COVID exposure notification app

Apple and Google are working on an exposure notification service as part of their COVID response. However, this service requires people to keep their phones on them in order to be effective. Unfortunately, many Garmin users leave their phones at home when going for a run or working out.

I was looking into using the framework developed by Apple/Google and was hoping to create something similar for Garmin watches. Check out this link to read more on what Apple and Google are doing. 

I'll let you dig into the details but at a high level, the way it works is using Bluetooth Low Energy your phone detects who you come in contact with, which allows you to be notified if you come into contact with someone who was diagnosed with COVID. The phones look for a UUID starting with "0xFD6F" and stores any UUID the phone came in contact with. In order to preserve privacy, UUIDs are stored locally and each phone uses a rolling identifier that updates every 15 minutes (see how the rolling identifier is derived here). 

The reason for this post is I wanted to get the community's thoughts on some of the issues/limitations I see and if there are ways to get around these.

Challenges

  • Needs to be running all the time - For this reason, I would think this would need to be a widget with a temporal event that runs every five minutes. This appears to be acceptable as Apple/Google recommend scanning every 5 minutes at a minimum 
    • The main concern with this approach would be if the temporal events fail or are canceled. It looks like temporal events are canceled when the watch is reset and are only reactivated when the user navigates to the widget
    • I don't see a blocker here that can't be solved with education and the UI for the widget
  • Broadcasting BLE - For contact tracing, Apple and Google will only pick up devices that have a UUID that start with "0xFD6F". I dont see any way to add a new UUID to the device or change the existing UUID using Connect IQ, so this seems to be a blocker. I really do not have a workaround for this
  • Scanning over BLE - It appears that for scanning for devices requires the developer to hardcode the full UUIDs to scan for, and cannot indicate a part of the UUID to look for. I have not looked too deeply into this but it appears to be another blocker
  • Storing UUIDs of people I came in contact with - The device needs to store each UUID the user came in contact with for 14 days, even though each UUID is not large in size, its reasonable to expect that there would be a lot of them (for example the person is often in crowded areas). Would the Garmin device be able to store all of this data without the risk of it being discarded?
    • I don't think this would be an issue but maybe I am missing something?
  • Exposure notifications - When a user is infected or comes infected with someone who is infected there needs to be a way to take the UUIDs saved locally and connect to the exposure notification service. Two potential solutions for this:
    • Apple and Google provide us a way to store these UUIDs to a user's phone as part of the services they are making available. This would provide one centralized place with all of the UUIDs someone came in contact with. This would allow the phone to handle the notifications and declaring if the user has tested positive for COVID
    • Allow for the Garmin watch to connect directly to the government app's APIs, I believe this could be accomplished from through the makeWebRequest function or potentially creating a companion app 

Sorry for the long post. I just wanted to get a second pair of eyes or hopefully someone at Garmin can pick it up as a generic feature of the devices.

  • 1) Temporal events.  Once a widget is started with a temporal event, it will contine to run every x minutes when possible.  Running a device app doesn't allow the background to run, or if you're plugged into a computer, they wont run.  But as soon as you exit the devive app or unplug, they can run again.  No need to restart the widget.

    2) as far as scanning, you can't see the BLE MAC address in CIQ, but you can look for any UUID that's advertising.  in the thiny52 sample in the SDK, in thingydelegate.mc, there's a function called "contains" which looks for a specific UUID, but there's no reason it something like it couldn't be done to look for a match in the first part of a UUID.  I have a feeling though they are talking about BLE MAC addresses and not UUIDs though, but if it is UUID, that's possble..

    3) storage - you have about 100k using Application.Storage.  That can be many UUIDs based on how they are stored.

    4) makeWebRequest would be a possible way to send the list to someone

    One thing not mentioned is GDPR and the info collected.  It's not just info on the user running the apps, but anyone that the user comes close to.