UK Pursues Centralized Coronavirus Contact Tracing App, Rejects Apple-Google Solution

The UK's National Health Service (NHS) is moving forward with plans to create an app for tracking coronavirus exposure that does not rely on APIs created by Apple and Google, reports the BBC.

Apple and Google's Exposure Notification System
Apple and Google's coronavirus tracking solution is decentralized for privacy purposes, while the UK wants a centralized solution. In the UK's version, the app logs data when people are near one another, using a computer server to determine who to send alerts to when a person is diagnosed with coronavirus.

Apple and Google's coronavirus API, by contrast, does not involve a central computer for routine collection of data and determination of contacts. Instead, only when a person has tested positive for coronavirus and consents to having their data uploaded to servers run by Apple and Google does information leave the user's phone. Once the user identifies his or herself as having tested positive, their anonymized identifiers will be added to the list downloaded by all other users, where any previous contact will be determined on-device.

The decentralized approach prevents government entities or malicious people from using server logs to track individuals and identify social interactions, but the NHS argues that a centralized approach will provide more insight into how COVID-19 spreads and it will allow for more control over who receives notifications.

"One of the advantages is that it's easier to audit the system and adapt it more quickly as scientific evidence accumulates," Prof Christophe Fraser, one of the epidemiologists advising NHSX, told the BBC.

"The principal aim is to give notifications to people who are most at risk of having got infected, and not to people who are much lower risk. It's probably easier to do that with a centralised system."

The UK has been pursuing its own tracking solution since before Apple and Google announced plans to build a coronavirus tracking solution that can be utilized by governments and health agencies worldwide.

Both the Apple/Google tracking APIs and the UK's separately developed app use Bluetooth, but without using the Apple/Google API, the NHS's app has to work around Bluetooth privacy limitations that prevent apps from accessing Bluetooth when running in the background.

According to the NHSX (The NHS's digital innovation unit), its engineers have found a way to make the app work "sufficiently well" on iPhones even when the app is not active on the screen. The solution involves waking the app up in the background each time the iPhone detects another device running the same software, with the app then executing code before returning to a dormant state.

This is more battery intensive than Apple's solution, which allows Bluetooth-based communication to happen in the background without an app needing to activate.

Several other countries were also pursuing contact tracing apps that did not use Apple and Google's technology, but have since agreed to adopt the decentralized tracking APIs. Germany, for example, was creating its own app that would use a centralized server design, but Apple refused to support Germany's plan and it saw heavy criticism from scientists. Along with the UK, France is also pursuing a COVID-19 tracking app that uses a centralized server, and has even asked Apple to ease Bluetooth restrictions.

Australia recently released a COVIDSafe app that does not use Apple's APIs, and issues with Bluetooth and Low Power Mode can prevent it from working. The app has to send push notifications to people to remind them to open it every once in a while, and it can cease to work if there are too many other Bluetooth apps running. It also results in more battery drain than normal, and in some situations, such as on public transport, users are instructed to leave the app open and running.

Australia's COVIDSafe app, via ABC News Australia
Apple and Google plan to debut their exposure notification APIs in a beta capacity this week, which will allow public health authorities that have begun developing apps to deploy them. Last week, the two companies announced a number of privacy-focused changes to further protect users and prevent location-based tracking.