Front Burner - COVID Alert: Canada’s incoming contact-tracing app

Episode Date: June 22, 2020

Prime Minister Justin Trudeau wants you to download an app. It’s called “COVID Alert” and it is a new voluntary contact-tracing app that will be available for download in just a few weeks. The app will first be tested in Ontario, before rolling out to the rest of the country. A lot of people are welcoming the app as a powerful tool to stop new coronavirus outbreaks. But it’s still too early to tell how many Canadians will be willing to sign-up to share their personal health information. Especially since companies like Google, Apple, BlackBerry and volunteers from Shopify were all involved in some way with its creation. Today, infectious disease specialist Dr. Isaac Bogoch talks about what a contact-tracing app means for Canada and shares his thoughts on privacy concerns.

In the Dragon's Den, a simple pitch can lead to a life-changing connection. Watch new episodes of Dragon's Den free on CBC Gem. Brought to you in part by National Angel Capital Organization, empowering Canada's entrepreneurs through angel investment and industry connections. This is a CBC Podcast. Hi, I'm Josh Bloch. Justin Trudeau wants you to download an app. There are over 30 million smartphones that could take this app in Canada,

so we can talk about a significant portion of the Canadian population that could be protected by this app that you can download and then forget about. COVID Alert is a new voluntary contact tracing app that will be available for download in just a few weeks. Testing will start in Ontario, and then the plan is to roll out the app across the country. Robust contact tracing is a key part of containing COVID, and a lot of people are welcoming the app as a powerful tool to stop new outbreaks.

But it's still too early to tell how many Canadians will be willing to sign up to share their personal health information. And there are a lot of questions about privacy, especially since companies like Google, Apple, BlackBerry, and volunteers from Shopify were all involved in some way with his creation. I kind of like it. If it works. And if it's not spying on doing other things, it's not supposed to be. Dr. Isaac Bogosh is an infectious disease specialist and a frequent guest

on this show. Today, he'll talk about what a contact tracing app means for Canada and share his thoughts on the privacy concerns. This is Frontburner. Hi, Dr. Bogosh. Welcome back. Thanks for having me back. All right, let's talk about COVID Alert. Can you just walk me through how this app actually works? Okay, so based on what we're told, people would download this app to their phone, and hopefully lots of people download this app to their phone. And this uses Bluetooth technology on the phone. So if other people have the app on their phone as well, you go about your day. And if you are in close proximity to someone else with this app on the phone, these apps will send out this unique anonymized beacon to the other devices that are nearby.

And each of these phones is going to record and securely store those beacons, those bits of code. And essentially, if someone has COVID-19, they can anonymously upload that to their app. And what would happen is anyone who you had a close contact with, or if your phone was in close contact with someone else's phone over the past 14 days, that person would be notified in an anonymized manner. They would say, hey, guess what? You had a close contact with someone who's tested positive for COVID-19. So if your phone gets in proximity for a certain amount of time at a certain closeness to another phone, it'll register that it has had contact with that anonymized number. A few days later, if that person you were in proximity with tested positive, you will get a

notification to reach out to your local health services. So, you know, I think the key things here that you sort of touched on earlier is that it's anonymous data. It uses codes to contact other phones. There's no personal information. It's not following you or tracing you because it's using Bluetooth and not really recording location data. So it doesn't track your location. This is what we're told. So essentially, it really attempts to check off those boxes of privacy while balancing that with informing people that they may have a close contact with someone who's had COVID-19.

I'm curious to know how sensitive the app is. You know, if I was walking down the street and passed someone who was later tested positive for COVID-19, would I then be notified? No, I think it's really going to be looking at two things. One is duration of exposure, and two is proximity of exposure. And really, we know that if we just forget the app for a second, who's at risk for getting COVID-19? Well, if you have a prolonged exposure to someone who has COVID-19, especially in an indoor environment, you're more

likely to get this. So, you know, you can think about some weaknesses of this app in that will it really account for indoor versus outdoor environments? Probably not. Will it know exactly how close you are? Well, Bluetooth has some distance associated with it. But if you're really two meters apart from someone, for example, or two meters or more apart from someone in an outdoor setting, you're just very, very unlikely to get this infection. So it's unclear as to the accuracy at which this app will be able to tell someone that they've had a true meaningful exposure. But again, this app is not supposed to solve all of our contact tracing issues. This app is supposed to be a supplemental tool. I don't think it's going to replace traditional contact tracing whatsoever. I think it might just be a

helpful supplement to the contact tracing that we already have. And so this app is voluntary, right? It relies on people who test positive to upload their results and then for other people to sign up in order to receive alerts. It'll be up to individual Canadians to decide whether to download the app or not. But the app will be most effective when as many people as possible have it. How effective do you think that can be? I honestly don't know. I really, really don't. We know, as you point out, there's got to be a lot of buy-in and people have to upload this.

And we keep hearing numbers like you need 40% to 60% of people to download this app for this to even be effective. But certainly we would. The more people that sign up for this, the better. It's interesting. Right now, during the course of the pandemic, at least in Canada, we flattened the curve from coast to coast. Things are doing really, we're doing really well. Even the hardest hit areas are improving, especially in and around the Montreal area and in the greater Toronto area.

Things are still getting better in those areas. So there's some degree of complacency now. And I think if the app was rolled out during more intense times, like during the lockdown, there probably would have been much wider adoption, I think. Perhaps they might not get that adoption now. However, I mean, I don't want to be Captain Doom and Gloom here, but if we fast forward till the fall, it's expected that there might be more and more cases of this for a variety of reasons. But if case numbers start to go up again, perhaps we'll see more buy-in for this app. You mentioned that public health officials or public health units are engaged in traditional contact tracing, where you have actual human beings reaching out to people who are infected to find out where they've been,

who they've been in touch with, and then going and contacting and alerting those people who may have been exposed to the virus. What do we know about how that traditional contact tracing process is going right now in Canada? I think in general, it's actually going very well. It's actually quite regional. So some places are better than others. And we certainly hear of success stories where the second there's a positive case identified, a positive case is rapidly contacted by a contact tracer who rapidly goes through and thoroughly discusses where that person has been, who that person has been in contact with. I mean, it's a unique skill. It's certainly a unique skill set. It's time consuming and it's rather labor intensive, but it's extremely

important. Other parts of the country have had pretty well recognized hurdles with this. I mean there were some highly publicized cases in and around the greater Toronto area where there were communication errors between the lab and public health which delayed contact tracing for a significant number of people. But a mix-up in communication with a lab meant some 700 cases were not reported to local health units and patients were not formally notified unless they went online. By and large though I think a lot of those contact tracing problems have been ironed out and we're doing a much better job in contact tracing right now in most jurisdictions. So, you know, I don't think that an app is really

going to replace this at any time soon. I think it's a helpful supplemental tool, but I don't think it's going to replace traditional contact tracing. Well, and it strikes me that one of the challenges of traditional contact tracing is you are relying on people's willingness to speak with public health officials and then to be truthful, to actually disclose all the information, you know, whether, you know, there might be reluctance to share private information or maybe even difficulty recalling some of the facts about where you've been and or who you've been in touch with. Absolutely. I think those are the two key ones, right? I mean, I can't remember what I ate for breakfast, let alone who I was in touch with 14 days ago. So there are historically a lot of challenges with that.

And the other issue too, as you point out, is, you know, there might be some sensitive things that people just aren't comfortable disclosing for a variety of issues, who they were in touch with, where they were in touch with them. I mean, people might not want to chat about that. with them. I mean, people might not want to chat about that. So technological tools such as this app could be very helpful. And we know that some places are implementing these rather successfully. There are mandates to use these in many places. So for example, we know that in South Korea, they're using similar technology. For example, the use of QR codes. Starting June 10th, visitors to nightclubs, karaoke bars and more will have to show a QR identity code of personal information.

Karaoke room owner Son Ki-seok explains. The customer can install the QR code app and put their personal information on their own smartphone, so it's safe from being leaked and helps prevent coronavirus infection. China, in certain parts of China at least, people have to have these types of apps as well. If you are headed into, for example, a space like a hotel, you open it up in real time because people have been screenshotting them. So they figured out a workaround to avoid that. So you have to actually push the button and show it time-stamped, and then they check it, verify it, and they'll let you in. But other places, for example, in European settings,

it does not appear to be mandatory. And everyone's sort of figuring out how they're integrating these tools at this point in the pandemic. And, you know, I'm not saying mandating is the way to go. I'm actually I'm saying the opposite. I think it would be very challenging to do something like that here in Canada. But certainly the more people that adopt this and use this, the more effective this will be. And obviously one of the main concerns for many Canadians in downloading this app will be around privacy, about sharing your private information. I suppose not surprising because the Bluetooth technology being used for this app was provided by Apple and Google. BlackBerry is doing a security review of it and there's volunteers from Shopify helping create the app. So what do we know about the safety of that data that's collected

and how that information will be stored? So it's supposed to be available for 14 days and then destroyed. If they're doing what they say they're supposed to do, there shouldn't be any issues. There really shouldn't be. But of course, there's well-known, well-publicized data breaches with, you know, anything. I'm not surprised that people are weary of downloading the app. But on paper, it looks like a very good plan. I guess the key thing here is, is it going to be implemented

well? And will it be as secure as they say it is? Claudia Popa is a cybersecurity expert with Data Risk Canada. The devil's in the details. It's always worth having an independent view of how the application is designed, how it's been developed, and certainly if privacy commissioners, especially the federal privacy commissioner, could endorse the application, it would really go a long way towards the trust level that the public can have. I think the other thing to consider, too, here, sort of just to bring it back down to planet Earth,

is it's using Bluetooth technology. It's not collecting any personal information. It's theoretically not tracking your location. It's tracking contact with other beacons, basically other people have downloaded the app. And, you know, I think people should look at their phone right now and look at all the other apps that they have on their phone. Right. You have Facebook on there. You have Instagram on there. You have Twitter on there.

You have TikTok on there. You have Google on there. You have your TikTok on there? Do you have Google on there? Do you have your email on there? Like what other information are you sharing with the planet or with other major corporations that aren't taking the same measures to protect your safety and that are selling your data? And then you think about an app like this. I'm not excusing anyone from using people's private information. I think that's wrong to put it bluntly. But I think there's going to be a lot of scrutiny and controls over an app like this. I think it's helpful to put it in perspective. I mean, it does appear that human rights organizations have been monitoring,

I know Amnesty International issued a report about privacy concerns related to some contact tracing apps, including the use of real-time GPS coordinates, which would, I guess, give people the ability to track exactly where a person is if they've downloaded that app. Amnesty carried out a detailed technical analysis of 11 apps, mainly in the Middle East, North Africa and Europe. The app from Bahrain, the app from Kuwait, and including also the app from Norway, all seem to show some properties that were concerning from a privacy perspective and from a human rights perspective. And the bottom line is that all three do conduct

that aggressive location tracking. My understanding is that this will be using technology that will basically tell you if you're in touch with other apps, but it doesn't exactly say where you were in touch with those other apps. I could be wrong on that, but I don't think this tracks your location. This tracks whether or not you're in close contact with other apps. At no time will personal information be collected or shared, and no location services will be used.

The privacy of Canadians will be fully respected. So I think it's important, though, that in general, we only have the framework of a plan. We actually don't have all the major details of this plan. I know this is going to become widely available, but as they make this widely available, we will hopefully hear about further details about how they're planning to roll this out, what exactly this app is going to do and what data is actually going to be collected, how they're going to share or dispose of the data, and who's going to have access to the data. I think those are all very important bits of information that Canadians would like to know before they choose to engage or not engage with this. Will you be downloading the app?

I probably will be, actually. I probably will be. You know, based on what I've seen, I think it can be a very helpful tool. Also, I want to know. Like, I'd love to know if I was in close contact with someone. And all fairness, my life these days really revolves being at my house or being at the hospital. So if I'm going to have an exposure, it's probably at work.

We care for people with COVID-19. So if they have the app downloaded on their phone, mine's going to be beeping off the hook because that's what we're caring for in the hospital. But I'll still download it. I will. We've reached Anne Kavoukian. Now, she's a former privacy commissioner for Ontario. It's amazing. It is totally privacy protective and it reveals no personal identifiers, no geolocation data, nothing. And let me be clear, I never take anything at face value you know trust but verify always look under the hood apple briefed me on two separate occasions on all the details involved

in this and it is amazing it is totally voluntary and under the control of the individual that's privacy is all about personal control I'm going to go. by National Angel Capital Organization, empowering Canada's entrepreneurs through angel investment and industry connections. Hi, it's Ramit Sethi here. You may have seen my money show on Netflix. I've been talking about money for 20 years. I've talked to millions of people and I have some startling numbers to share with you. Did you know that of the people I speak to,

50% of them do not know their own household income? That's not a typo. 50%. That's because money is confusing. In my new book and podcast, Money for Couples, I help you and your partner create a financial vision together. To listen to this podcast, just search for Money for Couples. It's been interesting watching what other countries have been doing around the world,

developing their own apps, and it seems like there's been some struggle in various places to come up with an app that works. I know that the UK just had to scrap their app, which was developed by the National Health Service, and redirect themselves now to something closer to what Canada is creating. Technical issues were revealed in the trial. It proved not to be effective on all devices. A parallel trial with an app provided by Apple and Google was being carried out elsewhere. Now the NHS will work with the companies to develop a new design. Why do you think it's such a struggle for countries to get this right?

It's just that balance between privacy and sharing of private information or the perceived sharing of private information and balancing that with public safety. And I think we're seeing more adoption of these technological tools in Asian countries. And I think, for example, a place like South Korea seems to have done it right. You have QR codes and apps that'll tell you if you're close to someone with COVID-19. You can tell if you're in an area where there's COVID-19. There was this very, very highly publicized setting where there was an outbreak of COVID-19 related to an individual who went to a nightclub. As health workers try to track at least 5,500 people who went clubbing more than a week ago and might be infected.

They say a 29-year-old man went to at least three nightclubs the night of May 1st. And there were about 100 or so positive cases that resulted from that one exposure, but they were able to rapidly conduct contact tracing, largely related to their digital tools that they're using. In addition to traditional contact tracing, largely related to their digital tools that they're using, in addition to traditional contact tracing, they're able to rapidly identify all these close contacts and ensure that they were provided with information and placed on a 14-day period of quarantine. And they were able to prevent a much larger outbreak as a result of harnessing traditional contact tracing tools with

digital applications. This is remarkable. But of course, if you're going into a public setting like a restaurant or a bar or a nightclub or anything like that, you have to scan your phone. You have to identify that you've been in there. Perhaps another question is the number of contact tracing apps that are out there. I know that Alberta has been using its own app called AP Trace Together for weeks now. And they've been having some software problems with that app as well.

When the app launched, it didn't work well on iPhones because it needed to be open and the phone unlocked. The province said an Apple operating system update would fix that. But Alberta Health now says that's just one part of the fix, and the app still needs to be tweaked on their end. Is it better or worse for contact tracing to have different app options across the country? Well, I think what's going to happen is that the software is really a Google-Apple mix, a collaboration. So the software is there and the provinces can create their own apps, or there's probably a country level app that will be developed as well. It will be one app that whether you download it and live in Ontario and travel to BC or travel

to the Northwest Territories, if that becomes an option, it'll work everywhere across the country. But the point is that regardless of what province you're in, all these apps are going to speak the same language and communicate with each other. So it's a countrywide approach, even though the app itself may look different between the provinces. That's a huge strength, again, if there's a wide uptick of this. Because we know Canadians travel and we move around, especially when we're seeing some of the lifting of the public health restrictions that we're living under. There seems to be a lot more travel within the country.

I'm curious to know whether there are other countries that we could turn to as examples of doing this very well. I mean, I know you brought up South Korea. There have been questions in that case about the tradeoff there when it comes to privacy that South Korea has been collecting much more robust data from individuals, including, you know, where people have used their credit cards or GPS locations? Is there a place, is there another country that has struck this balance between being able to collect sufficient information, but also respecting privacy? I don't think so. I honestly don't think I can give you a great example just yet. It's still early. And many of these countries, most countries now that are developing this,

they're really in their infancy. Places that have more well-established digital tools are China, Taiwan, Hong Kong, South Korea. Those places are more advanced. Many of those places mandate the use of them. And certainly they have more highway miles than we do. European countries are probably a close second place. They're more advanced than us in Canada and the United States using these digital tools. And they are, I would say, struggling to sort out which app to use, how to use it, and how to integrate this into routine practice. I can't think of any European country to date that has navigated this successfully,

but I think it's too early. And luckily, in most European settings, and at least in Canada, I can't say the same for the United States, but in most European settings and in Canada, we have largely got this infection under control for the time being. we can figure out how to get this done correctly. And no one would be surprised if there was a second wave of this infection, or if there was an uptick in cases, for example, in the fall and winter months. And perhaps we can use our time wisely now in the summer months and the few months that we have ahead to figure out how this app is going to work, who's going to use it, how we can encourage people to use it, really iron out any potential issues with safety and with privacy, and we can get it ready because there may very well be a time in the months ahead where we're really going to rely on this. Dr. Bogosh, thank you so much for your insight into this.

Anytime. Happy to chat. All right, a political update before we say goodbye. So on Friday, we covered the conservative leadership English debate with Power & Politics host Vashie Kapelos. You can catch that conversation in our feed. But since that episode aired, there's been some dramatic news. Over the weekend, Aaron O'Toole's campaign accused Peter McKay's team of stealing their confidential data, which was reportedly recently hacked. The two rival camps are perceived leadership frontrunners. O'Toole's campaign says it wants an investigation and has filed a complaint with three police agencies. McKay's team has flatly denied the allegation,

saying it was a, quote, desperate, last-ditch strategy. Well, that's all for now. I'm Josh Bloch. Thanks for listening to FrontBurner. For more CBC Podcasts, go to cbc.ca slash podcasts.