The introduction of the UK’s NHS Test and Trace app has faced repeated scrutiny, despite government backing. The app aims to trace those who have come into contact with an infected person – preventing further virus spread.
Contact tracing isn’t new. In fact, we’ve seen this method used throughout history to curb infectious diseases such as Smallpox and HIV. Today, COVID-19 poses a great risk to public health, particularly because of its high transmission rates. In order to try and combat the widespread effects of the pandemic, digital contact tracing has been implemented through 45 global government-approved smartphone applications.
How NHS Test and Trace came to be
The NHS Test and Trace website states the app is administered and owned by the Department of Health and Social Care.
In the apps initial development stages, two versions were created. NHSX commissioned the first app and VMware developed it. This version raised some privacy concerns due to its centralised approach for user data storage. Other issues arose with Apple’s Bluetooth usage restrictions, which prevented the app from working effectively on certain devices. These reasons among others resulted in the abandonment of the first app in June 2020. The second app version favoured a decentralised model, that stores user data on the device itself instead of a centralised server. The app uses the decentralised model and the Google and Apple Exposure Notification (GAEN) Application Programming Interface (API). It was officially launched in September 2020.
How does the NHS Test and Trace app work?
The NHS app has several features. It allows users to check their symptoms, order a Covid test, submit test results and check into venues by scanning a QR code.
The apps core infrastructure uses a risk-scoring algorithm. When a user consents to share their data, the algorithm identifies other nearby phones through Bluetooth low energy. The algorithm calculates 3 risk factors:
- The distance (Bluetooth signal strength) between two devices.
- Duration of contact – How many minutes were these devices within a certain distance of each other?
- The device owners positive/negative test result.
The apps initial release used GAEN API Mode 1 to contact trace. This version uses a three-bucket histogram to define risk, which adjusts to suit a countries social distancing regulations. In the UK, regulations suggest people are at increased risk of contracting the virus if they are within a 2-metre distance of others for 15 minutes or longer. When two app users meet this particular time/distance threshold and one of them receives a positive test, the algorithm categorises that contact as ‘high-risk’. High-risk users receive an app alert, informing them to isolate immediately and help mitigate the virus spread.
An app update in October 2020 (developed by The Alan Turing Institute) introduced the use of a sequential Bayesian process known as the Unscented Kalman Smoother. This update, named GAEN API Mode 2, measures the time gaps between changes in signal strength, which ‘smooths’ signal bouncing (attenuation) and allows the API to pinpoint device locations with greater accuracy. This reduces the chance of false positives, without impacting the number of self-isolation notifications for those who are high-risk. In fact, Mode 2’s increased accuracy has meant that more users are notified as high-risk than before. The update also conveniently removed the ghost notifications that mislead users upon initial release.
Maintaining privacy
The GAEN API’s popularity with governments is largely down to its ability to generate random number keys (pseudonymous identifiers). The API generates a key every 10-20 minutes to conceal any personal data or device information. This key exchanges with other devices within Bluetooth range to log ‘contact/exposure’. Each device will then periodically cross-reference its logged IDs with a live ID list of positive test results.
The app cannot detect a users GPS location or track where the user has been. It is unable to monitor or observe people isolating, or access any personal information on a device such as contacts or messages. The government and authorities are also unable to track users. In order to use the app, users must first opt-in to exposure notifications and agree to share their own data.
Staff from Accenture, Alan Turing Institute, NHS Digital NHSx, Oxford University, VMware Pivotal Lab and Zuhlke Engineering make up the development team. The National Cyber Security Centre is also an advisor for the security of the app.
Effectiveness, inclusivity and compatibility
Since its implementation, the app has raised a plethora of concerns.
The app’s effectiveness is heavily reliant on two things. Firstly, users must agree to volunteer their test results and a small portion of their personal data. In the app’s documentation, users do not have to submit any of this data if they don’t want to. Secondly, the app requires Bluetooth to operate. This means if your phone’s battery dies, or you simply turn Bluetooth off, you are not benefitting from the app’s core functions. Failure to document venue check-ins or positive test results could be encouraging the virus to spread, deeming the app unsuccessful and pretty much useless.
Inclusivity has also been an issue for Test and Trace. Currently, 28% of the population in England and Wales use the app. But what about young children and the elderly? These age groups are the least likely to own a smartphone or understand how to use the app in the near or distant future. By default, they are excluded from the potential of digital contact tracing.
Compatibility has also presented a challenge for users. Whilst the risk-scoring algorithm is ever-evolving, at the time of writing, older devices are only compatible with GAEN API Mode 1. As newer models hit the market, old smartphone devices tend to stop providing operating system updates. This leaves users who possess older devices at a disadvantage with the app’s accuracy. They can’t update their operating system (or the app) even if they wanted to!
Let us also not forget the incident that resulted in 15,841 COVID-19 cases going unreported as the UK was entering its second wave. The Test and Trace data was incorrectly syphoned into an Excel spreadsheet. One expert stated that ‘even a high school computing student would know that better alternatives exist’.
The cost
If you’ve read the news at all, you’ll know that the NHS Test and Trace programme has faced a lot of criticism for its extortionate costs. To date, it is costing taxpayers £37 billion over a two year period. This large sum begs the question, was it really worth all that money?
The National Audit Office (NAO) is the UK’s independent public spending auditor. They support Parliament by holding the government to account through conducting detailed audits of public spending. The below data is from the NAO’s Summer 2021 report which at the time of writing is unaudited, subject to change. The figures also do not sum due to rounding. Further insights can be found in their December 2020 audit.
| Date | Funds | Breakdown of spend |
| Financial Year 2020-2021 | £22 billion | £10.4 billion for testing* £2.2 billion on local authority grants (mostly pertaining to ‘contain’ activities) £0.9 billion on tracing £176 million for support payments £13 million for practical support for isolation |
| Financial Year 2021-2022 | £15 billion, but £17.9 billion estimated. Aiming to save £2.9 billion. | Forecasted spends: £13.1 billion for testing £1.7 billion on corporate services £1.1 billion on Joint Biosecurity Centre £0.8 billion for ‘contain’ activities £0.7 billion on tracing £0.3 billion on contingency |
*See a breakdown of testing in the below image:
The NAO’s report details that Test and Trace spent £13.5 billion of the £22 billion budget by the end of March 2021. This is an underspend of £8.7 billion, primarily in the forecasted spend on testing. ‘Contain’ activities refer to efforts made to identify local outbreaks and support local responses to the pandemic.
The Test and Trace app cost £76 million.
Serco, Sitel and other contractors
Two names that continue to make headlines in the programme are Serco and Sitel. Their role is to provide call handlers to contact app users who have been in contact with someone who has tested positive. Serco also manages roughly 25% of the fixed and mobile testing sites in the UK.
Both outsourcing firms rose to prominence when they won contracts for the Test and Trace programme on the 18th of May 2020. They won these contracts under emergency regulations without competition.
NHST&T told us that given the emergency nature of the initial response and the need to scale up operations at speed, it had to use the private sector to respond quickly under power of the emergency regulation. The emergency arrangements bring risks to value for money due to a lack of competition and normal regulatory processes.
National Audit Office
By March 2021, 964 contracts were signed across 454 suppliers in the public and private sector. The total value of these contracts stands at £14.1 billion, with testing accounting for £12.7 billion of the total. Just 10 of the suppliers make up more than half of the total contract value at £7.3 billion.
The argument stands that contracts like Serco’s and Sitel’s should have been handed to local communities and the NHS rather than private firms, who are now pocketing the taxpayer money they have profited from. The latest news revealed that Serco is now paying out dividends of £17 million to its shareholders. Meanwhile, the Chief Executive is taking home a paycheck of £4.9 million. These sums combined with the knowledge of a historically under-funded NHS has left a thorn in the side of UK residents, not least because it was expensive, but staff were reportedly clinically inexperienced and untrained.
Was it worth it?
To assess the apps overall success in its first 8 months, we must delve into the following:
Its early stages
A key factor that helped push for the apps initial creation was that officials believed a second national lockdown could be avoided if implemented correctly. History now tells us that the UK suffered another two lockdowns despite the introduction of NHS Test and Trace. We can hypothesise that the apps delayed-release was poorly timed with the state of UK regulations. The first lockdown restrictions were eased at the beginning of June, but the app didn’t launch until the 24th of September. By this point, the UK was nearing a second peak in cases, as rules were relaxed and people had already been mixing for several months.
Taxpayer money well spent?
On top of this, it was eye-wateringly expensive, with a lack of information supporting why it was necessary to spend so much money. In a time where the country needs to stand united, the UK’s frontline health and social workers face repeated pay cuts, pressures from understaffing and extortionate working hours. Meanwhile, private companies like Serco and Sitel are profiting from their involvement in the programme, instead of feeding it back into society where it is so desperately needed.
How many cases has the app really prevented?
If you’ve made it this far, I’ll do you a favour and give you the short answer.
We don’t know exactly. We probably won’t ever know. As noted in this peer-reviewed research paper, ‘digital tracing is a novel public health measure with unknown epidemiological impact.’
The paper goes on to highlight that between 24th September 2020 and December 2020, the NHS COVID-19 app traced a mean of 4.2 exposed users for every positive case, compared to a mean of 1.8 traced through manual methods. Assessments into other contact tracing apps show a similar pattern. Digital tracing appears to reach roughly double the number of manually traced contacts.
Whilst there is a degree of uncertainty here, the argument stands:
Averting one case now, or one transmission now, potentially prevents further transmissions downstream.
Victor Von Wyl; Epidemiologist at the University of Zurich.
Between December 2020 and January 2021, an estimated 0.2 positive contacts were traced per positive result.
In summary
It’s safe to say that this app (among others) has caused its fair share of controversy. Only time will tell how much (or how little) contract tracing apps will impact the viruses spread and in turn, society. So far, the NHS COVID-19 app has over 24 million downloads. At the very least, we can hope the app has given its users more power in self-awareness of their mobility. For now, though, it seems the negatives have vastly outweighed the positives of the NHS COVID-19 app.
