Utah's Contact Tracing App Doesn't Use Apple's Exposure Notification API, Opts for Less Private GPS-Focused Approach

[MacRumors]

Utah in April released "Healthy Together," a contact tracing app aimed at limiting the spread of the coronavirus by letting people know if they've come in contact with someone who is later diagnosed with the virus.

Utah's Healthy Together app does not use Apple and Google's Exposure Notification API, instead opting for a less private GPS and Bluetooth-based solution that's currently available in a beta capacity. Healthy Together was created by social media startup Twenty, and it does not take advantage of the decentralized, anonymized approach that Apple and Google are implementing, according to a report from CNBC.

The aim of the Healthy Together app is to help the 1,200 Utah Department of Health workers who are doing in-person contact tracing through phone calls. Utah's health department has access to the name, telephone number, and location data of people who test positive for COVID-19 and opt to share their data.

The app uses Bluetooth and GPS to determine when smartphone users come into contact with one another, and if someone tests positive, they can share their location history and contact history over the past 14 days with a contact tracer. Twenty believes that this can cut hour-long phone calls used for contact tracing down to 16 minutes. From Twenty chief strategy officer Jared Allgood:

"Jeff and Sarah are two individuals in this example who don't know each other but they both have the app on their phones. And so the both phones are emitting Bluetooth and GPS signals. Through that data we can identify whether or not two people have spent some time together."

"If Public Health is calling somebody who has the application on their phone, and they've granted permission to see this minimum set of data to do the contact tracing effort, now, instead of spending an hour, you know, interviewing Jeff and trying to fill in the gaps in his memory, they together can step through his list of location history."

Apple and Google's privacy-focused solution does not allow personal information to be provided to public health departments, and it does not involve location-based data collection, unlike Utah's Healthy Together app. Twenty's founders claim that the Healthy Together app is opt-in and users can choose to limit permissions like GPS or Bluetooth if they don't want their location tracked, but it's not clear how this impacts the effectiveness of the contact tracing design as implemented in Utah.

According to the Utah state website, Utah opted out of Google and Apple's solution because Bluetooth alone "gives a less accurate picture" than Bluetooth and GPS location data.

The goal of Healthy Together is to allow public health officials to understand how the disease spreads through the vector of people and places, and both location and bluetooth data are needed to accomplish that.

Bluetooth helps us understand person-to-person transmission, while location/GPS data helps us understand transmission zones -- having both of these important data points provides a more effective picture of how COVID-19 spreads. This data helps policy makers make the best possible decisions about how and where we begin to relax and modify restrictions as our community and economy begin to reactivate.

One of the benefits of the Apple/Google API is background Bluetooth tracking that does not require an app to implement battery draining features or require users to keep it open for smartphone to smartphone communication to be effective. Utah will not have the benefit of the API by opting for an outside solution, which could also impact the effectiveness of the app.

45,000 people have signed up for Utah's contact tracing app, which is about two percent of the state's population. Some estimates have indicated that to be effective, contact tracing apps need to be downloaded by 60 percent of a population.

Apple and Google have said that they're aiming to release the Exposure Notification API in mid-May, so we could see it as early as this week after the release of iOS 13.5. Following the release of the update, the first apps that use the API will be able to be released.

Update: The state of Utah says it has not completely rejected the Apple/Google API, and the following statement was provided to MacRumors:

While Healthy Together does not currently include the Apple/Google API (as it has not been officially launched), neither the state of Utah nor Twenty has completely rejected their solution. As it stands, Apple/Google's plans are to disallow the use of the API with apps that identify the user or utilize GPS, but there's still a lot to be learned out about what they ultimately roll out, and Healthy Together is still open to conversations and digging further into the API.

The Healthy Together app was created to meet specifications from Utah's public health team, and is intended to support and augment the work of their contact tracers, not automate or replace them. Our approach is tech agnostic and built to balance the need for public health effectiveness alongside the need to protect user privacy. Twenty invested heavily in building up a privacy framework that they believe not only meets but exceeds this balance wherever possible (see more here), and remains open to learning and/or adjusting along the way.

Article Link: Utah's Contact Tracing App Doesn't Use Apple's Exposure Notification API, Opts for Less Private GPS-Focused Approach

 

[luvbug]

That's OK, I reject Utah, so we're even! (I live in a nearby western state).

 

[Dwalls90]

Considering Utah is a state that leans conservative, which seem to be the most against giving up their freedom and data to "big government", I'm kind of surprised they went the more intrusive route.

 

[Analog Kid]

That‘s ok, joke’s on them— iPhone GPS data is garbage...

 

[djcerla]

This decision will literally kill people.

 

[Vidd]

Why does it need to be a trade-off between health risk and personal privacy when both Apple and Google went to the trouble of implementing those APIs?

 

[russell_314]

I'm not too keen on any of these contact tracing apps but if my state came up with this I'm sure not going to install it. I might trust Apple

"45,000 people have signed up for Utah's contact tracing app, which is about two percent of the state's population. Some estimates have indicated that to be effective, contact tracing apps need to be downloaded by 60 percent of a population."

They seem to be slightly short of their goal. 😂

 

[glowplug]

What happens when there are ten of these apps all trying to use the bluetooth? Cause that’s the direction things are going in.

 

[konqerror]

Considering Utah is a state that leans conservative, which seem to be the most against giving up their freedom and data to "big government", I'm kind of surprised they went the more intrusive route.

Utah politicians, civil servants, and medical doctors don't know anything about GPS or Bluetooth or Android or anything like that. What I bet happened was they signed a contract with a political crony and/or the lowest bidder and/or the one with the most women/minority/veteran/small business/HUBZone points, who developed this app and doesn't want to do any more work, at least until the state gives them more cash.

Meanwhile, the procurement office civil servants didn't understand the subject well enough to write in a provision in the contract to force the contractor to go back and fix it. When the press started asking questions, they went back to the vendor, they just gave a BS answer (which doesn't even capitalize Bluetooth), which both sides are sticking to in order to cover their asses.

 

[truthertech]

This decision will literally kill people.

Since the latest infection fatality rate studies demonstrate that 99.5% of us will survive an infection, what does your spreadsheet show as the absolute number who will die from Utah choosing one app or another?

 

[ghanwani]

We have no idea how accurate the test results are.

Star Tribune

Your source for Minnesota news today. Read articles, view photos or watch videos about news in Minneapolis, St. Paul, Duluth, St. Cloud, Rochester, and beyond.

m.startribune.com

Abbott’s Coronavirus Test Falls Short of Rival Device

Researchers said the company’s widely used device to swiftly detect coronavirus, including among senior White House officials, missed nearly half of the positive cases detected by another common test.

www.wsj.com

What are we tracking again?

 

[luvbug]

That‘s ok, joke’s on them— iPhone GPS data is garbage...

And your post, without some evidence to support it, is meaningless. Everyone is using the same silicon (from a couple of vendor choices) and the same satellites.

 

[konqerror]

And your post, without some evidence to support it, is meaningless. Everyone is using the same silicon (from a couple of vendor choices) and the same satellites.

While I agree his post is BS, I do have to point out that the GNSS core is in the Intel cellular chipset, which famously, nobody else is using.

 

[Speedy2]

Utah politicians, civil servants, and medical doctors don't know anything about GPS or Bluetooth or Android or anything like that. What I bet happened was they signed a contract with a political crony and/or the lowest bidder and/or the one with the most women/minority/veteran/small business/HUBZone points, who developed this app and doesn't want to do any more work, at least until the state gives them more cash.

Meanwhile, the procurement office civil servants didn't understand the subject well enough to write in a provision in the contract to force the contractor to go back and fix it. When the press started asking questions, they went back to the vendor, they just gave a BS answer (which doesn't even capitalize Bluetooth), which both sides are sticking to in order to cover their asses.

LOL
I think you are spot on. This EXACTLY sounds like what probably happened here.
It reflects my experience of working with government officials, too, so this sounds all too familiar. Sadly.

 

[ersan191]

Imagine thinking your crappy state government contracted software developers will do a better job than Google and Apple...

Nobody will use this, and it won’t work properly anyway. The fact that you’re going to have to download a buggy CDC app to use Apple and Google’s system is already bad enough.

 

[russell_314]

Utah politicians, civil servants, and medical doctors don't know anything about GPS or Bluetooth or Android or anything like that. What I bet happened was they signed a contract with a political crony and/or the lowest bidder and/or the one with the most women/minority/veteran/small business/HUBZone points, who developed this app and doesn't want to do any more work, at least until the state gives them more cash.

Meanwhile, the procurement office civil servants didn't understand the subject well enough to write in a provision in the contract to force the contractor to go back and fix it. When the press started asking questions, they went back to the vendor, they just gave a BS answer (which doesn't even capitalize Bluetooth), which both sides are sticking to in order to cover their asses.

Yup someone got a contract in exchange for $$$$$$. They'll bid low then offer a service that's useless. How do you think politicians become multimillionaires on a six figure salary.

 

[gnipgnop]

It's interesting that so many comments are heaping most of the blame on Utah's government and ignoring the fact that a private company wanted to sell their inferior product for taxpayer dollars. People always cut private companies way too much slack when it comes to an intent to rip off the public.

 

[Toratek]

THANK YOU APPLE!

 

[PrecisionGem]

It seems that most people who have the virus don't know they have it, the whole app thing seems pretty useless.

 

[russell_314]

It's interesting that so many comments are heaping most of the blame on Utah's government and ignoring the fact that a private company wanted to sell their inferior product for taxpayer dollars. People always cut private companies way too much slack when it comes to an intent to rip off the public.

Umm I want to sell you a broken MacBook for $5000... I guess by your logic the buyer of a product can't say no if someone wants to sell it so please let me know how we're going to make this deal 😂 😂 😂 😂 😂

 

[Swift]

Considering Utah is a state that leans conservative, which seem to be the most against giving up their freedom and data to "big government", I'm kind of surprised they went the more intrusive route.

I think this is the wrong approach. This gives the user an alarm. You ask for the test. You then meet the public health people, if you're positive, you gladly try to figure out what you might say. You go through the interview. Why would you find that bad? All you know now is that you're infected. Get in quarantine. Then we have an antibody test. So you can go back to work.

 

[Swift]

And your post, without some evidence to support it, is meaningless. Everyone is using the same silicon (from a couple of vendor choices) and the same satellites.

The code an the way it works has been explained. It is Bluetooth only, so you have no GPS in Apple or Android versions. It won't accept GPS data. It works on Bluetooth. So relative location only. There is no idea, you have tokens, there is a new encrypted token that is you every day. You can't tell from looking at it. The message comes only to the phone owner. It tells you YOU were exposed. I presume the best thing there is to offer you a test. During the test, they would interview you. The worst punishment out of this is the disease. It is in all of our interests to be interviewed so we can figure out every one. To put them in quarantine for 14 days. They can monitor your systems. You fever. I'm sorry if people see something sinister about public health, but I think that's really against all of our interests.

 

[russell_314]

The code an the way it works has been explained. It is Bluetooth only, so you have no GPS in Apple or Android versions. It won't accept GPS data. It works on Bluetooth. So relative location only. There is no idea, you have tokens, there is a new encrypted token that is you every day. You can't tell from looking at it. The message comes only to the phone owner. It tells you YOU were exposed. I presume the best thing there is to offer you a test. During the test, they would interview you. The worst punishment out of this is the disease. It is in all of our interests to be interviewed so we can figure out every one. To put them in quarantine for 14 days. They can monitor your systems. You fever. I'm sorry if people see something sinister about public health, but I think that's really against all of our interests.

Apps can't access Bluetooth on iOS in the Background without going through the specific API

 

[Swift]

The code an the way it works has been explained. It is Bluetooth only, so you have no GPS in Apple or Android versions. It won't accept GPS data. It works on Bluetooth. So relative location only. There is no idea, you have tokens, there is a new encrypted token that is you every day. You can't tell from looking at it. The message comes only to the phone owner. It tells you YOU were exposed. I presume the best thing there is to offer you a test. During the test, they would interview you. The worst punishment out of this is the disease. It is in all of our interests to be interviewed so we can figure out every one. To put them in quarantine for 14 days. They can monitor your systems. You fever. I'm sorry if people see something sinister about public health, but I think that's really against all of our interests.

If you want tp know what security experts say about this, listen to this: https://twit.tv/shows/security-now/episodes/764?autostart=false

 

[yanksfan114]

Has anyone seen the App Store posting for this app? It’s flooded with fake 5 star reviews and perfectly written reviews praising it and telling people everyone needs to sign up. It’s so obvious they are spamming fake reviews. How do you report stuff like this to Apple?