After weeks of testing and an €850,000 bill, the HSE's contact tracing app is finally live. Available from Apple's App Store and Google's Play Store, it is intended to be another weapon in the fight against the spread of Covid-19 in Ireland.
What is it?
The HSE's contact tracing app, developed by Waterford company Nearform, uses your phone's bluetooth connection to keep a log of any close contacts. That list is compiled using beacons that are identified by a string of numbers that change every 10 to 20 minutes.
If two phones are in close contact, they exchange their active ID, and that list is stored on phones for 14 days. To help protect privacy, the beacons are random and are not tied to a user’s identity.
What does it do?
The app is primarily used for three things: contact tracing, checking in on symptoms daily, and providing updates on Covid-19 in Ireland. You can use as many or as little of these as you like. The app asks you for a series of permissions that you can accept or reject as you see fit.
First up: contact tracing, the main purpose of the app. According to the terms and conditions, it determines a contact as anyone who has been closer than two metres from you for more than 15 minutes.
As part of the app set-up, it asks you to enable your phone's exposure notification service - the technology on which Apple and Google have been working together to bring to users of both Android and the Apple operating system iOS. It allows the official HSE app to access bluetooth in the background.
According to the product description, it shouldn’t have too much of an impact on battery life for your phone, but that remains to be seen. To use the app for contact tracing, you will have to give permission for it to use the exposure notification function on your phone.
If you test positive for Covid-19 and are using the app, the HSE will ask you to upload that previously mentioned list of random IDs stored on your phone. To do that, you will need a six-digit code supplied by the HSE via text message, an attempt to stop people falsely claiming to have a positive diagnosis. It also means you retain full control over the data on your phone, and it is not automatically uploaded without your knowledge.
Once you upload that data, the IDs are then added to a list that is downloaded daily to the phones of those using the app, and potential matches are processed on an individual’s phone. If there is a match found,users are alerted through the app that they may have been in contact with a confirmed case, and can then arrange a test.
Do I need to share my phone number?
During the set-up, the Covid Tracker app asks if you want to share your phone number but it’s not mandatory. If you give the app your phone number, it will only be used by the HSE to contact you if you are in close contact with a confirmed case of coronavirus.
The apps only share your number with the HSE if or when you have a confirmed contact. It is strictly opt-in and you can skip that if you don’t feel comfortable; it can always be changed later on through the in-app settings.
Aside from contact tracing, what are the app’s other functions?
The second function is the symptom tracker. The Covid check-in asks for some data – age group, location and so on, all of which are optional – and how you are feeling.
Select the “I’m not feeling well today” option and the app will walk you through a few questions, asking if you have a fever of more than 38 degrees, any type of cough, difficulty in breathing or loss of sense of taste or smell. If you have symptoms like a runny nose or sore throat, the app advises you to behave as if you have coronavirus and to self isolate for 14 days.
By 11.15pm on Monday evening, the app was already showing almost 8,000 check-ins, the majority of them from people feeling well. Some 15 minutes later, that number was close to 13,000. Before its official launch, there were more than 80,0000 registrations of the app.
The third main function of the app is to provide information on the current level of coronavirus in Ireland. You can get a county-by-county breakdown, plus hospitalisation figures and how Covid-19 is spreading in Ireland. It’s not quite as detailed as the Health Protection Surveillance Centre’s Covid-19 data hub, but it shows the essentials.
What does the app need?
On the most basic level, the app requires up to date versions of Apple and Google’s software, which include the exposure notification tool upon which the app is built. For Apple, that is iOS 13.5. Android is a little more forgiving, with the system requiring Android 6.0 instead of the latest operating system, Android 10, but you will need to install an update that was pushed to phones in the past couple of weeks.
If you are going to use contact tracing, you will need to enable bluetooth. Location services are not used, and both Apple and Google previously said there would be no sharing of location data with the Covid tracker software. However, it uses bluetooth scanning, and for phones running Android 6.0 and newer, that requires the device location to be turned on, so it can understand what devices are near each other.
After installing it on both iOS and Android, neither required access to my location data, nor did they appear on the list of apps that had used location services in recent days.
You will also be asked to allow the app to send you notifications.
For the app to be effective as a way of tracing contacts, it requires other people to also download and use it, which is why the HSE is keen to have as many people as possible share the app. The HSE has even included a “share app” option to make it as easy as possible for you to spread the word.
What else does it look for?
The app also asks for permission to collect app metrics, or data on how the app is being used. According to the terms and conditions, that includes if the app on your phone is being used, if exposure notification services have been turned on, if the app has received any exposure notifications, if it has uploaded diagnosis keys, the number of diagnosis key matches per exposure notification, the number of days between app triggering notification and upload of keys, and the ratio of exposure notification to positive cases.
Absolutely none of this is essential to the working of the app, so you can refuse consent in the first instance, or if you skipped through the menus quickly and didn’t realise what you were signing up for, you can go back and disable that in the in-app settings.
How accurate is it?
There have been various studies done on the accuracy of bluetooth for determining proximity, with recent research from Trinity College Dublin indicating that some environments – buses, for example, where there is a lot of metal – impacting on how accurate it is in determining distance.
According to the HSE, its testing programme showed that the app was able to accurately detect 72 per cent of close contacts.
What about privacy concerns?
There have been a couple of issues raised by privacy experts in the wake of the app’s launch. First is the collection of app metrics, mentioned above, which collects a lot of information on how you are using the app. That can be disabled, but it’s easy to skip through the set up process and accidentally agree to send your usage data if you aren’t paying close attention.
Second, although the app does not have access to location data, the exposure notification service on Android requires location services to be turned on, as previously mentioned. This doesn’t mean the HSE app has any access to location data; the Android operating system shows what apps have permission to access and have actually accessed location services, and the Covid Tracker Ireland app does not appear in that list.
Both Apple and Google have prohibited the public health apps from accessing GPS data, and have built in safeguards to stop tracing apps using the exposure notification services from inferring your location, through random IDs that are regularly rotated.
What if I change my mind about using the app?
If you want to get rid of the app, it should take your data with it. However, you can choose to wipe the app of your data first. Under Settings, there is a “leave” option. If you select “I want to leave” and confirm that choice, it will delete your information, and the app is reset. You can then delete the app.
Apple also allows you to delete the exposure log through Settings>Privacy>Health>Covid Exposure Logging> Delete Exposure Log.
