Everything you need to know about the NHS Covid-19 tracking app

Test, track and trace. That’s the UK’s new mantra for fighting coronavirus and easing the lockdown restrictions. Central to this effort is the NHS Covid-19 contact tracing app – a new digital tool that will, officials hope, dramatically slow the community transmission of coronavirus by tracking each and every case of it. As well as the contact tracing app, the UK is also recruiting thousands of human contact tracers and continuing to increase its testing capacity. Central to all this is the R transmission number, which officials need to keep as low as possible to ensure there isn't a second wave of infections.When combined each of these steps will help officials ensure they can safely ease lockdown measures. But how will the NHS Covid-19 contact tracing app work and when will people be able to download it? Here’s what you need to know about the app. So what is contact tracing? Contact tracing is a well-established method for controlling the transmission of conditions – for instance, it is used with sexually transmitted diseases, including HIV infections. The process involves a person who is infected recounting their movements and activities to build up a picture of who else might have been exposed. This is crucial with Covid-19. The virus is highly infectious, symptoms can take several days to first appear and people may also be asymptomatic, passing the virus on without knowing they are carrying it. Contact tracing done by humans involves an interviewer asking a person who is infected where they have been and who they have been in contact with. From here it’s possible to get in touch with those people who potentially have the virus and ask them to be tested or self-isolate. How does the NHS Covid-19 app work? Contact tracing apps aim to automate the human process – using the phone in your pocket. More than 30 countries are building tracing apps and the UK is no different. Its tracing software – the NHS Covid-19 app – is getting closer to launch. The first major tests of the app are due to start on May 7 on the Isle of Wight. The island has been picked as a testbed before wider rollout across the UK. "It’s highly unlikely the Covid-19 virus is going to go away," says Jonathan Van-Tam, England’s deputy chief medical officer. "Testing and contact tracing is going to have to become part of our daily lives in the future." The tests on the Isle of Wight could result in how the app is being tweaked before it is used more widely across the UK. Matthew Gould, the CEO for NHSX, the technology arm of the NHS, says the logic for creating the app is clear: it can potentially allow cases to be identified earlier and reduce the spread of the coronavirus. READ NEXT What is the coronavirus R number and why is it important? What is the coronavirus R number and why is it important? By MATT REYNOLDS The app itself works using Bluetooth signals. Bluetooth technology within phones, which has to be turned on at all times, broadcasts an identifier that is unique to that device. The identifier is essentially a random string of numbers that updates on a regular basis and doesn’t include any personal information. When your phone is near another Bluetooth device the two will exchange their identifiers. A list of all the devices, in the form of their unique codes, are stored on your phone for 28 days. Nothing else happens unless a user indicates that they are experiencing coronavirus symptoms. There is very limited functionality within the app. The only thing that users can do is report if they have Covid-19 symptoms. Within the app there is one central question: "how are you feeling today?" If you feel unwell you tap on the prompt and are asked whether you have a high temperature and a persistent cough. (Both are defined within the app). You are also asked to select which date the symptoms started. Having both of these symptoms indicates a person may have coronavirus and this information can then be sent to the NHS. Users will then see a link that tells them to follow health advice – such as self-isolating – and potential details for testing. When a user submits they have symptoms, the health service’s technology will determine whether the people they have been nearby need to be notified. This is done with a risk algorithm and not everyone will instantly be notified. What data does the NHS app collect? The government and NHS have been keen to stress that the app doesn’t collect user data that could identify an individual. Location data is not collected as GPS technology is not used and the app does not ask for a user’s name or other personal information. This extra information will be required if a person reports they have symptoms as they will need to be tested for coronavirus. There are a few pieces of information the app does collect. When you first download and use the app you will be asked to enter the first half of your postcode. Officials say this is to allow the NHS to track the spread of coronavirus. The app will also record what phone you are using and information around Bluetooth usage. This includes the unique IDs of the devices you phone has interacted with. It also includes both how long devices were communicating and how strong the signal between the devices was. A stronger signal should, in theory, mean you were closer to an infected person. Health officials hope that these pieces of data can be combined into coronavirus modelling to help understand more about how the virus spreads. While the app has been created to collect as little user information as possible, this doesn't mean there could be challenges faced. "There are some downsides to our approach though," Ian Levy, the technical director of the National Cyber Security Centre (NCSC), an arm of GCHQ, has said in a blog post. "For example, the system ends up with a list of devices that have been near each other, even though they're anonymous." The system knows that device 123456 and device ABCDEF, for instance, were near each other on a set of dates when one of the device owners reports their symptoms. "In theory, that's a privacy risk, but it's only stored on the NHS app system and there's no way to link device 123456 to 'Ian Levy' or a particular place," Levy says. "If you discover that my app ID is123456, there are some theoretical things you can do to try to understand my contacts if you've followed me round. But if you've followed me round, you've probably seen my contacts anyway." He adds the attack type couldn't be done remotely. Levy says the front end of the system will see a person's IP address but the NHSX system does not. "The cyber security monitoring of the system keeps logs which include IP address, but they're strictly access controlled and are only accessible to the cyber security team looking after the app system." Do I have to download the app? The app is voluntary. There is no obligation to download or use it, NHS and government advisors say. But the more people that download and use it, the more effective it could be in helping monitor the spread of the virus and easing lockdown conditions. READ NEXT How New Zealand put coronavirus on the brink of elimination How New Zealand put coronavirus on the brink of elimination By DAVID COX Academics from the University of Oxford say that at least 60 per cent of people need to use it for it to effectively reduce coronavirus spread. There are concerns within the NHS and government that not enough people will use the app. "This is new technology, lots of people, lots of countries are trying it because we think there is potential," Gould says. "The level of impact of the app does depend on the level of the uptake." If someone decides to delete the app then any data they have not sent to the NHS will be deleted. Are Apple and Google involved? Not directly. The UK government has decided to build a centralised app, rather than using a decentralised approach that Apple and Google have teamed up to create. This approach makes the UK a slight outlier as the majority of countries are using the protocols created by Apple and Google. Japan and France are also building centralised versions of contact tracing apps. The UK’s centralised app is less privacy-focussed than decentralised apps built on Apple and Google's framework, critics argue. While the NHS app does not collection personal user information, such as location or names, when people say they may have coronavirus symptoms the data about the number of devices they have been in contact with, plus the signal strength and signal duration, are transmitted back to a central, anonymised database. In the Apple-Google system, no information is transferred to a database. Gould says his teams have been talking with and working with Apple and Google even though they have not selected their system. Gould says there was a lot of thought around whether the NHS Covid-19 app should be centralised or decentralised. Ultimately, he says, the decision was taken as it gives more control over the system to the NHS and UK officials. They will be able to build on top of their own system. READ NEXT What if it takes a really long time to develop a coronavirus vaccine? What if it takes a really long time to develop a coronavirus vaccine? By VICTORIA TURK Will the app work? At present there is very little evidence that contact tracing apps will be a success. This is because using Bluetooth for contact tracing has not been done before and the first apps to be rolled out are in their very early stages. There are concerns around the accuracy of Bluetooth, how many people will use the apps and people hacking underlying databases. The NHS says the NCSC has been advising on the creation of the app. The concerns around the technology does not mean that it won’t be useful. It is hoped that contact tracing apps will be a valuable addition to other ways to manage and control Covid-19 cases. (These include wide-scale testing and the human contact tracing). What's next for the app? The test on the Isle of Wight is just the first stage. As long as the tests are successful, the technology is likely to be rolled out more widely over the coming weeks. No date for a rollout across the UK has been given. Contact tracing will be crucial until a vaccine is found, meaning that app-based tracking is here for some time yet. Gould says future versions of the app are likely to include options for people to provide more information to the NHS, such as their exact locations, collected through GPS technology, of where their contacts with others took place. This isn’t a feature in the app at present but Gould adds if it does get added it will be clearly explained to people and they will have to opt into this. Security and privacy researchers worry that contact tracing apps could suffer from "mission creep". They’re concerned that more features will be added to the apps over time and make them vehicles for mass surveillance. “It is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance,” a group of almost 200 UK-based researchers wrote in an open letter published before the launch of the NHS app.