Note that the Care19 app does not use the Apple-Google contact tracing (exposure notification) API.
The oversight suggests that state officials and Apple, both of which were responsible for vetting the app before it became available April 7, were asleep at the wheel.
“Should this have been vetted? Yes. We are following up on that as we speak,” said Vern Dosch, the state of North Dakota’s contact-tracing facilitator. “We know that people are very sensitive.” Health officials in South Dakota did not immediately reply to requests for comment.
Apple said it was investigating the report and that if it finds an app is out of compliance, it works with the developer to get it into compliance.
The app, called Care19, and produced by a company called ProudCrowd that also makes a location-based social networking app for North Dakota State sports fans, generates a random ID number for each person who uses it.
But according to the Jumbo report, the app sends the random ID number, along with a phone ID used for advertising purposes and apparent latitudes and longitudes of places visited by the user, to Foursquare, a leading location-data provider. The app also sends the random ID to servers run by Bugfender, a Barcelona-based service used by app makers to track and diagnose software malfunctions, according to Jumbo, which monitored internet traffic generated by the app. It’s accompanied by the phone’s name, which often includes the device owner’s first name, according to the report. The phone’s advertising ID is also sent to Google servers that appear to be affiliated with Google’s Firebase service, Jumbo found.
Google didn’t immediately respond to an inquiry from Fast Company about the data collected via the app.
No location data is truly anonymized. It can be cross-matched with other publicly-available data to identify and track individuals. — MacDailyNews, April 2, 2020
And, yes, once again, Apple’s App Store vetting process is proven shoddy.
These apps aren’t going to work for mitigating the spread of COVID-19 very well or at all (see why here, here and here), but they are going to provide excellent legal cover, which is necessary, especially in more litigious countries, for all of us to get back to life.
At the very least, and perhaps the primary impetus for the creation of these apps at universities and everywhere else, is that the existence of such apps relieve universities and everyone else from LIABILITY under the law. Look at digital contact tracing apps as a buffer for getting back to school, work, leisure activities, sports, travel, etc. without the fear of being sued.
Schools, restaurants, airlines, retailers, everyone will be able to say: “The apps exist. Not our fault if too few people use them. Get well soon, as do 99.72% (99.91% under age 65) of people who contract COVID-19!”
This is the real reason why digital contact tracing apps exist: Absolvement of legal liability. — MacDailyNews, May 22, 2020