Contact-tracing app hits teething troubles as minister confirms changes could be made

As headlines shift to the UK’s new lockdown rules, much to the probable relief of the developers of the country’s Covid-19 contact-tracing app with its controversial centralised database, news has already emerged of teething troubles in the second stage of tests of the app, which began on 4 May.

Less than a week since the app became available to residents of the Isle of Wight, UK communities secretary Robert Jenrick revealed that it had already been downloaded by more than 50,000 people – a third of the island’s population – and confirmed reports, highlighted by Computer Weekly on 8 May, that a radical change in the nature of the app was a possibility.

In addition, the app’s developer, NHSX, the digital innovation unit of the UK’s health service, has released details of an impact assessment outlining the full technical specifications of the app and its objectives and limits.

The UK contract-tracing app works by using Bluetooth to automate the “laborious” process of contact tracing and has the goal of reducing transmission of the virus by alerting people who may have been exposed, so they can take appropriate action.

Once installed, the app uses Bluetooth Low Energy to log the distance between a user’s smartphone and other phones nearby that also have the app installed. The anonymous log of how close users are to others will be stored securely on each user’s phone. If a user becomes unwell with symptoms of Covid-19, they can use the app to inform the NHS, which, subject to sophisticated risk analysis, will trigger an anonymous alert to those other app users with whom the user came into significant contact over the previous few days.

Yet almost as soon as the first details of the app’s capability were announced, critics weighed in with concerns about what the app could achieve and whether the UK public could or would make representative use of it. In particular, the main bone of contention was whether the app’s centralised nature would lead to privacy breaches and also whether it would be of any use at all if there was a lack of user uptake.

The other key question regarding the app’s potential surrounded the fact that the centralised approach meant users’ phones would need to be in constant powered-on mode for the app to function correctly, unlike alternatives that use decentralised technology from Apple and Google.

Despite the fact that centralised apps have been developed for use in countries such as France, Japan and, until recently, Germany, UK critics have hammered the use of the centralised concept, which has subsequently been defended by UK government scientists.

After reports on the BBC’s Andrew Marr Show that the London office of Switzerland-based IT development firm Zuhlke Engineering was actively working on a contact-tracing solution based on a decentralised model, using application programming interface (API) technologies developed by Google and Apple, Jenrick was challenged directly as to whether the UK was developing a second app.

He replied: “We are now building the network that we need through track and trace… We are also paying attention to what is happening in other parts of the world. This [the Isle of Wight test] is a pilot and we’re trying to get as many people to sign up for it as possible – 50,000 have downloaded it. We are learning lessons from other apps elsewhere in the world, and if we need to change our app, we will do, and that is the point of piloting this before we take it nationally across the country.”

When pushed further, Jenrick would not fully admit that the UK government was developing a second app, and reaffirmed his earlier comment about taking notice of global developments. “As far as I am aware, we are not developing a second app, but we are paying attention to other apps around the world, and if we need to adapt our app or move to a different model, then we will do,” he said. “We want the best app.”

“If we need to change our app, we will do, and that is the point of piloting this before we take it nationally across the country”

As Jenrick was making his remarks, the NHS was releasing more concrete information on the contact-tracing app in the form of a Data Protection Impact Assessment (DPIA) of the pilot.

The DPIA fully describes the purpose of the project and how it is processing the information necessary so that it can work to the benefit of the NHS in combating Covid-19. It describes the envisaged data processing operations; assesses whether those processing operations are necessary and proportionate in relation to the purposes for which the app is being deployed; and identifies risks and appropriate mitigation of risks to users and other data subjects from those processing operations.  

It also looks at the timeframe and purpose of the project and who the controllers and information asset owners will be. It also sets out full information to allay the many fears about data privacy the app has already generated though its centralised database. Indeed, the NHS said that because the operation of the app involves the processing of personal data, as that term is defined by the General Data Protection Regulation (GDPR), it created the DPIA.

“We recognise that public trust and confidence in the app is paramount to its success,” the NHS assured. “We also recognise that transparency around the functioning of the app and its privacy controls is key to engendering that trust and confidence.”

Indeed, the early functioning of the app has already been revealed. According to Isle of Wight residents who spoke to the Financial Times, some of those who used the app were receiving alerts that they had been in contact with someone infected with Covid-19 despite their not having ventured outdoors since downloading the app. The FT also noted anecdotal reports of residents having trouble downloading and, more importantly given the well-flagged nature of the centralised service technology and its potential functional difficulty regarding background usage, also that the app was running down their phone batteries.