COVID-19 , Data Masking & Information Archiving , Governance & Risk Management

NHS Reports COVID-19 App Success, Backed by Strong Privacy

Researchers: 'App Is Having a Positive Effect on Reducing the Impact of the Virus'
NHS Reports COVID-19 App Success, Backed by Strong Privacy
The U.K. National Health Service COVID-19 contact-tracing app for England and Wales (Source: NHS)

Good news in the fight to prevent COVID-19 infections: Researchers report that a digital contact-tracing app rolled out in England and Wales is helping to blunt the spread of the pandemic.

See Also: How Government Agencies are Improving their Data Collection Processes

They say their findings are clear evidence that everyone should continue to use the app - and similar apps worldwide - to help control the spread of the virus, especially during what are forecast to be difficult winter months.

"The app is having a positive effect on reducing the impact of the virus," the group of 13 researchers say in a paper that has been submitted for - but not yet undergone - formal peer review. The researchers do note, however, that "a number of independent scientists" have already reviewed the results.

Here are the findings: "We estimated that for every 1% increase in app users, the number of infections can be reduced by 0.8% (from modelling) or 2.3% (from statistical analysis)." In addition, the researchers estimate, with a 95% confidence interval, that the app has helped avert between 224,000 and 914,000 new infections in England and Wales from October to December 2020.

While such news is welcome, Britain continues to have one of the highest levels of COVID-19 infections in the world. Many public health experts have blamed the British government for a string of policy decisions and delays.

Contact-Tracing Apps

The contract-tracing apps being used in the U.K. - separate versions have been deployed in Scotland and Northern Ireland - run on newer Apple and Android devices and use Bluetooth to help detect other devices within range. If a user of one of those devices later tests positive for COVID-19, they can set a flag in their app, which is used to alert every other app user whose device was within range of the infected user for a specified duration of time when they were likely infectious.

The U.K. government originally proposed an app for England and Wales that would store all users' data centrally, despite numerous experts warning that unless they pursued a decentralized approach, with strong privacy and security protections, they risked not seeing a critical mass of users embrace the app, which remains optional to use.

Ultimately, U.K. Prime Minister Boris Johnson's administration made a U-turn and ordered the NHS app to work with APIs released by Apple and Google, which were released for use only by governments that committed to taking a decentralized, privacy-preserving approach.

The NHS COVID-19 app finally launched on Sept. 24, 2020. Since then, it has been downloaded to more than 21 million devices. It now has about 16.5 million users in England and Wales, according to the report. This amounts to "49% of the eligible population with compatible phones and 28% of the total population."

Public health experts say an app cannot replace a strong, manual test-and-trace program, which the U.K. has struggled to roll out.

But the researchers say the app has helped. "The main epidemiological impact of the app to date has been from the exposure notification function, which automates contact tracing from confirmed cases based on digital measurements of proximity events between phones," the researchers say in their report. "The app sent 1.7 million exposure notifications: 3.2 per index case, or 4.4 per index case who consented to be contact traced."

The researchers estimate that 6.1% of individuals notified by the app then tested positive for COVID-19, based on manual contact-tracing efforts finding that 7.3% of close contacts and 13.5% of direct contacts of someone who was infected would themselves later test positive.

Privacy by Design

The researchers note that the NHS app includes a number of features designed to maximize users' privacy, including a decentralized design, using obfuscation to hide patterns in network traffic, practicing minimal data collection, never tracking a user's location - for example via GPS - as well as using no identifiers, such as IP addresses.

The researchers also note that the app development team has been working closely with the country's privacy watchdog, the Information Commissioner's Office, which enforces the EU's General Data Protection Regulation, as well as the National Cyber Security Center, which is the public-facing arm of intelligence agency GCHQ.

All signs suggested that the app could help contain the pandemic - if enough people use it. "During the early stages of the pandemic, modelling and simulation based research suggested that 'a contact-tracing app … can achieve epidemic control if used by enough people,'" the researchers say. "We wanted to rigorously test and assess the strength of this assertion, using data from the NHS COVID-19 app."

Given the privacy-by-design approach, how could the researchers ascertain if the app is effective?

Per a data protection impact assessment of the app - as required by GDPR - they note that "the app allows some limited data to be collected - which are aggregated at the postal district level to protect privacy - to enable the app team to assess whether it is working as expected, to gain insights into the virus and to establish whether the app is impacting the spread of the virus."

Researchers: More Uptake Please

Based on the results of their study of the app's efficacy, the researchers have urged the government to help drive more users to embrace it.

"We believe that this evidence supports the need for the continued promotion, adherence and greater adoption of the NHS COVID-19 app (and other similar contact tracing apps around the world), to work alongside other non-pharmaceutical interventions, in order to help control the virus during these challenging winter months and beyond," say report co-authors Mark Briers and Chris Holmes, who are both program directors at The Alan Turing Institute - the U.K.'s national institute for data science and artificial intelligence - as well as Christophe Fraser, an expert on pathogen dynamics and big data at Oxford University, in a blog post published Tuesday.

"In summary: use the app, it works," the researchers say.

Briers said a further key to the app's success was improvements made to the app's "risk scoring component" in October 2020, which researchers say made the app more effective at alerting the right people at the right time.

But it's difficult to measure whether uptake was better because the U.K. ultimately chose to build an app that preserved users' privacy and prioritized data security, says Alan Woodward, a computer science professor at England's University of Surrey, who was one of a group of experts who had urged the government to take such an approach from the outset.

"But empirically, it seems reasonable to conclude that uptake was better because of the greater trust in the privacy of the app," Woodward says.

UK Government Slammed for Delays, Inaction

Despite the news that the app apparently has helped reduce the number of U.K. infections, the country nevertheless continues to have one of the highest levels of COVID-19 infections in the world.

The U.S. has recorded 27 million cases of COVID-19 - more than any other nation - followed by India at 10.8 million, Brazil at 9.5 million, the U.K. at 3.97 million and Russia at 3.95 million, according to the Johns Hopkins University COVID-19 dashboard.

In the U.K., poor government decision-making and inaction have been cited as chief culprits for the country's high rate of infection.

Devi Sridhar, chair of global public health at the University of Edinburgh, says the errors made by Johnson's administration have included a lack of "both clear leadership and messaging," failing to implement effective border policies or obtain required protective equipment for healthcare workers, the decision to cease community testing for the virus and repeatedly delaying the introduction of lockdowns.

More than 10 million people in the U.K. have now received at least one dose of a COVID-19 vaccine. But experts say that a new variant of the disease, which is more infectious and against which vaccines offer limited protection, could lead to a surge in cases this winter.

About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.