SGA and the Tech administration have selected NOVID, created by Dr. Po-Shen Loh of Carnegie Mellon University, as a recommended contact tracing app for the Institute’s community.
Contact tracing is a methodology to limit the spread of a disease by alerting people that are in close proximity to or have been in contact with an infected person. Loh’s background is in graph theory but started work on NOVID after realizing that he could apply his expertise in graph theory to the problem of controlling the spread of COVID-19.
Loh was previously awarded a Hertz fellowship to fund his research. As part of the program, Hertz fellows make a non-binding moral agreement to aid the United States in the case of a national emergency. Loh felt that developing the idea that later became NOVID was his obligation under this moral agreement.
NOVID offers two critical innovations in the area of contact tracing: it provides an early warning system that alerts users if someone infected with COVID-19 is becoming physically close; and it does not use any personally identifiable information to provide contact tracing services. The application has no registration process, and it doesn’t use the GPS services on users’ mobile phones.
The app instead uses Bluetooth and high-frequency sounds to detect other users and receive information about their exposure levels. The app scans for other mobile phones running NOVID via Bluetooth, and once it has found another NOVID user, sends high-frequency sound pulses (out of the range of human hearing) to detect the distance between the phones. This methodology allows NOVID to measure distances with extreme accuracy, much more than other contact tracing apps which use GPS to measure distances.
All data processing happens locally on the user’s device. No audio is uploaded to NOVID’s servers; the audio isn’t even saved onto the users’ phone. Once the distance between the two phones running NOVID is processed, it is uploaded to the servers, which maintain the complex network of interactions between NOVID users. On the servers, users are represented with completely anonymous identifiers assigned to each device running the app.
NOVID has received some criticism in the Tech community for being closed-source. Many contact tracing applications are open-source, which means that their source code is open for anyone to inspect or even copy and modify. The open-source model helps inspire confidence in the application’s developers, making it harder for them to add insecure or privacy-invading code to the applications. The NOVID team, however, has decided to keep the source code for NOVID proprietary in order to preserve the security of potential users.
Loh has received numerous offers from companies to purchase his technology for repackaging into their own contact tracing offerings. In Loh’s view, many of these applications would violate users’ right to privacy and anonymity. He notes: “I don’t want to live in [a] world where somehow all of the employers strongly encourage you to install something which [lets] you know exactly who is who.”
Tech is playing a critical role in the application’s adoption. GTRI is auditing NOVID’s source code – whenever a new version of the app is ready to be published, the NOVID team sends the source code to GTRI, where it is inspected for security and privacy issues.
Cy Heffley, the SGA Joint Vice President of IT, urges students who are skeptical of the app’s privacy protections to “seriously consider the cost and benefit of using the application.” To members of the community who have installed the application, he says: “Thank you. You’re doing a great service. Please continue using it.”