NHS X Trialling New COVID-19 Contact Tracing App Amid Concerns on Privacy, Input From Google, Apple

The NHS X, Britain’s new digital innovation wing for the National Health Services, deployed the app across the Isle of Wight on Tuesday alongside with efforts from the Royal Armed Forces and numerous teams to track the spread of the virus.

The app is set to launch in two to three weeks after trials begin at the Isle of Wight, NHS X chief executive Matthew Gould announced. UK health secretary Matt Hancock said residents would be contacted on how to install the app. The new tool will run on Apple iOS and Android.

How Will The UK's Contact Tracing App Work?

Contact tracing apps work by using anonymous Bluetooth signals to track whether a person has been infected with coronavirus, locating who needs to be quarantined to help ease social distancing.

The app does not require mobile data or location tracking via GPS, but plans may be used in the future on a voluntary basis, according to the NHS X.

"Privacy is crucial to the NHS, and so while these are unusual times, we are acutely aware of our obligations to people. Just as the NHS strives at all times to keep health records confidential, so it will keep the app data secure", an NHS post read.

Users choose to record their condition at the onset of symptoms, and will receive notifications to isolate when coming in contact with others previously infected by COVID-19.

All data is anonymised but linked to the device, with users entering their postcode for tracking purposes.

NHS X Awards Swiss Firm £3.8m Contract to Investigate Apple and Google Technical Advice

The news comes after it was found that British health officials were 'investigating' switching its contract tracing app to global standards advised by Google and Apple, just days after app launched at the Isle of Wight, the Financial Times reported.

Both the UK, along with France and others, have previously turned down help from the two US tech giants, preferring instead to work with European firms and health authorities in Germany and Italy, among others, to build the app.

But privacy activists have slammed the move, stating that the app may be less effective than using Apple and Google's software, including UK health authorities pooling data in a centralised database and failing to synchronise with apps globally, resulting in barriers while travelling abroad, the report said.

According to documents reportedly seen by the FT, the NHS X awarded Swiss firm Zuhlke Engineering a six-week "multimillion pound contract" valued at roughly £3.8m.

The contact would required the firm to “investigate the complexity, performance and feasibility of implementing native Apple and Google contact tracing APIs [application programming interfaces] within the existing proximity mobile application and platform", the report read, adding that the investigation had a contingent deadline of mid-May.

“We've been working with Apple and Google throughout the app's development and it's quite right and normal to continue to refine the app,” an NHSX spokesperson said in a statement.

Centralised and Decentralised Models of Contact Tracing, Privacy Concerns

Privacy concerns over the UK Government app were also raised after Scotland developed its own open source programme, allowing users to inspect whether code has been compromised by privacy breaches or monitoring.

Debates on differences between centralised and decentralised models have taken to social media, with many concerned about entrusting data and privacy to private firms or governments.

The UK Human Rights Joint Committee also launched an inquiry last month on the implications of the app, stating it was not "reassured" that it would "sufficiently protect the right to privacy and other human rights", among other concerns.

Debates on using a decentralised or centralised data system have also been discussed in recent weeks.

According to the NHS X, a decentralised model will allow a general understanding of who is ill, with lists continuously updating, but all data is anonymised without knowledge to health authorities.

But centralised models would report symptoms and send anonymous contacts to public health authorities with relevant information on contact with others.

Infected persons would then be notified to self-isolate, with health authorities using anonymised data to map the spread of the disease, Ian Levy, technical director of the National Cybersecurity Centre explained in a blog post.

He said: "While the system wouldn’t know who they are, encounters with them could be scored as more risky, and adjust the risk of someone being infected by a particular encounter appropriately. The NHS app uses this centralised model, but also protects your security and privacy strongly."

Other privacy concerns include randomly changing the encryption of device information, with many agreeing data should randomise every 15 minutes, he said, adding: "But that’s a policy balance and the period can be changed if necessary."

Nations Join Contract Tracing Efforts With Frontline Technologies

The debates come after countries such as China, Singapore, South Korea, Germany and others have successfully tracked COVID-19 cases with similar technologies, reducing overall cases and offering more effective treatments along with social distancing measures, a Lancet report read.

The study, which measured the efficacy of contact tracing programmes in Shenzhen, concluded that contract tracing apps were vital in the fight against Sars-Cov-2.

"Hence new technology-based approaches are greatly needed to assist in identification of contacts, especially if case detection is aggressive. Building on the SARS-CoV-2 experience in Shenzhen and other settings, we contend that enhanced case finding and contact tracing should be part of the long-term response to this pandemic—this can get us most of the way towards control," the report concluded.