Copyright © 2021 Roswell Daily Record
Copyright © 2021 Roswell Daily Record
Increased usage of the state’s smartphone COVID-19 notification system could greatly aid contact tracing efforts, a state official said, but New Mexicans — along with the rest of the country — have been slow to adopt the system.
The New Mexico Department of Health launched NM Notify in March 2021 using a platform developed by Google and Apple, the companies that create operating systems for nearly all smartphones in the world. Since then, about 40% of New Mexicans have opted into the system, Dr. David Scrase, acting secretary of the New Mexico Department of Health, said Wednesday.
Scrase said he believes NM Notify is one of the steps needed in learning to live with COVID-19.
“If everyone in New Mexico had the app, we wouldn’t have to do any contact tracing,” he said.
Scrase said during a December press conference NMDOH is staffed to contact trace about 300 cases of COVID-19 per day. As cases have increased — now at a seven-day average of more than 2,000 per day, according to NMDOH — contact tracing has become much more difficult.
Support Local Journalism
Subscribe to the Roswell Daily Record today.
Support Local Journalism
In addition, people are less likely to want to share with the state who they have had contact with or get information on what steps to take after exposure or a positive test, preferring to do that themselves, he said.
“It’s a very elegant, very simple solution,” Scrase said of NM Notify.
“I know not everybody likes the idea of their phone being monitored. I think it’s a great trade-off,” he said.
Scrase said he hopes the state can get to 80% usage of NM Notify by June.
Apple and Google announced in April 2020 they were partnering to develop software that could be used on both iPhones and Android phones to help public health authorities around the world trace exposure to the virus while protecting individual privacy.
The platform they developed and released just months later uses Bluetooth technology to determine when a user’s phone is within 6 feet of another phone that has the system enabled.
Bluetooth uses low-power radio waves to connect devices wirelessly, such as headphones or earbuds to a phone, a phone to a vehicle, or a mouse or keyboard to a desktop computer.
Android phones that have an app and iPhones that have exposure notifications enabled in the phone’s settings exchange anonymous keys — randomized strings of numbers and letters — with each other through Bluetooth, recording the distance between the devices and how long they were within range of each other, according to documentation from the companies.
A new key is produced every 10 to 20 minutes. Each one is unique to an individual phone, but the keys do not include any personalized information. Two weeks’ worth of keys are stored on individuals’ phones and are not uploaded to a server without user consent.
That consent can be given when a user receives a positive COVID-19 test. A user must self-report a positive test to NM Notify, using a verification code sent via text message by NMDOH and then consent to the keys their phone has created over the past two weeks to be sent to a server.
Other phones download the keys associated with positive tests and compare them to those it has received over the last two weeks. If there is a match, the user gets a notification of a possible exposure.
But adoption of the system has been slow, and not just in New Mexico. The Washington Post reported on Dec. 29 more than 20 states in the U.S. are not using the system. In states that are using it, only a fraction of those who have activated it have used it to report a positive test. In California, the report said, the system has been activated on more than 15 million phones but only 3% of the 3.9 million COVID-19 cases reported since the system was launched in the state were reported through the system.
In addition, according to a Pew Research Center survey, about 15% of Americans don’t own a smartphone, and the majority that don’t are 65 or older — one of the groups most susceptible to COVID-19.
An April 2020 poll by the Washington Post and the University of Maryland found that three in five Americans were unwilling to use the system due to privacy concerns, but a New Mexico cybersecurity expert said the system poses no greater concern than apps people are already using.
“Really the responsibility (for security) would be on the user, in my opinion, just like anything else,” said Stephen Miller, director of the Cybersecurity Center of Excellence at Eastern New Mexico University-Ruidoso.
Miller has worked in cybersecurity since the 1960s for NASA, the U.S. military and companies including Exxon. He’s taught in the field since 1995 and helped establish the Cybersecurity Center of Excellence at the Ruidoso campus. The center has been designated by the National Security Agency and the Department of Homeland Security as an academic center of excellence in cybersecurity, the first community college in New Mexico to receive that designation.
Privacy is always a concern with smartphones, Miller said, so people should be aware of what they’re using. Apps that use GPS technology can be tracked, but he noted that ability can usually be controlled in the phone’s settings.
“Most people just download Google Maps or whatever because it’s convenient. You can go in and look and see how to set the settings. You can configure settings so you can cut off the tracking if you want,” he said.
The COVID-19 tracking system does not use GPS or other location data.
Miller said people should be aware that how the system does work means an exposure notification might not necessarily be accurate.
“It’s not always accurate in the fact that sometimes the Bluetooth could pick up a person that maybe they had identified themselves as having exposure to COVID, but they just drove by you in a car. That would pick that up, but that doesn’t mean you’re totally exposed to that person. If they were in another room and you walked on the other side of that wall, they could still pick that up that you were in contact with a COVID-positive person,” he said.
Miller noted both Google and Apple have stated they do not collect any of the data from the system and the U.S. Centers for Disease Control and Prevention acknowledged the system is secure. He also said that he has not seen that the Department of Homeland Security or global cybersecurity organizations have raised issue with the security of the system.
The only issue with the COVID-19 tracking system Miller said he found occurred when Virginia, the first state to adopt the system, launched its Android app. The issue has since been corrected, Miller said.
“It was a problem with the Android applications, but it was a problem that affected all the apps for the Android platform,” he said.
“What happened was, if you had an app like NM Notify, those other apps could communicate with that app and then send out information,” he said.
As long as Android users keep their phone operating systems and apps up to date, that should not be an issue, he said.
City/RISD reporter Juno Ogle can be reached at 575-622-7710, ext. 205, or email@example.com.