Since the outbreak of COVID-19, governments around the world have highlighted the importance of contact-tracing apps to monitor infection levels, let people know when they may have been exposed and as a pre-cursor to a safe return to the office.
However, getting a contact-tracing app right is not easy – just look at the British government’s lengthy (and expensive) failed first attempt to launch an app in England as evidence. From privacy concerns to issues around centralized vs decentralized models, there have been few countries to release an app that was both successful and had widespread adoption.
One company that's been working to build functioning contact-tracing apps is NearForm, which has offices in Dublin, London and New York City and says it's in the “accelerated solution delivery business." While the nine-year-old company has previously worked with heavy hitters such as Netflix, Uber, Walmart and IKEA, it recently turned its attention to working with governments and health services to develop apps for nation-wide track and trace programs.
LinkedIn
NearFormChief Commercial Officer Larry Breen.
On Sept. 10, Scotland launched its NearForm-built "Protect Scotland’ app," which saw 600,000 downloads over a 24 hour period. (That number now stands at over 1 million.) NearForm has seen similar levels of success in other countries its worked with; around half the population of Gibraltar has downloaded its "BEAT Covid Gibraltar" app since it launched June 18 and the Republic of Ireland saw over a million downloads of its contact tracing app within two days of its July 7 launch.
Larry Breen, Chief Commercial Officer at NearForm, talked about what goes into building a successful contact-tracing app, the importance of user trust and the challenges his company encountered along the way.
This interview has been lightly edited for length and clarity.
How did NearForm become involved in developing contact tracing apps?
"NearForm builds very large-scale, highly secure, highly performant solutions, typically for the enterprise. When COVID came along, the health authority in Ireland identified the need for a COVID Digital contact tracing app. They were looking at the market and the different options out there and NearForm, with our reputation and being well known within the industry, became an obvious candidate.
"We have that enterprise scale but also – and this is key for COVID-19 – we are able to move extremely quickly. So, HSE (the Health Service Executive, responsible for the provision of health services for everyone living in Ireland) rang us up on a Saturday morning back in early March and said: ‘This is the outline of what we need to achieve, is it something that NearForm could support us with?’ We said, ‘yes’, spun up a team that evening and 10 days later we delivered the first app to them."
Can you talk through the process of developing the app?
"NearForm is a remote-first company. We've got people spread across 21 countries and we employ high-end talent with a focus on getting the best of the best rather than worrying about geographically where they're actually sat. We bring a lot of expertise and a lot of acceleration tools to the table, but in terms of product knowledge and domain information, we bring in partners with us. In this case, the HSE were the lead on the project, and we brought their knowledge and expertise to a whole bunch of other partners – all looking into different aspects of the project.
"We identified the fundamental tenet of building a contact-tracing app as privacy. We needed to be absolutely spot on with privacy from the get-go, even before anybody wrote a single line of code. That created the foundation from which we could work our way through its design and architect prototypes, and then from those prototypes create an actual end product.
"When we initially started back in March, we began by building what became labeled the centralized approach to contact tracing. Unfortunately, we identified a number of inherent issues with that model that would limit the usability, and therefore the adoption and penetration of the app. Through our networks and relationships with the likes of Apple and Google, the HSE and others, we engaged in a conversation to see how we could overcome it. We actually weren't the only ones having these conversations, there [were] a number of teams across the world that were obviously having similar challenges and identified similar issues,
"Apple and Google took our queries on board and, ultimately, we pivoted to the decentralized model, which is the version that the majority of the world [is] now actually moving forward with. This switch meant we had to build a second app for the Republic of Ireland which required a huge amount of work in terms of validation around privacy, security, user behavior studies and efficacy of the technology. We used a whole bunch of independent third parties and a number of academic institutes as well as government organizations to look at the data protection side of things.
"Although we built the app from a privacy-first point of view, we then opened it up to a huge amount of scrutiny and, ultimately, in conjunction with the HSE, we open-sourced the actual underlying code so there was nowhere to hide. This meant anybody who had any concerns could look at the minute detail and actually get into it and understand that privacy had been of absolute paramount importance to us and was therefore protected.
"We’ve also been able to engage with a number of other countries and, as of today, we're working with nine countries delivering nine different solutions. All the solutions are on the same theme, but we build an innovative solution for each country, so they have their own autonomy and controls as is necessary. We've also seen wider collaboration with a range of other countries that aren't necessarily using NearForm as their technology provider, but have asked us to consult and share information and advice. It’s important to make sure that anybody who can will get access to all these apps."
What are the countries NearForm has worked with on contact tracing apps?
"In order of deployment, we've got Gibraltar live, the Republic of Ireland and Northern Ireland live, and Scotland live. We've got another European country going live within the coming weeks (that information is not yet in the public domain). On the other side of the pond, in the U.S., Pennsylvania, and Delaware will be going live in a short while and there's two others within that region that we'll also be announcing in the next three or so weeks."
Can you talk us through how the app and the technology works?
"First of all, you need to download the app and enable it. There's some OS prompts to enable the actual underlying technologies, the premise behind that being all the app’s services have to be opt-in. It's very much your choice – there's nothing forced on you or any aspect you don’t know about. It's all very clearly explained.
"Once you enable it, you just leave it in your pocket and away you go. You get on with your day-to-day life and all the while your app is sending out an anonymous and randomly generated ID or key. At the same time, every other app is also doing likewise, sending out these IDs. Each of those apps is also then collecting IDs so any ID that it ‘hears,' it collects and stores it locally, within your app, and leaves them just sitting there.
"What then happens is people who do go for tests and get diagnosed as being COVID-positive, where they've been using the app, they're asked to upload their keys. Again, no personally identifiable information, just the random ID that the app has generated, gets pushed to a central server and all the other apps pull them down. Once they have the information in their phone, the app does a cross match – the keys that they've been in contact with, versus this list of diagnoses. If it gets a match, it does an assessment to see if it fulfils the criteria of being a contact event. If it does, it flags you up and says: ‘Hey, you've had a contact event. Please follow the relevant health advice.’
"It’s relatively straightforward and very user friendly. You don't have to actually do a lot other than enable the app and put it in your pocket. Other than that, you just leave it there and let it do its job. It will also prompt you if you need to undertake any kind of follow on activity."
Were there major challenges or roadblocks you came across in the development?
"There were a number of different challenges when it came to developing the app. It’s very easy to say: ‘We decided to build it from privacy first point of view,’ but that requires you to rethink your instincts that you've developed over years of building out apps. You need to challenge each piece as you go through to make sure anything that you might do by default doesn't actually have a privacy consequence. That's a challenge from both a mindset and a technology point of view.
"The second privacy-related challenge is, if you go privacy first, there's a lot of useful information and data that isn't available for you to use, because there's a risk [it] would impinge on that privacy-first mantra. So, if you go back to the centralized model we discussed earlier, even though privacy was at the heart of that, it wasn't to the same extent. That model would have made more data available for statisticians and epidemiologists that are actually looking into the disease. But, when you decide to go anonymous, you can no longer see that information. However, it's right and proper that you can't see that information to make sure that there's truly a privacy-first approach being taken
"The final challenge is less of a technical one and more of an operational one. Typically, if you’re doing a healthcare project delivery, there's a huge amount of planning and a huge amount of consideration that needs to take place. You go step by step through the project and it's typically a 12- to 36-month life cycle under normal circumstances. COVID doesn't allow for all of that, so as a consequence you have to take this project that typically would be set out in yearly type chunks and milestones and condense that down into hours, days, or weeks. That created a big challenge for a lot of countries and organizations that have actually got involved with building contact tracing apps.
"From a NearForm point of view, part of our credentials is we've always worked at an accelerated pace. We're used to working at these kinds of speeds and we’re also used to working with big enterprise and helping them change from being a slow, monolithic company to one that needs to be a lot more agile and fast moving. Still, you’ve got to bring a lot of people along on those journeys and when you get together all these different collaborative partners – although everybody's there with the right intent – it's about fueling those efforts so we can actually deliver the kind of results that we've seen achieved in recent weeks."
How important is public confidence in a country’s contact-tracing app?
"When we built our app, we didn't just build one. We built an app, but then we created versions of it so we could trial them to see which one got the best results. We looked at how people actually behaved and tried different messages, different wordings, different fields etc. so by the time we actually brought it to market, it had been thoroughly tested and we could feel super confident about it.
"It's all about instilling that confidence into the citizenry. Naturally, there's this whole swath of the population going: ‘Is this something I want to download? Is my data going to be subject to hacking?’ And the answer is, absolutely not. But we needed to build that confidence, we needed to make sure that, when it launched, the HSE felt confident it was a very robust and scalable project. We’ve actually had a higher uptake than we had planned for or anticipated. But luckily, we’d engineered for that scenario so we can deal with any of those peaks in volume that are out there.
"We also released all our information out to the industry ahead of time, so anybody that had a beef or a worry, or a qualm or query, could really look at the data and dig into it. This meant that by the time we actually launched the Irish version of the app, those would-be naysayers from before were actually advocates going forward because they had been able to look at the app and discover there really is nothing to be concerned about. That gave a real sense of relief and confidence into our citizenry and we shot past 20% adoption levels within hours of launching. Now, we're around north of 40% adoption levels, and we expect that will continue to grow. (At the beginning of September, the HSE said around 1,500 people a day were downloading the app.) We've seen other iterations around the world where they've had some initial strong uptake, but then it's plateaued and started to decline. We're continuing to see that growth."
Finally, why is interoperability so important here?