How the COVID-19 alert apps work

The Pennsylvania and Delaware apps use a Bluetooth platform from Apple and Google that sends out random strings of numbers, called chirps, that other smartphones with the app can hear and record. Those numbers change every 10 to 20 minutes.

If someone tests positive, the app on that person’s phone can upload all the random numbers the phone has sent out to other phones in the past 14 days. Another person  with the app can download that list of numbers, and that person’s phone can match the list against the numbers it has come into contact with. Because the matching is done on the user’s phone, not a government database, only the user knows if the phone has matched with another one.

If there’s a match showing you have been in close contact with someone who tested positive, you can choose to get tested. If you get a positive result, you can put that into the app to alert the other app users you have been close to. Close contact means being within 6 feet of another phone for at least 15 minutes.

By design, all those steps require someone using the app to actively do something, said Marc Zissman, who worked on the app. He’s the associate head of the cybersecurity and information sciences division at the Lincoln Laboratory at MIT.

“Let’s look at how private that is,” Zissman said. “I was a sick person, what did I do? I uploaded all the chirps that I sent over the past two weeks, but those chirps, they had nothing about me in them."