• by Laurie Sullivan  @lauriesullivan, April 13, 2020

The British National Health Service (NHS) will become the first to use Apple’s and Google’s COVID-19 tracing technology built into an app, according to reports.

The opt-in mobile app, which relies on the same "flow" used between devices to serve an advertisement, warns users when they come into close proximity to someone who has been infected with or has self diagnosed with COVID-19. 

NHS Health Secretary Matt Hancock announced at a daily pandemic press briefing that the country will pre-test an initial version of the software on a limited number of families this week, with plans for a rollout soon after.

The software uses a method called Contact Tracing, not tracking, which requires users to opt in. The Contact Detection Service is the vehicle for implementing contact tracing by using Bluetooth low energy for proximity detection of nearby smartphones and for the data exchange. A tracing key per device is also required. A tracing key is uploaded to the device when the device owner agrees to participate and is diagnosed as being positive for the COVID-19 virus.

Here's how the opt-in mobile app works. The mobile phone user who has been identified as someone who has self diagnosed with or has been infected with COVID-19 would need to opt-in. After testing, the user would enter a tracing verification code received at the time of their COVID-19 test status.

The Proximity identifiers from other devices are processed exclusively on devices. Users decide whether or not to contribute to contact tracing. If diagnosed with COVID-19, users consent to sharing Diagnosis Keys with the server.

The app is intended to help reduce the spread of infection. The technology, created by Apple and Google, also relies on an API that uses Bluetooth low energy to trace the phones, keeping users anonymous.

The two companies say the app does not collect personally identifiable information or GPS location data. It uses anonymous identifier beacons to determine COVID-19 cases. The app also requests the user’s consent before uploading the last 14 days of data.

Apple and Google on Friday, along with the announcement, released a series of white papers describing the technology. Devices advertise and scan for the Contact Detection Service through a 16-bit service unique identifier that changes periodically.

The protocol, which could become the main guideline for serving advertisements as the two companies hunker down on privacy measures, maintains anonymity through Contact Tracing Bluetooth Specification -- rather than location -- for proximity detection.

The user’s Rolling Proximity Identifier changes on average every 15 minutes and needs the Daily Tracing Key to be correlated to the user. This, according to the companies, reduces the risk of privacy loss from advertising them.