Dream of Coronacation: What organizations need to know about privacy, BLE attacks, and contact tracing

It’s been said that Virginia is the state for lovers, but nowadays it’s popping up in global headlines for other (and might we add, less politically charged) reasons. Earlier this month, Virginia released the first U.S. COVID-19 contact tracing app based on the Google-Apple technology partnership. This technology, created back in May was leveraged by Virginia public health authorities to create the free app COVIDWISE, which is now available in the Apple and Android app stores.

So this app has the potential to track and drastically reduce the spread of coronavirus? Okay, sign us up! Virginia may simply be a test monkey at this point in time, but in a few weeks from now, they could be well on their way to a coronacation. However, this assumes that everyone will comply with the state’s call to action.

As expected, there’s a large group of naysayers who have refused the app on account of their privacy. Now the question you’ve all been waiting for: Is it safe? Let’s examine. Here’s what we know:

• The app itself relies on Bluetooth low energy (BLE) technology to alert users who have come into contact with an individual that tested positive for COVID-19. Rather than tracking user identity and location, the technology creates random sequences of numbers, exchanges them with local users, and the app then uses that information to inform users if they’ve been near an individual who has tested positive.
• Users have the option to anonymously share their results through COVIDWISE.
• During a press conference, Gov. Ralph Northam stated that the app doesn’t track or store personal information. The Virginia Department of Health confirmed that no location data or personal information is collected, stored, tracked or transmitted from the app.

According to Ben Seri, vice president for research at Armis Inc., there are advantages and risks to using Bluetooth-enabled contact tracing apps. Bluetooth technology protects user privacy by changing signals often to hide users’ unique addresses, but data could be exposed when unsecured mobile phones connect to other devices. As companies like Google and Apple have improved their implementation of Bluetooth technology over the past few years, exploitations across devices have becomes less common. On the other hand, as more people start using these apps, hackers may launch creative remote cyberattacks to target Bluetooth-enabled devices. On the other hand, most of us already have Bluetooth enabled for one reason or another, in which case this app doesn’t increase BLE attack risk at all.

Privacy risks aside, Bluetooth may not be the right technology for tracing the location of the virus. Unlike a GPS, Bluetooth isn’t designed to generate detailed, reliable data on proximity. This technology can’t identify if users are separated by glass, a brick wall, or anything at all for that point. In this case, it’s possible someone could be falsely notified that they came into contact with someone who tested positive for the virus. Also, the apps aren’t reporting on where the users or devices are, only that they came in to contact. For this reason alone, the apps based on Google-Apple technology aren’t sufficient for contact and proximity tracing within an organization’s walls. Keep reading to learn how we’re helping solve that problem.  

As the fight to contain the coronavirus pandemic rages on, so does the war on cyber. To protect ourselves and our organizations as best we can, it’s important that we take necessary precautions: practice safe cyber habits, be aware of your surroundings—both physically and virtually— and wear your mask! 

Carolina Advanced Digital is uniquely qualified for both Wi-Fi and BLE-enabled location services for Contact and Proximity tracing within an organization. We can help you return to work safely. Contact us today to learn more and schedule a free 30-minute call with our engineering team to understand what options you should consider with your existing Wi-Fi environment, and/or overlay or integrated BLE solutions.