Contact tracing app ‘fails’ NHS and cyber security tests

The app is being trialled on the Isle of Wight this week and was due to be rolled out nationally if successful.

The government’s anticipated coronavirus tracing app has failed crucial security tests and is not yet safe enough to be rolled out across the UK, according to reports.

It is understood the system has failed all tests needed in order for it to be included in the NHS Apps Library, including cyber security, clinical safety and performance, reports the HSJ. The NHSX app is being trialled across households on the Isle of Wight this week and is due to be rolled out nationally, if successful, later this month.

The app uses Bluetooth to alert a mobile user when they have spent more than 15 minutes within 6ft of someone who has tested positive for Covid-19 or experienced symptoms. It will also advise the user to self-isolate if they have come into contact with someone who is infected.

But senior figures described the app as a ‘bit wobbly’ and have raised concerns it could affect public trust if privacy settings aren’t tightened. There are fears particularly regarding users’ personal information once they log that they have tested positive or recorded symptoms, meaning they then become ‘traceable’.

A senior NHS national source told the HSJ: ‘The real problem is the government initially started saying it was a ‘privacy preserving highly anonymous app’, but it quite clearly isn’t going to be… 

‘When you use the app and you’re not [Covid-19] positive in the early stages, you’re just exchanging signals between two machines… But the second you say, “actually I’m positive”, that has to go back up to the government server where it starts to track you versus other people.’

However, senior figures said the app is still in its early stages and that its test failures are not a ‘big disaster’ right now but fear it may not be ready quick enough.

All of the apps showcased in the NHS Apps Library have been approved in line with NHS and national standards, regulation and industry best practice. As part of the tests which must be passed, developers are asked questions regarding clinical safety, data protection and security.

The app is part of the government’s test, track and trace strategy, with UK officials hoping it will be central in its efforts to slow the spread of the pandemic as lockdown measures begin to ease.

Speaking during Sunday’s daily No 10 press briefing, Transport Secretary Grant Shapps stressed the app would be completely confidential and urged as many people to download it as possible.

He said he hoped more than half of the Isle of Wight’s 80,000 households will download the app to properly test it before it can be rolled out elsewhere.

Mr Shapps said: ‘The idea is that we will encourage as many people to take this up as possible. This is going to be a huge national effort and we need for this to work 50-60% of people to be using this app.

‘Not everybody has a smartphone, and I appreciate that for various reasons not everybody will download it but it will be the best possible way to help the NHS.’

He added: ‘It’s striking… how public spirited people have been throughout this crisis and knowing that this is a contribution that all of us can make to helping to keep our neighbours and community safer, I think, is a very, very powerful incentive.’ 

Users’ personal data is recorded under an anonymous ID on the app, rather than by the person’s name.

If and when someone starts showing symptoms, or tests positive for Covid-19, they are then able to share the information on the app.

It will then send a notification warning of possible infection to all those phone users to have come in requisite proximity recently.

An NHS Digital spokesman told the HSJ that apps are not usually assessed for the app store during earlier stages of testing.

He added that although it had been asked to carry out early assessments, further reviews would be undertaken after the pilot.

A spokesman for NHSX said the National Data Guardian’s panel had been consulted on the plans and the data collected by the app would only be used for NHS care, evaluation and research.

He added that an independent assurance board involving experts in mobile apps, data governance and clinical safety has also been set up to scrutinise the app.

Get in touch with our news team by emailing us at webnews@metro.co.uk.

For more stories like this, check our news page.