Apple says COVID-19 contact tracing apps can include duration of proximity when deciding what is a proximity event, potentially limiting false positive pings
Surveillance and the pandemic: it doesn't have to be a nightmare Sergio De Simone / InfoQ : Google and Apple Jointly Working on Contact Tracing for iOS and Android Samantha Wiley / iLounge : Apple and Google will join to add Opt-In COVID-19 contract tracing technology to both Android and iPhone Carola Frediani / Guerre di Rete : [Guerre di Rete] Contact Tracing: a che punto siamo Tweets: Ben Adida / @benadida : 1/ Last night, I spent some quality time with the Apple docs on the new contact tracing protocol and APIs they and Google are preparing. I'm quite optimistic about this effort. Here's why. Moxie Marlinspike / @moxie : So it takes BTLE privacy a ~step back. I don't see why all of the existing beacon tracking tech wouldn't incorporate this into their stacks. At that point adtech (at minimum) probably knows who you are, where you've been, and that you are covid+. Thomas Steinke / @shortstein : Bluetooth LE has a range of up to 100m/300ft. So bluetooth-based COVID-19 contact tracing will collect excessive contacts. False positives will lead to alarm fatigue. 🚨😴 The obvious solution is to record signal strength, but the @Apple/@Google API does not provide this info. https://twitter.com/... Dare Obasanjo / @carnage4life : Although Apple & Google's have done a commendable job making their contact tracing APIs private, in reality they'll be ineffective if anonymous. Many people won't self quarantine if an app tells them to unless there some enforcement. See Taiwan/Singapore. https://www.theverge.com/... Alan Woodward / @profwoodward : When considering whether the new NHS corona app is the best exit strategy may I recommend you read @rossjanderson piece here https://www.lightbluetouchpaper.org/ ... especially what proper contact tracing requires. Roger McNamee / @moonalice : Excellent post by EPIC advisory board member Ross Anderson on contact tracing in the real world. https://www.lightbluetouchpaper.org/ ... Kai-Fu Lee / @kaifulee : Opt-in contact tracing won't work. If 10% people opt-in, 50% always-on bluetooth, 40% people infected voluntarily report, then only 10%*10%*50%*40%= 0.2% pairwise contacts get reported. Am I missing something? https://twitter.com/... Arun Sukumar / @arunmsukumar : “in the months after the API is complete, the companies will work on building tracing functionality into the underlying operating system, as an option immediately available to everyone with an iOS or Android phone” https://www.theverge.com/... Hakan / @hatr : Ross Anderson quite skeptical whether the tracing-app is going to work. He raises several issues (trolling, social interactions, false-positives) and ends with a plea to redistribute “resources from the surveillance-industrial complex to public health” https://www.lightbluetouchpaper.org/ ... https://twitter.com/... Eugene Gu / @eugenegu : Google and Apple's contact tracing technology has big implications for privacy rights and freedom. While it may be useful for tracking sick contacts during the coronavirus pandemic, this same technology can be used to persecute political dissidents in a surveillance police state. Fred Abrahams / @fredabrahams : Important @ACLU paper on the limits of location tracking in an epidemic. THREAD 1/6 https://www.aclu.org/... https://twitter.com/... Malte Engeler / @malteengeler : “Why has surveillance become the only device through which we can effectively act?” Open letter to the #DP3T GutHub. #Corona #Tracking https://github.com/... Michael Ossmann / @michaelossmann : This is a very good summary of concerns about the Apple/Google Bluetooth contact tracing system. I was musing about an identical system a few weeks ago and for these very reasons chose not to propose it publicly. Marketing this as “privacy-preserving” is problematic. https://twitter.com/... Brad Lander / @bradlander : But even beyond the privacy, feasibility, and enforcement concerns (and there are many), it's not clear bluetooth apps will really work. So we will need to hire a lot of people to work on contact tracing. By definition, this is a local & state effort. https://www.theverge.com/... @onekade : ACLU comment on the Apple/Google contact tracing scheme https://www.aclu.org/... Casilli / @antoniocasilli : It seems that the Apple/Google solution has the same privacy problem as other proximity tracers: it's anonymous as long as you are not positive. Moreover it'll most likely be linked to geoloc data+risk of linking to adtech+possibility of proximity “pranks” https://twitter.com/... https://twitter.com/... Michael Veale / @mikarv : I really welcome the proportionate API moves, and the fact the proposed A-G collaborative protocol is decentralised is good. But going forward societies and communities need to have much more say in what gets put in operating systems, and how they can refuse it. https://twitter.com/... Zack Whittaker / @zackwhittaker : Earlier this week, the ACLU warned about the limits of using location tracking during the coronavirus pandemic. Made some really thoughtful points. Would be curious to see what @granick and @jaycstanley think about this latest effort. https://www.aclu.org/...
Context & Ripple Effects
This is a spec-level clarification arriving mid-build-out: with dozens of tracking apps already in use or development across governments and health authorities, Apple is telling developers how the Bluetooth proximity signal should be interpreted — a ping only counts as an exposure event if the two devices were near each other long enough. It is a direct answer to one of the practical failure modes critics catalogued around the same time, where brief incidental encounters would otherwise register as exposures.
The timing matters because the joint Apple-Google effort was still pre-launch; the guidance lands weeks before the Exposure Notification API shipped publicly in iOS and Android updates, meaning state health departments writing apps had a chance to bake duration thresholds into their event logic from day one rather than retrofit it.
First-order effects
- Developers building on the Exposure Notification protocol gain a tuning lever against false positives — the single most likely driver of user distrust and app abandonment once alerts start firing.
- Health authorities designing state apps must now decide what duration threshold defines a meaningful exposure, moving an epidemiological judgment call into app configuration.
Second-order effects
- Accuracy becomes a competitive axis between centralized national apps like India's 75M-download tracker and the Apple-Google decentralized model, since fewer false pings strengthens the opt-in case that platform vendors are making.
- If duration filtering measurably cuts spurious alerts, adoption rates — the weakness critics flagged — improve without any change in privacy posture, pressuring governments that chose centralized architectures on effectiveness grounds.
Third-order effects
- Apple and Google are effectively setting public-health parameters at the operating-system layer, a precedent for platform vendors governing sensor-derived data (Bluetooth, location, motion) that outlasts the pandemic.
- The pattern points toward OS-level exposure/telemetry APIs becoming standing infrastructure that health agencies build on, with the platforms — not governments — controlling the interpretation rules.
The trend: Smartphone platforms are becoming default public-health infrastructure, with Apple and Google defining both the privacy constraints and the signal semantics that government contact-tracing apps must operate within.