Coronavirus: Scotland refuses to join NHS contact tracing app

Fears were raised today that the new NHS coronavirus contact tracing app only ‘half-works’ on iPhones after experts claimed it can only effectively operate on the devices if the screen is unlocked.

The ‘NHS Covid-19’ app is a key piece in the UK Government’s plan to get the country out of lockdown and back to work and will need at least 60 per cent of the nation to download it for it to be effective.

But another series of concerns about the app have been raised today, after experts yesterday warned that it was open to abuse because it lets users trigger alerts to all their contacts themselves simply by telling the program they feel unwell. This could lead to chaos if too many people ‘cry wolf’ and trigger a slew of false alerts.

Now an expert has claimed that the NHS app only half works on iPhones – because its Bluetooth technology only ‘listens’ for other phones when the handset is locked and does not broadcast its status. It means that when two iPhones with the app are together, they will not record contact.

The joint Google and Apple technology in the tech giants’ own contact tracing app fixes this flaw, but the NHS app does not use this software.

In another potential flaw, residents on the Isle of Wight taking part in the trial told Mail Online that the app appeared to drain their phone’s battery life at a faster rate while others on the island said that privacy fears made them reluctant to download the app.

And the Scottish government also dealt a potential hammer blow by saying it will only commit to the technology if it is shown to work and is secure.

Dr Michael Veale, a lecturer in digital rights and regulation at University College London, told MailOnline that the app ‘only half-works on iPhones’.

He added: ‘This is because the UK has decided, unlike countries such as Ireland, Germany, Austria, Switzerland, Estonia and more, to not use the new decentralised building blocks Apple provides in its new iOS 13.5 operating system next week.

‘In particular, iPhones are only able to ‘listen’ when they are locked, and not to reach out to other phones. To talk to another phone and register a contact, they need a phone that can reach out to prod them and ‘wake’ them up, or they won’t spot them.

NHS worker Anni Adams looks at the new NHS app on her phone on the Isle of Wight today

How will the NHS app work?

The NHS is rolling out its new coronavirus track-and-trace app today for testing across the Isle of Wight. This is how it will work

STEP ONE: DOWNLOAD THE APP

Britons will be able to download the app for free from the Department of Health website.

It is also available via the Apple and Android app stores or via a link sent by email to NHS and public sector workers.

It is being tested on the Isle of Wight before a potential roll-out across the country, probably one region at a time.

STEP TWO: PROVIDE A PARTIAL POSTCODE

To register the person will be asked to provide the first half of their postcode, which shows the NHS the town or borough they live in – but not their name or their exact home address.

The user will be asked to allow the app to use the phone’s bluetooth to keep track of other phones it comes in to close to and for how long for.

The NHS insists it will not be tracking location data – only phones

But while the Government has said ‘your postcode will not be used to track your location’ – it is less clear if they also mean your location will not be tracked at all.

STEP THREE: KEEP YOUR PHONE ON

The user will be told to keep their phone and Bluetooth switched on at all times and the app will run in the background without them doing anything.

The user will also be asked to allow ‘push notifications’ – which allows the NHS to send a person messages directly to their phones.

When an individual goes out, the app will keep a log of every time it comes within Bluetooth range of another phone – but that person must also have the app.

All IDs will be anonymous, with each app registered to a code rather than a person or address.

STEP FOUR: REPORT YOUR SYMPTOMS IF YOU BECOME ILL

If someone becomes ill they will be asked to log on to the app and input it. They will be asked if they have the common symptoms of coronavirus such as a high temperature and a continuous cough.

If no, nothing will happen. If yes, they will be told to order a coronavirus test.

STEP FIVE: APP SENDS YOUR DATA TO THE NHS SERVER FOR ANALYSIS BY EXPERTS

If it is a suspected coronavirus case, these symptoms and the anonymous IDs of all the phones the user has come into contact with are automatically sent to an NHS server.

The NHS will analyse the data sent by the original sufferer using an ‘algorithm’ based on distance of between one and two metres, and the amount of time, probably around ten to 15 minutes.

STEP SIX: NHS SENDS AN ALERTS TO CONTACTS

It will then alert app users who have been in ‘significant contact’ with the original person with symptoms.

In early versions of the app, this warns the user that they have been in contact with someone who has reported symptoms and should self isolate.

If the original sufferer tests positive, everyone they have been in contact with will receive a stronger ‘red’ alert telling them to go into quarantine. The original sufferer triggers the red alert by entering a PIN issued by the NHS after they test positive.

The Department of Health has not revealed exactly what the alerts will say. The Department of Health says: ‘The app will advise the public what action to take if a user has been close to someone who has become symptomatic. The advice on what people should do can be adapted as the context and approach evolves.’

The app will calculate how at risk a contact is by measuring their exposure to the person with symptoms. It will measure exposure by time and proximity. The NHS analysts will set the risk parameters that trigger alerts.

STEP SEVEN: ORIGINAL SUFFERER CONTACTED BY HUMAN NHS CONTACT TRACERS

The app will issue the original person with symptoms instructions on how to get a test using the software.

One of around 10,000 UK human contact tracers may also get in contact on the phone and ask the app user how many people are in their household, where they have been and who they have been close to, that they know of, to find people who may not have been picked up by the bluetooth.

They will also try to contact these new contacts if required.

STEP EIGHT: SUFFERER IS TESTED

Once the Covid-19 test arrives at the person’s home they will be expected to swab and then put it back in the post to an NHS testing centre. They may also be eligible for a home test by a health worker or visit one of the country’s test centres. The result should be available within 48 hours.

There are then two possible outcomes:

• The person tests negative. In this case, your contacts are told via a message that it was a false notification.

• The person tests positive. In this case, your contacts are asked to isolate for 14 days, and get them into the clinical testing path.

STEP NINE: HUMAN CONTACT TRACERS CONTACT AT-RISK CONTACTS OF ORIGINAL SUFFERER AND PLOT HOTSPOTS

The NHS’ army of human contact tracers will contact app users who have been in ‘significant contact’ with the original person with symptoms will be alerted through the app. They will provided with ‘health advice’ – which may include self isolation – based on the NHS’ assessment of their level of risk. Not everyone who has been in contact will be alerted based on the NHS algorithm. This advice will be constantly modified by doctors based on the current siutuation.

‘When two iPhones users are together, as they are both only listening, no contact will be made or recorded. It is only if there is a nearby Android phone present that the phones can be nudged to ‘wake up’.’

The same issue was faced by Singapore, which was the first country to try a contact tracing app. TraceTogether gained only a 20 per cent uptake with many users finding their iPhone had to be unlocked for it to work properly.

Another technology expert, Timandra Harkness, author of Big Data: Does Size Matter?, told the New Statesman that the app ‘wouldn’t work with the phone locked or while you are using it for anything else’.

She added that a friend in Singapore found this to be an issue on the TraceTogether app, which meant that ‘you have to leave it on and … ‘upside down’ in your pocket to go into Low Power mode.’

If a person with the app reports Covid-19 symptoms, a risk score for an interaction is calculated based on the distance between devices, how long they were in contact for and the infectiousness of the person at the time.

It comes as the Scottish government dealt a potential hammer blow to Health Secretary Matt Hancock’s app after saying it will only commit to the technology if it is shown to work and is secure.

Nicola Sturgeon has said she is ‘cautious’ about the app and has stressed Scotland’s approach to stopping the spread of the disease will be more ‘old fashioned’. Meanwhile, Professor Jason Leitch, Scotland’s national clinical director, said he will only download the app ‘once I’m confident that it works’ and the ‘security is good’.

In other developments in the UK’s coronavirus battle today:

Britons could spend four days working in the office and the next ten working from home in radical new plans put to the government today.
Another 436 people were last night confirmed to have died of COVID-19 in England, Scotland and Wales, taking the number of victims past 29,000 and making Britain the worst-hit nation in Europe;
The scientist nicknamed ‘Professor Lockdown’ who convinced Boris Johnson to impose the coronavirus shutdown quit his Government role after it was revealed he flouted the restrictions he helped craft by holding secret trysts with his married lover;
The Foreign Secretary dashed hopes of a widespread return to school after half-term, warning that it was too soon to even consider the move;
Nicola Sturgeon has again jumped the gun on Westminster by revealing Scotland’s provisional ‘exit strategy’ from the coronavirus lockdown. The First Minister released a 27-page plan for how the loosening might happen north of the border, days before the PM is expected to unveil his ‘road map’ on Sunday.

Should Scotland refuse to recommend the app it will undoubtedly hit the UK government’s efforts to hit the 60 per cent threshold.

It came amid growing concerns over the way in which the app works and the data it will collect with experts warning Mr Hancock it is ‘almost inevitable’ he will face a legal challenge.

Civil liberties campaigners and barristers are demanding the government legislate to restrict the way in which the data collected by the app can be used.

Some are concerned that the lack of regulation could result in the movement of people data eventually being used to identify anyone who is not sticking to social distancing rules so they can be punished.

The UK government has insisted so-called ‘shoe leather epidemiology’ will be part of its ‘test, track and trace’ programme with 18,000 staff due to be recruited – but the app will be integral to its success.

It began to be trialled on the Isle of Wight this week with a view to then rolling it out nationwide in the coming months.

Willoughby Matthews, 21, from Cowes, who has now got the app on Android, told MailOnline: ‘I downloaded the app last night, so far it’s been alright.

‘It has had a slight effect on the battery life but not as bad as I was expecting. It’s fairly user-friendly, once downloaded you just put the first part of your postcode in, then you’re asked to give location permissions.

‘Bluetooth has to remain on all the time, if you try and turn it off you get a warning message, which is a bit annoying, but you get used to it. You can’t do much with it, apart from push the ‘I feel unwell’ button, so I’d say it’s very user friendly.’

The proportion of Apple IOS to Android users in Britain is roughly 50:50, while 75 per cent of people responding to a poll in the Island Echo said they intended to download the app.

The results of another online survey carried out by Isle of Wight Radio were similar – showing that 79 per cent of respondents said they would download it while 21 per cent said they would not.

The Isle of Wight’s population is about 140,000, meaning more than 100,000 people could download it.

Isle of Wight resident Omar Lakhssassi told LBC News: ‘It’s caused a bit of a split opinion across social media here on the Isle of Wight.

‘Many people including myself are very happy to download this app and to try and make a difference to the data recording so the Government can track and trace people that have Covid-19 symptoms.

‘I’m hoping that it will enable us to come out of the lockdown sooner rather than later on a national level.

‘Some people though are quite dubious – they are worried about their privacy being breached, and very vocal on social media, saying they won’t download this app.

‘Personally I’ve got no problem downloading the app, having read the guidance it is very anonymous, it doesn’t ask for my personal details, it doesn’t ask for my name, or my email address or even my phone number.

‘It just asks for the first four digits of my postcode and just asks three simple questions on how I’m feeling.

‘And I believe that if the symptoms are consistent with coronavirus, it will alert me to getting a test and hopefully that will limit the impact I will have on other Isle of Wight residents.’

And Oliver Dyer, from Isle of Wight Radio, told the BBC: ‘We’ve got a high elderly population over here, some people who don’t have iPhones, and they’ve raised concerns on how they’re supposed to download the app, how they’re supposed to get behind this scheme.’

The app, developed by NHSX, works using bluetooth which logs whenever someone is within two metres of someone else for more than 15 minutes.

People will be told to tell the NHS when they develop coronavirus symptoms and at that point the data collected by the app will be used to contact everyone the infected person has been close to in recent weeks.

The Government has insisted that all data will be completely anonymised, with Mr Hancock rejecting claims the app could open the door to ‘pervasive state surveillance’. He said that was ‘completely wrong’.

But the Health Secretary is facing an uphill battle to win over critics of the initiative after the UK adopted a different path to other European nations.

Britain’s app will see contact information held centrally by the NHS with ministers arguing this will speed up the tracing part of the programme so that people can be tested quickly.

But other European nations are using decentralised apps, one of which is backed by Google and Apple, which see phones communicate directly with each other.

Artificial intelligence firm involved with NHS worked with Dominic Cummings on Vote Leave

An artificial intelligence firm involved with the NHS’s coronavirus response was hired to work with Dominic Cummings on the Vote Leave campaign, it has emerged.

The London-based firm, Faculty, has also been awarded at least seven government contracts worth nearly £1million in only 18 months, reported the Guardian.

Cabinet Office minister Theodore Agnew has a £90,000 shareholding in the company – and Faculty’s chief executive Marc Warner was present at a meeting of the Scientific Advisory Group on Emergencies (Sage).

Faculty is working with NHSX – which is behind the new NHS app – on a project to create a data store system that brings multiple data sources into one secure location. However the firm said is not involved in the new app.

Faculty has previously supplied data science services to the Vote Leave Brexit campaign, which Mr Cummings ran before he became chief adviser to Prime Minister Boris Johnson.

Experts believe this approach is less likely to face a legal challenge because the data is not stored centrally.

Barristers told the Telegraph that the UK’s app proposes ‘significantly greater interference with users’ privacy’ and as a result it will require ‘greater justification’.

They argued the government is yet to justify its approach and that it is ‘almost inevitable’ that legal proceedings will be brought against it with the potential for a protracted court battle.

The fact the UK has chosen a different path to many other European countries has sparked fears that the different systems will be incompatible.

That could result in Britons having to unnecessarily quarantine themselves for 14 days when travelling to another country.

But Mr Hancock said misunderstandings about privacy issues with the UK’s contact tracing app are making it harder to fight coronavirus.

Amnesty International UK has been among the voices to share their fears that privacy and rights could become another casualty of the virus as a result of the app, while a group of UK academics working in cyber security, privacy and law recently signed a joint letter saying it could open the door to surveillance once the pandemic is over.

The Government has refuted such suggestions, saying data is kept on a person’s smartphone and can only be shared with the NHS when the individual decides, if they are displaying symptoms and request a test.

The UK now has more confirmed COVID-19 deaths – according to backdated statistics from the Office for National Statistics, National Records Scotland, and Northern Ireland’s NISRA – than any other country in Europe

How is the NHS tracing app different to one made by Apple and Google?

The app technologies developed by Google/Apple and the NHS are based on the same principle – they keep a log of who someone has come into close contact with – but the way they store data is the main difference. The NHS’s keeps information in a centralised database, while the Google/Apple app is de-centralised.

NHS app: Lists on NHS servers

The NHSX app will create an alert every time two app users come within Bluetooth range of one another and log this in the user’s phone.

Each person will essentially build up a list of everyone they have been in ‘contact’ with. This will be anonymised so the lists will actually just be numbers or codes, not lists of names or addresses.

If someone is diagnosed with the coronavirus or reports that they have symptoms, all the app users they got close to during the time that they were considered infectious – this will vary from person to person – will receive an alert telling them they have been put at risk of COVID-19 – but it won’t name the person who was diagnosed.

NHSX insists it will delete people’s data when they get rid of the app.

Apple/Google: Contained on phones

In Apple and Google’s de-centralised approach, meanwhile, the server and list element of this process is removed and the entire log is contained in someone’s phone.

That app works by exchanging a digital ‘token’ with every phone someone comes within Bluetooth range of over a fixed period.

If one person develops symptoms of the coronavirus or tests positive, they will be able to enter this information into the app.

The phone will then send out a notification to all the devices they have exchanged tokens with during the infection window, to make people aware they may have been exposed to COVID-19.

The server database will not be necessary because each phone will keep an individual log of the bluetooth profiles someone has come close to. These will then be linked anonymously to people’s NHS apps and alerts can be pushed through that even after the person is out of bluetooth range.

It is understood that if someone later deletes the Google/Apple app and closes their account their data would be erased.

Will NHS benefit from central data?

If the NHS collects the data it may be able to use it as part of wider contact tracing efforts as well as being able to detect local outbreaks using location data.

In future, if someone is diagnosed with COVID-19, members of an army of 18,000 ‘contact tracers’ will be tasked with working out who else that patient has come into contact with and put at risk.

It is not clear how much access the human contact tracers will have to data collected through the app.

Speaking to Sky News, the Health Secretary said concerns that the app could track people are ‘wrong’ and ‘not based on what’s happening in the app’.

‘I haven’t yet seen a critique based on privacy that is accurate or based on actual understanding of what the app does, so if anybody… has those concerns or is proposing to write about them, I would suggest that they go and look at what the app actually does before doing so,’ he said.

‘Because if you are spreading those sorts of stories and discouraging people from downloading the app, then what you’re actually doing is making it harder for us as a community to fight this virus.

‘I’m being quite robust in my response to these critiques because we have taken the concerns into account.’

Mr Hancock reiterated that an ethics advisory board will oversee the app, and there are plans to publish a data protection impact assessment and the source code for public scrutiny.

One of the key issues has been around the decision to take a centralised approach, meaning when a person chooses to share their data it is sent to a computer server anonymously, instead of staying between smartphone devices, known as decentralised.

Professor Michael Parker, a member of the Government’s Sage advisory group and an NHS adviser on the app, told BBC Radio 4’s Today programme: ‘The advantage of a centralised system is that we want our health system to be coherent, we want it to work in a way that is intelligent.

‘And we want the NHS to be taking control of this. We don’t want, I think, our health system to be managed by tech companies in a way that is potentially disconnected.

‘I would argue that we really want an integrated system that is centralised but carefully managed and in an approach that treats patient information in a way that is appropriately depersonalised.’

Former deputy Labour leader Harriet Harman has called for legislation to protect the personal data of those using the NHS coronavirus app.

Meanwhile, there are also fears the UK app could be abused because it is reliant on people reporting symptoms.

Experts believe mischievous pupils could falsely report having symptoms in order to shut down schools or disaffected workers could do the same to try to get firms closed.

Jim Killock, the executive director of the Open Rights Group, said: ‘Someone might feel that they are fed up with their boss and want to cause some trouble so they self-report and get half of the work force sent home to self-isolate.’

Lawyers are also concerned that the app is not underpinned by its own legislation.

Some civil liberties campaigners are concerned that the lack of regulation could see the data collected being abused in the future.

For example, they fear the data could be used to show who has been breaking social distancing rules with punishments then being dished out.

Legal experts have put forward a draft bill which would set ‘basic safeguards’ on how the app could be used in the future.

Those safeguards would include a guarantee that no one would be penalised for not having a phone, for leaving their house without a phone and that no one will be ‘compelled’ to install the app.

Concerns have been raised about the safety of the NHS holding such sensitive data given the fact the health service has previously been targeted by hackers.