CDC announces digital contact tracking standards for Apple and Google practices

The U.S. Centers for Disease Control and Prevention (CDC) released a new document this week outlining what it sees as key features of its contact-tracking app, which appears to be good news for Apple’s partnership with Google. Millions of people are expected to download contact tracking apps in the coming months to slow the spread of coronaviruses. As the primary regulator, CDC guidance is important because public health organizations often refer to it when deciding which technologies to support.

CDC announces digital contact tracking standards for Apple and Google practices

In its latest CDC publication, the organization cites the PACT protocol as an example, recommending a “Bluetooth-based approach” to close tracking while maintaining privacy. Unsurprisingly, Apple and Google developed a contact tracking system that extracted ideas from the PACT protocol, an open source protocol developed under the leadership of the Massachusetts Institute of Technology.

The two companies will unveil sample applications using their systems early next week and release beta software to developers on Wednesday. Apple and Google say they will decide what systems to make and how to implement them.

Similar contact tracking apps are currently deployed in Singapore and Australia, using smartphone signals to track who infected people have been contacted and can be targeted to be isolated or tested for epidemiology.

There are two broad methods for digital contact tracking applications. A type often referred to as “decentralization” is anonymous and can be used without a phone number or email address. Another method, often referred to as a “centralized system,” feeds infection data back to public health agencies so that they can actively reach people who may be infected.

Apple and Google support a decentralized approach that they see as a more secretive way to track contacts that can be as effective as contact tracking, and that it can be faster and more widespread because users remain anonymous and can be reached by automated means if users are at risk.

As governments decide on digital contact-tracking strategies, debate surging around the world. In Europe, Germany and Italy support Apple-style decentralized systems, but the UK, France and Norway want to integrate their digital contact tracking apps with health authorities.

The CDC is not explicitly on one side, and in its preliminary standards they distinguish case management software, like those used by public health officials, from close-up tracking software used by individuals.

Case management software is sold to state and city public health agencies and can incorporate health-oriented privacy practices, including automatic direct contact with people who test positive. Consumer-facing apps downloaded from Apple and Google’s app stores are described as “close tracking” by the CENTERs for Disease Control and Prevention, although these companies prefer to call them “exposed notifications.”

The CDC’s announcement did not name Apple or Google. In one section of the document, the CDC says the minimum standard for contact notifications through the application includes manual notifications, which hints at the possibility of building a centralized system. But it also said the preferred system under its standards included anonymous, automated notifications, such as those provided by decentralized systems.

The CDC says the Close Trackapp app can use location tracking, including GPS, but recommends selective anonymity for the system. The CDC’s standards state that the best applications will be open source and use open architectures and standards. While Apple and Google have always been transparent about how to build their own systems, Apple’s iOS has not always been open source.

Neither tech giant publicly commented on the CDC’s latest outline, but a group called the TCN Alliance on Friday praised the group’s standards, which promote Bluetooth-based anonymity.

Find out more:

https://t.co/vpGRcFvNUk