Update to NHS COVID-19 app brings improved warnings, end to 'ghost' notifications

It's all about timing, apparently

The NHS has updated its COVID-19 app for England and Wales*, meaning it now uses the latest version of the contact tracing API co-developed by Google and Apple.

Like all apps using the Google-Apple Exposure Notification (GAEN) contact-tracing APIs, NHS COVID-19 uses Bluetooth handshakes between devices to identify the duration and proximity between contacts. The latest version of the API changes how it calculates interactions by considering an additional data point: timing.

By observing the duration between Bluetooth broadcasts, the app is better placed to disregard random "echoes" produced by signals being bounced off surfaces, in turn creating more accurate readings.

Explaining the update to the API, the Alan Turing Institute's Professor Mark Briers wrote:

"The GAEN API now provides health authorities with time sequenced attenuation values, with the attenuation value being a 'raw' measurement at a particular point in time, rather than being aggregated into histogram format. This means that we have several more pieces of information to use (in a fully privacy preserving manner), and can better approximate transmission risk."

This approach to predicting the values of distance between users uses a Bayesian process called an "Unscented Kalman Smoother", and presupposes that two devices are unlikely to have major fluctuations of distance during a contact.

Version 3.9, which is available to download from today via the App Store and Google Play Store, also addresses the problem of "ghost notifications," which have plagued users of the app, and prompted some to self-isolate where it wasn't medically necessary.

Previously, users would be alerted if there had been a "possible exposure" to someone who has tested positive for the disease, even if it didn't meet the threshold for self-isolation. As previously discussed by this publication, the NHS Covid-19 uses a points-based scoring system to determine whether someone should self-isolate, based on the duration and proximity of the contact.

In response to user complaints, the NHS addressed the problem by sending a follow-up notification to users telling them to disregard the previous message. This was a sticking plaster, however, and the API has now removed these notifications altogether.

Separately, the algorithm developed by the NHS to determine risk has been altered to take into account the improved API, as well as a better understanding of the infectiousness of the disease. In practice, this means the threshold upon which someone is instructed to self-isolate has been reduced.

Being within two metres (roughly 6.5ft) of an infected person for five minutes is scored at 300 points. Medium proximity, which is defined as between two and four metres (6.5ft to 13ft), is scored at 150 points. Previously, you needed to rack up 900 points in order for the app to issue a self-isolation warning. Now, that's been reduced to 120 points, meaning being as close as two metres to someone positive for just a few minutes is enough to trigger an alert.

In an article published on the DHSC's Technology in the NHS blog, the current chief of Track and Trace, Gaby Appleton, noted this will result in more people confined to their homes for a period of two weeks.

"The lowering of the risk threshold is expected to increase the number of people asked to self-isolate by the app, having been in close contact with someone who has tested positive," she wrote.

"We believe lowering the threshold is necessary to reduce the R rate and break the chain of transmission."

The NHS COVID-19 app had somewhat of a rocky start. Early issues prevented those on low incomes from claiming financial support grants for those self-isolating. As reported earlier this week, localisation issues prevented some those with Android devices using unsupported languages from accessing key functionality of the app.

Another major flaw was the lack of interoperability between contact tracing apps used in other regions of the UK. The DHSC said it's aiming to add compatibility between the apps used in Scotland, Northern Ireland, Jersey, and Gibraltar in the future, and is consulting with the National Cyber Security Centre (NCSC) to ensure this is accomplished in a secure manner. ®

* The app does not cover the entire UK: Northern Ireland's contact-tracing app is called StopCOVID NI, and Scotland has Protect Scotland. Both of these countries' apps are based on the decentralised protocol.