Previewing Colorado's New COVID-19 Notification Phone App

Governor Jared Polis's September 8 press conference about COVID-19 was dominated by discussion of a deal to allow a limited number of fans to attend the September 27 game between the Denver Broncos and the Tampa Bay Buccaneers — a contest that turned out to be agonizing on every level.

Nearly lost amid the pigskin talk was a subject that deserved much more time in the spotlight than it received: a partnership with Google and Apple to launch the EN Express program, which will provide mobile-phone users with access to COVID-19 exposure notification technology.

Sarah Tuneberg, of the Colorado Department of Public Health and Environment, noted that the interface, accessible with a click on iPhones and through a free app for Android devices, will automatically contact individuals who've been in close proximity to someone who has tested positive for the virus, after which they will be directed to test sites and provided with information about quarantining and the like. Polis and Tuneberg predicted that the system would be up and running by month's end.

This timeline proved to be overly optimistic. But a CDPHE spokesperson, corresponding via email, promises, "We are working with Google and Apple to make this service accessible to Coloradans as soon as possible."

How will it work when it finally arrives, and how do officials hope to convince people to use it? We got the details from the department in the following Q&A:

Westword: How long has the plan for an exposure notification service been in the works?

CDPHE: The State of Colorado has been evaluating the options for the role of phone-based technology in addressing the pandemic. There were a lot of experiments in other countries and states in the spring and summer, but none of them felt like a good fit for Colorado. We wanted to watch and see what happened in other jurisdictions so that we could make the best decision for Colorado and Coloradans.

At what point did Google and Apple get involved in the process?

On April 10, Apple and Google announced a framework on their phones that supported privacy-focused solutions to help people know if they have been exposed to someone who has COVID-19. Several other states and countries launched apps based on this technology. In August we started talking with Apple and Google about the EN Express program that dramatically reduces the software development effort required from a state to launch Exposure Notifications. CDPHE and our partners at OIT had completed some evaluations of the systems already and were interested, so we became more interested in the solution when Apple and Google offered a faster and easier way to launch this functionality while maintaining privacy protections for Coloradans.

What are the reasons health officials saw coming up with this kind of system as important?

Awareness is key to stopping the spread of COVID-19. This service is another tool in the toolbox that helps Coloradans work together to minimize disease transmission. It also can help identify asymptomatic individuals by notifying them of potential exposure and encouraging them to quarantine themselves from others and get tested.

What were the biggest challenges, technological and otherwise, involved in coming up with a system that enhanced public safety without raising privacy concerns?

Though Colorado was not responsible for creating and developing this technology, we wanted to ensure that we used a service that prioritized the safety and privacy of Coloradans. It does not collect, use, or store any personal identifiable information or location data. The service is designed to protect your privacy. We also wanted to use a service that is customized to Colorado’s needs, including connecting individuals with their local public health agency.

How would you summarize the way the service works for users of Android and iPhone mobile cell phones?

Exposure notifications is a voluntary new service available on both iPhone and Android phones that helps slow the spread of COVID-19. When you opt in by enabling exposure notifications on your phone, whenever you are within close proximity (approximately six feet of someone for at least ten minutes), your phones will exchange secure, anonymous tokens. If you test positive for COVID-19, you can choose to enter your positive test result into the system and share these anonymous tokens, which will send a notification to anyone with whom you have exchanged tokens recently, notifying them of possible exposure. The service is available nationwide, but will be customized for Colorado. This service does not collect any personally identifying information or share it with the State of Colorado, your Local Public Health Agency, Apple or Google.

Does the department have a goal for a percentage of Colorado cell phone users to sign up for the service, and if so, what is it and by when would it be preferable for the mark to be hit?

We do not have a specific goal for usage, but the more Coloradans who participate, the more effective the service will be.

Is there a threshold the service needs to meet in order to be effective, and if so, what is it?

There is not a specific threshold, but the more people who use the service, the more effective it is. Researchers at Oxford University estimate that with 10 percent usage of this service there would be a measurable impact reducing the spread of COVID-19. That same study found higher rates of impact and estimated that if 60 percent of the population used the service it would dramatically reduce the spread of COVID-19 to the point that most businesses and activities could resume at pre-pandemic levels.

Will the service still be useful even if a relatively small number of Colorado cell phone users opt to enable it, but not as useful as it could be?

If even one person is notified of an exposure through the service, gets tested and isolates, the service has been useful. It is one more strategy in the effort to identify positive cases quickly, and get those who have COVID-19 to isolate themselves.

What is your argument in favor of cell phone users enabling the service?

In order to stop the spread of COVID-19, we must all work together. Using this service helps us quickly identify exposure to positive cases and provide support to those who need to isolate. It is completely optional and anonymous. This service will help people make better health decisions for themselves and their loved ones. If folks in Colorado use the service, we believe it will help reduce the spread of COVID-19.

During their announcement about the service, both Governor Polis and COVID-19 response team leader Sarah Tuneberg stressed that users' private data would not be shared as a result of signing up for the service. In this highly politicized atmosphere, is there concern that a significant percentage of the public may not believe that and concoct theories about a nefarious desire to track their whereabouts or something along those lines?

Reassuring the public that their information remains anonymous is critical. This service is designed to protect privacy to the fullest extent possible. It exchanges randomly generated anonymous “tokens” (like Y2RzQ0RT) that are not associated with a phone number, name, location, or IP address. These anonymous tokens change every fifteen minutes to further protect users’ identities. It uses a secure, decentralized design to determine if a user has been in contact with a positive case, and it is not tracked on any servers. After fourteen days, or once an alert is triggered, the tokens are permanently erased. The code for the service is open-source, so people can verify that it does not capture any personally identifying information.

How do officials plan to try and put such worries to rest?

We are providing information about the exposure notification service on our website and are networking with local, private and state partners to disseminate information about the service. That information should help security and privacy researchers throughout the state to confirm that private information is being protected in this system.

With the Pepsi Center testing site scheduled to close on October 1, will testing capacity in metro Denver be able to handle a possible rise in demand for tests after the service becomes available, and if so, how?

We have collaborated with local partners to create a network of community testing sites, and anyone who wants a test can get one. Our testing sites are not at capacity.

If the service is successfully implemented and embraced by a large percentage of residents, how will it help in the fight against COVID-19?

The more positive cases that are identified as early as possible after infection, the more people who are ill can self-isolate, which will reduce disease transmission. Exposure notifications complement the current testing and case investigation process. It alerts individuals to a potential exposure to the virus, and provides guidance they might otherwise not have received. This is especially helpful in identifying asymptomatic cases. Asymptomatic individuals will be notified of exposure, get tested and quarantine, which will protect others from disease transmission.