4 things you need to know before installing the HSE Covid-19 contact-tracing app

7 Jul 2020

Image: © galitskaya/Stock.adobe.com

The HSE’s Covid-19 contact-tracing app is now available, but what does it do and how effective could it be?

Developed by Waterford-based Nearform, the much anticipated HSE contact-tracing app is now live in Ireland on both the Apple App Store and the Google Play Store.

While restrictions around movement and activities are beginning to lift in Ireland, the coronavirus is still seen as a substantial threat going forward, should there be a second wave of the virus. A contact-tracing app is seen as one way to help track any future spread of the virus and, potentially, keep those who may be infected from infecting others.

Yesterday evening (6 July), Minister for Health Stephen Donnelly, TD, said the app will be “a really powerful part of the toolkit in fighting this disease”.

But what exactly does the Covid Tracker Ireland app do and how much can it learn about you? To help guide you, here are four things you should know before installing the app.

What does it do?

With estimates that 3.6m people in Ireland currently own a smartphone, the HSE sees these devices as a potentially valuable tool to inform people if they have come into close contact with someone with Covid-19, or to alert people that they may be infected.

As the Irish app is built on the Apple and Google Exposure Notification API, it will identify when one person comes in close contact with another on a given day based on Bluetooth ‘handshakes’ from their devices.

These handshakes would occur when two people spend more than 15 minutes within two metres’ distance. So, if one person then voluntarily logs in the app that they have been diagnosed with Covid-19, anyone who was in close contact with them would be notified anonymously. This is achieved using random IDs that auto-delete after 14 days.

Self-reporting is the backbone of the app’s concept. Through the Covid Check-In option in the app, users can log if they are feeling healthy that day or displaying any symptoms. This will also help give the HSE an idea of the general population’s overall health without revealing specific personal information on users.

The information the app asks users to voluntarily provide is age, sex and locality, such as Dublin or Galway, rather than a specific address or location. Users will also be asked if they want to supply a phone number so the HSE can contact them, but this is optional.

How will it affect my phone?

As it uses the Apple and Google API, the contact-tracing element of the app requires users to switch on the Exposure Notification Service However, as the Exposure Notification Service is a more recent update, it will only be available to those with phones running Android 6.0 (Marshmallow) or higher, or iOS 13.5 or higher..

Both companies and all involved with this API have said that this solution will not significantly affect a phone’s battery life, but it remains to be seen how this will work in practice. At all times that the app is active, your phone’s Bluetooth will be running in order to engage ‘handshakes’ with other devices.

The app will also ask you to accept notifications so that it can alert you if you have come into close contact with an infected person.

If you are confirmed to have Covid-19, the HSE will ask for consent to collect the random IDs your phone has logged during close contact with other users. In this instance, the HSE will send the user a six-digit code via SMS to allow for the data to be transferred. This is to prevent false diagnosis claims as well as to ensure that data is not taken from users phones without consent.

How secure is my data?

Prior to its launch, many questions remained over how private the app would actually be. While the Irish app follows the more privacy-conscious decentralised model put forward by Apple and Google, the terms and conditions say that it will look to collect app metrics when the Exposure Notification Service is switched on. This could include when a user’s diagnosis may have been uploaded or the ratio of exposure notification to positive cases.

Almost all data sent through the app requires user consent and these settings can be changed at any time. This is deemed necessary for an app that, in the wrong hands, could reveal a lot of significant personal information about a user.

Screenshot of the Exposure Notification Service in Android with the Covid Tracker Ireland app installed.

Screenshot of the Exposure Notification Service in Android with the Covid Tracker Ireland app installed. Image: Colm Gorey/Siliconrepublic.com

How effective will it be?

This remains the biggest question. A recent study published by researchers from Trinity College Dublin (TCD) has called into question the effectiveness of Apple and Google’s API, particularly with how Bluetooth connections are made on public transport.

Speaking of their findings, Prof Doug Leith of the TCD School of Computer Science said: “We found that the radio environment inside a bus is highly complicated, presumably due to all the metal which reflects the radio waves.

“As a result, the signal strength can be higher between phones that are far apart than phones close together, making reliable proximity detection based on signal strength hard or perhaps even impossible.”

The efficacy of the app also depends on how much of the population downloads it. It has been widely reported that at least 60pc of a country’s population needs to use a contact-tracing app for it to be effective. However, a spokesperson for the Oxford team behind this research has called out this misreporting and said that these apps can have “a protective effect” at “much lower levels”. In fact, what the Oxford study states is: “Our models show we can stop the epidemic if approximately 60pc of the population use the app, and even with lower numbers of app users, we still estimate a reduction in the number of coronavirus cases and deaths.”

At the time of writing, more than 100,000 people have already downloaded the Covid Tracker Ireland app less than 24 hours after it went live.

It is very much early days for Ireland’s Covid-tracing app, but expect continual app updates over the course of the next number of weeks and months.

Updated, 11.57am, 7 July 2020: This article has been amended to clarify the estimation of uptake needed for Covid-tracing apps to be effective and to include comments from the spokesperson for the Oxford study referenced.

Colm Gorey was a senior journalist with Silicon Republic

editorial@siliconrepublic.com