NHSX
show image

Laurie Clarke

Reporter

How will the NHS Covid-19 contact tracing app work and when will it go live?

This article is regularly updated to reflect emerging developments. 

The NHS has announced the imminent launch of a coronavirus tracking app that will let users know if they’ve been in close proximity to someone infected with coronavirus and need to self-isolate. 

The app is currently being piloted in the Isle of Wight and will be rolled out to the rest of the nation afterwards. This was originally intended to happen by late May, but the government has back pedalled, now saying the app will be launched “in the coming weeks”. The app is one element of a wider ‘track and trace’ programme, which the government says will be rolled out from June 1.

The app is considered to be one of the central planks of the government’s strategy for how the UK could gradually lift lockdown conditions – if people are told to isolate immediately after coming into contact with carriers of the virus so that they avoid passing it on, even if asymptomatic. The digital contact tracing app is intended to be complemented by much wider testing and manual contact tracing supported by a team of 25,000. 

NHSX, the NHS England innovation unit, is leading the project, and development of the app is reportedly being carried out by Pivotal, a subsidiary of American software giant VMware.

A team at Oxford University has been developing the algorithm since mid-January, inspired by the Chinese tracking app that designates people a red or green riskiness code determining whether they should self-isolate.

How will the contact tracing app work?

The app will log, using Bluetooth LE (a standard feature that runs continuously and automatically on your smartphone), the proximity of other people who have the app installed. A record of this “anonymous proximity information” will be stored on the device. Users will be encouraged to enter into the app whether they have experienced symptoms of coronavirus. If a user reports symptoms of Covid-19, all of their contact data for the previous 28 days will be uploaded to the central server. All of the people they came into close contact with will then receive an alerts of the need to self-isolate.

If someone reports symptoms, a contact tracer will get in touch and, depending on their responses, may arrange for them to take a Covid-19 test. However at present, the app has no way for users to enter this test result into the app.

When will it launch?

The app has been made available to citizens living on the Isle of Wight as part of a pilot programme. The UK government says that this will be extended to the mainland “in the coming weeks”.

Will it be voluntary?

The app will be voluntary to download. However, according to researchers, it will only be effective at tracking and curbing the spread of coronavirus if at least 56 to 60 per cent of the population download it. The adoption rates of other nations’ coronavirus tracking apps are not particularly hopeful. Only one in six people signed up for Singapore’s voluntary TraceTogether app. 

Will it be successful?

The UK government believes that an app will be a central way of alleviating lockdown conditions, by tracking people who might be infected with coronavirus and getting them to self-isolate before infecting others. Unlike other diseases like Sars and flu, people infected with coronavirus can be asymptomatic for a number of days before expressing symptoms, meaning they can come into contact with a number of people before feeling sick. Research has shown that people with symptoms are far more contagious, but 80 per cent of new cases are spread by people with less severe symptoms for this exact reason.

According to a new analysis by the scientists at the University of Oxford behind the app, “digital herd protection” is likely to be essential to loosening lockdown restrictions without seeing a huge second peak of infections. “We see it as the only alternative to … applying isolation to the whole population,” said professor David Bonsall, senior researcher at Oxford University’s Nuffield Department of Medicine and a clinician, who co-led the project.

However, there are a number of issues both the design of the app, including the over-sensitivity of the Bluetooth mechanism used to track contact events that might yield a large number of false positives. The Health Service Journal reported that the app claimed that the app failed the necessary tests to be included on the NHS app store including cyber security, performance and clinical safety. This is denied by the government.

There are also potential issues with functionality. Apple and Google have said that centralised contact-tracing apps such as the NHSX app will not be able to run continuously in the background on phones that use their operating systems (i.e. the vast majority of phones). This means that the NHSX app can’t emit a Bluetooth ID when it’s running in the background. The NHSX app has tried to circumvent this issue by allowing the app to become activated by other phones emitting a Bluetooth ID in the near vicinity. However, this means that there has to be a sufficient number of phones with the app running in the foreground at any one time in order to alert the app – a fairly sizeable assumption.

Will it infringe on my privacy?

Given its planned use of bluetooth data tracking, the app has understandably been met with circumspection from privacy advocates. A number of privacy experts have highlighted a range of problems associated with the app’s centralised (as opposed to decentralised) design including that the data can be used to build a social graph of an individual’s contacts, that this type of app is vulnerable to mission creep, and that individual’s could theoretically be subject to persistent tracking using the app. 

NHSX has attempted to soothe these concerns by saying that the data will be anonymised. However, data that creates a complex social graph is very difficult to truly anonymise. In fact, many experts have pointed out that it would be relatively easy to identify an individual on the basis of this data.

Wariness around the app has been fuelled by a report from the Guardian revealing that a draft government memo explaining how the NHS contact tracing app could work noted that ministers might be given the ability to order “de-anonymisation” at some point to identify people from their smartphones. It said the app could use device IDs, which are unique to all smartphones, to reveal users’ identities, if deemed “proportionate at some stage”. It didn’t detail under what circumstances such a measure would be ‘proportionate’. A spokesperson from NHSX denied that this had ever been on the table. 

In April, Matt Hancock said: “All data will be handled according to the highest ethical and security standards, and would only be used for NHS care and research, and we won’t hold it any longer than it’s needed. And as part of our commitment to transparency, we’ll be publishing the source code too.” 

However, just before the app’s launch, NHSX is still yet to publish the source code. In addition, NHSX CEO Matthew Gould was unable to provide a definitive list of who might be privy to the app’s data when speaking to parliament. He said: “[…]what I can say is, we will have proper procedures in place consistent with law that will make sure that only those who have an appropriate public health reason for seeing the data do so, and they do so under very clear conditions and criteria.”

Before the public announcement of the app, a number of technology and privacy experts published an open letter to the CEO of NHSX and the health secretary Matt Hancock imploring NHSX to follow best ethical practice in developing the app. A section of the letter warns that “Part 3, section 61A of the Investigatory Powers Act enables people with symptoms or a diagnosis of Coronavirus to be tracked without notice[…].”