The federal government has unveiled a new nationwide app to help alert people of possible exposure to COVID-19.
Prime Minister Justin Trudeau announced Thursday that the app, which was initially developed by the province of Ontario, will be rolled out and tested first in Ontario in the coming weeks and then in other provinces by early July.
Canadians will be able to download the app for free on the Apple App Store or the Google Play Store.
The Canadian Digital Service is leading the development of the app, in collaboration with the Ontario Digital Service, and building upon technology developed by Shopify volunteers. It incorporates Bluetooth technology provided by Apple and Google to anonymously record instances where users have come into close contact. The app will undergo a security review by BlackBerry.
Trudeau stressed the use of the app is voluntary.
“It will be up to individual Canadians to decide whether to download the app or not, but the app will be most effective when as many people as possible have it,” he said.
A survey completed by Abacus Data and commissioned by a group of Canadian senators in May found that 80 per cent of Canadians support the use of mobile contact tracing.
Here’s how the app will work: if you test positive for COVID-19, a health-care professional will help you upload your status anonymously to a national network using a unique, temporary code.
A random code associated with your phone will be held in a secure national database, Trudeau explained, and that database of randomized codes associated with each smartphone that uses the app will be divided into two columns — those who have tested positive and those who have not tested positive. That database will then be consulted by the app across the country to see whether or not that randomized code has tested positive for COVID-19.
Other users who have downloaded the app and have been in proximity with someone who has tested positive will be alerted through the app that they’ve been possibly exposed to the coronavirus. The notification will encourage them to contact their local public health authorities.
“The app is there. The national database of anonymized data is there to be consulted by the app across the country. The third part of the app is integration into the local public health services so when someone is tested positive the app is notified,” Trudeau said. “That requires working with the provinces on that. We have a number of provinces already moving forward on that. … Obviously it will work better once all provinces and territories are part of it.”
Trudeau said the government is taking the privacy of Canadians very seriously, and information will not be stored by the app, nor will any information ever leave the user’s phone. The app will also not disclose the identity of users, nor will it track the user’s locations.
“At no time will personal information be collected or shared, and no location services will be used,” Trudeau said.
“It functions entirely on an anonymized basis. There are no identifiers of your phone, of your number, of your identity, of your address, of your location that is any part of this app.”
Won’t track location
Sumit Bhatia, a data security expert with Ryerson's Cybersecure Policy Exchange, said instead of using GPS location data, it uses Bluetooth technology for anonymous, phone-to-phone communication, which is safer and more secure than location tracking.
“Location data typically relies on satellite-based GPS positioning or what we refer to as triangulation of cell towers to hone in on where you are. What Bluetooth data is doing is it's not calculating location, but communicating with another device that emits signals through standard space technology,” Bhatia explained.
“We believe that Bluetooth technology reduces the vulnerability that folks have around exposure of sensitive and personally identifiable information and behavioural information, which you can get out of location-based data.”
In May, Canada’s federal, provincial and territorial privacy commissioners issued a joint statement with nine key principles that governments should keep in mind when considering contact tracing technology.
For example, they maintain the use of the apps must be voluntary, with a clear legal basis and meaningful consent, and that personal information should be used only for its intended public health purpose and de-identified or aggregate data should be used whenever possible.
The commissioners also highlighted the importance of transparency, accountability and necessary safeguards in using such technology.
Protecting privacy
Trudeau said Thursday that the national privacy commissioner worked with officials on the development of the app.
“It’s extremely important that we make sure that Canadians’ privacy is protected not just for their sake, but because we know the uptake of this app won’t be there if people are worried for their privacy,” he said.
“Because it’s completely anonymous, because it’s low maintenance … people can be confident this is an easy measure they can have to continue to keep us all safe as we reopen, as we get more active. This is an approach we are confident is going to make a big difference, and Canadians can do this and forget about it.”
Bhatia said the app is a step in the right direction, as it implements many of the suggestions privacy experts have deemed necessary for a safe, secure contact tracing app, such as the fact that it’s voluntary, that it uses Bluetooth rather than location data and that it uses a decentralized model for data collection, meaning the data will be stored on an individual device rather than be uploaded regularly to a remote server.
However, Bhatia said he would like to see more transparency around how other non-governmental institutions or people might use the app, and any steps being taken to address some of those concerns.
“For example, we don't want a landlord refusing somebody entering into a condominium … or (somebody) being refused access to goods or services based on whether or not a person uses the app,” he said.
“We don't know if there's going to be opportunities for them to directly tap into that data. We certainly don't believe that's the case, but I think there has to be messaging that clarifies that for concerned citizens who may not necessarily know how the technology works.”