A blockbuster partnership between Apple and Google to combat the coronavirus pandemic hinges on a common wireless technology found on nearly every smartphone—Bluetooth.
The two technology giants said Friday that they would work together to develop software that would help tell people if they have come in close contact with someone who tested positive for the coronavirus. Doing so would require people to agree to have their smartphones link with others nearby.
Apple CEO Tim Cook said in a tweet that the iPhone-maker along with Google are working “to help health officials harness Bluetooth technology in a way that also respects transparency & consent.”
“Contact tracing can help slow the spread of COVID-19 and can be done without compromising user privacy,” Cook said.
However, privacy experts worry that tracking people’s movements can harm civil liberties by helping authorities keep tabs on people at all times. Critics point to the use of GPS, with its ability to pinpoint people’s location as particularly invasive.
But recently, some researchers have said that the Bluetooth wireless technology could be a better alternative because it would still preserve privacy. Instead of tracking people’s locations indefinitely through GPS, it would rely on Bluetooth, which only allows communications between other nearby devices for a limited amount of time, like temporary walkie-talkies, without revealing their specific locations.
The popular TraceTogether app, used in Singapore to help monitor the spread of the coronavirus, and increasingly in other countries, is also based on Bluetooth. User smartphones send data to other users of the app who happen to be nearby. If one user later tests positive for the coronavirus, authorities can notify those who have been nearby about it so that they can be tested. Officials never know where the contact took place nor can they easily track where the app’s users go.
Still, privacy experts have expressed concerns about TraceTogether, even though it relies on Bluetooth technologies. For instance, some have questioned the process for downloading the app in Singapore, which requires people to register their phone numbers.
Electronic Freedom Frontier lawyer Adam Schwartz told Fortune that “Bluetooth contact tracing is a vast improvement over location tracking, but it still needs strong privacy and security safeguards.”
“We appreciate that Apple and Google have made a commitment to protect privacy,” Schwartz continued in an email. “We will be taking a close look at the protocol’s specs, as well as safeguards implemented in any public health apps that take advantage of this new protocol.”
Apple, eager to be perceived as a corporate steward of privacy, is heavily promoting Bluetooth and its still-to-be developed technology as ensuring civil liberties aren’t breached. In preliminary technical materials also released on Friday, Apple laid out several ways the service would preserve privacy.
Apple said, without elaborating, that “Users have transparency into their participation in contact tracing.” It added that any data representing a unique identifier would be altered “on average every 15 minutes, making it unlikely that user location can be tracked via bluetooth over time.”
“The Contact Tracing Bluetooth Specification does not require the user’s location; any use of location is completely optional,” Apple said in the technical documents. “In any case, the user must provide their explicit consent in order for their location to be optionally used.”
Third-party app developers will get some access to the project’s technologies in mid May. A final product will be ready for the broader public sometime later.
Still, the Bluetooth service has yet to be developed by Google and Apple, so privacy experts have not had a chance to inspect it. Additionally, while Bluetooth may better protect privacy than other technologies, it’s unclear whether the service will include other privacy vulnerabilities in its overall design.
“To their credit, Apple and Google have announced an approach that appears to mitigate the worst privacy and centralization risks, but there is still room for improvement,” Jennifer Granick, ACLU surveillance and cybersecurity counsel, said in a statement. “We will remain vigilant moving forward to make sure any contract tracing app remains voluntary and decentralized, and used only for public health purposes and only for the duration of this pandemic.”
More must-read tech coverage from Fortune:
—How the coronavirus stimulus package would change gig worker benefits
—Zoom meetings keep getting hacked. How to prevent “Zoom bombing”
—Why China’s tech-based fight against the coronavirus may be unpalatable in the U.S.
—Hospitals are running low on the most critical supply of all: oxygen
—Listen to Leadership Next, a Fortune podcast examining the evolving role of CEO
—WATCH: Best earbuds in 2020: Apple AirPods Pro Vs. Sony WF-1000XM3
Catch up with Data Sheet, Fortune’s daily digest on the business of tech.
