On Friday, Apple and Google revised their ambitious automatic contact tracking offer just two weeks after the system was first released. An Apple official said it was the result of feedback the two companies received about the specifications and how to improve them. The company also released a “Frequently Asked Questions (FAQ)” page, which again reveals a lot of information that has already been released.
When making a phone call with the announcement, representatives of each company promised to disable the service for the first time after the virus outbreak had occurred. These decisions must be made regionally and it is unclear how public health authorities will reach them. However, the engineer decided that the API was not maintained indefinitely.
Some changes seem to be designed to address privacy issues that have occurred since the initial release. According to the new encryption specification, daily tracking keys are now randomly generated rather than mathematically derived from the user's private key. Crucially, if the user decides to report a positive diagnosis, the daily tracking key is shared with the central database. Some cryptographic experts have been concerned that certain attacks in previous cryptographic protocols could associate that key with a specific user. The use of randomly generated keys makes connecting people to the diagnosis more difficult. As part of the change, the daily key is now called the "temporary tracking key," and the long-term tracking key included in the original specification no longer exists.
The new encryption specification also sets certain protections for metadata related to the system's Bluetooth transmission. With random code, the device broadcasts the default power level (used for proximity calculations) and a running version of the tool. This information can be used to fingerprint a specific user, so engineers have come up with a new system to encrypt it so that it cannot be decoded during transmission.
The company is also changing the language used to describe the project. The protocol was first released as a contact tracking system and is now called the "exposure notification" system. While the proposed apps and protocols may support some of the features of existing contact tracking, they can't do more sophisticated tasks to interview targets and identify clusters of infections, which can provide information to future public health efforts. Companies say the name change reflects the new system should "support public health authorities' extensive contact tracking efforts."
Friday's change does not address the question of how health authorities confirm positive diagnoses to prevent trolls or other false positives, and it is likely that certain app developers will address the question. Engineers thought it was best for local authorities to develop their own verification systems for their own distribution systems, given the various variations of the health system internationally.
One of the biggest questions regarding this project is whether or not the public health agency will adopt the project, and the company hasn't provided details about the specific partnership. However, they said they had discussed the project with dozens of stakeholders, including public health agencies.
The first phase of the program is distributed through allowed APIs, and new documentation provides detailed information about specific restrictions on who is allowed access. "Documents are only managed in conjunction with public health authorities and are approved according to specific criteria designed to meet privacy requirements and to protect user data." I'm not sure if these criteria are acceptable for Android-based apps distributed outside the Google Play store, but Google has historically raised data privacy issues for these apps.