Research institutes warn of necessity for UK contact-tracing app to link to testing

As the roll-out of a Covid-19 contact-tracing app in the UK transcended its original diagnostic purpose, the debate as to its potential flaws and fundamental effectiveness rages on, with studies from UK IT and academia giving conditional blessing to the app.

The main issues that the BCS, The Chartered Institute for IT and the Cass Business School, which is part of City, University of London, centre around data privacy, but also that the app’s use be totalled aligned with testing for the virus to produce worthwhile tracking data.

Indeed, the BCS warned that without this link, “you cannot ‘big data’ your way out of a ‘no data’ situation”, while Cass cautioned that the contact-tracing app would not be effective unless there was significant public uptake, something that government experts have already conceded will be a challenge.

Developed by NHSX, the digital healthcare innovation unit of the UK’s National Health Service, the contract-tracing app works by using Bluetooth to automate the “laborious” process of contact tracing and has the goal of reducing transmission of the virus by alerting people who may have been exposed, so they can take action to protect themselves.

Once installed, the app will start logging the distance between a user’s smartphone and other phones nearby that also have the app installed using Bluetooth Low Energy. The anonymous log of how close users are to others will be stored securely on the user’s phone. If a user becomes unwell with symptoms of Covid-19, they can allow the app to inform the UK National Health Service (NHS) which, subject to sophisticated risk analysis, will trigger an anonymous alert to those other app users with whom the user came into significant contact over the previous few days.

In a policy position paper, the BCS, The Chartered Institute for IT, offered general support for the app, regarding the implementation of such a product as necessary, but it warned that it must overcome “perceived Big Brother elements” to ensure the UK public gets on board.

Indeed, the BCS said the biggest threat to the success of the contact-tracing app would come from the fact that it is based on the use of a centralised database. This, it cautioned, might have a negative effect on uptake by the public and minimise the chance of reaching the 60% uptake implementation target needed to produce qualitative results.

BCS said a sustained campaign to increase public confidence in IT, supported by assurances of real safeguards, open and ethical data governance and protection by design, was fundamental.

“Contact-tracing apps must be founded on ‘privacy by design, privacy by default’ principles and government must set a high bar for transparent and ethical data governance as its future legitimacy and trust with public data is at stake,” said Kathy Farndon, vice-president of BCS, The Chartered Institute for IT.

“It is vital that the impacts of a contact-tracing app – as part of the UK’s response to Covid-19 – are considered in terms of the key challenges it presents, such as data protection, privacy, public trust and civil liberties,” she added.

“Contact-tracing apps must be founded on ‘privacy by design, privacy by default’ principles and government must set a high bar for transparent and ethical data governance as its future legitimacy and trust with public data is at stake”

In its paper, BCS made several recommendations that the government, public health authorities and developers should consider when developing contact-tracing apps. These include the aforementioned facilitating mass levels of Covid-19 testing to work in tandem with the contact-tracing app; engaging and working strategically across the UK’s devolved administrations, with civil society to develop and implement a wide-ranging, inclusive communication programme regarding app installation and use; ensuring minimum interference with people’s personal “data” lives; and that data isn’t sold or shared beyond its intended stated purpose.

For its part, the study from the Cass Business School recommended that the NHS be put in charge of the app, with priority access to testing for those alerted and/or with symptoms. It said it was possible to implement a privacy-respecting contact-tracing app that could achieve widespread adoption in the UK, but only if the health service, rather than the government, ran it.

Cass researchers asked a representative sample of 2061 UK adults to choose between different contact-tracing app configurations to estimate their preference for various features. This information was used to simulate the adoption rates for different potential contact-tracing apps. The researchers found that adoption rates increased further if the app was linked to priority testing for Covid-19 for those who get infection alerts.

The study revealed that a “maximum adoption” app that would reach the highest adoption, regardless of implications for privacy and civil liberties, had a maximum adoption rate of 77.6%; a “recommended” app that would reach the highest adoption while safeguarding privacy and civil liberties was found to have an adoption rate of 73.5%; an “expected NHSX” app that the NHSX/UK government had announced had the lowest adoption rate, with 51.1%.

The Cass researchers cautioned that these adoption rates occurred under ideal conditions in which everyone was informed about the app, and that actual adoption rates would be lower. It noted that the main reason why the “expected NHSX” app achieved a lower adoption rate was because in this scenario, the government was perceived to be in control of the app and its data, and because no plans had been announced to link the app to priority testing.

Study co-author professor Caroline Wiertz said an understanding of which app configurations encouraged the public to use an app needed to be a central part of this discussion.

“This is critical because a contact-tracing app will not be effective unless there is significant public uptake – no matter how technologically sophisticated or superior the app is,” she observed. “One particularly sensitive challenge for the successful implementation of a contact-tracing app is navigating the potential privacy and civil liberty issues inherent in these apps.”

The researchers also uncovered interesting differences in app adoption likelihood. Preference for a contact-tracing app decreases with age and increases with household income. The researchers noted that people with lower incomes and older people were less likely to own a smartphone, and that older people might feel technologically challenged using apps. Respondents in London had a stronger preference for the app, perhaps an indication that the app appeals more to residents of densely populated areas.

What was described as a surprising and concerning finding is that respondents showed a willingness to share more data and accept more invasive measures than would be imaginable in “normal” times. People were more likely to adopt an app if they were afraid of Covid-19, if they or their family had been ill or experienced symptoms, and/or if they have suffered financial or mental health consequences due to the lockdown.

“The decision-makers involved in the design and launch of this contact-tracing app have an enormous responsibility to get it right,” Wiertz concluded. “They must strike a fine balance in designing and implementing an app that on the one hand relies on our cooperation and personal data to be effective, but on the other hand does not overreach into our willingness to make sacrifices and share personal data to combat this pandemic.”