Misconceptions persist about effectiveness and privacy of Canada's COVID Alert app

After closing his Barrie, Ont., café for the day recently, René Segura checked his smartphone and saw a reassuring message.

"No exposure detected," the screen read.

Like 1.9 million other Canadians, Segura downloaded the COVID Alert app on the understanding it would notify him if he spent time in close contact with a known coronavirus carrier.

Launched by the federal government on July 31 — and so far only operational in Ontario — the app is designed to warn users if they've spent at least 15 minutes in the past two weeks within two metres of another user who later tested positive for the coronavirus.

Having survived a near-death encounter with COVID-19, Segura has extra incentive to use the app.

"I still have my guard up," Segura said. "I don't want to go through the same episode again."

The app, which works on later-model Apple and Android devices, has received positive reviews from privacy advocates, but myths persist about the data it collects — and doesn't collect.

Experts in both technology and public health stress that the more people who use it, the better it will be. However, they say it doesn't need to be adopted by a majority of the population for it to have a positive impact.

Segura installed COVID Alert as a means of extra protection, knowing he would constantly be in close contact with customers at the café he co-owns with his wife. In March, at age 41, he was placed in intensive care with a severe case of COVID-19. He's fully recovered now but had lingering symptoms for weeks.

With businesses like his recently reopening and students soon going back to school, Segura said the app is "a great tool." He just hopes it will function as advertised.

Using the app does not lessen requirements for public health measures like physical distancing, handwashing and wearing a mask. It's also not meant to replace manual contact tracing — where teams reach out to anyone who's been put at risk of exposure.

So far, there are few ways to measure whether it has been effective, but that appears to be the price for the software's built-in privacy measures.

WATCH | COVID-19 exposure notification app rolling out in Ontario:

Does it work?

At this point, it's virtually unknowable whether the app has prevented anyone from contracting COVID-19.

In a nutshell, "you're trying to measure something that didn't happen," said Lucie Abeler-Dörner, a scientific manager at Oxford University's Nuffield Department of Medicine in Britain. She said it's a recurring challenge when reviewing preventative public health interventions.

When a user of the app is diagnosed in Ontario, they're given a one-time code to input, which then alerts others with whom the patient has been in close contact recently. The feature is built on a framework jointly developed by Apple and Google.

To ensure better privacy, the data is stored on individual devices, not on a central server. The drawback is there's no way of knowing how many users have received an exposure notification.

What's more, a user isn't told when, where or with whom any potential exposure occurred, so it's impossible to determine whether it's a real threat or the result of a glitch. The alert would direct the user to seek advice from provincial public health officials.

The app uses Bluetooth to determine the proximity of other smartphones, but the technology's level of precision is unclear.

Andrew Urbaczewski, an associate professor in business information and analytics at the University of Denver, who examined the effectiveness of similar apps in various countries, said testing such technology in a lab doesn't guarantee results in the real world.

"We've got no reason to believe that it doesn't work," he said in an interview, "but we certainly don't have five years or five months or even five weeks of history as to whether or not this works in the wild as intended."

Urbaczewski pointed to three indicators of success: the app's download rate among the population, its capacity to accurately provide exposure notifications and its users' willingness to follow public health advice in the event of contact with the virus.

An Ontario government spokesperson confirmed to CBC News on Wednesday that COVID Alert has been downloaded almost 1.9 million times "with it being expected that the overwhelming majority of these downloads have come from Ontario."

Although the app is available across Canada, it has so far only been integrated into Ontario's health-care system, rendering it virtually useless in the rest of the country for now.

Prime Minister Justin Trudeau has suggested the Atlantic provinces will join next.

"We hope to see the number of downloads continue to increase across Canada as other provinces and territories connect their health-care authorities to the system," said Alain Belle-Isle, a spokesperson for the federal Treasury Board, the department that is tracking the download rate.

Once anecdotes emerge of exposure notifications leading users to get tested, that's "what's going to be compelling for people to download it more," said Emily Seto, an assistant professor at the University of Toronto's Institute of Health Policy, Management and Evaluation.

"I've downloaded it," she said. "Everybody should — if they can — download it," because of the potential public health benefits.

How many users are needed?

It's often been reported that a majority of people in a given country would need to install a coronavirus app for it to be effective. Experts now say that's not entirely true. Much smaller uptake can help, too.

In April, a team of Oxford University scientists, including Abeler-Dörner, published research suggesting if 60 per cent of the British population installed a contact-tracing app, it would be effective in stopping the epidemic. The number has since been cited around the world to illustrate that high uptake is needed for the app to work.

"It's the figure from early simulations, and it's the figure you need to control the epidemic in the absence of all other measures," Abeler-Dörner said in an interview this week.

"Our latest simulations show that actually you start seeing an impact of the app from about 15 per cent uptake."

But Abeler-Dörner, who is part of a team of scientists advising the British government and the country's National Health Service, said she suspects even smaller uptake provides benefits.

She pointed to anecdotal evidence from Germany that young, urban populations living in denser neighbourhoods and prone to take part in group activities — more likely to spread the virus — are also more likely to install a coronavirus app.

In Canada, 1.9 million downloads represents five per cent of the country's population of 38 million. It's unclear how many of the downloads have come from provinces where the app is not yet active.

Once downloaded, the app also requires a short installation process before it can monitor for COVID-19 exposure. Data from Switzerland indicates not everyone who downloads a coronavirus app actually uses it. The country's app has seen more than two million downloads, but as of Monday, it had fewer than 1.25 million active users.

When COVID Alert launched, Canada's chief public health officer, Dr. Theresa Tam, said officials would need "an ongoing way of evaluating its effectiveness." She declined to provide an uptake target but said the more people who use it, "the more useful it would be."

In July, Australia topped a list compiled by app analytics firm Sensor Tower ranking national coronavirus apps by download rate (21.6 per cent). Ireland is reported to have reached 1.3 million downloads — representing more than 26 per cent of the population — for its COVID Tracker app within eight days of its release.

The Canadian app has only been in use for two weeks. "I think you're on the right track," said Abeler-Dörner.

Is it actually secure?

The federal government, digital privacy advocates and software experts have provided assurances that COVID Alert is safe.

"Canadians can opt to use this technology knowing it includes very significant privacy protections," federal Privacy Commissioner Daniel Therrien said when the app was released. "I will use it."

The app only exchanges random codes, not identifying data, with nearby devices. It checks daily for codes belonging to a user who's said they've tested positive.

The app doesn't provide the government — or anyone else — with a user's name, whereabouts or health information. It also doesn't use a smartphone's GPS function, which could have allowed the app to geolocate a user.

But some Canadians appear to still have deep-seated doubts.

Leger survey results released this week found that 52 per cent don't believe the government when it says the app does not collect personal information and does not geolocate users. Another 39 per cent did not believe the app "will work."

The results come from a web survey of 1,513 Canadians carried out Aug. 7-9. The comparable margin of error for a study this size would be plus or minus 2.52 per cent, 19 times out of 20.

A promotional campaign has followed the release of the app, with ads appearing on websites, social media platforms and elsewhere. The U of T's Emily Seto said targeted campaigns might help clear up misconceptions.

As employees return to workplaces, she said, managers "may want to promote it — maybe not make it mandatory — but to have a campaign to [help] understand the benefits, as well as the privacy measures."

Could it be better?

The concession for enhanced privacy and security measures appears to be a limited set of public health functions.

"That's always the tradeoff," said Urbaczewski. He compared it with Apple's Siri vocal assistant, which he said sends less data to a central server compared with Amazon's Alexa, but it can be less responsive as a result.

Coronavirus apps with fewer privacy protections in use elsewhere can provide public health officials with more data to get a better handle on outbreaks. Ireland's COVID Tracker also uses the Apple-Google framework, but it counts the number of positive test results recorded in the app and how many users get exposure notifications.

Experts say publishing such data can help build trust among the population that the app is working. As it stands in Canada, officials have provided little tangible evidence of its efficacy.

It's unknown how many users have uploaded a COVID-19 diagnosis through the app since its launch. A federal government representative directed such inquiries to Ontario's Ministry of Health, which instructed a reporter to ask Ontario's Treasury Board Secretariat, which in turn declined to provide an exact figure.

Swiss officials regularly post online the number of active users and downloads. In Germany, the federal disease control agency reported Tuesday that 1,320 people had so far been issued codes for uploading their positive tests to the app.

In Canada, the government is considering how to track — and potentially make available — data related to the app once other provinces and territories adopt it.

"Anything that the government can do to continue to promote these types of things and talk about the successes they've had will just encourage individuals to participate in the overall effort," Urbaczewski said.

So far, the only measure made available in Canada is the download rate: 1.9 million in about 12 days.

Abeler-Dörner said she recommends that public health authorities collect additional app data manually, such as by asking people who are reached through traditional contact tracing if they were previously alerted of an exposure through the app. That way, officials could get a sense of whether the app is notifying users quickly, as it's meant to.

The other persistent criticism of the initiative surrounds the app's accessibility. COVID Alert can only run on an Apple or Android device released in the past five years, making it unavailable to vulnerable populations without access to recent technology.

Research has consistently shown that lower-income and marginalized communities are at a higher risk of contracting the virus — meaning those who could most benefit from an exposure notification app can't access it.

Singapore addressed the issue by providing contact-tracing tokens — small devices carried in someone's pocket or purse — that play a role similar to an app.

In Canada, the flaw arises from the Apple-Google framework, which only works on later-model phones. But according to Sebastian Skamski, a spokesperson for Ontario Treasury Board President Peter Bethlenfalvy, that covers "the vast majority of smartphones owned by Ontarians."