Let's go! How does COVID Alert work in comparison with ABTraceTogether, and does it work any better when devices are running in the background? Let's dig in!

Spoiler: Strong evidence that COVID Alert is fully functional.

The COVID Alert app itself doesn't do all the cool stuff. It's job is to provide a user interface, but the actual exposure tracking is performed by the Google & Android systems in the background. As an app, it is Open Source, and developed in the open ( https://github.com/cds-snc/covid-alert-app).

In the background, EN, which I'll use as an acronym for the exposure notification system, is also a Bluetooth Low Energy app. (See my tweets yesterday for some of the terminology here: https://twitter.com/mfenniak/status/1328548981362675714)

EN also acts as both a central and a peripheral, the same as AB app.

EN is a bit simpler than ABTraceTogether; the devices don't read and write to each other

EN as a peripheral broadcasts an advertisement saying "I'm a EN device, and my rolling proximity identifier is {data}."

EN as a central reads and records those broadcasts.

There were two things I wanted to test with COVID Alert / EN. Does it send out data while the apps are in the background? And does it receive data while the apps are in the background?

I took apart my ABTraceTogether diagnostic tool to create a new tool: https://github.com/mfenniak/exposurenotification-nodejs

This new tool acts as an Exposure Notification central device. It reads and decodes all of the EN packets from nearby phones, and outputs really exciting text data. The "rpi" field in this screenshot is the encrypted unique identifier for a device.

First test, then: does an iPhone and Android continue to send these things in the background? Yes; very clearly. As soon as I ran my diagnostic tool, I started getting EN packets from all three of the devices on my desk. They all had their screen shut off for hours.

The second test was much trickier. Does it record data in the background? To start to be confident about this, I had to get into the database on a device. The EN database is stored in "private" storage on both phones. It can't normally be exported.

I rooted my Android last week for the ABTraceTogether testing. root is a term for the super-user of a Linux system. I reinstalled the OS from scratch and modified it so that I could be root, and read the entire storage. I also had to install a very new OS to get EN.

With the rooted device, I was able to download the storage for the built-in Google apps. Searched for "EN" and "contact" and found six folders containing data. The filenames LOCK, MANIFEST, CURRENT, LOG, sent shivers down my spine...

I recognized these as the telltale signs of a RocksDB system. A few years ago, I ran a nightmarish project trying to do data stream processing with Kafka Streams, and RocksDB left a scar on my psyche. Anyways.

I was a bit wrong; it was LevelDB. Same idea, different software.

These are "key-value" store databases. They store two pieces of binary data, a key, and a related value; fast to read & write, easy to use.

app_contact-tracing-contact-record-db was the piece of data I wanted. I downloaded a tool called leveldbutil to dump the data files.

I'm looking for the rolling proximity indicators (RPI) that I was able to pull from my desktop. The key of this database is a 18 byte value, and an RPI is a 16 byte value. I chopped the first two bytes off, re-encoded it to match my log file, and...

I confirmed that the RPIs that I'm receiving over Bluetooth are also being stored on my Android. And the app was never brought into the foreground; in fact, the phone wasn't touched all day.

So, that concluded the second test; passed with flying colors.

This experimentation indicates that the EN system behind COVID Alert works in the background.

Is my testing 100% fool-proof? Nah, nothing is.

I'm limited to only getting data off an Android. I can see iPhones transmitting (while in bkgnd), but can't see them storing data.

Does COVID Alert work better than ABTraceTogether? There are a *lot* of factors to consider, and not all of them are tested here.

+ It works in the background; so that's a big deal.
+ It works across the entire country.
+ It doesn't have Android bugs, like ABTraceTogether.

+/-? It uses a direct notification approach, rather than a contact tracing approach. If contact tracing is overwhelmed, then I think this is a pro for COVID Alert.
- It doesn't allow for different actions for high-priority cases, like ABTT could.

An app alone doesn't create an entire effective system. It needs to be well advertised, well adopted, and well-integrated into a COVID-19 testing system. But that's a problem for both apps.

The technical strength of the software clearly favors COVID Alert.