German COVID-19 alert app protects user data

"Patience always pays," the proverb goes. The introduction of a coronavirus warning app has taken a little longer in Germany than in many other countries. China and South Korea, for example, were already using apps to track infection chains back in March. European countries such as France followed at the beginning of June.

But the new German coronavirus alert app beats most others in terms of data privacy.  Here are the most important questions about the new app with their answers:

Why is the issue of data protection solved better in Germany than in other countries?

Unlike in India or China, for example, where the coronavirus warning apps create complete, visible movement profiles of the users and send them to central government computers, the German warning app does not detect user locations at all.

The app does not find out where anyone is, which means no authorities can spy on the users. The app recognizes only which other app users are currently in the vicinity. This works via Bluetooth, a wireless standard that enables devices to exchange data at close range.

Read more: Coronavirus contact tracing reignites Polish privacy debate

The phones send each other short-term identification numbers. The actual contact data is only stored locally on the users' respective smartphones and it is encrypted in such a way that even the phone owners cannot view it. The data is automatically deleted after two weeks.

There is also some data stored on verification servers and app servers. However, this data is anonymized and used to send verification keys and transaction numbers to ensure that the system works securely. To increase people's trust in the app and guarantee transparency, the developers have published the app's source code  in advance.

How does the warning work if someone is infected?

If a lab determines that someone has become infected, a specially generated QR code with the test result is sent to that person. This code then needs to be scanned into the person's smartphone. Only when this has been done can an alert be transmitted by the phone, which sends the anonymized data of people who have come into contact with the infected person to a central server.

This server then sends a push message automatically to all those people, i.e., people who have been in the vicinity of the infected person for a period of at least 15 minutes within the last 14 days. The fact that the warning can be released only by means of the QR code from the laboratory ensures that nobody can trigger a false alarm.

People who receive such a warning will also be given recommendations on how to proceed: for example, by having themselves tested for the coronavirus by a doctor and putting themselves in quarantine. 

Read more: Opinion: Coronavirus concerns are not carte blanche to snoop

When will the app be available and who can use it?

Federal Health Minister Jens Spahn has announced that the app developers — Deutsche Telekom  and SAP — will present the app on Tuesday 16 June 2020. It should then be available immediately.

However, not all smartphone users will be able to install it: It will run on Android devices from version 6 and iOS from version 13.5. Google Play Services must also be running on the devices. This software component is not installed on newer Huawei smartphones, for example.

The first app version will initially be available in German and English. Other languages, such as Turkish, are to follow.

What other weaknesses are there?

Not all laboratories that test for SARS-CoV-2 and not all health authorities are equipped with the necessary digital infrastructure to send test results to the system and generate QR codes.

This means that people who have been tested by such laboratories and found to be infected but cannot obtain a usable QR code must contact a telephone hotline that has been set up jointly by SAP and Deutsche Telekom. The call center is meant to be able to handle about 1,000 calls per day.

Those calling in will have to answer test questions from call center employees to ensure that they have indeed tested positive. However, the questions and answers must not allow any conclusions to be drawn about the person's identity. The complicated procedure does nonetheless carry the risk that patients may trigger false alarms or inadvertently disclose their personal data. 

European patchwork

A major weakness of all coronavirus warning apps — including the German one — is that they are all only individual national solutions. They are not compatible on a worldwide basis, and even within the European Union there are at least seven different solutions that are not linked or compatible with each other. As a result, if travelers want to protect themselves and others with a warning app, they have no choice but to install several apps at once.

There is another problem: With the German and French apps, the warning can be sent only if a testing facility from the respective country has confirmed the infection. If, for example, a German facility detects the infection in a person who has returned from France, no warning message can be sent to potential contact persons through the French app system.

Almost all European solutions are based on the exchange of data via Bluetooth and thus meet at least minimum data protection standards. But in France, for example, the data is then stored on a central server.

Also, not all apps are as error-proof as the German one. For example, the Austrian app makes it easier to send out a false report because no positive test result has to be proven. The situation is similar in Britain, where an additional mechanism has been put in place to cancel false alarms that have already occurred.

However, at least the apps for Germany, Austria and Switzerland are expected to be able to communicate with each other in the foreseeable future because they use  a uniform standard developed by Apple and Google.

Read more: Apple, Google team up to make software to slow down spread of coronavirus

Will the app drain my battery?

That was a major concern for the developers and the reason why they configured the app so that it doesn't constantly look for other smartphones, but only briefly and at appropriate intervals. This is to prevent users from uninstalling the app again at some point because the batteries are always going flat.

When does the app start to pay off in the fight against the coronavirus?

Experts have set themselves the goal of getting about 60% of people to install the app. Health Minister Spahn is a bit more cautious in his expectations, telling the Rheinische Post  that he would be satisfied if there were a few million users.