Contact tracing: The app is 'urgent and important', but there's still no launch date in sight
The UK's contact-tracing app is still not set for national launch anytime soon, despite recognition that the technology might provide a welcome helping hand for the country's manual virus-testing program.
Speaking at the parliamentary Science and Technology Committee meeting, Simon Thompson, the newly appointed managing director of the NHS COVID-19 app, admitted that he could give no specific date for the app's launch, and gave no evidence that the tool would be released in time to cope with a potential second wave of infections.
Digital Transformation
"We really recognize that the introduction of the app is urgent and important, but it has to be a product that people can trust," said Thompson. "We are leaving no stone unturned to make sure we can accelerate at pace, and have a product that works that we can put in the hands of our citizens to make sure they have the maximum freedom and minimum risk."
SEE: COVID-19: A guide and checklist for restarting your business (TechRepublic Premium)
Thompson's sentiments were echoed by Baroness Dido Harding, chair of NHS Improvement, who highlighted that the organization could not commit to "a particular date", since the development of the app is currently "ongoing".
NHSX's contact-tracing app was announced last April and trials for the technology started on the Isle of Wight in early May, with an initial launch date scheduled for a few weeks later. It has since emerged that the tool ran into technical difficulties, and its release has been postponed indefinitely.
The UK health services started off with a so-called centralized design for the app, which is at odds with the decentralized Bluetooth-based contact-tracing API option that Apple and Google have made available for iOS and Android.
The decision to snub the tech giants' protocol led to various technical glitches, and eventually the government decided to ditch the original design in favor of a "hybrid" model that would include elements of both centralized and decentralized models.
It is still unclear what the new app will be used for, and what exactly such a "hybrid" model entails. The UK is now running behind several European counterparts, including France, Germany and Italy, which have now successfully launched their own contact-tracing technologies.
"That's not something we think anyone in the world has working at a high standard enough, that if we receive an electronic message telling us to self-isolate, we will trust it," said Harding. UK Prime Minister Boris Johnson recently made a similar claim that no country in the world has a working contact-tracing app.
Michael Veale, lecturer in digital rights and regulation at University College London, said that it is still too early to tell if the technology deployed in other countries is effective.
"No country has a functional app in the sense that there hasn't been a retrospective peer-reviewed study six months on because we haven't had six months that have passed," said Veale. "But many countries have an app that they believe works functionally based on Bluetooth."
Veale is a co-developer of an open-source protocol called DP-3T, which Apple and Google adapted for their decentralized API. As examples of success, he pointed to the SwissCovid app released in Switzerland, and to Germany's Corona-Warn app, which has now been downloaded by 15 million users – both of which are based on the tech giants' API.
Decentralized apps have been pitched as more privacy friendly, as they keep users' Bluetooth data on their device until they decide to report having tested positive to COVID-19. In contrast, in a centralized model such as the one originally designed by NHSX, all Bluetooth interactions are sent to a central database managed by public health authorities.
SEE: Contact-tracing app: How did the UK go so badly wrong?
For that reason, Veale said that he was confident that the UK's new app will be a more trustworthy system than its earlier version. He nevertheless stressed the need to subject the technology to intense security and privacy scrutiny, whichever shape it takes.
For example, Lilian Edwards, professor of Law, Innovation and Society at Newcastle University, recently proposed a bill setting legal safeguards for the future app. This includes, among other suggestions, ensuring that no one can be penalized for not using the app, or that personal data be deleted or anonymized as soon as possible once the period of crisis has ended.
The proposals are yet to be implemented, and Veale said that there is a risk that they could be overlooked.
The UK government started a manual contact-tracing program one month ago, and still hasn't carried out the mandatory Data Protection Impact Assessment (DPIA) before it was launched. The Open Rights Group (ORG) has since threatened to take legal action if the privacy checks aren't processed as legally required.