Apple and Google Block UK Corona App Update Due to Location Data Sharing

NHS COVID-19 Test and Trace App viewed on a mobile phone

Apple and Google Block UK Corona App Update Due to Location Data

Apple and Google have blocked the latest update of the UK corona app because it asks users to share location data. This is against the tech giants’ rules. The NHS Covid-19 app sends users an anonymous alert when they have been in contact with an infected person. The app is available in England and Wales.

Bluetooth-Based Covid-19 Contact Tracing

Almost exactly a year to date, Apple and Google announced a rare collaboration to help battle the coronavirus. Together, they launched a system for tracking the spread of Covid-19. Their technology uses Bluetooth to create a contact tracing tool that alerts users if they have come in close contact with someone who has tested positive for Covid-19.

The Apple-Google contact tracing API, called the Exposure Notification API, is designed to ensure user privacy is safeguarded. Governments and health agencies can integrate the API as a building block for the contact tracing component of their own apps. Dozens of countries based their Covid-19 app on this system, including the US, New Zealand, Canada, Denmark, Germany, and the whole of the UK.

In fact, the UK only switched to the Apple-Google model mid-2020. They did this only because their homegrown system didn’t work well enough on iPhones. The app also raised concerns in terms of privacy. Apple-Google’s model, on the other hand, does all the contact-matching on the devices themselves thus avoiding privacy issues. It only provides the phone’s anonymized ID to a centralized database.

Scanning a Location’s QR Code

People who use the NHS Covid-19 app can also be notified when they visit a location that has also been visited by infected people. To enable this function, they have to scan a QR code at the locations they visit, such as shops, beer gardens, restaurants, churches, or sports centers. If other people were at the same venue around the same time that later test positive for the coronavirus, the user may get an alert.

A venue alert is only triggered if certain criteria are met. Public health experts determined the criteria. They included, for example, the type of venue and the number of coronavirus cases within a certain period. Alerts will generally only be sent for outbreaks that happened in the last 7 days. Currently, authorities rarely use this function, as no history of check-ins can be gathered.

This is because venue check-ins do not leave people’s phones. All location matching happens on the device. If people get an alert, the name of the venue will not be revealed. It only tells people that they may have been exposed to coronavirus at a venue they recently visited. Consequently, they are asked to take particular care with social distancing and to look out for any symptoms.

NHS Covid-19 app Update Blocked by Apple and Google

The latest version of the NHS Covid-19 app would automate the QR code alert system. To do this, the app would ask users who have tested positive for Covid-19 if they are willing to share the locations whose QR codes they have scanned. With their permission, the user’s venue history would then be uploaded to a centralized database. People who also visited these locations would then receive an alert.

However, this principle breaks the rules set by Apple and Google when they built the API. Last summer, both tech giants stated (PDF) that corona apps that use the Apple/Google Exposure Notification system would not be allowed to collect any location data. “There will be restrictions on the data that apps can collect when using the API, including not being able to request access to location services, and restrictions on how data can be used”, they stipulated.

The NHS’ plan was to ask users who already had a positive test for their permission. They had hoped this would provide them with a means to circumvent the restrictions. However, Apple and Google have found that any app using their API needs to treat all data collected within the app the same way. Consequently, the latest version of the British corona app cannot be downloaded from either of the two tech companies’ app stores.

Downloaded More Than 22 Million Times

The NHS Covid-19 app has been downloaded more than 22 million times. Users reported visiting a particular location more than 104 million times through the app. The app is available in several languages, namely English, Welsh, Bengali, Urdu, Gujarati, Punjabi, Chinese, Romanian, Turkish, Arabic, Polish and Somali, and can be used by people living in England and Wales. Scotland and Northern Ireland have launched their own versions of contact tracing apps.

The new version of the NHS Covid-19 app would have significantly eased the job of Test & Trace staff. Currently, they need to call every person who has tested positive for Covid-19 individually. Then ask them to manually look up their venue history. And ask them to verbally recite all the locations they visited. Whereas the new version of the app would allow users to share this data in bulk.

A similar change to the Scottish app went ahead without any roadblocks. This is because Scotland launched a separate app for this venue function. Developers have disconnected the app, called Check in Scotland, entirely from the Apple/Google based app.

IT communication specialist
Sandra has many years of experience in the IT and tech sector as a communication specialist. She's also been co-director of a company specializing in IT, editorial services and communications project management. For VPNoverview.com she follows relevant cybercrime and online privacy developments.