Dated May 6, 2020; last modified on Mon, 05 Sep 2022

Contact Tracing

“Apps” in this context means contact tracing apps released by public health authorities to do contact tracing. The APIs are limited to them.

Big Picture

Release APIs to enable apps to interoperate between Android and iOS devices. Bluetooth-based contact tracing baked into Android and iOS, such that no app is needed for broadcasting/listening. This ensures broad adoption, but will be on an opt-in basis.

Interesting debate for privacy, ethics and public health. Public health officials have a duty to warn, but patients risk stigma.

If you know you have COVID-19 but opt-out, what does that make you?

How It Works

Users must opt in. Via Bluetooth, devices regularly broadcast and listen to random identifiers (beacons). The beacons change every 10-20 minutes. If a user is diagnosed with COVID-19, they report this on the app, and consent to their most recent beacons going into the [central] positive diagnosis list.

This list is touted to be privacy preserving and opaque to Apple and Google. Don’t know how yet, but probably something to do with differential privacy.

Each device stores the received identifiers. At least once a day, the device downloads the positive diagnosis list and notifies the user of any exposure. Exposure is calculated from time spent within range of an infected person. The beacons’s Bluetooth signal strength is an okay estimate for proximity.

There are edge-cases in the tradeoff between privacy and health. For example, if the app knows that the user has only been in contact with one person, and therefore the user can pretty much determine who gave them COVID-19, then what?

One of the privacy arguments is that the exposure notification system will be disabled on a regional basis when it’s no longer needed. Okay, I’ll bite. If the system is all positive and privacy-preserving, why ever turn it off? Server costs? Battery life?

Did it work?

Mostly no. Adoption rates have been lower than the recommended +60%. The decentralized model also makes it hard to analyze how many false positives and false negatives were encountered.

South Korea flattened its COVID-19 curve in 20 days. However, their approach is more privacy invasive, e.g. an app that alerts users if they’re within 100m of a place visited by a confirmed COVID-19 patient based on data released by the KCDC. Inbound travellers must also download an app and report health conditions for 14 days. Google Timeline on Google Maps was also found useful for contact tracing.

Public Policy and Politics

Australia closed its borders, and limited intrastate travel. South Australia piloted a home-based quarantine app that has impromptu prompts. Victoria imposed a curfew and suspended its parliament. New South Wales used the military to enforce lockdowns. Sydney and Melbourne have banned anti-lockdown protests. However, Australia did a subpar job of acquiring and distributing vaccines. That said, while the US has 194/100k deaths, Australia has 4/100k deaths. Given that COVID-19 is now considered an endemic rather than a temporary pandemic, will Australia’s limitations be lifted?


  1. Apple and Google partner on COVID-19 contact tracing technology. . .
  2. Contact tracing. .
  3. Exposure Notification | Frequently Asked Questions. . .
  4. Exposure Notification - Bluetooth Specification. . .
  5. Exposure Notification - Cryptography Specification. . .
  6. Exposure Notification API. . .
  7. Coronavirus: The great contact-tracing apps mystery. Rory Cellan-Jones; Leo Kelion. . Jul 22, 2020.
  8. How Korea responded to a pandemic using ICT: Flattening the curve on COVID-19. . May 11, 2020.
  9. Is Pandemic Australia Still a Liberal Democracy? Conor Friedersdorf. . . Sep 2, 2021. Accessed Sep 2, 2021.