If Bluetooth doesn’t work for contact-tracing apps, what will?

The inherent limitations of Bluetooth will make Apple and Google’s contact-tracing apps woefully imprecise, but right now it might be the best solution we’ve got
Getty Images / WIRED

Last week, Apple and Google announced that they would be joining forces to create a tool that will assist public health authorities in creating contact tracing apps to help stop the spread of Covid-19. These apps, one of which is currently being developed by NHSX – the digital innovation arm of the NHS – will work by notifying someone if they have come into contact with someone who has tested positive for the disease.

The apps have likely been inspired by the aggressive implementation of technology-backed contact-tracing techniques used in countries such as China and South Korea. But unlike South Korea’s contact-tracing approach, which uses a combination of CCTV, interviews, credit card data and past geolocation information to trace people’s whereabouts through cell towers, Apple and Google will instead be using Bluetooth Low Energy (Bluetooth LE) to trace people’s location.

The first phase of the companies’ two-pronged approach comes in the form of a software update in mid-May which will allow iOS and Android devices to anonymously communicate through contact-tracing apps, regardless of the software the user’s phone is running on. The second phase will be another software update which won’t require the user to download a contact-tracing app to broadcast their whereabouts, something that the companies say will – like the apps – be opt-in.

Apple and Google will partner with the public health authorities, who will build their apps using the two company’s application programming interface (API). This will help authorities and residents contact trace between Android and iOS devices. The API enables your smartphone to periodically exchange anonymised tracing keys over Bluetooth, locally storing every key of anyone you have come into contact with.

If you later find out that you have tested positive for Covid-19, you will be able to update your status on the app. All of the people who you have come into contact with and your phone has exchanged keys with in the last 14 days will, with your consent, be sent an alert with advice on what they should do next. These contact-tracing keys will stay on your device, rather than in a centralised server.

This localised storing of cryptographic keys is a big deal, simply because public health authorities will have to abide by Apple and Google’s strict specifications if they want to use the API. The cryptographic keys refresh every 15 minutes and remain anonymous, meaning your data is kept private. It’s an elegant solution that will fix the numerous issues plaguing apps such as Singapore’s TraceTogether, which requires the user to have the app running at all times in order to actively continue tracking each other’s whereabouts.

Michael Veale is a lecturer in digital rights and regulation at University College London and is part of an international consortium of technologists, legal experts, engineers and epidemiologists that created an open-source contact-tracing app, similar to the one Apple and Google is proposing. He says that with Apple’s approach, public health authorities’ apps will not be allowed to ask for a list of the people that someone has been in contact with. “This means that centralised approaches, such as Singapore’s TraceTogether, will still have to remain on in their pocket because Apple has decided that they are engineered in a way that is not proportionate or more privacy-preserving,” says Veale.

These apps, however, aren’t a silver bullet. Not everyone in the UK has a smartphone. According to figures released in 2019, 21 per cent of Britons don’t have a smartphone, and researchers from the University of Oxford say that 60 per cent of the population will need to be using the smartphone app for it to be effective. That’s 40 million people. Just 12 per cent of people in Singapore downloaded the TraceTogether app, for example.

While the adoption rate of people agreeing to contact trace could be increased thanks to Apple and Google’s second phase contact-tracing rollout, which crucially wouldn’t require an app to help track people’s whereabouts, a broader issue remains. These apps will be relying on an imprecise bit of technology – Bluetooth LE – to work, and the wireless technology standard has its limitations.

Bluetooth LE has a rough range of 10 to 30 metres, depending on your smartphone and the Bluetooth chipset. The NHS recommends that we stay two metres apart from each other, but with Bluetooth being able to ping other phones within a 30-metre range, without precision, there’s an increased chance of the app alerting you to false positives of people who have never even come into contact with you.

Paul Patras, reader at the school of informatics at the University of Edinburgh says that interference could be an issue when it comes to these contact-tracing apps, which could cause the amplification of false positive reports. “You can conceivably receive a packet with good signal strength from a transmitter that is not necessarily nearby; due to reflections,” he explains. “Multiple copies of the same signal may arrive at the receiver and amplify the message. This can negatively impact the correct assessment of the range.”

Kasper Rasmussen, associate professor of computer science at the University of Oxford says that if you live on the ground floor of an apartment block, for example, Bluetooth could exchange cryptographic keys with the upstairs neighbour who you’ve never spoken to as they pass by your window. “Ultimately, there’s nothing you can do to guarantee that you will have no false positives,” he says.

Bluetooth can, with its wide range, detect another phone in its vicinity, but it couldn’t pinpoint what direction that person was coming from or whereabouts in the area they were located compared to your phone, for example. Bluetooth 5.1 uses direction finding and point of arrival to help locate the direction in which a signal was sent to a phone, but very few smartphones have this new chipset.

“There are ways in which you can, in theory, do ranging and angle of arrival estimation. But I am not aware of fully tested commercial solutions,” says Patras. “There’s been research work on indoor localisation, using external Bluetooth beacons or anchors, but that can be expensive.”

So, with all of Bluetooth’s problems with accuracy, why are we using it for contact tracing? Frankly, it’s because the technology just isn’t there.

Apple had a solution for fixing the imprecise nature of Bluetooth, when it decided to implement Ultra-Wideband (UWB) chips in its latest iPhones. UWB works by sending billions of pulses across a wide range of frequencies, and listens for a response from a corresponding pulse sequence.

This kind of technology could help to determine how close an infected person came to you and in what direction, making contact tracing a lot easier. But the company has yet to utilise UWB in any life-changing way. And as the majority of phones don’t have the necessary components, UWB becomes far less useful as it can only communicate with other UWB chipsets. “Ultra-Wideband is one option which I think wouldn’t be available to that many people,” admits Rasmussen.

Patras says that a solution to Bluetooth’s imprecision could have been implemented using the cell towers around us. If someone makes a call to 111, for example, the emergency services could locate that person quite precisely, he says. And instead of using Bluetooth, it would use the cellular infrastructure to help create a contact-tracing map.

Though he cautions this approach, which is why the Apple and Google’s Bluetooth solution, with all its flaws, might be the most elegant. “Bear in mind that this will involve a lot of processing of data. And there’s a cost associated with that,” Patras says. “There are privacy implications because you don’t really need to know where everybody is all the time.”

Veale says that there are always going to be challenges with the technology. “Bluetooth was not designed for contact tracing, but it is easy to be alarmist about the ways in which this can go wrong,” he says. “One alternative people have said is use GPS data instead. GPS data doesn’t work indoors. It doesn’t tell you what storey of a building you’re on. And it has extremely, extremely low precision. So location data is really an inappropriate tool for the job of matching people together.”

So, while Bluetooth might not be all that accurate, it allows Apple and Google to preserve people’s privacy while also managing to give a ballpark estimate of the risk chance in your area. With these Bluetooth-based contact-tracing apps, you will never know who has had Covid-19, just that you have been in the vicinity of them within a period of time. Bluetooth isn’t ideal, but right now it might be the least worst solution we’ve got.

Alex Lee is a writer for WIRED. He tweets from @1AlexL

Coronavirus coverage from WIRED

😓 How did coronavirus start and what happens next?

❓ The UK's job retention furlough scheme, explained

💲 Can Universal Basic Income help fight coronavirus?

🎲 Best video and board games for self-isolating couples

👉 Follow WIRED on Twitter, Instagram, Facebook and LinkedIn

This article was originally published by WIRED UK