Leon Neal/Getty Images
show image

Laurie Clarke

Reporter

Is the NHSX contact tracing app really the answer to the UK’s coronavirus crisis?

China was quick to roll out widespread bio-surveillance measures in response to the coronavirus crisis. A few months into the ongoing global pandemic, many nations, including liberal democracies, are also trialling or rolling out some form of tracking in response to the viral outbreak. The UK is set to launch a new app from NHSX, the health service’s innovation arm, that will use Bluetooth technology to track the spread of infection. It’s been billed as an integral part of a strategy that will allow us to lift lockdown conditions and more hastily return to some kind of normalcy. But there are a number of reasons that the promise of this technology is perhaps overstated. 

First is the issue of adoption. The app will apparently be voluntary to download, but at least 60 per cent of the population will need to do so in order for it to be effective. That’s roughly 40 million people. The app’s design was inspired by Singapore’s TraceTogether technology, but the adoption rate for that – also voluntary – app doesn’t bode well for the NHS. About 12 per cent of Singapore’s population signed up. The low adoption rate is exacerbated by the fact that the technology depends on users encountering other people who have also downloaded the app in the wild. In Singapore’s case, “roughly 1 per cent of random contacts would be covered” former national coordinator for health information technology at the US Department of Health and Human Services, Farzad Mostashari, wrote on Twitter. “Even if you get 1/3 of the population to adopt it, only 9 per cent of contacts will be covered.” 

The idea of contact tracing is not new, and has been employed for a long time in the area of sexually transmitted diseases. But this form of contact tracing relies on manual methods, i.e. people remembering who they’ve slept with and contacting them personally, or supplying health service officials with information to contact them. Some efforts to do the same for coronavirus are underway in the US. But the argument for using a tech-based intervention to track Covid-19 is that you don’t remember everyone you walk past or stand next to, and that it’s less burdensome on an already over-stretched health service. 

Despite this, there’s no hard evidence that contact tracing apps are the most effective means of tackling the coronavirus crisis. Some countries that have managed to efficiently curb the spread of the virus – China, South Korea and Taiwan – have used them, but whether contact tracing technology alone is instrumental to success remains unclear. In the case of both China and South Korea, location and contact tracing data was supplemented by many other strategic prongs.

In South Korea, contact tracing has been complimented by CCTV, credit card data and interviews, alongside extensive testing, with police and health authorities permitted to obtain location data from telecommunication companies if an individual refuses to willingly hand over this information. In China, an app was used to assign users a traffic light code which dictated how much freedom of movement they were permitted. It’s still unclear how exactly this risk score was calculated, but it pulled in data about proximity to confirmed coronavirus cases and viral hotpots. This information was shared with the police, who could use it to enforce quarantine. 

The UK has seemingly opted to use Bluetooth data to track coronavirus. This method works by logging people that users encountered in close proximity, and notifying them of the need to isolate if one of their contacts reports symptoms of coronavirus. But this technological design comes with risks.

The first is over-sensitivity. Bluetooth technology is not finely tuned enough to say definitively whether you were within a two metre range of someone. As Ross Anderson, professor of security engineering at Cambridge University and one of the academics being consulted by the NHS about the app, points out, the technology is likely to flag up people on the wrong side of apartment walls, floors and ceilings; people riding past on a bike; or people chatting while maintaining a distance of more than two metres –  scenarios in which it would be impossible to contract the virus.

“It would be quite intolerable for the government to prohibit such social interactions, or to deploy technology that would punish them via false alarms,” writes Anderson in a blog. “And how will things work with an orderly supermarket queue, where law-abiding people stand patiently six feet apart?”

He does offer ideas of how to mitigate this problem. “I expect the app developers will have to fit a user interface saying: ‘you’re within range of device 38a5f01e20. Within infection range (y/n)?’” However, Anderson points out that an “avalanche of false alarms” will probably lead people to engage with the app less seriously. 

This problem of false alarms could be compounded by the problem of over zealous self-reporting of symptoms. If we use the app en masse without significantly increasing the number of tests, then people could be over cautious when entering information into the app – thus creating a number of false positives that has a ripple effect throughout the populace.

If 40 million people are entering every time they have a cold this could render the app ineffective, as well as potentially distorting figures on the reported rates of the virus. Something that could overcome this problem is changing a fundamental premise of the app from targeting those with ‘symptoms’ of coronavirus to those with a ‘diagnosis’ of coronavirus. However, Matt Hancock has so far specified “symptoms” will be the focus of the app. 

The choice to use Bluetooth data could pose yet more problems. Timandra Harkness, author of Big Data: Does Size Matter?, points out that because Apple iPhones and the latest Android phones don’t allow Bluetooth to run continuously in the background, the NHSX app wouldn’t be able to run for much of the time. “The app wouldn’t work with the phone locked or while you are using it for anything else,” Harkness writes, adding that a Singaporean friend told her this was also an issue for the TraceTogether app, and meant that “you have to leave it on and … ‘upside down’ in your pocket to go into Low Power mode.”

Harkness writes that one way to solve this issue would be to develop contact tracing technology along the lines that Google and Apple are doing so themselves, that operates on a decentralised model that doesn’t upload contact data to a centralised body for processing and storage. Apple has said it will only allow these types of app to run continuously in the background. Hancock has suggested that the NHSX app will upload data to a centralised body saying: “All data will be handled according to the highest ethical and security standards, and would only be used for NHS care and research, and we won’t hold it any longer than it’s needed.” 

A decentralised approach has been commended as a boon for privacy, but there are other reasons why the NHS might hesitate before pivoting to this model. Anderson writes that decentralised systems are “all very nice in theory but are a complete pain in practice as they’re too hard to update.” Relying on cryptography tends to make things even more complex, fragile and hard to change,” he writes. “In the pandemic, the public health folks may have to tweak all sorts of parameters weekly or even daily. You can’t do that with apps on 169 different types of phone and with peer-to-peer communications.”