Contact-tracing app raises privacy concerns

As the United Kingdom gradually emerges from its novel coronavirus-induced lockdown, contact-tracing infrastructure will be an essential part of the government's strategy, at least until a vaccine is ready.

The need for such infrastructure means there will be an inevitable debate about the balance between civil liberties and the need to protect the public from COVID-19.

Esther Rodriguez-Villegas, an electronic engineering expert at Imperial College London who chairs low-power electronics within the Department of Electrical and Electronic Engineering, says the National Health Service app is "one potential non-pharmacological intervention which can definitely help to modulate the epidemic curve, whilst we wait for a vaccine to be ready".

The app, which will be used to track down contacts of people who have the virus in a bid to stop its spread, was launched on the Isle of Wight on May 5.

After someone tests positive for COVID-19, the app anonymously warns other app users if they have been geographically close to that person and informs them about their increased risk.

The exact reasons why the government decided to trial the app on the Isle of Wight have been not given, but Rodriguez-Villegas said it was likely chosen because it "provides a large enough testing population, whilst still keeping some control on the testing conditions".

Rodriguez-Villegas said the NHS will, during the trial, be examining "things like usability, interoperability between a variety of mobile phone models, or whether there is potentially any software bug that could affect the functionality and has not been identified in controlled bench testing".

"It might also be possible that they are looking into what is the most effective way of defining what a 'contact' is; in other words, what is the most practical trade-off between the duration and distance between two people, for this to be considered as a potentially risky interaction," she explained.

The initiative requires people to sign up to a "centralized" model of the app, which means there will be a central computer server that will collect data from the users. It is a detail that has raised some worries about data security.

"Many concerns have been raised in relation to the information that this app is intending to collect, maybe not in the first version, but in successive ones, as well as the fact that they are not using a de-centralized approach," Rodriguez-Villegas said. "Whether these concerns are going to affect the levels of adoption by the public is still an unknown. The larger the number of people who adopt the app, the more efficient this will be as an intervention."

Rodriguez-Villegas said she favors a "privacy by design" approach to contact tracing, requiring privacy to be taken into account throughout the whole engineering process.

In recent days, the NHS has come under pressure to build a second contact tracing app, favored by Google and Apple, with a decentralized model.

Some observers wonder whether the new contact tracing app might open the door for a similar approach to be applied to other health crises after the novel coronavirus pandemic ends.

Rodriguez-Villegas said while the idea of a contact-tracing app could be extended to other contagious diseases, it is very unlikely that would happen.

"Unless we are in a situation similar to this, I cannot find strong reasons to justify a decentralized approach, or to collect information about individuals, which could potentially lead to knowing things about their lives that they would not have been willing to share, had they understood the technical details of the implementation," she said.