Virginia’s Covidwise Contact-Tracing App Passes the Privacy Test

In August, the Virginia Department of Health (“VDH”) launched a smartphone app called “Covidwise” for self-reporting Covid-19 infections and receiving notification of prolonged, recent exposure to someone with Covid-19.

Being a lawyer, I wondered whether that app could turn into your legal enemy. Might it set you up to be identified and then sued or criminally prosecuted for infecting others with Covid-19?

I wondered because a current criminal case in Richmond federal court shows how people who use Google services on their phones, such as Gmail, the Chrome browser, and Google Maps, can be identified by time and location to prosecutors and civil litigants through subpoenas to Google.
Those Google services are not used in the Covidwise app, but I still wondered about privacy.

I spoke with Jeff Stover, Director of Health Informatics & Integrated Surveillance Systems at VDH. Stover said Virginia was the first state to release an app like Covidwise.

The app is a free download in both the Apple and Google Play (i.e., Android) app stores. It uses Bluetooth to detect whenever you are physically close to someone else using the app. It keeps on your phone a record of when you were near another app user and how long the close contact lasted.

If you are diagnosed with Covid-19, VDH will ask if you use the app. If you do, VDH will give you a six-digit PIN to enter into the app. The app will then notify all other app users who have been within about six feet of you for 15 minutes cumulatively within the last 14 days.

After investigating and speaking with Stover, my privacy concerns are allayed.

Stover said the app was designed to maximize user trust by avoiding use of any information-gathering or technology that could be used for snooping. The app will not identify you.

He said the app is built upon functionality recently added to operating systems by Google and Apple that allows phones to store and exchange anonymous keys over Bluetooth. No information regarding app users is kept on a central server. There is no registration process. The app keeps records by anonymous Bluetooth keys stored only on users’ phones. The app collects no GPS or personally identifying information.

The app of those notified will tell the user only that he or she had prolonged, recent exposure to an unnamed person who reported in the app being sick with Covid-19.

The app is gaining traction. Stover said, as of September 21, about 548,000 people have downloaded it. Just under 200 app users have received a positive Covid-19 diagnosis and been provided with a PIN to enter into the app to notify the system.

The app is giving notices to those exposed. On September 20, it notified 245 people. It notified 231 on the 21st.

Surprisingly, governmental entities, schools, and employers are not requiring use of the app. It’s not part of Covid-19-reporting apps being used by colleges in Virginia. Those apps do not have similar contact-tracing reporting. Except for government-issued cellphones for Fluvanna government employees, it appears no Virginia governmental entity has required its employees to use it.

Back to my lead question: Could using the app get you prosecuted or sued?

Using the app would not make you a target. There’s no central database for anyone to subpoena. The Bluetooth keys placed on users’ phones recording contact contain no identifying information, so the app doesn’t identify you to others.

In the unlikely event you got sued or prosecuted for not quarantining after discovering you’ve been exposed to Covid-19, perhaps your phone could then be seized and searched. That’s a stretch. The app might indicate it gave you notice you needed to quarantine. But I understand the app on your phone keeps only about 50 days of notifications, so the incriminating notice probably would be gone by the time a legal dispute got rolling.

Overall, using the app contributes to stopping the spread of Covid-19 without endangering your privacy or legal position. Consider pitching in to the fight by using it. It’s on my phone.

Written on September 22, 2020

by John B. Farmer

© 2020 Leading-Edge Law Group, PLC. All rights reserved.