There was a moment in recent weeks when it seemed as if Ireland’s contact tracing app would never arrive.
Intended to be a weapon in the State’s arsenal to keep Covid-19 in check as we reopened the economy and its borders, the app would help to trace contacts that people were unaware of or had forgotten. With pubs, restaurants and workplaces reopening and people venturing from their homes to socialise once again, it was seen as playing a critical part in efforts to fight the virus.
The HSE was initially confident that the app could be rolled out within 10 days. That was back in March.
Even when the app had been built and tested, requiring only official sign-off from government, there was still no sign of it becoming available even as the Republic was speeding through to phase three of its reopening plan.
But, on July 6th, we had white smoke. The app finally appeared in the App Store, followed by the Google Play store, and quickly began to gain momentum. By the end of last week, it had been downloaded more than 1.1 million times since it was released, surpassing expectations for its adoption. It passed one million registrations within 48 hours of its launch.
Did anyone really believe we would see the contact tracing app as quickly as had initially been promised? Probably not, given the scale of what was needed. But Colm Harte, head of product with Nearform, the Waterford company tasked with building the app, said a version of the app was ready quite quickly.
“It was intense,” he said. “There were people who put their hand up, who wanted to be involved in something that is seen as a good thing, a positive thing,” he said. “We build a lot of software systems, but there’s not many that have this sort of impact on people’s day-to-day lives.”
Public sector projects aren't Nearform's usual market. The company, which develops enterprise software and uses cloud computing to build faster, more stable, more versatile business platforms, has a string of high-profile names on its client list. Founded in 2011 by Cian Ó Maidín and Richard Rodger, the company's first project was rebuilding the Sunday Business Post's website. A year later, Nearform signed up Condé Nast and now counts the New York Times, Intel, IBM and Microsoft among its paying customers.
It was the strength of its private sector work that brought it to the attention of the HSE. Unlike in normal times, Nearform did not have to go through the lengthy tender process, an emergency situation that is provided for under tender regulations.
Desktop exercise
Fran Thompson, chief information officer for the HSE, said the authority conducted a desktop exercise and identified a number of prospective candidates; Nearform was eventually chosen from that list. "We did get some recommendations, and we knew their track record, mainly in the private sector," he said.
So the contact tracing app was a bit of a new departure for the company.
Given the public health emergency, speed was of the essence.
“When we kicked off, we were trying to get something done in about 10 days. There were late nights, early mornings, weekends . . . there was a lot of effort put in and people were happy to,” Harte said.
“When we went past that initial 10 days, we brought the team back to more of a normal working cadence because there’s no point burning people out. You’ll get less out of them.”
The speed with which the team pulled the initial elements of the app together was partly down to work already done in Singapore. That country had rolled out its contact tracing app to users on March 20th, and was expected to publish the source code shortly afterwards, a move that would allow other countries to use it to build their own.
“It took them a few weeks before they actually released the code, but it kicked off the initiative. We started working on the app, and we started looking into the bluetooth capabilities on Android and iOS,” explained Harte.
Within those first 10 days, there was a version of the app that had all the user interface functionality – a version of the symptom checker, a version of the updates and the screens for contact tracing – but the contact tracing itself wasn’t in place. A separate team was working on the bluetooth functionality in parallel.
Ineffective
One issue quickly emerged: the bluetooth technology didn’t work all that well on iPhones. In fact, it was almost ineffective, requiring users to keep their screens unlocked all the time and the contact tracing app active.
“What we realised after working on that for a while is it was limited; there’s specific things, particularly in iOS, that just stop it from being all that effective,” he said.
“A good example is when you lock your phone; bluetooth still works to an extent but not the way we wanted to use it. You can’t use it as the sender and receiver at the same time. So, for example, iPhones would stop broadcasting as soon as you locked your phone, they might see an Android device, but they wouldn’t be broadcasting themselves. Two iPhones could be side by side and never see each other if they’re locked, which would defeat the purpose of the app.”
Nearform took on board some of the negative feedback on the Singapore app. “There was a lot of effort put into that to try and make it work reliably. We were trying different approaches, but we were still coming up against limitations,” Harte said.
Then Apple and Google stepped in. The two companies said they would work together to facilitate contact tracing, first by building an API that would support public health apps and allow Android and iOS phones to "talk" to each other, even while locked. The second part of this would see the technology integrated into the operating systems.
So the Irish team had a choice: ditch what they had been working on and go with Apple/Google tech, or carry on knowing that the app wouldn’t work on iPhones.
“It was a tough choice, you know: do you stick with what you have? It’s not perfect, but, you know, maybe it’s okay, maybe it’ll be good enough. Or do you make the switch?
“The HSE then made the decision that we needed to make the switch, it has to work; if it’s not going to work properly, there’s no point,” he said. “That was a big call on their part. Nobody had gone with the Apple/Google solution yet.”
Although the decision caused another delay, in hindsight, most agree the HSE made the right choice. There were some conditions for access to the exposure notification services. Only official public health apps would have access, and those apps had to use the decentralised model to protect users’ privacy. None of the apps would be allowed to access GPS data on the phone, a further privacy protection.
The latter point has caused some confusion. On registering, users can supply some private information, including age range and locality, but it isn’t necessary to use the app.
Another issue cropped up with Android. The Covid Tracker Ireland app has no access to the GPS location data captured by your phone but, because bluetooth scanning can be used by some apps to determine the approximate location of devices, Android placed it under a wider "location" setting in its system.
Location services
According to Google's documentation, it is to give users more control over location services on their phones; in practice, it means if you turn the main "location" switch off, exposure notification services won't work correctly. The workaround is to turn on the main location services switch and disable access to location for individual apps such as Facebook, Twitter, or any others you don't want to have access to the information.
Part of the pledge was to make the app as transparent as possible. The HSE’s Thompson said the app was always designed to be as privacy-focused as possible.
“From the very beginning, the app was designed with privacy at the core. We worked and liaised closely – informally initially – with the Data Protection Commissioner,” Thompson said.
The HSE has since published the Data Protection Impact Assessment, and has also published the source code. “I think we are really comfortable, happy with the way that’s turned out,” Thompson said.
Not everyone is as positive about the app’s credentials. The Irish Council for Civil Liberties (ICCL) and Digital Rights Ireland have scored the app as a C+, taking it to task for asking people to submit optional information during the registration process.
They also had an issue with the use of the app for symptom tracking, which it said extends the Covid-19 tracking app beyond the single purpose guided by the European Data Protection Board.
There have also been questions over the efficacy of contact tracing apps, an issue that the ICCL report card also raised. Tests carried out by researchers in Trinity College Dublin found using the app in certain environments could affect its accuracy. For example, being surrounded by a lot of metal – such as on a bus – could lead to signals being read incorrectly, missing some contacts and creating false positives with others by amplifying the bluetooth signal to make it seem closer than it was.
Handbag
Other issues were found with determining location depending on where the phone was placed – in a front pocket, a handbag, a rear pockets. For some, there are too many variables that could lead to false positives and affect people’s ability to work or interact with family.
There are also other issues that have been raised because of the system’s lack of personal information. Because the apps are limited in what data they can capture, it also limits their effectiveness to public health authorities and epidemiologists as a way of tracking the spread of the disease.
“The decentralised model is better from a privacy perspective, but from an epidemiological perspective, you get a lot less useful information,” explained Harte. “You can’t, for example, now identify who the super-spreaders are, how many people one person is specifically kind of having contact with, potentially infecting, and all that kind of useful information that those people would want.”
But he is confident that the app can be a powerful weapon in the battle against Covid-19.
“I do think it’s an effective way. It’s absolutely not 100 per cent accurate, the testing we did, you’re looking at maybe somewhere mid-70 per cent. I view this as a complementary solution to the manual contact tracing; it’s not to replace it. It’s not perfect in all environments,” said Harte.
“Bluetooth wasn’t designed for measuring distance; it wasn’t one of its intended primary purposes. But it is what’s available. You don’t really have many other options to do this. And so for me, it is effective, it’s not 100 per cent effective. And I think it’s worth going with.”
Once developed and tested, there were more hurdles to get through. Not only did it need a data privacy impact assessment – published by the HSE and available to both the general public and users of the app – it also had to go through the Government before being submitted to the Google and Apple app stores.
Sign-off
In June, the HSE said the app was ready and just required sign-off from the government. That would happen at a cabinet meeting; the question was when. The HSE initially expected it to be signed off the following week; in the end, it was July 1st and a new Government that made the final decision.
“There’s a huge sense of pride now across the company, especially the team that built it, myself included,” says Harte. “Before launch, it was a nervous time. You’re not sure what to expect.
“You’ve done all your testing, performance testing and scale testing, but there’s always that certain level of ‘what if something goes wrong on launch day?’, from a technical perspective, and obviously you don’t want that to happen.
“When the numbers started growing quickly, that was great, and then when we started seeing the positive feedback, it’s a huge sense of pride. To have gotten to a million installs in that time period, it’s personally something I’m very proud of.”
Nearform isn't stopping there. In the very near future, Northern Ireland will launch its own app based on the same source code and system as the HSE version. That was built by Nearform too, ensuring cross-Border compatibility.
Nearform has also built the contact tracing app for Gibraltar. And it is in talks with other health authorities to bring the app to other countries and states.
So what was the financial ticket for the successful launch of Covid Tracker Ireland? How much has it cost the taxpayer?
The bill for the HSE’s app currently stands at €850,000, between Nearform’s fee, paying for the testing, security and the data protection impact assessment. That is significantly less than the £12 million spent by the British government on its app, which has already seen one version dropped and work start on a second app that now supports the Apple and Google technology.
“I think we got good value for money,” says Thompson. “If it actually stops one or two people going to hospital in the long term, that is a massive, massive saving both in human costs and in financial terms.”
