The UK's coronavirus contact-tracing app could be technically ready for deployment in as soon as two to three weeks, according to the boss of health service innovation group NHSX, Matthew Gould. Speaking before the Science and Technology Committee, Gould said that the technology would be trialed in one area first and, subject to the tool performing well, would then be scaled up nationally as part of a wider strategy to emerge from lockdown.
The app is designed to trace and warn people who might have become infected with the coronavirus as a result of having been exposed to someone who has reported symptoms. Once it is installed on multiple phones, the tool records proximity via Bluetooth and, if a person becomes diagnosed or symptomatic with COVID-19 at a later date, it issues a notification to those at a higher risk of being infected.
Because the coronavirus can be transmitted before people become symptomatic, traditional manual contact tracing has been unable to stay ahead of the pandemic, and a digital tool has been pitched by the health authorities as a way to track and warn people fast enough.
SEE: IT pro's guide to the evolution and impact of 5G technology (free PDF)
It is estimated that, should 60% of the population use the app and stick to its advice to self-isolate or quarantine when necessary, the virus's reproduction rate could be brought to under one, down from three.
Gould conceded that, in order to give the tool a chance of sufficient uptake, deployment will have to go hand-in-hand with a strong communications campaign to encourage people to download the app.
"To achieve the levels of download that would be optimal will be tough," said Gould. "We will have to find messages and messengers that will resonate in all the communities in the country that we need to be a part of this. It will require an enormous comms effort."
NHSX recently revealed that the organization would not be following the same decentralized model as Apple and Google in developing the app, which has raised concerns among privacy advocates. The tech giants have put forward an API for Bluetooth-based contact-tracing apps, in which phone owners are matched based on their handsets' anonymous key-codes, with their data never going through a central database.
The UK government's approach, on the other hand, is centralized: when a user reports symptoms of the coronavirus, the warning is sent to a central computer server, which then works out who to send an alert to among the contacts that the infected person's phone has registered.
Gould stressed that a centralized model still protects people's privacy because it relies on anonymous identifiers, rather than identities. The reason that the NHSX picked this particular approach is because it will allow the health services to run a number of analytics that would be impossible with phone-to-phone matching.
For example, scientists could look at patterns of propagation, and detect malicious usage of the app. They would be able to release users who have been told to self-isolate if it turns out that the person who reported being symptomatic was in fact not infected. In the decentralized model proposed by Apple and Google, tracking back individuals would be much harder.
The NHSX boss said that there was "something of a false dichotomy" between both models, by which decentralized approaches are associated with privacy. He explained that all the data collected would be anonymous, and that users will have the choice, when they become infected, of whether to report their symptoms to the NHS in order to generate the cascade of warnings to their contacts.
Looking at future versions of the app, Gould mentioned that users may be offered the option to reveal, on top of anonymous proximity contacts, the location of where these contacts took place.
"This would be very useful epidemiologically," he said. "It would allow us to know if certain places, or sectors, were particularly a source of proximity contacts that subsequently became problematic."
The idea is likely to be frowned upon by privacy groups. Bluetooth has been favored by governments as a solution precisely because, unlike GPS or Wi-Fi data, the technology only tracks which devices have been near one another, instead of registering users' locations.
Gould made it clear, however, that location-sharing would be an opt-in and not the default setting for the app. He also clarified that he expects the app to be shut when the COVID-19 crisis has passed.
Lilian Edwards, a professor of Law at Newcastle University, said that there was always a risk in building a centralized index of the movements of an entire population which may be retained in some form beyond the pandemic.
"We have a precedent of previous pandemics leading to a mass extension in state surveillance," said Edwards. "That is my worry. The devil is in the detail: without absolute details of the tech, it's hard for me to say more."
Jim Killock, the executive director of Open Rights Group, told ZDNet that such transparency is what the NHSX has been lacking throughout the process of developing an app for contact-tracing. "The NHS doesn't have a great record around the protection of privacy and consent issues," he said. "The lack of transparency at this point is exasperating."