COVID-19: Exposure Logging and Contact Tracing:
Is It Safe?
Part 1

Click or Tap Icons to Share! Thank you!
Authored By  :
Bill Kochman

Published On :
June 25, 2020

Last Updated :
August 29, 2020


Apple And Google Announce Exposure Notification API, What Is An API?, Bluetooth Technology, Exposure Logging And Contact Tracing Apps, Exposure Notification FAQ, Apple And Google's Concern For User Privacy Protection, User Participation Will Be Purely Voluntary, Apple Restricts Use Of Contact Tracing Apps To Authorized Public Health Authorities Only, Bluetooth Identifiers, Apple And Google Will Not Receive Identifying Information About Any User, Central Database, Identifier Log And Downloaded Identifiers, Users Will Receive Very Limited Info About Other Users, No Actual Identities Or Locations Are Revealed To Anyone, Why Immediate Screen Alerts Are Bad News, Awkward Incident On The Bus, Be Sensitive To How Others Feel, The Accuracy Of Contact Tracing And Exposure Notification App Depends On How Many People Install And Enable, Why I Will Not Install A Contact Tracing App, Our Local COVID-19 Situation, A Troublesome Paragraph In Offical Exposure Notification FAQ


Let me begin by saying that if you are one of my longtime readers, you will quickly discover that this current article is very different from most of my other articles and series. You will not find a single verse of Scripture in it. This is because it is more a technical-oriented article regarding Apple's iOS operating system, COVID-19, Exposure Logging, and contact tracing apps. So, unless you possess a specific interest in these topics, you may want to pass on reading this article. On the other hand, if you are the owner of an iOS device -- or even the owner of an Android mobile device for that matter -- then I encourage you to continue reading. You may learn something, or at least find some interesting tidbit in what I have to say in the following paragraphs.

As I mentioned in a Facebook post on May 24, 2020, included in Apple's Release Notes for iOS 13.5, was the announcement that iOS 13.5 includes an API -- or Application Programming Interface -- referred to as the Exposure Notification API. This API was developed by Apple in conjunction with Google. Apple was very upfront about it, and the inclusion of this new API was made known to iOS device users upon installation of iOS 13.5. I recall reading the notice myself when I first installed iOS 13.5 about a month ago. Today, I re-read my original Facebook comments and decided to convert them into a full-fledged Bill's Bible Basics article in order to reach a wider audience across the eight social networks where I participate. This article will of course include a lot more information than my brief post on Facebook at that time.

So exactly what is this ominous-sounding thing? Well, in actuality, an API is not really something evil. It is simply a group of functions and procedures that are included in a computer's operating system -- in this case, iOS -- which allow an app to interface with that operating system, and to take advantage of certain of the operating system's features and data. In other words, an API allows the app to interact with the operating system which is installed on the device, by making certain requests to the OS, or operating system.

One way to look at it is that an API is a kind of computer information and communication portal between the app and the operating system that is installed on the device, whether that device happens to be a desktop computer, a laptop or a mobile device such as a cellphone. Stated even more simply, an API allows an app to talk to the device, in order to do things with it, and to get certain information from it.

One simple analogy is a car. A car in and of itself can do nothing. It is just a dead hunk of metal, rubber, plastic, and who knows what else. Until you, the driver, get into the car, place the key in the ignition and turn it, or else push a button, the engine does not turn over, and the car remains dead. In similar fashion, an API in and of itself can do very little until an app interacts with it. So, you install an app, which is then automatically plugged into the OS by way of the API so that you can get things done with it. That is pretty easy to understand, right?

In this particular case, Apple's Exposure Notification API allows iOS apps -- none of which have been released yet by any app developers as of June 25, 2020 -- to interface with your device, for the purpose of tracking and logging the spread of COVID-19, or coronavirus, and for notifying you of your possible exposure to the same.

In other words, using a device's Bluetooth technology, said apps will allow you -- and anyone else who chooses to install and enable such an app -- to know whether or not you have been potentially exposed to the coronavirus by any infected person who has been in your close proximity. There is a caveat to this, however, which I will explain to you momentarily. In short, the accuracy of the application will depend directly on how many people in your immediate vicinity have a contact tracing app installed and enabled on their devices as well. The more the merrier, which I imagine is what government health officials are hoping will happen. We shall see.

It is also worth mentioning that, currently, there are three main classes of Bluetooth technology. Class 3 has an intended range of less than ten feet; while Class 2 has an intended range of 33 feet; and Class 3 has an intended range of up to 328 feet. However, there are newer versions of Bluetooth -- such as Bluetooth 5.0 -- which claim to have a range much greater than that.

Please note though that these intended ranges are affected by a number of factors, including the transmitting strength of the device that is being used, the sensitivity of the receiving device, and any obstructions -- such as walls and buildings -- which may be between the transmitting device -- such as your iPhone -- and the receiving device -- such as another person's iPhone. Of course, there is also the issue of repeaters, but I won't be delving into that, because I am trying to keep this discussion simple and in layman's terms for the computer novices amongst us.

In the case of my 256 GB iPhone XS Max, I dug into "Settings -> General -> About" to find my iPhone's model number. Using the model number, I then went online and discovered that my iPhone uses Bluetooth 5.0. On a desktop Mac, you can find the same kind of information simply by going to "About This Mac -> System Report -> Hardware -> Bluetooth." Additional online research revealed that this means that the Bluetooth on my iPhone has a potential range of up to 800 feet. I was not aware of that! Of course, we still need to take into consideration the aforementioned factors. So I seriously doubt that my device really has anything close to that range when all is said and done.

Returning to Exposure Notification API and COVID-19 contact tracing and exposure notification apps, Apple and Google both emphasize that the data which will be collected by such apps will be totally anonymous. Stated more clearly, neither your personal identity, or your specific location, or any other personal information will be revealed to other users of said apps. The only thing that you and they will know, is whether or not any infected persons were in your immediate vicinity at some point in time so that you can take action accordingly to protect your health. In their online "Exposure Notification FAQ", Apple and Google make the following points regarding one's usage of said apps, and their personal privacy:

----- Begin Quote -----

• Each user will have to make an explicit choice to turn on the technology. It can also be turned off by the user at any time.

• This system does not collect location data from your device, and does not share the identities of other users to each other, Google or Apple. The user controls all data they want to share, and the decision to share it.

• Random Bluetooth identifiers rotate every 10-20 minutes, to help prevent tracking.

• Exposure notification is only done on device and under the user's control. In addition, people who test positive are not identified by the system to other users, or to Apple or Google.

• The system is only used for contact tracing by public health authorities apps.

• Google and Apple will disable the exposure notification system on a regional basis when it is no longer needed.

----- End Quote -----

For those of you who are obviously concerned about government overreach -- no doubt there are many of you out there, myself included -- Apple and Google's "Exposure Notification FAQ" states the following regarding this particular issue:

----- Begin Quote -----

"The goal of this project is to assist public health authorities in their efforts to fight COVID-19 by enabling exposure notification in a privacy-preserving manner, and the system is designed so that the identities of the people a device comes in contact with are protected.

Access to the technology will be granted only to public health authorities. Their apps must meet specific criteria around privacy, security, and data control. The public health authority app will be able to access a list of beacons provided by users confirmed as positive for COVID-19 who have consented to sharing them. The system was also designed so that Apple and Google do not have access to information related to any specific individual."

----- End Quote -----

As the previous quotes make very clear, any COVID-19 contact tracing and exposure notification apps which may be written will be strongly regulated, and they will only be issued by authorized government public health officials. In short, not just every Tom, Dick and Harry iOS developer will be able to write and distribute a coronavirus contact tracing app in the App Store. Apple will certainly make very sure of this. To reiterate, these apps will only be distributed by authorized state government health agencies in the U.S.A., and will at some point be made available in the App Store, if they meet Apple's specifications. As any longtime Apple developer can tell you, Apple is indeed very strict when it comes to which apps are allowed in the App Store.

As the previous paragraphs likewise explain, these apps will utilize a random Bluetooth identifier, or beacon -- that is, a long string of numbers and letters -- which changes quite frequently. With your permission, your device will broadcast this random identifier, just as other devices will likewise broadcast their own unique identifiers, if the user has the contact tracing app installed and enabled. Using Bluetooth, when these devices come near each other, they will exchange -- and log -- the identifiers they have come into contact with.

If an individual discovers that they have been infected by the COVID-19 virus -- that is to say, they test positive -- they can voluntarily choose to upload their identifiers to a central government database. These positive identifiers are downloaded on a periodic basis by all devices which have the contact tracing app installed. Even here, Apple and Google are being very careful regarding exactly which information these government health agencies and databases receive. In their FAQ, they again state the following:

----- Begin Quote -----

"If a user decides to participate, exposure notification data will be stored and processed on device. Other than the random Bluetooth identifiers that are broadcast, no data will be shared by the system with public health authority apps unless one of the following two scenarios takes place:

• If a user chooses to report a positive diagnosis of COVID-19 to their contact tracing app, the user's most recent keys to their Bluetooth beacons will be added to the positive diagnosis list shared by the public health authority so that other users who came in contact with those beacons can be alerted.

• If a user is notified through their app that they have come into contact with an individual who is positive for COVID-19, then the system will share the day the contact occurred, how long it lasted and the Bluetooth signal strength of that contact. Any other information about the contact will not be shared.

In keeping with our privacy guidelines, Apple and Google will not receive identifying information about the user, location data, or information about any other devices the user has been in proximity of."

----- End Quote -----

So how will you know if you personally have been exposed to COVID-19? If the app on your device finds a match between your device's identifier log and the list of identifiers it has downloaded from the central database, it will place a warning notice on your screen, so that you will know that you have potentially come into contact with someone who has tested positive for the coronavirus. The notice will inform you of when the individual tested positive, as well as on what date you were near them.

As I mentioned earlier, there is a small caveat to all of this. While the exposure notification app also identifies how close you came to an individual who is infected -- based on Bluetooth signal strength -- as well as for how long a period of time you were near them, as far as I am aware, the date when they tested positive, and the date when you came near them, is the ONLY information that the on-screen notice provides to you.

In short, the app will NOT inform you precisely where your contact with the infected individual occurred, how close you were to them, or who they are. I don't have any of these apps installed on my iPhone, so I cannot confirm these points with 100% certainty, but that is what I personally understand from Apple and Google's May 2020 FAQ. Furthermore, you do not get these on-screen notices in real time. With good reason, they occur after-the-fact, because it takes time for people to upload their identifiers to the central database -- assuming that they are willing to do so -- and it takes time for the updated identifier records to be downloaded to your device.

But that is not all. Consider what would happen if you were notified in real time. Imagine that you are out and about and amongst a group of masked individuals in a public space. Let us suppose that within that group of people, there are one or more individuals who have been infected, and who have already reported themselves to the central database. All of a sudden, people in that group would start to simultaneously receive COVID-19 contact notices on their cellphones. Can you imagine the panic which might grip the crowd as each person quickly and suspiciously looks around them in the hope of trying to determine who might be infected?

Please also note that this process works in reverse as well. In other words, if you were to become infected, and choose to voluntarily upload your identifiers to the government's database, then others will know if they have come into contact with you at some point, assuming they have the app installed on their device. When I say "you", I am speaking in a generic sense. They obviously won't know that it is you personally, but they will know that they have recently come into contact with someone who has been infected.

Returning to the issue of immediate alerts, now imagine if you are the person in that crowd of masked individuals who is infected. Knowing already that you have been infected, how would you feel if upon receiving a contact alert on their screens, people suddenly turned theirs eyes towards you with suspicion? It would not make you feel very good, would it, even if they don't know for certain that it is you who has been infected with the coronavirus. So the fact that these notifications occur after-the-fact is a good thing, in my opinion. Not only does it avoid undue panic by the public, but it keeps infected people safe from potential harm as well from irate individuals.

I kind of have an idea of how this might feel. Let me relate a small incident which occurred to me a few weeks ago when I went in for my monthly lab work and doctor's appointment. As with other places around the globe, our island has been fully practicing social distancing and lockdown since mid-March. In fact, despite the fact that I am supposed to have my blood tested every month without fail in order to check my PT/INR, and to adjust my dosage of anticoagulant as needed, due to the pandemic, I was able to get a three-month supply of my meds from my personal physician the last time that I saw him in March. Therefore, from the third week of March until the first week of this month -- June 2020 -- I didn't venture any further than the garbage bin outside to empty my trash. My daughter wouldn't even let me do my own food shopping, being as I am high risk. And she still doesn't allow it. God bless her! What love!

At any rate, when I do go out -- which is usually only about two or three times a month at best -- I use a bus service that is designated for people with disabilities. It is a very nice and convenient service which takes me from my very doorstep to my destination, and then returns me home again when I am done taking care of my personal business. These special buses are usually small shuttle buses which seat only a few passengers. In fact, they are so small, that practicing social distancing with a minimum of six feet between passengers is impossible. Not only is it a very small space to begin with, but it's also an enclosed environment where everyone is breathing the same air. As such, logistically-speaking, each bus should only be carrying two people at a time until the lockdown and social distancing is lifted, in my view. That is, the bus driver and only one passenger.

In the few times that I've gone out since this pandemic first began, the bus driver -- who is both masked and gloved -- has always made sure that I am likewise wearing a mask -- I use a FFP3 mask from Israel -- and they check my temperature as well before I am allowed onto the bus. Well, despite knowing that social distancing is supposed to be practiced, imagine my surprise when while taking me to my appointment earlier this month, the driver stopped to pick up another passenger. I did not say anything to the driver, but I really questioned in my mind if what he was doing was approved by the central office, as his actions were clearly in violation of social distancing practices. Maybe I should have questioned him once I realized that he was going to make another stop before dropping me off; but I didn't do so.

As if that wasn't enough, when this new passenger got on the bus, while they had a mask, it was hanging below their chin, and they made no effort to put it on before boarding the bus. It was not until a few minutes later, after glancing over at me, I believe, that they finally raised their mask to their face. Again, I was shocked by this individual's lackadaisical attitude. But that is not all. While the bus driver had taken the time to check my temperature before allowing me to board the bus, he did not do so with the new passenger. As you can probably imagine, I was feeling a bit perturbed by this point. Here I was following all of the pandemic rules, and this bus driver and passenger were doing the exact opposite. I even wondered if it was a matter of discrimination because I am Caucasian. Could he really have forgotten to check the new passenger's temperature, when he had checked mine only some twenty minutes before? Who knows.

On that particular morning, I had woken up with a rather nasty headache, so I was really in no mood to be talking to anyone. Nevertheless, I still offered a cordial greeting to the new passenger, and then I kept quiet. Besides the headache, those FFP3 face masks are hot and tight, and I don't like having to wear them. So this was further motivation on my part to keep quiet. Despite the fact that I was somewhat bothered by what had just occurred, I gave no physical sign of my disapproval. I said nothing. I gave no nasty looks. I just kept my mouth shut.

I don't know if the other passenger simply picked up on how I was feeling, or if they were just feeling guilty on their own accord. But whatever the case may have been, just as they were getting down from the bus, they questioned the bus driver regarding why their temperature had not been checked. It was at that point, after being reminded by the passenger, that the bus driver finally checked their temperature. Again, I did not say a word. I still wonder if I should have called up the bus company and questioned them about this incident. I may still do it, even though this incident occurred a few weeks ago, because I will be taking the bus again very soon.

So, my point in sharing this anecdote with you is that I do have a pretty good idea regarding how someone might feel if the exposure notifications on our devices occurred in real time. If I was the infected person in that crowd, I would probably quickly slink out of that place as quickly and as inconspicuously as I could. And if it was someone else in that crowd who was infected, they just might feel the darts and questioning glances as people began to wonder who it was amongst them who might be infected. So let's all try to be sensitive to how others may be feel in regards to the coronavirus. A little consideration goes a long way.

By the way, if you are wondering what my general thoughts are regarding this pandemic, the various actions which have been taken by the government, social distancing, and the requirement to wear face masks, please refer to the other three articles, seventeen BBB Blog posts, and one poem which are listed at the end of this current article. They offer a rather complete picture of my position regarding this entire matter.

Let me stress again that the accuracy of the contact tracing and exposure notification app on your device all depends on how many other people have actually installed and enabled such an app on their device. No doubt, many people are going to refuse to do so due to privacy concerns, whether they are real concerns or imagined. As such, there could be people in your vicinity who have been exposed to or infected by the coronavirus, and you still would not know it, because they do not have any app installed on their particular device that is sending out beacons. In such a case, unless that person gets sufficiently sick to where they have no choice but to go in for medical treatment, health authorities will have no clue that they have become infected, unless someone reports them. Neither will you know. Let's hope that we never come to the point where people are actually turning each other in. God forbid!

Whether or not you personally choose to install a COVID-19 contact tracing and exposure notification app on your device is entirely up to you. Personally, I have no intention of doing so at this current time, because quite frankly, we are faring quite well here, thank the Lord. In fact, since March 12th when testing began here, we have only had 231 confirmed cases of coronavirus in all. These cases have sadly resulted in 5 deaths, with 52 cases still remaining active, and 174 cases of recovered individuals. In contrast, the USS Theodore Roosevelt -- which was docked at our island until recently -- fared much worse, and at last report had 1,156 infected cases as of May 2020. I assume the sailors are all recovered now being as the aircraft carrier has already left port after a longer-than-anticipated stay here.

Another reason why I am personally not all that interested in installing a COVID-19 exposure notification and contact tracing app on my iPhone is simply because, as I mentioned a moment ago, I really don't go out that much. Due to my age, and also due to my personal health situation, I am pretty much a recluse, and I live a rather solitary life. As such, installing a coronavirus contact tracing app would not be of much benefit to me.

But there is another reason why I am very hesitant to install such an app on my iPhone. It concerns a troubling paragraph that is found in the aforementioned Exposure Notification FAQ that was jointly published by Apple and Google in May of this year. In the paragraph -- which I quote below -- they seem to indicate that during the second phase of the implementation of this contact tracing and exposure notification endeavor, a person's device will already have the ability to both transmit and receive Bluetooth beacons -- or identifiers -- in spite of the fact that an official contact tracing app hasn't yet been installed by the user on their device. Either that, or I am simply misunderstanding what Apple and Google are stating in the following paragraph. Please notice what I have placed in uppercase letters:

----- Begin Quote -----

"After the operating system update is installed and the user has opted in, the system will send out and listen for the Bluetooth beacons as in the first phase, BUT WITHOUT REQUIRING AN APP TO BE INSTALLED. If a match is detected the user will be notified, and if the user has not already downloaded an official public health authority app they will be prompted to download an official app and advised on next steps."

----- End Quote -----

As I said, if I understand this correctly, this means that even though I have not yet installed a contact tracing and exposure notification app on my iPhone or enabled "Exposure Logging" on it, nevertheless, it ALREADY has the ability to send out and receive Bluetooth beacons -- or identifiers -- and look for possible contacts with other device owners who may have been infected with COVID-19, because I have already installed the iOS 13.5 update since one month ago. That is how I interpret the phrase "the operating system update". If this is indeed what that paragraph is saying, then it seems to contradict what I wrote on Facebook one month ago when I said that Apple does not surreptitiously install software on your device which allows it to contact trace you in regards to the coronavirus.

In reading the previous FAQ paragraph more closely, please notice that it mentions the user opting in AFTER installing the iOS 13.5 update, but BEFORE downloading and installing "an official public health authority app". This now makes me wonder exactly what was on that Release Notes screen when I updated my iPhone to iOS 13.5. I honestly don't remember now. Did I unknowingly and inadvertently agree to allow tracking from that point forward without realizing it, and even though "Exposure Logging" has not been enabled on my device to this very day, nor any contact tracing app installed on my device to this very day either? In other words, by simply installing the iOS 13.5, did I automatically give my consent to have my device transmit and receive COVID-19 beacons? A clear answer from Apple would be appreciated.

That one paragraph -- which I openly admit I could possibly be misunderstanding -- appears to contradict everything else that both Apple and Google mention in their FAQ -- namely the following four points -- and it leaves me somewhat confused. Please note that these four points are paraphrased in my own words. However, to my knowledge and understanding, they are an accurate reflection of what is actually stated in the official FAQ, the URL of which I will be giving you in part two of this same article:

1. The device user must explicitly choose of their own accord to enable "Exposure Logging".

2. The device user must explicitly choose of their own accord to download and install an exposure notification and contact tracing app.

3. The device user must explicitly choose of their own accord to voluntarily report their positive diagnosis of COVID-19 to state health officials by using the contact tracing app which they have willingly installed on their device.

4. By voluntarily choosing to report their positive diagnosis of COVID-19 to their contact tracing app, the device user acknowledges that their most recent keys to their Bluetooth beacons will be added to the positive diagnosis list which is shared by the public health authority. This information will then be downloaded to the devices of other app users.

Now, if all of that is true, then I fail to understand how is it that my device can already be transmitting and receiving COVID-19-related Bluetooth identifiers, when I have by no means fulfilled any of the aforementioned steps, or given my consent for my device to do so. In other words, I certainly have not enabled "Exposure Logging" on my XS Max iPhone. I have not downloaded and installed any exposure notification and contact tracing app on my device. Neither have I been positively diagnosed with the coronavirus, or reported myself to health officials by way of any installed contact tracing app.

Please go to part two for the conclusion of this article.

⇒ Go To The Next Part . . .


Click or Tap Icons to Share! Thank you!

BBB Tools And Services


Please avail yourself of other areas of the Bill's Bible Basics website. There are many treasures for you to discover.