NHS coronavirus app: how the contact-tracing app works

As the UK lockdown begins to loosen on 13 May we’ll all have a little more freedom, being able to go out and exercise as many times a day as we like. To help avoid a second spike of coronavirus, many restrictions will remain in place. And one way to detect any local flare-ups is to ask people to use an app which keeps track of who has contact with whom.

Soon the NHS’s COVID-19 app will be available to download and this is exactly what it does.

What is contact tracing?

It’s a phrase being bandied about a lot at the moment. It’s a system which tries to figure out who an infected person has passed a disease on to, in an attempt to prevent it spreading any further.

In this case, if one person develops symptoms of coronavirus and then tests positive for it, the people that this person has been in close proximity with over the past 14 days will be notified and advised to self-isolate and seek testing to find out if they also have the virus.

Put simply, it works like an early warning system which prevents the virus spreading as quickly as it would do if you didn’t know you’d been near someone with the virus until you also develop symptoms.

How do I get the NHS COVID-19 app?

You can download it from the Google Play Store and Apple App Store on your Android and iPhone.

At the time of writing, the app was in beta and still being tested before being made available for everyone to use. 

Don’t confuse it with the main NHS app: this one is called NHS COVID-19 and its icon is as shown below.

Our advice is to only use these two app stores to download the app: avoid downloading it from any website or other app store as it’s highly likely it will not be the genuine article and could contain malware that might spy on you. 

There are, sadly, a whole load of coronavirus scams you need to watch out for.

How does the COVID-19 app work?

It uses each phone’s Bluetooth to detect each other and record any ‘significant contacts’. These are periods where you are close to another app user for a certain period of time. The strength of the Bluetooth signal is used to work out just how close you were to the other person – or their phone, at any rate.

If someone develops symptoms and chooses to notify the NHS via the app – determined by answering a series of questions in the app itself – all those contacts, which include a time and date, are uploaded to a ‘secure NHS database’. Anyone who had significant contact with you recently will get an alert via the app, so they can self-isolate.

The app creates an anonymous ID for each user and when you get an alert, you won’t know who it was who developed symptoms.

Does NHS COVID-19 app track me?

Rather than using GPS and tracking your location as you move around, it simply asks for the first part of your postcode, such as SE16. This usually covers around 8000 addresses, which is another way to ensure you remain anonymous.

You might wonder why the app needs to know your location at all, but it’s for three reasons:

1. to help predict demand on hospitals in your area
2. to help decide who should be alerted of a possible coronavirus outbreak
3. to give advice to people living in a ‘hotspot’ area

Why are people saying the NHS contact tracing app is no good?

One main reason is that the NHS COVID-19 app uses a ‘centralised’ approach, storing anonymised data in a central database rather than on users’ phones. The latter method is the decentralised approach that’s being used by Apple and Google’s joint effort. (Read more about decentralised COVID tracing on our sister site, Macworld).

The UK is one of the only countries (including France) not to use the technology offered by Apple and Google, primarily because it demands that the data be kept on the user’s device. This could be a problem on the border of Northern Ireland as the Republic has said it will use a decentralised approach, making it impossible to record contacts when people cross the border.

There are other potential issues, too. First and most obviously, this is an opt-in system. No-one can force you to install and use the app, and the NHS says that there needs to be an 80% uptake for it to be very effective. If people don’t use it, it isn’t going to work very well.

Second, there needs to be a critical mass of Android users for the iPhone app to work. That’s because Bluetooth needs to be on all the time to record each contact. Apple’s operating system turns off Bluetooth when it’s not actively being used, and the NHS app uses Android devices to keep Bluetooth ‘awake’ on iPhones. The only fallback is a prompt to get iPhone owners to open the app so Bluetooth is turned back on.

There’s a danger of false positives, where people are notified they’ve been in contact with someone who’s gone down with coronavirus, but in reality they haven’t. For example, if you stop at traffic lights next to another car, a ‘significant contact’ could be recorded as both phones are close to each other. 

But since you’re isolated from that person, there was no contact. The system cannot tell whether or not there was contact or not, so people may end up self-isolating for no reason.

Finally, the app requires Android 8 or iOS 11 or newer. Those with older phones which can’t be updated to these versions won’t be able to use the app. 

Some people are worried about privacy and security when using the app, but there’s a  blog post on the National Cyber Security Centre website which explains more about how the app has been developed with security in mind.