NHS officials are racing to introduce greater privacy safeguards for the contact-tracing app at the centre of the government’s lockdown exit strategy amid mounting concern from security experts, MPs and users.
Whitehall sources conceded to the Guardian that they were “two steps behind in public engagement” because the app – which tracks everyone a user has met and warns them to self-isolate when the user reports Covid-19 symptoms – has had to be developed at high speed.
It plans to complete the appointment of an ethics board to improve oversight and publish the software source code in the next month, and has not ruled out “a sunset clause”, agreeing to delete all data collected once the country returns to normal.
On Monday, Matt Hancock announced that the NHS Covid-19 tracing app would be tested on the Isle of Wight this week before being deployed around the UK by the end of the month to monitor and contain future outbreaks.
But there are growing worries about public take-up after security specialists and MPs raised concerns, in particular over the central database which will contain anonymised records of those reporting symptoms and who their phone has come in contact with.
Robert Hannigan, a former director of the government’s intelligence and security organisation, GCHQ, said while he thought the app was “not a threat to individuals” because it only recorded a person’s postcode alongside a unique reference number for each phone, it was right that the exercise in surveillance should be reviewed after the crisis.
“My own feeling is that this should be time limited. So, at the end of the pandemic we need to pause this experiment and have a proper public debate, and parliamentary debate, about the use of these apps in the future,” he said.
A former chairman of the culture media and sport select committee, Damian Collins, wrote to Hancock, the health secretary, with a series of questions arguing that it was “vital there is a high level of support” for the app, which required “reassurances to be given about both its effectiveness and the processes for controlling the data gathered by it”.
The Conservative MP asked whether the app and data collected “would be destroyed at the end of the pandemic”, as Australia has agreed to do, to prevent it being used for other purposes by government.
The app has been developed by NHSX, a digital unit jointly under the Department of Health and the NHS. Those involved say that any data collected – a unique monitoring of the British population – will not be shared with any other government departments or private companies.
Retaining some information in a central database has been deemed necessary because it allows the NHS to track regional outbreaks and obtain information about the future spread of the disease. Google and Apple have tried to promote an alternative database-free decentralised approach, which was rejected by the UK.
Ministers want 60% of the population to download the app in order for it to be most effective in monitoring coronavirus outbreaks, but insiders concede that it may be taken up by somewhere closer to 20% at first until concerns about monitoring and privacy are properly dealt with.
Prof Lillian Edwards, a specialist in internet law from Newcastle University, said that while the contact data being retained was described as anonymous, it was nevertheless personal – and that she was concerned that members of the public would not have the right to have it deleted.
“That’s a basic right under our privacy rules – the famous right to be forgotten – and it shows up some basic problems with the centralised architecture,” she added.
But Raab said at the government’s daily press conference that the UK wanted to develop its own bespoke technology, and had taken appropriate security advice. “The reality is we want the app to be focused on the UK and we want the technology to be tailored to make sure we can deal with the specific challenges we’ve got in this country,” he said.
“We’ve worked with the experts we’ve got at the National Cyber Security Centre to make sure we’ve got the greatest protections on things like privacy.”
Technical experts also raised concerns. Smartphone operating systems impose strict limits on normal apps that prevent them from infringing user privacy, harming performance, or breaking other apps.
Those limits affect the operation of the NHS’s centralised app: on iPhones, for instance, the app will stop broadcasting its identifier when another app is being actively used, and will only start broadcasting if it hears another identifier first.
That means two iPhone users sat next to each other on a train, both playing the game Candy Crush, would fail to register as a contact, unless a third phone was nearby with the app open.
“On iOS, there are background services issues,” says Graeme Scott, founder of critical intelligence platform Synoptic. “The issue the NHS has is that this is a 24-hour situation, dealing with background services when you can’t have certain functionality available. Which then begs the question: how reliable it will be?”
On Tuesday, the deputy chief scientific adviser, Prof Angela McLean, praised South Korea for its track-and-trace system, which it rolled out in March. The country has a population of 51 million and 245 deaths from coronavirus, while Britain, with a population of 66 million, has a death toll of more than 29,000.
“Find people who have symptoms, get them tested, find good quick reliable ways to find people they have been in contact with and ask them to go into quarantine,” McLean told the daily government press conference.
“That is the strategy that has worked in South Korea and South Korea is really the place in the world we can look to and say ‘this worked’. They did have quite a big outbreak actually that they brought under control with contact tracing so I think they are a fine example to us and we should try and emulate what they’ve achieved.”