The Contact Tracing App and Your Privacy By Adam Dowse

I can imagine having the government know your exact location isn't something you'd be immediately thrilled by. So when the public heard that the UK government are asking to install a 'Tracing' app onto our phones, it has been met with scepticism and negative associations have been raised. Are we all going to live as if in an episode of 'Big Brother'? Because honestly, who wants to be traced?

This reputation is a huge problem.

Viruses are spread by people that are in three states:

  • Asymptomatic (Does not develop symptoms)
  • Pre-symptomatic (Will develop symptoms, but are not currently doing so)
  • Symptomatic (Is showing symptoms)

The virus is also spread upon touching infected objects and having the germs that infest it enter the body via face touching or eating before washing one's hands. The government's current system asks symptomatic people to isolate for at least seven days, something that they say will reduce the spread. However, estimates have shown that there is a 46% contribution to the epidemic from pre-symptomatic individuals that are "alone almost sufficient to sustain epidemic growth". Put simply, just isolating symptomatic individuals is not enough.

Contact tracing is the only way of stopping the coronavirus once and for all, and many methods that have been around for decades have the ability to inform the community if they've been around a symptomatic person without even using your GPS or holding any information about you. The DP-3T protocol is one of many algorithms that can make this possible. As described below by journalist Nicky Case, epidemiologist Marcel Salathé, and security researcher Carmela Troncoso:

  1. Your phone's Bluetooth signal sends out pseudo random set of numbers and letters (masking your identity and location) every few minutes, called a string. If another app is within a set distance this list will be sent and stored on that phone for 28 days.
  2. If you find out that you are showing symptoms, you inform the app and it uploads all the strings, that you've sent to phones, out to an NHS database. All the information stored here is completely untraceable and in the event of a data breach it would just look like a load of random numbers and letters.
  3. All apps check this NHS database regularly and compare the strings to the ones stored on the phone that they have received. If there is a match, then you have been in contact with someone showing symptoms and should self-isolate.

This system cuts the spread of the virus drastically, it does not store any personal information and it is easy to implement. So why are we still waiting and why do they not want to give a timeline on its development? Matthew Gould, the lead in the app's development, said "it can potentially allow cases to be identified earlier and reduce the spread of the virus," but so far in the UK, only the Isle of Wight has been given access to the system and even then, this occurred four months after the virus started to spread. If this could help save lives, then why has it not been used yet?

To increase the security of the system further the app could have been decentralised. Or simply, no data is stored on a server making it harder to access. However, this is a controversial topic because the companies offering these services are tech giants such as Facebook and Amazon, who have a poor track record in security and ethical practices. If our confidence could be reinstated into these companies, we would have the opportunity to push an app to millions of people much faster than is currently being done, potentially saving thousands of lives in the process. The sad fact is that the trust the public had previously in the aforementioned companies has now been tainted and the evolution of the use of tech in the government sectors will be greatly impacted.

A paper produced by Ferretti and Wymant in Oxford showed that the all-important R value of the virus may have never increased past one and therefore not into epidemic state if an instant access app could have been released at the virus' conception. The paper goes on to show how the currently implemented contact tracing via phone calls and email has a delay time of roughly three days before individuals can be notified, and explores how this system displays no way to control the epidemic in the UK. If we cannot contain people that are pre-symptomatic quickly enough, all our actions against the virus become redundant.

This paper also shows a digital tool where you can see for yourself how different delay times affect the virus spread and see how many people would need to use the app to make it effective. The misconceptions about the security of a track and trace app need to be addressed if the required 60% uptake is to be met and for the UK to have a working virus combatant and finally start using technology to securely help our community.

If an app is clearly the only way to reduce the impact of this virus, where is it?


Created with an image by Gilles Lambert