Apple and Google have promised to turn off the API used for contact tracing as soon as there is no more need for it. The companies have not given a definitive end date for the use of the API. The changes in the initial proposal for the app were made because some privacy concern arose after the system was first announced.
Apple and Google announced the system only two weeks ago, but now the proposal for the API has been revised. The Bluetooth-based Covid-19 contact tracing platform works like many of the other tracing apps. Apple and Google will provide the building blocks for an app which should also guarantee privacy and security. Public health authorities can then take these building blocks and build an app.
One of the worries about the initial plan concerned a daily tracing key. This daily tracing key would be shared with a central database when you report a positive diagnosis. The issue was that this key was generated from the master key on your device. Experts stated that it might be possible for hackers to link those keys with a particular user. That is why daily tracing keys will now be generated randomly, so that there is no more connection with the master key. This daily key has been renamed and is now called a temporary tracing key.
The companies have renamed the system as well. It was originally announced as a contact-tracing system, but now they are calling it an exposure notification system. The reason for this is that the app cannot take over from the traditional contact tracing where infected people are interviewed. The app should not be seen as something you can use instead of traditional methods, but is an addition to these methods.
A worry that has not been addressed in the revision is how the API is going to prevent false positives. It would be very easy for someone to stir up some commotion by registering a false positive. Engineers think that this issue will be addressed by the app developers and local authorities. In that way they can make sure it works for their specific testing system.
But most importantly, both companies have promised that the platform will be disabled after the outbreak has been sufficiently contained. The decision to switch off the tracker would have to be made in each individual region. How such a choice would be made is unclear as of yet. The engineers have stated that they never intended for the APIs to be active indefinitely.
Experts voiced their worries about the fact that this project could be seen as a surveillance system. As a move towards transparency, the companies have released a FAQ page where you can find a lot of the information that has already been made public. But we might have to accept a certain level of surveillance if we want to win the fight against the virus.