Canada’s federally-approved COVID-19 exposure notification app launched this morning, with residents of Ontario being the first in the country to be able to use the tool aimed at limiting the spread of the virus.
Called COVID Alert, it can be downloaded by anyone in the country but so far only those in Ontario will receive the codes necessary to alert others using the app that someone who has been near them has tested positive for the virus.
Ottawa hopes to quickly announce the app’s availability in other provinces and territories so it can be used across the country. It uses the Apple/Google framework. In an attempt to make sure different jurisdictions within a country from launching competing apps Apple and Google are restricting use of their framework to one app per country. As a result last month Prime Minister Justin Trudeau turned down Nova Scotia’s plan to have its own app.
The app underwent a beta test earlier this month in Ontario with 5,000 users.
Initially developed by Ontario’s digital service with the help of open-source code from the e-commerce platform Shopify, COVID Alert is based on the Apple/Google framework which doesn’t upload personal or location data to a government or health authority server. This so-called de-centralized approach contrasts with the centralized model of some apps whose purpose is to help health authorities with contact tracing of those who have tested positive for the disease.
Federal officials who gave a technical briefing to reporters before the official announcement this morning emphasized that this is an exposure notification app only and isn’t a contact tracing app. Alberta’s ABTraceTogether app, launched in May is a contact tracing app. The goal of COVID Alert, officials said, is only to let people know if they have been exposed to the virus. It will not help manual contact tracers.
When asked how the app will help health researchers limit the spread of the disease during the briefing, an official said the success of the app will be measured by the disappearance of the virus from Canada.
As of Thursday, there were 115,470 cases of COVID-19 in Canada, including 8,917 deaths.
By taking the contact notification approach, the federal and Ontario governments hope to increase the public take-up of the app by meeting privacy concerns. UPDATE: By Saturday afternoon the Android version of the app had been downloaded more than 100,000 times.
In the technical briefing with reporters, officials said the federal privacy commissioner was consulted on privacy issues during development, and they expect the commissioner’s office will shortly make a statement. An advisory council of experts is also providing ongoing advice.
“Canadians can opt to use this technology knowing it includes very significant privacy protections,” said federal privacy commissioner Daniel Therrien, in a statement. “I will use it.”
Information and Privacy Commissioner of Ontario Patricia Kosseim agrees that the app could be an important tool, among others, to help control the spread of the virus in Ontario.
“I support the use of exposure notification technology to help control the spread of COVID-19, provided it is used in the way it’s been designed to respect the privacy of Ontarians,” says Commissioner Kosseim. “This app will only work if people trust their personal information will be protected and choose to use the technology. Based on our review of the app and acceptance of our recommendations, I am satisfied that there are strong measures built in to help protect individual privacy.”
Downloading and use of the app is voluntary. However, the commissioners noted there a risk that third parties may seek to compel app users to disclose information as to their use of the app, including any exposure notifications. The privacy commissioners noted that Ottawa and Ontario have undertaken to communicate publicly that individuals should not be required to use the app or to disclose information about their use of the app.
In the briefing with reporters this morning, federal and Ontario officials made no predictions on how many people they hope will use the app, only that they hope it will be widely downloaded.
Briefly, the app uses Bluetooth signals to exchange random codes with other smartphones that have the app and which are no more than 2 metres apart for no less than 15 minutes. The app collects a list of those random ID numbers for 14 days, discarding numbers on the 15th day as time goes on. If a user tests positive for COVID-19, they can –it’s the user’s choice — ask the app to send them a one-time-key, which gets punched into the app. The app then notifies the people on the list of random IDs that someone near them has tested positive within the last 14 days.
At the same time, the app gives those notified a piece of provincially-tailored advice on how they can take to keep themselves and others safe.
Officials emphasize that the app has no way of knowing a user’s location, name, address, place or time they were near someone. Users can voluntarily register their province when installing the app so they can receive provincially-tailored information, but it’s not mandatory.
Android users must turn on location settings for the Bluetooth sensing to work. Officials at the technical briefing stressed no location information is stored or transmitted. Apple users don’t need to change their settings for the app to work.
To protect against cyber attacks, Canadian servers will store users’ IP addresses for three months (and in the case of an identified security incident, up to two years). The governmentg says this is a standard way Ottawa uses to protect online systems from cybersecurity threats.