Why the UK’s Contact-Tracing App is not the Solution
21 May 2020
On the 4th May, the British government announced its plans to develop a contact-tracing app which would enable digital contract-tracing on a larger scale, in order to ease restrictions while at the same time maintaining public safety. The app is currently first being tested on the Isle of Wight, which has a population of 141,000 and will subsequently be launched to the rest of the UK in June.
The app works specifically to let people know if they have been in close contact with an individual who subsequently reports positive for Covid-19. Whenever two users come in close contact, Bluetooth signals from each device perform a digital “handshake”, while keeping the data anonymous. This is then used to track down people to alert them of the need to quarantine, far more rapidly than the traditional methods. This is reliant on users to voluntarily “opt-in” to record details of any symptoms when they start to feel unwell. So if that person actually tests positive for Covid-19, a message will be pinged to people found to have been in close contact with them in the last 28 days (based on their anonymous IDs) and recommend them to self-isolate. If they take a test proving negative, then they may be released from this self-isolation on the app. Any data will not be stored for longer than 28 days and will be wiped when the pandemic is over, and the use of the app is finished.
The London School of Hygiene and Tropical Medicine has suggested that “test and trace” strategies could slash rates of transmission by 50-65%. However, it is widely opinionated that such an app in the UK will likely raise more problems than it will solve.
For one, although China adopted a location-health status tracking app earlier in their suffering of the pandemic, there is a lack of reliable data pertaining to its usage and it is difficult to determine any app’s effectiveness in limiting the transmission of Covid-19.
Furthermore, it is not easy to capture sufficient participation on an app to make a significant impact on contact tracing outside of an authoritarian state like China. The UK is aiming for 50% usage for the population to at least use such an app. Still, in countries like Singapore, where a contact-tracing app is already available, and voluntary, only 12% of the population use it. Under such circumstances, this means that the statistical likelihood of two people who have the app massing by each other is only 1.44%.
“Many are concerned that, upon emerging from the current crisis, a tool will have been created that enables widespread data collection on the population”
Of course, Google and Apple have claimed that the government could just automatically install the software on everyone’s phones. However, a dispute has arisen that pitted the UK government against these companies, which are pedalling a competing outline and design for contact-tracing. In fact, the UK is one of the few countries that have decided to create an app that is actually incompatible with the contact-tracing API that is currently in development by Google and Apple. Instead of decentralising any data and information across devices like Apple and Google intend to do, the UK will pool its information in a single database operated by the NHS. The UK government argues that this will provide a greater insight into the transmission of Covid-19 and warn of the most at-risk users.
Many academics, security researchers and privacy groups working to restrict government data collection argue that this will cause new issues in the area of state surveillance – the UK government has previously suggested that other organisations will be allowed to use the data and information that has been collected for future public health research. This is something that Apple and Google forbid; and another reason the UK has had to build its own app without the help and guidance of such companies. Many are concerned that, upon emerging from the current crisis, a tool will have been created that enables widespread data collection on the population, or on targeted sections of the population, for surveillance.
Some experts have raised concerns that patient confidentiality is being compromised through the handling of extremely sensitive data, like location data, on a very large scale. Researchers have already identified problems with the app, particularly with storing unencrypted data on handsets and weaknesses in the registration process that could allow attackers to steal encryption keys . Matt Hancock, British Secretary of State for Health and Social Care, has claimed that the data would only be held for as long as required, according to the highest security and ethical standards, and any user-to-user information will be anonymous. However, an early draft-memo from the UK government has indicated that such an app will potentially be able to de-anonymise the data to enable the government departments to identify individuals and their smartphones. Does this mean that the data was never anonymous in the first place? Surely this creates a significant risk of compromising a vast amount of private data. The dangers of storing both the location and health status, of what could potentially be every person in the country are huge.
In fact, critics also claim that the British app will not work effectively unless it uses code provided by Apple and Google. An Australian app with a similar design was criticised for its technical problems; Germany recently switched to support the Apple-Google requirements, as also used by Switzerland, Austria and Italy. Many experts agree that there is no way to build a contact-tracing app without the help of Apple and Google who are moving extremely fast and are capable of providing a unified system that works across borders, that is already in use by a lot of countries.
A further branch of the problem is the viability of the app’s usage. Both Google and Apple input restrictions on how apps can use Bluetooth in both iOS and Android by blocking devices from pinging on another, even in close quarters, if the phone is locked or the app is closed. This drastically reduces the effectiveness of any contact-tracing app. Although Google and Apple can rewrite such rules for their own contact-tracing app, because they control the operating systems, it means that it is far harder for individual countries like the UK to overcome such problems themselves. The UK government has implied that it has resolved such issues, claiming that it is possible for such an app to work in urban environments that have a mix of old and new iOS devices in constant use, but this still remains a long way from the reliable mechanism that is so necessary to trace the spread of a deadly disease.
“A prerequisite of a successful app must be free, or at least affordable, Covid-19 testing that is widely available to the entire population on a large-scale”
In addition, Bluetooth contact-tracing is not consistent with the possible infectivity range, which is not limited to two metres and cannot pass through physical barriers like walls and ceilings, unlike Bluetooth connection. Thus it will likely miss most of the potential infection vectors as well as provide considerable false positives.
South Korea has taught us that, to be most effective, contact-tracing relies on widely available testing, so a prerequisite of a successful app must be free, or at least affordable, Covid-19 testing that is widely available to the entire population on a large-scale. It is crucial that such testing be available prior to the use of a contact-tracing app – otherwise, it is merely unchecked surveillance that cannot provide sufficient or valid information to users or public health services. Even the initial target for tests-per-day in the UK – 100,000 – falls far below the required testing capacity for an effective contact-tracing app.
And what happens if people refuse to self-isolate upon receiving an alert? Of course, Britain is not likely to force people to quarantine against their will. But perhaps a live nurse who has manually contact-traced a transmission is more persuasive than a text message?
In such a vein, it can be agreed that public health services are already very good at contact-tracing using the traditional, conventional, manual methods due to the great deal of experience in tracing the spread of other infectious diseases. Surely the support and resources should be directed towards these already existing and effective practices?
A tracking app will, in the best-case scenario, have limited efficiency and in the worst-case scenario, give people a false sense of security leading to another wave of infections. If it is not properly managed it will create the danger of more abuses and greater vulnerability than before: I am unsure whether experimenting with such untested technology and wide power afforded to the government is a good idea during a crisis. As Carly Kind, director of the Ada Lovelace Institute, stated, “A bad app is definitely worse than no app”.
Featured photo by Daria Nepriakhina