The federal government is promoting the use of a smartphone app that can alert Canadians if they have been near someone who has recently tested positive for COVID-19.
The decision, announced by Prime Minister Justin Trudeau at a news briefing on Thursday, ended weeks of speculation over which particular version of the technology Ottawa was leaning toward – or whether it was dropping the idea altogether because of concerns that such apps may compromise the privacy of those who use them.
The app selected by the federal government is the same one unveiled by Ontario Premier Doug Ford shortly after the Prime Minister’s announcement. It is a version of COVID Shield, an app created as an independent project by a team of developers affiliated with the Ottawa based e-commerce company Shopify. It relies on an interface created jointly by Apple and Google that has been adopted by several other countries, including Britain, which today said it would shut down an app it developed earlier in favour of the Apple-Google system.
Ontario officials said the app could be available for individuals to download as early as July 2.
While use of the app is voluntary, its impact will depend in part on how many people opt to install it on their devices.
“It will be up to individual Canadians to decide whether to download the app or not, but the app will be most effective when as many people as possible have it,” the Prime Minister said.
In April, Alberta became the first province to roll out a contact-tracing app in the battle against COVID-19. More than 200,000 Albertans have since downloaded the app, which has received mixed reviews.
A spokesperson for the province said that Alberta supports an integrated approach to contact tracing across provincial boundaries but will wait to see how federal plans develop before deciding how to co-ordinate efforts.
The health impact of contact-tracing apps, also called exposure-notification apps, is difficult to assess. This is partly because the apps are blind to unreported cases of COVID-19, which are thought to be a significant source of infections.
But in Canada it is privacy that has driven the conversation about the apps, a concern that was raised last month by Canada’s Privacy Commissioner, among others.
Any individual using the Ontario app who tests positive for COVID-19 can choose to upload this information using a verification code that will be given out with the positive test result. The app will then anonymously alert all others whose devices were within close range of the one belonging to the person who tested positive. All records of recent contacts are kept only by the devices and not in a central repository. Records are automatically erased after 14 days, thought to be the maximum time required after an exposure for an infection to develop.
“The data will be anonymous and protect the privacy of the user. That was at the top of list, when we looked at apps,” Mr. Ford said in a separate briefing with reporters.
Blackberry Ltd., based in Waterloo, Ont., has been enlisted to review the app for Ontario, as well as the system that connects it to the province’s health database.
The company, which in recent years has shifted from smartphones to secure communication technologies, said that a team of about a dozen experts has been going through the system to ensure there are no vulnerabilities that would allow data leaks or attacks.
“As the solution gets rolled out to other provinces, ongoing review is necessary to ensure the application itself stays secure,” says Sarah Tatsis, BlackBerry’s vice-president of advanced technology labs.
The app is based on the wireless communication technology known as Bluetooth, which allows devices to sense one another and keep track of their encounters without having to provide that information to others. Apps of this type received a higher grade from Amnesty International when it released a report on Tuesday ranking different countries based on how well their COVID-19 technologies protect individual privacy.
Florian Kerschbaum, director of the University of Wateloo’s Cybersecurity and Privacy Institute, said Bluetooth is the preferred way to protect privacy because it only keeps track of how close individuals may have been to one another not where their encounters took place. Some apps rely instead on GPS to show where an individual who may have been exposed to COVID-19 has been.
The fear is that this kind of detailed tracking data could be misused by governments or other entities. Dr. Kerschbaum added that it also raises the possibility that hackers could create fake GPS profiles for different locations that can be used to spy on individuals by revealing whether they are near one of the fake profiles.
He said that the app proposed by Ontario appears to satisfy the privacy principles that he and other experts have laid out.
“I will install the app,” he added.
Thursday’s news marks the end of a bumpy ride for a process that began in March when researchers and tech companies first began debating and experimenting with how best to leverage mobile phones to fight the pandemic.
Several groups produced their own in-house solutions to the problem, including Montreal’s Mila artificial intelligence hub and the Vector Institute at the University of Toronto, among others. At various times these were among the options that appeared to be in the running for provincial or national endorsement. Both groups have said that they are now shutting down their projects.
Mila’s scientific director, Yoshua Bengio said that the entire experience suggests that the public needs to be more engaged in the conversation about how personal technologies should be used at times of crisis, in part so that they can clearly understand the risks and benefits.
“If people don’t understand the pluses and the minuses they probably won’t upload the app,” he said. “And if they don’t, the app is pretty useless.”
With a report from Josh O’Kane
Our Morning Update and Evening Update newsletters are written by Globe editors, giving you a concise summary of the day’s most important headlines. Sign up today.