Switzerland claims to be first to trial Apple and Google COVID-19 APIs

Two universities, the army and several hospitals in Switzerland have launched what is claimed to be the worlds’ first major trial for Google and Apple’s decentralised contact tracing APIs.

While many governments have opted against the advice of privacy and security experts, universities ETH Zurich and Ecole polytechnique fédérale de Lausanne (EPFL) will work with the army and several hospitals to trial Silicon Valley’s version of the contact tracing app.

“This is the first time that the operating system updates from Google and Apple enable its deployment and testing on such a large scale,” said Professor Edouard Bugnion, Vice-President for Information Systems at EPFL.

Should the app work as desired it would certainly be a cause for celebration for the many societies under strict lockdown protocols. It could also prove quite embarrassing for the government who elected for a centralised data model, contrary to expert advice, some of which are facing teething problems.

Several thousand Swiss citizens are now free to download the application, with the pilot set to last for a few weeks. The team is effectively waiting for legislation amendments before launching to the general public, though depending on the timeliness of politicians is similar to guessing the length of string.

This application is based on the Decentralized Privacy-Preserving Proximity Tracing (DP3T) design, geared towards protecting privacy. As it should be with every application, the Swiss app is built on and around the concept of maintaining and protecting privacy, not with privacy as an add-on when other criteria have been satisfied, like the UK-version has.

“Our goal is to offer a solution that can be adopted in Europe and around the world,” said Professor Carmela Troncoso, head of the Security & Privacy Engineering Laboratory at EPFL and the brain behind the DP3T protocol.

Operations for the application which are deemed essential but also sensitive from a privacy perspective will all be performed on the device. The application will log the unique identifier of any other device which has been in close proximity (less than two metres) for a sustained period (15 minutes). Should the individual test positive for the coronavirus, as GP will issue a single-use code to be entered into the app, which will alert any individuals who have been logged as a contact.

Although calls for a unified approach to creating contact tracing applications have largely been ignored by attention seeking politicians, the world should be watching this Swiss experiment very closely. The decentralised approach is one which is built with privacy in the foundations, and while it might not offer the flexibility some government data scientists are after, there is no need to make any compromises to privacy or security.

This should be taken as a lesson by politicians around the world; privacy and security should not be forgotten in the battle against COVID-19.