COVIDWISE – The new COVID-19 app launching in Virginia; What is it and is it safe?
On August 5, 2020, Virginia rolled out the new free COVIDWISE app using pandemic technology created by Apple and Google. Its purpose is to notify people if they might have been exposed to the coronavirus.
How does it work?
When someone tests positive for COVID-19, a contact tracer (public health worker trained in tracing virus contacts) reaches out and encourages the person to download the app if they don’t already have it on their device. If the person downloads the app, or already has it, they’ll be given a six-digit PIN unique to their lab result. Once that is done, the app will notify other users of potential exposure.
The app generates an anonymous token for your device and works in the background (so as not to drain your battery or data). It exchanges these tokens via Bluetooth Low Energy (BLE) technology. It is a passive process that begins once opted-in and you do not need the app open for it to work.
Your device downloads daily a list of all the anonymous tokens associated with positive COVID-19 cases and checks them against the list of anonymous tokens it has encountered in the last 14 days. If there is a match, the app will notify the user with instructions from the Virginia Department of Health (VDH) on how to best proceed.
Is it safe?
Yes. The VDH chose to use this Apple/Google technology to create its app because of its security features and anonymous nature. There are other competing platforms that track location through device GPS and/or report specific information back to the government. The COVIDWISE app does neither of these things to protect individual Virginians’ privacy. The app does not collect, use, or store any personal identifiable information or location data.
Limitations
While we applaud the VDH’s choice to maximize the privacy of Virginians (as our firm sees with alarmingly frequency both sloppy and negligent behavior when it comes to cybersecurity protections), this approach has some drawbacks in the maximum efficacy of this public health initiative. The lack of reporting back to the VDH places the burden entirely on the individual to act appropriately to get tested if alerted, quarantining, etc. The lack of location data forces the app to use estimating data of distance between individuals via the Bluetooth signal strength between two devices. This can cause false positives (such as two people being on opposite sides of a thin wall).
Ultimately, the VDH’s approach seems the most sensible to get the maximum number of people to use the COVIDWISE app. Although it comes with the limitations as noted, the lack of tracking and anonymity of the usage is welcomed and should put Virginians at ease.
If you have any questions about the COVIDWISE app, or any cybersecurity matter, feel free to contact us to speak to one of our cybersecurity attorneys.
Official COVIDWISE site: https://www.vdh.virginia.gov/covidwise/
