A new contact-tracing app developed by the NHS will be released across the UK within the next few weeks, but experts are concerned about whether it will work.
Speaking to a committee of MPs on Tuesday, Matthew Gould, the head of NHSx, confirmed that the app would not keep data decentralised despite a request by Apple and Google.
Mr Gould also confirmed that the app will allow people in the UK to self-report if they were experiencing the symptoms of COVID-19, potentially allowing them to send false reports and force people to self-isolate when they don’t have to.
The app could start being rolled out in the UK in a test area next week, before being deployed across the country in “two to three weeks”, according to Mr Gould.
Apple and Google are updating their mobile operating systems, which are run on 99% of phones worldwide, to allow them to keep track of which other devices they come into close proximity with.
This contact log can then be used to alert people if someone they had come into close contact with was suspected of being infected with the coronavirus.
But healthcare authorities will only be able to access this log through a special application programming interface which the companies are developing, and which can only be used if the data is kept on the phones themselves and not collected centrally.
Mr Gould told MPs that the UK’s approach had “a measure of centralisation” as it would be the NHS which sends the alerts, rather than them happening on a phone-to-phone basis.
“We don’t believe that’s a privacy endangering step,” Mr Gould said, adding: “But also, by doing so, it allows you to see the contact graph of how this is propagating and how the contacts are working across a number of individuals, without knowing who they are.”
But privacy advocates Open Rights Group warned: “As we understand matters, without using the Apple-Google method, the NHSx app would end up draining batteries and causing screen locks to be disabled for many users.
“If this is the case, take up of the app will be poor, and the project will not work very well. Australia, also using centralised matching, are having to constantly pester users via screen notifications when the app switches off.
“Battery life will be affected, and users will end up with screens unlocked, increasing security risks.”.
Alongside Professor Christophe Fraser of the University of Oxford, Mr Gould confirmed that the app would find out about people showing symptoms of the coronavirus when they self-reported those symptoms through a questionnaire.
But, as the University of Cambridge’s Professor Ross Anderson wrote, allowing people to self-report that they are showing COVID-19 symptoms could encourage them to abuse the system by making false reports.
“Anyone who’s worked on abuse will instantly realise that a voluntary app operated by anonymous actors is wide open to trolling,” said Professor Anderson.
“The performance art people will tie a phone to a dog and let it run around the park; the Russians will use the app to run service-denial attacks and spread panic; and little Johnny will self-report symptoms to get the whole school sent home.”
To tackle this, Apple and Google say they are working with public health authorities to provide the validation for any diagnoses. But the NHS app will instead use a survey.
Professor Fraser told Sky News that, from an epidemic control perspective, self-diagnosis was an essential part of digital contact-tracing.
“Our earliest results suggested that close to 50% of infections are spreading before a person shows any symptoms. As such, the speed of contact tracing is very important, it needs to keep up with the epidemic.
“Self-diagnosis, based on a series of carefully sequenced questions answered in the app, will, if appropriate, trigger a notification to guide people you have come into close proximity contact with to self-isolate.”
Mr Gould, of NHSx, said that the contact-graph created by the UK’s centralised system would allow them to detect malicious use, explaining: “One of the ways you can do that is looking for anomalous patterns.”
He added: “Even if you don’t know who the individuals are, you can see anomalous propagation, which the approach we’ve taken allows… we’re not clear that a decentralised approach allows that.”
David Bonsall, a senior researcher at Oxford University’s Nuffield Department of Medicine and a clinician at Oxford’s John Radcliffe Hospital, told Sky News the researchers were prepared for abuse.
“We have a parameter in our epidemiological model that can adjust rates of non-COVID reasons for reporting symptoms. This includes other infections and non-infectious reasons that people might self-report, some of which will be malicious,” he acknowledged.
“All solutions to this epidemic are going to be massively helped by people behaving responsibly – by keeping up with social distancing, not burdening health care resources unnecessarily etc.
“NHSx are setting the app up with the necessary safeguards to identify people who use it irresponsibly.
“But we hope given the scale and severity of the epidemic that this will implicate a small proportion of users and that these safeguards will mitigate against malicious use as much as possible.”