The federal and Ontario governments are launching smartphone apps to assist their COVID-19 contact-tracing efforts, with help from Shopify and BlackBerry.

The Canadian Digital Service and the Ontario Digital Service (ODS) are leading development on the apps, which use a Bluetooth-based, decentralized system developed by Google and Apple. Ontario’s COVID Alert app is expected to be available for download for both iOS and Android phones by July 2.

ODS sent a version to the federal government three weeks ago, according to an Ontario government source. “The federal government particularly liked the integration with local public health officials, so this is what they are choosing to roll out across the country,” the source told The Logic.

The apps will notify users who may have come into contact with others who test positive for COVID-19. “We will soon begin testing this out in Ontario,” Prime Minister Justin Trudeau said Thursday. “There are already a number of other provinces including B.C. working with us on this, but it will be available to everyone in the coming weeks.” Use of the app will be “completely voluntary,” he said. 

A federal government source told The Logic the national and Ontario apps are distinct, but both are based on COVID Shield, an open-source tool developed by a group of volunteers at Shopify. The federal version—which Trudeau said will also launch in July—will be informed by the early results from Ontario, and will work throughout all provinces and territories. Some of those jurisdictions may choose to adopt it, said the source, whom The Logic agreed not to name because they were not authorized to speak publicly. 

The Google-Apple API is designed to make apps from different public health authorities interoperable, so the two will work together, as will any other provincial versions built on the same model.

“Using a national application will help ensure that Ontarians are notified, regardless of which province they are in, helping us towards the goal of ensuring we can all move more freely and safely,” said an Ontario government statement.

Shopify spokesperson Sheryl So told The Logic on Thursday that the firm couldn’t say much because the apps are not a Shopify initiative. “The national app will be owned and operated by the Government of Canada in cooperation with the provinces and territories,” she said.

BlackBerry became involved in the project just over a month ago, CTO Charles Eagan told The Logic. The Waterloo, Ont.-based company, which has made major pushes into enterprise security and privacy, had volunteered to perform auditing and stress-testing for a number of contact-tracing and exposure-notification apps under development, including an AI-based product from Montreal’s Mila Institute. “We’re looking at what the attack vectors would be, basically trying to figure out how a malicious actor could come at it and provide mitigation for it,” Eagan said.  

Though Trudeau said last month the federal government would be “strongly recommending” a contact-tracing app for use across the country, Health Minister Patty Hajdu subsequently said some provinces preferred to have public health officials manually contact anyone who may have come into contact with confirmed COVID-19 cases.

Neither Ottawa nor Ontario has announced a formal target for how much of the population they hope will use it. “If we can talk about a 50 per cent uptake, for example, or more, then it becomes extraordinarily useful,” Trudeau said, noting that in addition to notifying individuals if they’ve potentially been exposed to the virus, “it’ll actually allow us to have a better sense of when there are spikes or resurgence of a virus in a particular area.”   

Ontario Health Minister Christine Elliott told reporters Thursday the COVID Alert app would also give users “quick access to public health advice and next steps.”

In April, federal privacy commissioner Daniel Therrien called for any contact-tracing app to use de-identified or aggregated data wherever possible, and to only use the information for public health purposes. ”At no time will personal information be collected or shared, and no location services will be used,” Trudeau said on Thursday. “The privacy of Canadians will be fully respected.” He added the government “worked with” the watchdog on the new app.   

The privacy commissioner’s office was “recently contacted by Health Canada about a COVID-19 exposure notification application,” said spokesperson Vito Pilieci. “We have requested and are awaiting necessary information and, until such time as we receive that information, we have not provided our recommendations to the government.”  

The Apple-Google system generates random keys, which are traded via Bluetooth with other smartphones in close proximity. People who report positive tests can upload their own keys to a public registry; other users’ apps will download them, and compare them against the ones they’ve logged over the previous two weeks. 

In order to have a standard privacy and security perimeter for the entire country, the federal government will host a secure universal key server as a central depository for all the anonymous proximity data generated by the app’s users.

Alberta is currently the only province with a contact-tracing app, ABTraceTogether. Deloitte built it for the province using a system built in Singapore. The Alberta app was downloaded 186,000 times in the first three weeks, accounting for about 4.3 per cent of the provincial population.

Mila began working on its own app in March, based on protocols developed by Britain’s National Health Service (NHS). On May 14, Shopify CEO Tobi Lütke announced via Twitter his intention to have a “small group of Shopify volunteers … make a reference implementation” of the Apple-Google exposure-notification APIs. “We intend to open source our work soon,” Lütke said. Earlier this month, the federal government declined to endorse Mila’s app in part due to privacy concerns over the amount of data it collected on users, including age, gender, location and medical history to enhance the app’s predictive ability. 

On Thursday, the BBC reported the NHS was abandoning its first effort at a contact-tracing app in favour of a new one built on the Apple-Google API. The growing number of governments using the tech giants’ system means more people working on solving some of its efficacy challenges, such as limiting the false positives and negatives that may arise from Bluetooth connections in dense apartment buildings, said Chris Parsons, senior research associate at the Citizen Lab at the University of Toronto’s Munk School of Global Affairs & Public Policy. It could also make it easier to track exposure when cross-border travel resumes.

Rebecca Finlay, vice-president of engagement and public policy at CIFAR, a research organization, said Ottawa should rigorously test its app to “understand how well it works at this moment in time” and apply those results to a possible second wave of infections or future pandemics. Participating governments should also be making those results public to build trust, said Carole Piovesan, a partner and co-founder of INQ Data Law. The two were speaking on a conference call hosted by The Logic on Thursday.

Experts have called for governments to impose strict controls on any contact-tracing or exposure-notification apps. Cybersecure Policy Exchange, a Ryerson University group, wants legislation ensuring employers, transit operators, retailers and others can’t mandate their use, citing the discriminatory impact on residents who don’t have smartphones. “While reassurances from the Prime Minister that the app will be ‘completely voluntary,’ are encouraging, that is not enough to make it true,” said Sam Andrey, director of policy and research at the Ryerson Leadership Lab, which contributes to the exchange.  

The Canadian Civil Liberties Association has said the data shouldn’t be shared with other government entities like police forces or the Canadian Border Services Agency.

Parsons said Canadian governments should move quickly on such regulations, citing Australia’s adoption of similar rules, as well as make clear what data it’s logging, how long it will hold it for, and when it will be destroyed. Ottawa’s app is unlikely to “entirely revolutionize the contact-tracing process that follows after exposure notification,” he said, citing Australia and calling for a public education campaign to explain the technology’s limits. “Not having [a] notification on your phone doesn’t inherently mean that you’re safe and can wander around without a mask.”