[Paywalled] coverage from the Telegraph:
Revealed: Government's coronavirus tracing app failed key tests on cyber security and privacy
Health officials are to launch pilot version of app on Isle of Wight, urging all Britons to sign up when it becomes national
By Laura Donnelly, Health Editor 4 May 2020 • 5:07pm
NHS chiefs have said high take-up of the app is key to saving lives and helping ease the UK out of its coronavirus lockdown
The Government's coronavirus tracing app has so far failed key tests on cyber security and privacy, it has emerged.
Health officials are to launch a pilot version of the app on the Isle of Wight, urging all Britons to sign up when the scheme becomes national.
NHS chiefs said high take-up of the app is key to saving lives and helping ease the UK out of its coronavirus lockdown, but on Monday it emerged that the product has failed all the standards that would allow it to be included in the health service app library.
The "track and trace" app is expected to be rolled out nationally within weeks, with all adults asked to sign up.
The tracker monitors when phones come into close contact, meaning that when a person logs on with symptoms of possible Covid-19, others who have been in close proximity are alerted to watch out for symptoms.
Health chiefs insist the system is anonymous but allows people to be notified when their risk of exposure to the virus has been increased.
Coronavirus podcast newest episode
On Monday, Matthew Gould, the chief executive of NHSX, the technology arm of the health service, said: "The level of impact of the app does depend on the level of uptake.
"So we're going to mount a really serious campaign to make sure that people know that if they do want to carry on saving lives, protecting the NHS and get the country back on its feet, downloading the app is one way that they can do that."
Officials said the centralised nature of the system will allow them to identify coronavirus "hotspots" and find out more about symptoms and the levels of exposure which increase risk of infection.
But the launch was dealt a major blow as it emerged that the app has so far failed the tests needed for it to gain approval for inclusion in the NHS app library.
Any healthcare app needs to meet certain standards before it is kitemarked, but senior NHS sources told Health Service Journal (HSJ) the app had so far failed all the tests required for inclusion, including cyber security, performance and clinical safety.
The HSJ also reported concerts about how users' privacy will be protected once they log that they have coronavirus symptoms and become "traceable", and how this information will be used. Senior figures told the journal it had been hard to asses the app because the Government was "going about it in a kind of a hamfisted way".
They said that because the app keeps changing it had not been fully tested, they and decsribed it as "a bit wobbly".
The app will use Bluetooth technology to register a "contact" when people come within 6ft of each other for at least 15 minutes. If someone develops virus symptoms, they inform the app and an alert is sent to people they have been in close contact with.
On Monday, the deputy chief medical officer, Jonathan Van Tam, said high take-up of the app was crucial to its success, adding: "We do have some uncertainties about how many people will download the app.
"It will be important that a significant proportion of the population downloads the app for it to have the greatest chance of giving us additional 'oomph' in the contact tracing space, which in turn will give us additional room for manoeuvre in terms of other social distancing easements that we can consider in the weeks and months to come."
Health officials insisted concerns about privacy and security have been addressed, and Mr Gould said: "We've put privacy right at the heart of it and the way it works. The app is designed so that you don't have to give it your personal details to use it. It does ask for the first half of your postcode, but only that.
"So you can use it without giving any other personal details at all. It doesn't know who you are. It doesn't know who you've been near. It doesn't know where you've been – rather, what it does is assigns randomised identifiers to its users."
Mr Gould said all the detail stays on the phone until people become symptomatic and get an option to upload their information. Even when individuals upload their details, those who have been in contact with them would not be given the identify of the person who may have exposed them to risk, he stressed.
Professor Van Tam said there was "significant optimism" that high numbers of people would engage with the app. Officials said it has yet to be decided whether children will be included in the national app.
A spokesman for NHSX said the National Data Guardian panel had been consulted on the plans and the data collected by the app would only be used for NHS care, evaluation and research. An independent assurance board involving experts in mobile apps, data governance and clinical safety has also been set up to monitor production of the app.
The spokesman said apps were not normally assessed for the app store during the earlier stages of testing and, although it has been asked to carry out early assessments already, further reviews would take place after the piloting.
https://www.telegraph.co.uk/news/2020/0 ... key-tests/