CDC criteria for digital contact tracing opens door for Apple-Google approach

The Centers for Disease Control and Prevention published a new document this week, outlining what it views as the critical features of contact tracing apps. The recommendations appear to be good news for the Apple-Google partnership.

Millions of people are expected to download contact tracing apps in the coming months to slow the spread of the coronavirus. CDC guidance is important because public health organizations often refer to it when they decide what technology to support.

In the latest CDC publication, the group cites the “PACT protocol” as a an example of the recommended method for using “Bluetooth enabled proximity tracking” while maintaining privacy. As CNBC reported earlier this week, Apple and Google, in developing a contact tracing system, took several ideas from PACT, an open-source protocol developed under the leadership of the Massachusetts Institute of Technology.

The companies will unveil sample apps using their system early next week, company representatives said, and released beta software for developers on Wednesday. Apple and Google have said they’re leaving it to public health authorities to decide what system to make and how to implement it.

At their most basic, contact tracing apps, like those currently deployed in Singapore and Australia, use signals from smartphones to trace who an infected person has been in contact with, so those people can be isolated or tested.

Two broad approaches to digital contact tracing apps have been used. One, often called “decentralized,” is anonymous and doesn’t require a phone number or email address to use. The other approach, often called a “centralized system,” feeds infection data to public health authorities so they can reach out manually to people who may have been infected.

Apple and Google are among those who support the decentralized approach, saying that it’s a more private way to do contact tracing, and that it can get faster and more widespread adoption because users remain anonymous and are contacted through automation if they’re at risk.

The debate is raging around the world as governments decide on their digital contact tracing strategy. In Europe, Germany and Italy are backing an Apple-style decentralized system, but the U.K., France, and Norway want to integrate their digital contact tracing app with health authorities.

The CDC doesn’t clearly come down on one side or the other. In its preliminary criteria, it separates case management software, like that used by public health officials, and proximity tracking software, used by individuals. It says that apps are “used in addition to contact tracing case management tools.”

Case management software is sold to public health organizations in states and cities, and can incorporate health-oriented privacy practices, including automating direct outreach to contacts of people who have tested positive. Consumer-facing apps, downloaded from Apple and Google’s app stores, are described by the CDC as “proximity tracing,” though the companies prefer to call it “exposure notification.” The CDC bulletin doesn’t mention Apple or Google by name.

In one part of the document, the CDC says that the minimum criteria for contact notification through apps includes manual notices, which suggests a centralized system. But it also says that a preferred system under its criteria includes anonymous, automated notifications, like those provided by decentralized systems.

The CDC says that proximity tracing apps can use location tracking, which includes GPS, but recommends a selective and anonymous approach to that system. The criteria released by the CDC notes that the best apps will be open-source and use open architectures and standards. While Apple and Google have been transparent about how they’re building their system, Apple’s iOS is not open-source.

Neither tech giant has publicly commented on the CDC’s latest outline, but a group called TCN Coalition, which promotes an anonymous Bluetooth-based system, praised the group’s criteria on Friday.

―CNBC