Week 1

Answer from Reema and the Ada Lovelace team:

The NHSX contact tracing app is not (at present) being delivered by a private sector commercial partner. The NHS has opted to develop its own centralised contact tracing app. This is different to, e.g in Germany, where Google and Apple are delivering a decentralised contact tracing app model.

Palantir and Faculty are supporting the NHS to deliver a data platform, called a ‘data store’, to understand, analyse and visualise the spread of the virus, and anticipate pressures on the NHS’s system. Whilst there are many concerns about the transparency of these contracts, raised by civil society organisations and the British Medical Association (BMA) they don’t relate to the app.

Answer provided by Reema and the Ada Lovelace team:

Some privacy concerns have been raised about the app. The app privacy policy mentions that anonymised data might be shared with a range of data processors that include a list of private sector companies. The spokesperson also says that the company has been in touch with American hospitals. Their privacy policy notes that it could travel outside of the EU not just for analytics but to be shared with other research partners.

This is a great question - but something that we hope to answer together as a group! Syliva - perhaps you could ask this on Thursday / at the next session and see what we hear from others. (Anna, Traverse)

Experts have previously suggested that 60 percent of UK population will need to download it for the system to work, suggesting that the pilot is close to hitting the target. (Expert in this case on public record is Prof Christope Fraser, University of Oxford, Big Data Institute)

Source: The Independent,reporting on the requirement for uptake https://www.independent.co.uk/news/uk/politics/coronavirus-app-uk-nhs-contact-tracing-phone-smartphone-a9484551.html

According to reports from the Transport Secretary, Grant Schapps, over 50% of people on the Isle of Wight have downloaded the new app.

Recent update shows the Isle of Wight's MP saying that ~65% of people on the island have downloaded the app. 

Source: https://news.sky.com/story/coronavirus-isle-of-wight-downloads-of-covid-19-trial-app-exceed-expectations-11990190 

The Information Commissioner’s Office is the UK’s privacy regulator. Its recently published guidance and recommendations says that: ‘App use, from installation to sharing of information, should be voluntary with no negative consequences for individuals if they do not take action. Functions should be de-coupled to allow the user to benefit from one function without being compelled to provide data for other functions.’ 

Source: https://ico.org.uk/media/for-organisations/documents/2617676/ico-contact-tracing-recommendations.pdf
 

It however, caveats this point with the fact that it will ‘keep these recommendations under review, taking into account how COVID-19 develops’.

Others have proposed that Parliament introduce a Coronavirus (Safeguards) Bill that explicitly includes principle of non compulsion, so that no one can discriminate against people who have not used or installed an app.  

Source: Draft Coronavirus Bill https://osf.io/preprints/lawarxiv/yc6xu/

Centralised Model: Here the identifiers are created by a central server, who sends them to the phones. Thus, the server can choose which identifiers to give to particular phones. In this scheme, upon infection the identifiers that have been seen by the infected person’s phone are loaded up into a database, and the central authority has a way of reversing the identifier so as to obtain the actual person. They can then contact the person who was in contact with the infected person.

Decentralised Model: Here the identifiers are created on each user’s phone. Then, only the identifiers sent by the infected persons phone are loaded into the central database. The non-infected users occasionally read from this central database. They can see locally on their phone whether they have been in contact with an infected user; and can then take appropriate action depending on the prevalent medical advice. But no-one can associate identifiers with actual people.

The UK has opted for a centralised model:

Argument: a huge amount of false-positives can be generated via Bluetooth. A centralised approach is the only way to make sure that if someone reports being sick, a warning will be sent only to the app users that have come into epidemiologically significant contact with the infected person – and not to the person waiting for the bus on the other side of the road from them.

Ross Anderson, professor of security engineering at the University of Cambridge: "You can't do that kind of analytics if you take the Google and Apple approach, which will broadcast a warning to everybody that has been registered as soon as someone calls in sick. The problem is that you'll end up getting an alert every so often, advising you to go home and self-isolate, and 99% of the time it's going to be a false positive."

See also the response to the centralised / decentralised question for more arguments for / against. 

In addition to the privacy/rights based concerns about centralisation there have been some practical considerations around supporting efficacy of uptake.

Germany’s shift was influenced as much by practical concerns as privacy concerns. Apple reportedly refused to unlock iPhone Bluetooth connectivity to allow centralised apps run in the background.

This would mean phones using the app would have to remain unlocked for it to work, draining phone batteries more quickly.

It is early days yet (not everyone can even use the app) – and there is nothing in the public domain that looks at how well it is working.

There are media reports that NHSX are now working on a decentralised app but again, nothing confirmed: https://www.digitalhealth.net/2020/05/nhsx-working-on-second-tracing-app-using-apple-and-google-tech/