Apple and Google reveal more details on latest contact-tracing update

2 Sep 2020

Image: Luke Maxwell/

Apple and Google’s joint Covid-19 contact-tracing venture is about to enter its second phase, but what does it mean for public health apps?

As touched on recently, the Google Apple Exposure Notification (GAEN) system built into the later versions of iOS and Android to aid Covid-19 contact-tracing efforts is about to enter a new phase.

Many countries, including Ireland, have developed their own contact-tracing apps that use GAEN to notify users when they may have come into close contact with a confirmed Covid-19 case.

However, Apple and Google are now rolling out Exposure Notifications Express (ENE), an updated version that aims to increase the availability of contact tracing through smartphones, even among those who don’t have a dedicated app installed from a public health authority (PHA).

ENE is now available on iOS 13.7, which is currently being rolled out to Apple users, while Google will release a slightly different version under the same name for Android 6.0 and higher later this month. In a blog post, Apple said that this second phase of smartphone contact tracing is not a replacement for a PHA app but provides another option for exposure notifications.

“iOS continues to support dedicated exposure notifications apps, and a PHA can offer exposure notifications apps and the app-less Exposure Notifications Express at the same time,” the company said.

Graph showing how the Exposure Notification Express system works.

How the Exposure Notifications Express system works. Image: Apple

How it works

The update will give PHAs more power to send notifications to those who have not yet downloaded an exposure notification app or don’t intend to. Under the new system, a PHA must create two different types of servers: a test verification server and a key server.

If someone with an iOS device is diagnosed with Covid-19 and has ENE enabled, the test centre will send a positive result to the PHA. The PHA then generates a code that is sent to the phone user through email, read over the phone or via SMS.

The user then inputs the code or clicks a link to confirm their diagnosis, which is then sent to the test verification server and then confirmed and stored on the server. The iPhone will then create an encrypted code and anonymous authentication token, and ask the user to give permission for the diagnosis to be stored on a key server.

Once that’s confirmed, the more familiar process of alerts being sent to those who may have had close contact with the person can occur, but without them needing to have the app installed. However, Android’s version of ENE will automatically create a basic contact-tracing app for PHAs.

In a joint statement seen by the BBC, Apple and Google said: “ENE provides another option for health authorities to supplement their existing contact-tracing operations with technology, without compromising on the project’s core tenets of user privacy and security.”

Colm Gorey was a senior journalist with Silicon Republic