Android Update Source: Apple launches COVID-19 ‘Exposure Notification Express’ with iOS 13.7

Apple and Google are continuing to make good on their planned roll-out of exposure notification technology for helping with COVID-19 contact tracing efforts. The two partners are introducing new tools that make it much easier for public health authorities to implement digital exposure notification, without the need for developing and maintaining their own individual apps. Apple makes this possible via the iOS 13.7 system update, out today, while Google is implementing it with an automatically-generated application on Android 6.0 and up coming later this month, a workaround required because of the very different method through which it manages system services and OS updates.

This change in the way the technology works means that users won’t have to actually download and install a dedicated app created by the public health authority (PHA) in their jurisdiction to participate. Instead, you’ll receive a notification that provides information supplied by your local health authority about the exposure notification system and what it does, from which you can choose to opt-in. On iOS, that’ll mean installing a provisioning profile, while on Android, it’ll result in that auto-generated app, which is installed via the Google Play store. Apple and Google clarified that Exposure Notification Express co-exists with existing dedicated PHA apps, rather than replacing it.

PHAs using Exposure Notifications Express can provide Apple and Google with contact information, guidance about care and precautions, and recommendations on next steps. PHAs provide their name, logo, criteria for triggering an exposure notification and info to be offered to an indictable in case of exposure using a system that’s easy for non technical people to use.

Local health authorities will still have to elect to participate, and customize the text and messaging delivered to users in their regions when the receive this notification and onboarding info, but they’ll no longer have to develop and distribute their own applications in order to set up a digital exposure notification system based on the combined Apple/Google tech to supplement their contact tracing efforts. The health authority will also be responsible for determining how they calculate exposure risk, which is what they were able to do with dedicates apps, too. That’s huge, since while Apple and Google note that 20 countries globally have already introduced apps based on their API, and 25 U.S. states are “exploring” use of the system, with six states having launched apps so far, making this a system level feature with a lower technical barrier to entry on the developer/health agency side should help expedite roll-out.

To start, Apple and Google say they expect DC, Maryland, Nevada and Virginia will be the first to implement Exposure Notification Express sometime soon, with others likely to follow. The companies also said they’re working with the U.S. Association of Public Health Laboratories on a national key server that will effectively allow users to have exposure tracking work across state lines when they’re traveling out of their home health agency district.

There has been a lot of misinformation circulating about contact tracing requiring a threshold of 60% or higher adoption to be effective; that’s based on a misinterpretation of an Oxford study published earlier this year. The researchers behind the study subsequently clarified that in fact, any level of contact tracing, as aided by apps that support digital contact tracing, has a positive effect on reducing the spread of COVID-19, as well as resulting deaths.

The system includes the same privacy protections that Apple and Google have provided throughout, which means your location information is not collected or connected to any exposure notifications. Instead, the tech uses a randomly-generated key to track when and where a device has come into Bluetooth range with other devices also using the software. It maintains a log of these random identifiers, and checks against reported confirmed diagnoses (also fully anonymized) to see if there has been any exposure risk – as determined by the definition of exposure in terms of duration and distance as established by each region’s governing public health authority.