In March 2020, NHSX commissioned a contact tracing app to monitor the spread in the United Kingdom of the coronavirus disease 2019 in the 2020 pandemic, developed by the Pivotal division of American software company VMware. The app uses a centralised approach, in contrast to the Google / Apple contact tracing project. NHSX consulted ethicists and GCHQ's National Cyber Security Centre about the privacy aspects. The app records the make and model of the phone and asks the user for their postcode area. It generates a unique installation identification number and also a daily identification number. It then uses Bluetooth Low Energy to record the daily identification number of other users nearby. If a user is unwell, they can tell the app about symptoms which are characteristic of COVID-19, such as a fever and cough. These details are then passed to a central NHS server. This will assess the information and notify other users that have been in contact, giving them appropriate advice such as physical distancing. The NHS will also arrange for a swab test of the unwell user and the outcome will determine further notifications to contacts: if the test confirms infection with COVID-19, the contacts will be asked to isolate.
Within NHSX, the project was led by CEO Matthew Gould and Geraint Lewis. Around 17 June, Gould and Lewis returned to their other duties, and Simon Thompson – chief product officer at online supermarket Ocado and a former Apple executive – was brought in to manage the project.
First phase plans and cancellation
The first public trial of the app began on the Isle of Wight on 5 May 2020 and by 11 May it had been downloaded 55,000 times. When the first national contact tracing schemes were launched on 28 May – NHS Test and Trace in England, Test and Protect in Scotland – the app was not ready to be included. Replying to a question at the government's daily briefing on 8 June, Hancock was unable to give a date for rollout of the app in England, saying it would be brought in "when it's right to do so". On 17 June, Lord Bethell, junior minister for Innovation at the Department of Health and Social Care, said "we're seeking to get something going before the winter... it isn't a priority for us at the moment". On 18 June, Health SecretaryMatt Hancock announced development would switch to the Apple/Google system after admitting that Apple's restrictions on usage of Bluetooth prevented the app from working effectively. At the same press briefing Dido Harding, leader of the UK's test and trace programme, said "What we've done in really rigorously testing both our own Covid-19 app and the Google-Apple version is demonstrate that none of them are working sufficiently well enough to be actually reliable to determine whether any of us should self-isolate for two weeks that's true across the world".
Functionality
The functionality of the app was questioned in late April and early May 2020, as the software's use of Bluetooth required the app to be constantly running, meaning users could not use other apps or lock their device if the app was to function properly. The developers of the app were said to have found a way of working around this restriction.
Privacy concerns
The app was subject to privacy concerns, the government backtracking on initial statements that the data collected from the app would not be shared outside the NHS. Matthew Gould, CEO of NHSX, the government department responsible for the app, said the data would be accessible to other organisations, but did not disclose which. The data collected would not necessarily be anonymised and would be held in a centralised repository. Over 150 of the UK's security and privacy experts warned the app's data could be used by 'a bad actor ' to spy on citizens. Fears were discussed by the House of Commons' Human RightsSelect Committee about plans for the app to record user location data. Parliament's Joint Committee on Human Rights said the app should not be released without proper privacy protections. The Scottish government said they would not recommend the app until they could be confident it would work and would be secure.
Related contracts
– a company linked to Cambridge Analytica and previously hired by Dominic Cummings to work on the Vote Leave campaign – provided research and modelling to NHSX in support of the response to the pandemic. Palantir, also linked to Cambridge Analytica, provided their data management platform. These contracts began in February and March respectively.
Second phase
As outlined on cancellation of the first app on 18 June, the Department of Health and Social Care published on 30 July a brief description of the "next phase" app. Users would be able to scan a QR code at venues they visit, and later be notified if they had visited a place which was the source of a number of infections; the app would also assist with identifying symptoms and ordering a test. By using the Exposure Notification system from Apple and Google, personal data would be decentralised. An initial version of the app was expected to be released to selected users "shortly".
