Getty Images / WIRED

Covid-19 crosses borders, but contact tracing apps don’t – yet. Travel from Scotland into England, and your interactions with other people won’t be collected. It’s a “significant failing,” one Scot who travels daily into Newcastle told BBC News.
The problem is echoed throughout Europe, though a partial solution is due to launch next week to share data between some EU member states. But as international travel slowly recovers, the difficulty in getting apps to detect those from other nations will widen.

Advertisement

One location spotted this problem and solved it before launching its app – Northern Ireland, which shares an open border with the Republic of Ireland. When Northern Ireland’s contact tracing app first launched – in August, a month ahead of the rest of the UK – it quickly became apparent that some organisation between the two nations would be necessary.
When the Northern Ireland government asked developer NearForm to create a contact tracing app after it built the same for its southern neighbours, it was made clear that interoperability needed to be included. “One of their key requirements was interoperability between North and South, as I think there’s about 30,000 people a day going back across the border,” says Colm Harte, technical director at NearForm.
The task was made easier not only because NearForm designed both apps, but because it used Google and Apple’s exposure notification service (ENS), which added support for country-to-country interoperability in May. “That solves a lot of problems,” Harte says, notably providing a common key format for how identifiers between phones are exchanged. “It doesn’t matter what the app running on the phone is, the identifiers that are exchanged are at the OS level, managed by the exposure notification service itself.”
The other countries that make up the UK also use the Google-Apple framework, meaning interoperability is possible – but as yet not in place. Initially, England and Wales opted to design its own app, but after struggling to build one that worked, switched to designing atop that same ENS framework. With the launch of the NHS Covid-19 app last month that app, all of the UK could, in theory, set up a gateway and have a contact system that covers England, Northern Ireland, Scotland and Wales. But so far, it doesn’t, though there are plans to eventually make that happen.

Advertisement

The Department for Health and Social Care didn’t respond to WIRED’s requests for comment, but told the BBC that it was “working on a technical solution,” which would include the Republic of Ireland.
While political will is perhaps the largest challenge, technical work was required by NearForm to the two Irish systems. When someone in Northern Ireland tests positive, their keys are uploaded to the local backend server; the same happens in Ireland. “There are two completely separate systems,” Harte says.
To let the two systems talk without losing the privacy protection of the decentralised system, NearForm set up a federated server, which simply means it pools their shared data. “Instead of the two systems talking directly, they talk to a third-party server,” Harte says.
Every 12 hours or so, each country’s back-end server uploads its latest positive-test keys to the federated server and also downloads any new keys from the other country, to feed back to their own local app. “From an app perspective, the app only ever talks to its own back end,” he adds. “It keeps everything separated, which is good from a security and privacy perspective.”

Advertisement

As it’s all in the backend, users don’t need to switch to a different app when they cross the border, he adds. “It’s a nice solution for users because they don’t have to do anything.”
A similar interoperability system is set to cover the European Union – or the parts of it using a decentralised contact tracing app that want to take part, at least. Agreed in May with technical specifications detailed in June, it was hoped to work ahead of the summer holiday season, but it’s yet to actually arrive. A trial ran in September between Czech Republic, Denmark, Germany, Ireland, Italy and Latvia, with operations beginning this month for the first phase of countries.
Run from the European Commission’s data centre in Luxembourg, the system was designed by SAP and T-Systems, using a similar third-party server dubbed a “gateway” to let member countries’ apps share data.
Each countries’ app will connect to the gateway service, sharing the randomly generated, pseudonymous identifiers of people who have tested positive to the gateway server and the same from other countries in order to send out notifications if necessary. No tracing data is shared, only those diagnosis keys. “Each backend communicates only with the gateway, so you don’t have a direct exchange between the different backends,” says EU spokesperson Johannes Bahrke. “And that keeps the data flow to a minimum and is much more efficient.”
The gateway system only works for countries that have opted for a decentralised model, meaning France will be unable to take part. Ireland will have a shared gateway server with Northern Ireland as well as the EU, meaning positive-test keys will be shared to both – but keys it downloads from Northern Ireland won’t be subsequently shared to the EU and vice versa, Harte says.
There are other ways to go about this. Every app could talk to each backend server, but the added complexity means it doesn’t scale if additional countries need to be added. Alternatively, each country’s app could have a shared back-end, all talking to the same place. That’s the system being used in the US thanks to efforts by the Association of Public Health Laboratories, which has teamed up with Microsoft to build a single key server for all state-level apps, meaning notifications can work across state lines.
All of this means a global contact tracing app is possible, but not trivial to build. That’s easiest if every country uses the Google-Apple framework; Australia, Mexico, Singapore and many more don’t. It’s possible to build a system that can link decentralised and centralised systems, but the random ID formats are different so they can’t simply be fed into each other’s systems. That means they’d need to be translated and that’s likely to spark errors. “It’s a lot of challenges to get that working reliably,” Harte says.
Second, concerns around bandwidth need to be addressed. “One obstacle is that, when using the privacy-preserving Apple Google EN model, the exposure keys of all new cases must be downloaded and matched locally on every user’s device,” says Chris Hicks, a research associate at the Alan Turing Institute.
“Each additional region that must be included when matching exposure keys adds overhead to every client device, and to the backend that serves those clients.” Estimates suggest that the gateway service will receive 390MB per day, and that will be subsequently downloaded by each participating country and pushed back to each and every app system. If 12 million people used the app in England and Wales, he calculates that would cause traffic of 4.7 petabytes each and every day. (There have currently been more than 17 million downloads of the English and Welsh app).
“One option that could save a significant amount of traffic overhead, at the expense of some privacy, would be to restrict the distribution of international diagnosis keys to users which indicate they have travelled internationally,” he adds. To do this people would have to tell apps about their travel.
Harte agrees that the volume of keys uploaded and downloaded is a real challenge, but bandwidth aside, adds that NearForm has stress tested its own system with millions of keys and so far it’s all worked. “But it’s another layer of testing and consideration that needs to be factored in when you’re getting to those kinds of volumes,” he admits.
There are solutions, but they come with tradeoffs. “The Apple Google system is already quite optimised and only uploads around 14 Temporary Exposure Keys (TEKs) per user that is tested positive,” says Hicks. “Perhaps downloading the necessary international keys could be restricted to users that have travelled internationally but this would come at [the] cost of some privacy.”
And third, everyone would have to want to do it – and if even the EU doesn’t have all countries on board, making the rest of the world agree to a system is likely an unsolvable challenge. “The question is not necessarily technical, but more legal,” says Bahrke. To bring outsiders into the EU system, non-members would need to agree to follow the EU directive that encompasses the exchange of health data, for example.
But a wider challenge may be convincing anyone – governments or the public – that such contact tracing apps are useful enough to bother taking on such a challenge, as questions remain around relying on Bluetooth for tracking and the uptake of QR code check-ins. Weeks after launch, the England and Wales app had sent only alert about breakouts at venues. If such apps aren’t actually useful inside borders, there’s nothing to suggest that’s any different globally.
And take-up remains less than hoped. The country with the highest download rate for a contact tracing app in September was Singapore, with just 40 per cent, with others seeing much lower take-up and few notifications. If you can’t convince citizens inside a country to use an app, good luck doing so around the world.

Digital Society is a digital magazine exploring how technology is changing society. It’s produced as a publishing partnership with Vontobel, but all content is editorially independent. Visit Vontobel Impact for more stories on how technology is shaping the future of society.

More great stories from WIRED
💿 Meet the Excel warriors saving the world from spreadsheet disaster
🚀 Inside Gravity’s daring mission to make jetpacks a reality
🧥 Don’t get cold this winter. How to the get the most out of your home heating

Advertisement

🔊 Listen to The WIRED Podcast, the week in science, technology and culture, delivered every Friday
👉 Follow WIRED on Twitter, Instagram, Facebook and LinkedIn

Get WIRED Daily, your no-nonsense briefing on all the biggest stories in technology, business and science. In your inbox every weekday at 12pm UK time.

by entering your email address, you agree to our privacy policy

Thank You. You have successfully subscribed to our newsletter. You will hear from us shortly.
Sorry, you have entered an invalid email. Please refresh and try again.