The NHS defends its decision to use centralized contact tracing

“Engineers have met several core challenges for the app to meet public health needs…”

What you need to know

• The UK’s National Health Service is lining up to debut its contact tracing app.
• Efforts have been met with skepticism over its decision not to follow Apple and Google’s decentralized model.
• Despite this, NHSX says that its engineers have met the challenges that this could cause.

The NHS has said that its UK contact tracing app will be functional and practical, despite the fact it has chosen not to go with Apple and Google’s decentralized model of contact tracing.

As reported by ZDNet:

With traditional public health contact-tracing methods unable to keep up with the pace of the pandemic, the UK government has been working on a tool to digitally track and warn people who have been around someone who is showing symptoms of the coronavirus.

But the health service’s innovation agency NHSX has now confirmed that it will not be following the approach jointly put forward by Apple and Google to help governments and health agencies reduce the spread of the virus, and will be taking a different approach.

A spokesperson for NHSX (the digital arm of the NHS) has told ZDNet that engineers have used Apple and Google’s standard API and that the app adheres to Bluetooth low energy. Where its plan differs, is in the use of a centralized database:

The UK government’s homegrown app is also likely to come under public scrutiny as a result of privacy concerns. The new tool follows a centralized model, which means that when a user reports symptoms of the coronavirus, the warning is sent to a central computer server, which then works out who to send an alert to among the contacts that the infected person’s phone has registered.

Apple and Google’s solution would never collect any geographic data, nor would it feature a centralized database of user information. The NHS’ decision not to go with Apple and Google’s preferred model will mean that its app will not be able to run in the background, instead, having to be opened every time your phone detects another device running the software, a massive inconvenience, impractical, and a drain on battery life.

A spokesperson however stated:

“Engineers have met several core challenges for the app to meet public health needs and support detection of contact events sufficiently well, including when the app is in the background, without excessively affecting battery life”

As the report notes, there is clearly support for both possible approaches, Jim Killock of Open Rights Group told ZDNet that “it obviously seems, on the surface, a better approach to use Google and Apple’s system” and that the NHS should have to give a very clear explanation as to why it couldn’t make a solution more privacy-friendly.

On the other hand, Cambridge professor of security engineering Ross Anderson said that Apple and Google’s approach would broadcast a warning to everyone, and that “99% of the time it’s going to be a false positive.” He also noted that Apple and Google’s solution “is a huge opportunity for abuse.” By using a central database, a questionnaire can ensure that someone reporting symptoms or a possible case can be assessed to ensure the information is correct. Anderson also said:

“We need to avoid getting into a fight between different camps, because it is a sheer distraction from the real task at hand, which is saving lives,” he said. “A small amount of privacy exposure is entirely acceptable in the context of a pandemic.”

Recently, Germany has u-turned on its own centralized contact tracing effort, instead choosing to operate a decentralized model as advocated by Apple. It remains to be seen whether the NHS’s own offering will be up to standard.