New COVID-19 exposure-alert smartphone app available

Canadians can now begin downloading a voluntary smartphone app meant to warn users they've been near someone who tests positive for COVID-19.

Prime Minister Justin Trudeau says he downloaded the "COVID Alert" app this morning and says the more people who sign up to use it, the better it will be able to trace — and help to slow — the spread of the novel coronavirus.

"Health experts say that if enough people sign up, this app can help prevent future outbreaks of COVID-19 in Canada," Trudeau said Friday in Ottawa during a visit to the Public Health Agency of Canada.

The free app, available for Android and iPhones on Friday by searching "COVID Alert" in the app store, is designed to track the location of phones relative to each other, without collecting personal data anywhere centrally, using digital identifications unique to each device.

Then users can be notified if their phones have recently been near the phone of a person who later volunteers that they have tested positive for COVID-19.

Once a diagnosed person signs into the app, a notification is sent to anyone with the app installed who has been within two meters of the ill person for more than 15 minutes within the prior two weeks.

The app will then encourage users to call their provincial health services for advice on what to do, once a user gets a notification that someone who had been nearby tested positive for COVID-19. In Toronto, for example, those who are exposed are instructed to find out how to get tested, and if they do not get tested, should self-isolate for 14 days from the date of the exposure.

Trudeau said the app is currently linked to the Ontario health system, but anyone in Canada can begin using it today and more provinces are joining it soon. He said the Atlantic provinces will be the next to link their health systems to the app and the federal government is in talks with other provinces too.

"I want to be clear: this app isn't mandatory. It's completely voluntary to download and to use," Trudeau said. "And it doesn't collect your name, address, geolocation, or other personal information."

The Privacy Commissioner of Canada and his Ontario counterpart both support the application, they said in a joint statement Friday.

"Canadians can opt to use this technology knowing it includes very significant privacy protections," privacy commissioner Daniel Therrien said. He and Ontario information and privacy commissioner Patricia Kosseim said government monitoring of its implementation and effectiveness, coupled with independent oversight, are key to maintaining public trust.

The app works with key codes distributed by Ontario public health officials, government officials said. The key codes will be given by healthcare providers to patients who receive a positive COVID-19 diagnosis. Those in other provinces can still download the app and will still be notified if they have been near someone who entered a key code, government officials told reporters.

If someone downloads the app at the time of receiving a positive COVID-19 test result, app users who had been in their vicinity will still be notified when the ill person "uploads" the key code.

Because the positive test result is reported to the app by the user, rather than public health officials, the government characterized the app’s use as voluntary. Government officials also declined to call the app "contact tracing," since it does not collect personal contact information or trace locations. In a briefing with the media, officials said that it would be up to experts on an advisory council to decide how the information would be used by public health researchers.

The voluntary nature of the app raised questions about whether it will get widespread adoption, since officials said it is prerequisite for the app to be installed by both the person who contracted COVID-19 and those who wish to be notified.

When the app was first announced by Trudeau on June 18, technology lawyer Michael Geist told The Canadian Press that a critical number of people must download the apps for them to be effective. Otherwise, Geist said at the time, people may feel a false sense of security because they are not being notified.

A separate poll from Statistics Canada on Friday indicated that Canadians are split on the use of contact tracing apps, with about a quarter of adults aged 25 to 64 "very likely" to use an app — and another quarter "very unlikely" to do so, mostly citing privacy concerns and location tracing.

The app, designed with open source code by Shopify Inc. employees and security features from BlackBerry Ltd., uses random Bluetooth codes, not location data, government officials said.

However, the Canadian government does store users' IP addresses for a period of three months to two years, in what it says is a standard protocol for protecting against cyber attacks. Plus, Android users must turn on location services to use the Bluetooth function, although officials said the app’s permission settings do not permit location collection. Government officials said they had been in contact with Google about the potential to turn off location services to use the Android app, but that as of Friday, the setting must be turned on.

The Bluetooth signals sent between app users’ phones are encrypted, stored on each individual phone, and deleted after 15 days. Codes that are "uploaded" to servers when someone reports a positive COVID-19 result are also deleted after 15 days, the app’s privacy policy says.

This report by The Canadian Press was first published July 31, 2020.