DENVER–The Colorado Department of Health and Environment (CDPHE) recently announced the upcoming availability of a cellphone app created by Apple and Google that will allow people to opt in to an anonymous “token exchange” on their phones that will keep track of their proximity to people who might later be diagnosed with the COVID-19 virus.
Announced September 8, the “Exposure Notification Express” (ENExpress) app will swap anonymous “tokens,” or bits of code, with other users who come within about six feet and who linger for 10 minutes or longer. These exchanged tokens are stored on each person’s phone for 14 days. New random tokens are generated within a users phone every 15 minutes to prevent tracking of the individual.
If a user is diagnosed with confirmed COVID-19, the diagnosing agency will issue that person a special code that is entered into the phone that then triggers a notification to everyone with whom tokens have been exchanged in the last 14 days, advising them to contact health authorities to be tested. The identity of the infected person is never revealed to other users or state health authorities and no individual identity or location data is created, stored or disclosed to anyone, according to CDPHE’s website.
How the individual phone numbers and their owners are kept confidential while still being able to send out notifications to and from token holders, and who stores and has access to that data, is not stated.
While Apple and Google created the operating system structure (API) for the system months ago, the original iteration required states to program their own apps. This caused the idea to be widely ignored, and only six states created an app.
Both companies collaborated to create ENExpress as a joint effort to standardize the interface and encourage states to take advantage of the technology by relieving the burden and cost of designing and programming 50 different apps.
Colorado will be one of the first states to deploy ENExpress, and it is expected to become available in late September for Apple smartphones and in late September or early October for Android devices.
This is one of many efforts to create cellphone-based software to assist in detecting and limiting the spread of the virus.
CDPHE claims there is no personal information or location data involved, making use of the data impossible for contact tracing, which is different from exposure notification.
CDPHE also says that the system is entirely optional and users can turn token exchange and notifications on and off at will.
Some experts say that unless 60% to 70% of the population uses the app it will be ineffective at helping control viral spread.
Attempts have been made to use cellphones as contact tracing data sources, and governments worldwide have been hankering for such tracking, but here in the U.S. concerns about individual privacy have largely frustrated the sort of contact tracing South Korea implemented early-on in the pandemic, that it credits as helping to keep its infection numbers relatively low.
The Brookings Institution, a nonprofit public policy organization based in Washington, DC reported in April on South Korea’s contact tracing program, saying, “The tools deployed by Korean authorities are readily available in other technologically advanced countries. What sets Korea apart is the political willingness to use these tools to their full potential in supporting a public health response.”
CDPHE goes to great lengths to assure Coloradans that ENExpress cannot be used for tracking individuals, even if they are confirmed as having COVID-19. But contact tracing remains an important part of CDPHE’s plan for reducing the spread of the virus.
Governor Polis’ office reluctantly admitted in mid-April to using “publicly available aggregated cellphone data” produced by Google to create “heat maps” of Coloradans’ travels during his “Safer at Home” lockdown order.
The intersection between cellphone data, exposure tracking, contact tracing and privacy is a complex one, and given the lack of explicit statutory prohibitions, the boundaries of data acquisition, collation and analysis the government is obliged to observe are unclear.
