure notification API.

Apple is working with Google on its exposure notification initiative, and Google has also delivered its beta Google Play Services update with the exposure notification API and SDK to select developers who can test using Android Developer Studio.

Public health authorities are able to use these new tools to begin getting their apps that take advantage of exposure notification ready. Apple is planning to release its exposure notification API in mid-May following the testing period.

Apple and Google first announced plans to develop Bluetooth-based contact tracing technology (now known as exposure notification) on April 10, providing a privacy-focused way to track coronavirus exposure.

The beta API released today is the first part of a two-prong effort to provide an exposure notification platform for health agencies. Apps created by verified health authorities can incorporate the API to allow smartphones to communicate with one another, providing users with notifications if they've come into contact with someone that is later diagnosed with COVID-19.

When smartphone users with a contact tracing app installed come into contact with another person that also has an app installed, their phones exchange an anonymous identifier beacon. If one of those people contracts coronavirus, they can then choose to notify all of the other people they've been in contact with, and at that point, all the other smartphones that have exchanged info with the infected person's smartphone will be notified.

The API works cross platform on both iOS and Android devices, and it was built with privacy and transparency in mind. A random, rotating identifier, which changes every 15 minutes, is assigned to a person's phone and transmitted via Bluetooth to nearby devices.

No personally identifiable information is associated with the identifier, and the list of identifiers a person has been in contact with doesn't leave the phone unless the user decides to share it. Users that test positive will not be identified to other users, Apple, or Google, and location data is not collected.

Exposure time is recorded in five minute intervals, with the maximum exposure time capped at 30 minutes. All Bluetooth metadata is encrypted, and exposure estimates will rely on the power level of the Bluetooth signal to determine the distance between two phones when contact was made.

Public health authorities will be able to define and calculate an exposure risk level that they can choose to assign to users in the event they are notified of COVID-19 exposure, allowing for fine-tuned notifications that will evaluate exposure based on information like approximate distance and exposure duration. Exposure risk is calculated on users' devices in the app and the data is not shared with Apple or Google.

Apple and Google on Friday plan to release additional information including sample code that will aid developers in understanding how the exposure notification system will operate, and specific criteria for developing apps.

Detailed privacy information about Apple's exposure notification initiative is available on Apple's Contact Tracing website, with info on Bluetooth and Cryptography specifications along with a Frequently Asked Questions feature.

In the future, Apple and Google plan to debut a broader Bluetooth-based contact tracing platform that is built into iOS and Android, allowing more individuals to participate.

Update: Due to the Labor Day holiday in Europe on Friday, Apple plans to release additional details associated with the betas of the exposure notification API early next week.

Article Link: Apple Lays Groundwork for Coronavirus Exposure Notification API in iOS 13.5 Beta 3 and New Xcode 11.5 Beta [Updated]

 

[BlueCreek]

If this is built directly into the OS, Android may struggle to get many users as only a very small percentage of phones get the latest updates and takes a very long time to trickle down stream

 

[rjohnstone]

If this is built directly into the OS, Android may struggle to get many users as only a very small percentage of phones get the latest updates and takes a very long time to trickle down stream

Not really.
Google changed they way certain core features were updated a few years ago.
A lot of it is tied to Google Play Services. Google can update key components without a core OS update.


"Apple is working with Google on its exposure notification initiative, and Google has also delivered its beta Google Play Services update with the exposure notification API and SDK to select developers who can test using Android Developer Studio."

They may bake it into future OS releases, but Google Play Services is how Google can add features to a device without requiring a full blown OS update.

 

[123]

If this is built directly into the OS, Android may struggle to get many users as only a very small percentage of phones get the latest updates and takes a very long time to trickle down stream

Android is generally much more open, so I could imagine this functionality doesn't need an OS change and could basically be developed by anyone.

 

[TechieGeek]

If this is built directly into the OS, Android may struggle to get many users as only a very small percentage of phones get the latest updates and takes a very long time to trickle down stream

"For Google, the update to enable the tracking tools won't be like a normal operating system upgrade. It will instead come through a set of tools called Google Play Services, which lets Android sidestep some fragmentation issues by pushing updates directly, without the approval of device and wireless partners. The company normally uses Google Play Services to update its own apps, like Gmail and Maps, and to push changes like a new app icon. The contact tracing tools will be available for phones running software as old as Android Marshmallow, the version of the operating system released in 2015."

 

[B4U]

It is time for digging out the flip phones if we do not want to be tracked?
Well, even the cell towers can still trace us...

 

[Babygotfont]

enough with the covid already

 

[dcworthi]

enough with the covid already

I've been sick with Covid for nearly 8 weeks and still can't taste and smell. My friend Alex lost his mom; she was 51. My friend Kelly lost his grandfather and my friend Rosemary lost her nephew. I sincerely hope you're not suggesting that Apple shouldn't be doing this.

 

[calzon65]

I understand the critical importance to do something to reduce COVID-19 deaths and infections, plus kudos to Apple for at least doing something to help reduce this horrible pandemic, but at the same time I am nervous about the lingering surveillance that may survive after a COVID-19 cure is found.

It looks like George Orwell's 1984 may finally arrive in force

 

[dcworthi]

I understand the critical importance to do something to reduce COIVID-19 deaths and infections, but at the same time I have to say George Orwell's 1984 will finally arrive in force

Any smartphone already provides for that, but my understanding is that participating in tracking apps will be optional. Your concern is valid; tech has made a turnkey dictatorship possible for many years. However, nobody is forced to use or carry a smartphone... there's Nokia's available for purchase again. My way of not spreading the virus was to remain at home when symptoms appeared, but not everyone has that ability. It took me nearly 3 weeks to get tested (positive) and many weeks longer to begin to feel better.

 

[dugbug]

It is time for digging out the flip phones if we do not want to be tracked?
Well, even the cell towers can still trace us...

don't install one of the apps and touch 'approve tracking' (this is just an API)

 

[Aston441]

I've been sick with Covid for nearly 8 weeks and still can't taste and smell. My friend Alex lost his mom; she was 51. My friend Kelly lost his grandfather and my friend Rosemary lost her nephew. I sincerely hope you're not suggesting that Apple shouldn't be doing this.

what state or country are you in?

 

[44267547]

It is time for digging out the flip phones if we do not want to be tracked?
Well, even the cell towers can still trace us...

I would love to use my Motorola Razr again. And it still powers on! I’m not interested in being tracked, Although I gather the intent behind the app to promote awareness.

 

[calzon65]

Any smartphone already provides for that, but my understanding is that participating in tracking apps will be optional. Your concern is valid; tech has made a turnkey dictatorship possible for many years. However, nobody is forced to use or carry a smartphone... there's Nokia's available for purchase again. My way of not spreading the virus was to remain at home when symptoms appeared, but not everyone has that ability. It took me nearly 3 weeks to get tested (positive) and many weeks longer to begin to feel better.

I am truly saddened that you have had to suffer through COVID-19 and your friend lost his mother at such an early age. My heart goes out to you and your friend during these very trying times.

You are absolutely correct, nobody forces us to carry a smartphone. Just like I am not forced to drive a car (I could ride a horse), mobile phones have become a virtual necessity for life the 21st century, but at the same time, we should not be subjected to heavy handed surveillance.

I hope you recover quickly.

 

[diego.caraballo]

How many people will be trolling others by clicking on “I have been diagnosed” and send an alert to everyone? And how many will be ashamed of probably have infected other people and will not letting the app know after being diagnosed. Also, battery impact of this continued token exchange with nearby phones?

 

[Rocko99991]

HIPAA?

 

[wdwpsu]

9/11 opened the door to a bunch of invasive measures on the guise of "Security". Here we go. Patriot Act all over again.

 

[rjohnstone]

I would love to use my Motorola Razr again. And it still powers on! I’m not interested in being tracked, Although I gather the intent behind the app to promote awareness.

The API has nothing to do with "promoting awareness". It's for keeping track of every device you come in contact with that is also running the API.
[automerge]1588182944[/automerge]

HIPAA?

Not an issue. Any app written to use the API in the U.S. will have to be HIPPA compliant.
It's federal law, they have no choice.
If the feds waive the HIPPA requirement, I would be worried.

 

[Stromos]

So I got ripped for not reading the full spec and thinking the security sucks on another post. I read the whole spec. An interesting way of doing things.

My new thought is that if someone gets crafty they just need to get their phone to flood phones around them with keys until they memory bomb the devices around them. Be interesting if it could cause an overflow for the jailbreak community or fill a lower storage device.

I'll admit I was in the wrong about how secure the system is but I am oddly excited to see how it will be abused. Be checking Krebs and other sources as soon as this starts rolling out. Plenty of bored people right now.

 

[dannyyankou]

So with this API, I would get a notification if I came in contact with someone with COVID-19?

 

[benshive]

enough with the covid already

That'd be cool if ignoring problems made them go away.

"Enough with world hunger"

"Enough with political corruption"

"Enough with school shooters"

Wow, I feel much safer now

 

[now i see it]

These exposure tracking apps are going to turn into "terror apps".

 

[Chlloret]

It is time for digging out the flip phones if we do not want to be tracked?
Well, even the cell towers can still trace us...

Any phone can be tracked, including a Moto Razr. Or Nokia 2110.
this API can not track. It can not be used to track you. Or anybody else. The App you have to install can not track you. Or anybody else.
Its so nicely documented, why is nobody reading the specs?

 

[B4U]

I would love to use my Motorola Razr again. And it still powers on! I’m not interested in being tracked, Although I gather the intent behind the app to promote awareness.

Dang...RAZR?
StarTAC FTW! Actually, just found the Nokia banana phone again and it still powered on!
Wish my car's battery lasted this long!

 

[Websnapx2]

Any phone can be tracked, including a Moto Razr. Or Nokia 2110.
this API can not track. It can not be used to track you. Or anybody else. The App you have to install can not track you. Or anybody else.
Its so nicely documented, why is nobody reading the specs?

Because it doesn't fit their narrative. You cannot convince someone of something they don't want to believe‚ regardless of facts.