Canadians can now begin downloading a voluntary smartphone app meant to warn users they've been near someone who tests positive for COVID-19.

Prime Minister Justin Trudeau says he downloaded the "COVID Alert" app this morning and says the more people who sign up to use it, the better it will be able to trace — and help to slow — the spread of the novel coronavirus.

"Health experts say that if enough people sign up, this app can help prevent future outbreaks of COVID-19 in Canada," Trudeau said Friday in Ottawa during a visit to the Public Health Agency of Canada.

The free app, available for Android and iPhones on Friday by searching "COVID Alert" in the app store, is designed to track the location of phones relative to each other, without collecting personal data anywhere centrally, using digital identifications unique to each device.

Then users can be notified if their phones have recently been near the phone of a person who later volunteers that they have tested positive for COVID-19.

Once a diagnosed person signs into the app, a notification is sent to anyone with the app installed who has been within two meters of the ill person for more than 15 minutes within the prior two weeks.

The app will then encourage users to call their provincial health services for advice on what to do, once a user gets a notification that someone who had been nearby tested positive for COVID-19. In Toronto, for example, those who are exposed are instructed to find out how to get tested, and if they do not get tested, should self-isolate for 14 days from the date of the exposure.

Trudeau said the app is currently linked to the Ontario health system, but anyone in Canada can begin using it today and more provinces are joining it soon. He said the Atlantic provinces will be the next to link their health systems to the app and the federal government is in talks with other provinces too.

"I want to be clear: this app isn't mandatory. It's completely voluntary to download and to use," Trudeau said. "And it doesn't collect your name, address, geolocation, or other personal information."

Canadians can now begin downloading a voluntary smartphone app meant to warn users they've been near someone who tests positive for COVID-19.

The Privacy Commissioner of Canada and his Ontario counterpart both support the application, they said in a joint statement Friday.

"Canadians can opt to use this technology knowing it includes very significant privacy protections," privacy commissioner Daniel Therrien said. He and Ontario information and privacy commissioner Patricia Kosseim said government monitoring of its implementation and effectiveness, coupled with independent oversight, are key to maintaining public trust.

The app works with key codes distributed by Ontario public health officials, government officials said. The key codes will be given by healthcare providers to patients who receive a positive COVID-19 diagnosis. Those in other provinces can still download the app and will still be notified if they have been near someone who entered a key code, government officials told reporters.

If someone downloads the app at the time of receiving a positive COVID-19 test result, app users who had been in their vicinity will still be notified when the ill person "uploads" the key code.

Because the positive test result is reported to the app by the user, rather than public health officials, the government characterized the app’s use as voluntary. Government officials also declined to call the app "contact tracing," since it does not collect personal contact information or trace locations. In a briefing with the media, officials said that it would be up to experts on an advisory council to decide how the information would be used by public health researchers.

The voluntary nature of the app raised questions about whether it will get widespread adoption, since officials said it is prerequisite for the app to be installed by both the person who contracted COVID-19 and those who wish to be notified.

When the app was first announced by Trudeau on June 18, technology lawyer Michael Geist told The Canadian Press that a critical number of people must download the apps for them to be effective. Otherwise, Geist said at the time, people may feel a false sense of security because they are not being notified.

A separate poll from Statistics Canada on Friday indicated that Canadians are split on the use of contact tracing apps, with about a quarter of adults aged 25 to 64 "very likely" to use an app — and another quarter "very unlikely" to do so, mostly citing privacy concerns and location tracing.

The app, designed with open source code by Shopify Inc. employees and security features from BlackBerry Ltd., uses random Bluetooth codes, not location data, government officials said.

However, the Canadian government does store users' IP addresses for a period of three months to two years, in what it says is a standard protocol for protecting against cyber attacks. Plus, Android users must turn on location services to use the Bluetooth function, although officials said the app’s permission settings do not permit location collection. Government officials said they had been in contact with Google about the potential to turn off location services to use the Android app, but that as of Friday, the setting must be turned on.

The Bluetooth signals sent between app users’ phones are encrypted, stored on each individual phone, and deleted after 15 days. Codes that are "uploaded" to servers when someone reports a positive COVID-19 result are also deleted after 15 days, the app’s privacy policy says.

This report by The Canadian Press was first published July 31, 2020.

Keep reading

I just threw up a little.

Oh, sorry! Please excuse my COVID-1984.

Unbelievable! After ensuring everyone was totally living in fear, now let's add psychosis and hypochondria to the mix with this new app. Everyone will be sooooooo ready for that vaccine.

I'm impressed with how the creators of this app decided to handle data privacy.

I'm a software developer, working as a data engineer right now. I have first-hand experience with the technical capabilities companies have to collect data about people, as well as insight into why companies might be interested in certain data. One of the things always on my mind is how I can make sure the data I help companies collect can't be used unethically. This includes things like anonymizing the data collected - "Person A" bought "Product A" without knowing other sites "Person A" visits instead of "Jane Doe" who also browses another particular website not even affiliated with the website in question bought a particular brand of product.

What stands about this app is that it doesn't collect peoples' information at all. The best security is to not allow a connection at all (ex. an electronic voting machine not being connected to the internet at all to prevent hacking risks). Likewise, the best privacy is to simply not collect the data in the first place. Instead, peoples' phones keep a history of the codes they've seen where they've been nearby for 15 minutes with other phones with the app, and a person diagnosed can opt into uploading their generated codes to the government's central server when they're diagnosed (which won't include any data about where they were when those codes were generated). The government can make this whole system work without collective data about every single user, and the data that is collected from those who choose to share it after they're diagnosed is extremely anonymized.

This all relies on the government being truthful about what the app does. This is also a valid concern. TikTok is an example of an app that denies collecting a lot of information about its users yet has been shown through technical analysis to in fact be collecting a lot of information (https://www.cnet.com/news/tiktok-accused-of-secretly-gathering-user-data...). If you have these concerns, know that that feeling is healthy. You can do your own independent research (look for reputable sites that report on this) or use techniques like decompiling the app, observing network traffic from the app, etc, if you have the technical skills to do so.

Keep it simple: just say NO!

Why would anyone trust anything this sham of a government recommends?