On Monday the health secretary, Matt Hancock, announced the launch of a mobile phone contact tracing app that is at the heart of the government’s strategy for easing the coronavirus lockdown. It is being tested on the Isle of Wight before becoming nationally available by the end of the month. Using the Bluetooth capabilities in smartphones, the NHS Covid-19 Tracing app will keep records of whom a person meets. If a user or contact declares they have become ill (there is no requirement to have a test) it will send notifications to everybody on that list advising them to self-isolate. But the announcement of its launch immediately prompted a raft of questions, about the technology, its security – and whether the public would use it. Why did the UK choose this type of app? There are two possible ways a contact tracing phone app could work. One is a “decentralised” model where all the relevant contact information is held only on users’ phones. The alternative approach – the “centralised” model – is where some data is held by the NHS in a single database. Apple and Google have tried to promote a decentralised model, arguing it is best for privacy, and have worked together to develop a set of interfaces to support a contact tracing app on that basis. But the NHS team developing the official tracing app rejected that approach, and instead insisted on holding a central database of those who say they have been infected. But this has raised concerns over privacy. Ian Levy, the technical director of the National Cyber Security Centre (NCSC), wrote on Monday that the NHS would only hold anonymous data. Each app user is assigned a unique number (the actual number changes daily) and data about people they had met would only be uploaded after they had reported feeling ill. This, Levy said, would allow the NHS to better “understand how the disease appears to be spreading” and have some “contact graphs to carry out some analysis” – although such exercises would be limited as the only data that the app asks for is the first part of a person’s postcode. Is the NHS app secure? It has been developed at breakneck speed – over the past two months – and while NHSX and the firm that has developed it, VMware Pivotal, have had advice from government security experts at the NCSC, there remains the possibility that there could be security flaws. Levy, however, argued they were minimal. He said the central system only stored a set of numbers and if you discovered “my app ID is 123456, there are some theoretical things you can do to try to understand my contacts if you’ve followed me round. But if you’ve followed me round, you’ve probably seen my contacts anyway.” Others have raised concerns that the central database could expand and increase the security risk. Matthew Gould, the chief executive of NHSX, wrote last month: “In future releases of the app, people will be able to choose to provide the NHS with extra information about themselves to help us identify hotspots and trends.” That prompted Damian Collins MP, a former chair of the culture, media and sport select committee, to wonder whether that would make it easier to identify people in the database if it was hacked. He also asked whether the centralised database should be deleted at the end of the pandemic, as Australia has committed to do. Will the public cooperate and download it? This is unclear and part of the purpose of the trial on the Isle of Wight to see if the public is willing to use it. A similar app that encourages people to self-report coronavirus symptoms, developed by King’s College London, has more than 2.4 million users. But that represents about 3.5% of the UK population. Oxford University’s Big Data Institute has estimated that if 60% of the population adopted the NHS app then it could help “substantially reduce” the number of new coronavirus cases alongside other relevant measures to control the disease – and help the UK come out of lockdown relatively safely. Few, however, believe the NHS app will prove that popular at first. Those who have helped to develop it at NHSX admit in private that the speed at which they have had to work has made it difficult to sell the need for the app to the public and properly reassure citizens about its privacy and security. On Monday, Gould told MPs: “Even if the takeup rate is 20%, that gives us important insights into how the virus is spreading.” That may be more realistic, although that means takeup would be roughly in line with Singapore, a country with a markedly higher respect for the state. Can it be enforced? There are no plans to enforce takeup at the moment. Nor is it clear what the immediate incentive is, either. People living in the Isle of Wight will not see an early easing of the nationwide lockdown so their reason to get involved would need to be a desire to test the app on behalf of the rest of the country. Ultimately, however, effective coronavirus monitoring, testing and tracing will be at the heart of a suite of strategies to ease the lockdown – and already those involved in its development are appealing to Britons’ sense of civic duty. As Gould has put it: “If you want to keep your family and yourselves safe, if you want to protect the NHS from being overwhelmed and at the same time want to get the country back and the economy moving, the app is going to be an essential part of that strategy.” There is another issue: what if the app tells someone they need to self-isolate, and they don’t? So far, there has been no discussion about how you persuade people to abide by the warning.