Science and Technology Committee
Oral evidence: UK Science, Research and Technology Capability and Influence in Global Disease Outbreaks, HC 136
Tuesday 28 April 2020
Ordered by the House of Commons to be published on 28 April 2020.
Members present: Greg Clark (Chair); Aaron Bell; Chris Clarkson; Katherine Fletcher; Andrew Griffith; Darren Jones; Carol Monaghan; Graham Stringer; Zarah Sultana.
Questions 340 - 422
Witnesses
I: Professor Danny Altmann, Professor of Immunology, Faculty of Medicine, Department of Immunology and Inflammation, Imperial College London, and British Society for Immunology Spokesperson; and Professor Susan Michie, Professor of Health Psychology, UCL.
II: Matthew Gould, Chief Executive Officer, NHSX; Professor Lilian Edwards, Professor of Law, Innovation and Society, Newcastle Law School; and Professor Christophe Fraser, Senior Group Leader in Pathogen Dynamics, University of Oxford Big Data Institute.
Witnesses: Professor Altmann and Professor Michie.
Chair: The Science and Technology Committee today is considering evidence on specific proposals that may aid the successful lifting of the lockdown measures, specifically immunity testing and certification and contact-tracing applications. At 11 o’clock, we will observe a minute’s silence in respect of care workers and other workers around the world who have lost their lives in this pandemic.
Before we begin, can I take any declarations of relevant interest by members of the Committee?
Darren Jones: I maintain my practising certificate with a law firm called Kemp Little, although I am advising no clients related to the issues today. I also chair Labour Digital and the parliamentary technology forum that is doing work on these issues.
Q340 Chair: Before we begin, I should say that I and members of the Committee welcome the decision by Sir Patrick Vallance to publish the names of the people attending the Scientific Advisory Group for Emergencies and its subsidiary bodies. We called for that as a Committee following the evidence sessions that we have taken in recent weeks because we think it is important that the public should know the breadth and depth of the scientific advice informing crucial Government decisions. We are very grateful for that response to our recommendations.
I am delighted to welcome for our first panel two witnesses. Professor Danny Altmann, professor of immunology at Imperial College London, is giving evidence on behalf of the British Society of Immunology, which, with the Academy of Medical Sciences, has convened an expert group to consider what is currently known about the immunology of Covid‑19. Professor Susan Michie is professor of health psychology at University College London. Her work concerns the design, delivery, uptake and impact of behaviour change interventions in health. Welcome to you both. Thanks for joining us.
Professor Altmann, could you describe for the benefit of the Committee and viewers what we know about the body’s response to Covid-19?
Professor Altmann: For a virus that has been known about since January, it has been a very steep learning curve and, in a way, we have learned quite a lot. It has come from two sources. It has come from lots of studies in China and elsewhere around the world, mainly on severe hospitalised patients, which is a caveat because they are not the same as all the rest of us who might have been exposed in the community; and it has come from stuff we know about the near-cousin viruses, SARS and MERS.
To say it in a couple of sentences, all that adds up to quite big diversity and heterogeneity in immune response. Some make lots of antibodies; some make almost none. From the other viruses, we think they do not necessarily last very long, or not very many years. There are many, many parts of the immune response; there are thousands of different cell types, which would take too long to explain, but in understanding immunity we need to appreciate things such as which antibodies neutralise the virus and stop it getting into the body.
Many of the severely exposed people have those, but not everybody. There is also a part of the immune response called the cellular immune response, T-cells, and some people have measurable immunity by that, but not by antibodies. The take-home message would be that it is heterogeneous, terribly variable and we do not yet know the bottom line of what it takes to protect you.
Q341 Chair: You have anticipated my next question. What are the big things that we do not know that are important to discover, if we can, over the weeks and months ahead?
Professor Altmann: Lots and lots of things. What an antibody test tells you is that you have met the virus; you have had exposure to the virus and it triggered an immune response. It offers no conclusion whatsoever about whether you would be immune to it next time you met it.
Immunologists, whether they are studying live infection or vaccination, get very obsessed with things called correlates of protection, which we call COPs. That means all the tests you can do and all the measurables that give you a number to quantify whether the likelihood is that a person would be protected next time they met the bug. That is the thing we need to know. For this infection, we kind of don’t have the foggiest notion of that at the moment. If I had to guess, I would say that the amount of neutralising antibody you have on board might be a good proxy for that, but who knows?
Q342 Chair: Is it surprising that we do not know that, compared with other viruses you have studied, or is it a typical stage of development of knowledge?
Professor Altmann: It has been an incredibly heroic and steep and rapid learning curve. We have probably learned faster about this in three months than about some other things in 30 years. If you look in medical textbooks at the table of measurable values for correlates of protection for a measles or flu vaccine, they took years and years to evolve, so people have done terribly well.
Q343 Chair: To anticipate some later questions from my colleagues, in your view how important is the question of immunity to decisions around the lifting of social distancing measures?
Professor Altmann: As a professor of immunology, I can hardly think of anything more important, because the virus has not gone away and is not going away any time soon. There is a lot of discussion about the timeline for having an effective vaccine. We have no answer. All of us wanting to go back on to the streets, wanting to do our jobs and go back into the community must have effective potent immunity that will protect us. We need it; we need to be able to measure it and understand it, and we cannot make any guesses about it. You cannot just say, “Oh, gee, lots of people in the population must have seen this virus. I suppose we must be safe.” It is not a thing that is guessable; it has to be measurable.
Q344 Chair: Can the lifting of lockdown measures proceed safely with limited or no knowledge of immunity, in your view?
Professor Altmann: It is not really for me to say. As an immunologist and knowing how desperately lethal this virus can be, I would be terribly worried about any assumptions on those grounds.
Q345 Graham Stringer: Professor Altmann, the World Health Organisation has estimated that 2% to 3% of the population are immune. Do we have an estimate for the UK’s immune population?
Professor Altmann: There is an immense amount of work in progress on that at the moment, and I hear updates about it several times a day. All I can say about it is that, while there are glimmers of data that I have seen in the UK or elsewhere, I do not think I have seen any credible community data anywhere that goes much above 10%.
If you do your calculations for what we would need for safe herd immunity to go back about our business, it is somewhere between 60% and 80%. Whatever happens, there is an enormous gulf between the 10% figure and the 60% to 80% figures that, somehow, we need to bridge in some way.
Q346 Graham Stringer: I think you said that having antibodies does not definitely prove that you are immune. Can you expand on when we can definitively say somebody is immune and how we would say that?
Professor Altmann: It has proved a very hard question for immunologists. Historically, the question of correlates of protection comes up most in the context of licensing vaccines when you want to know, “Am I going to license vaccine A, B or C, and is there evidence that it is likely to protect most people?” That tends to come out of a long period of work looking at animal studies, transfer of protection and correlates of protection in people who have been exposed. Who got sick and who did not? It tends to be a big body of work over a number of years. I know of lots of work of that type going on at the moment for Covid. I think it will come out fairly fast.
Q347 Graham Stringer: But you do not have even a rough estimate of the level of immunity in the UK.
Professor Altmann: No. It is very hard to get the data. I have seen glimmers of key pockets of data that give you figures of less than 10%, and ditto for New York, for example. There is so little data at the moment.
Q348 Graham Stringer: Does the duration and severity of the illness affect the level of immunity that you are likely to have after the illness?
Professor Altmann: Almost certainly, yes. That was the point I made at the beginning. I have looked at all possible data that has come out on immunity. It is so diverse; it looks as if somebody has fired a scattergun at the page. Everybody is a bit different, but, if you had to draw some conclusions, you would say there is terribly low immunity in people who do badly and might die; there is also terribly low immunity in people who perhaps have been mildly infected and met very little of the virus and, therefore, have stimulated very little antibody response, which might be most of us out there in the community; and there is a cluster in the middle who have quite decent levels of immunity.
Q349 Graham Stringer: As you say, Professor, the illness can be very severe, to the point of death, or you can almost not notice that you have got it. I have read that there are some indications that the virus has evolved into at least two different viruses. Do you know if that is the case? Has the virus evolved, so we are dealing with not just one coronavirus but two or three very closely related ones?
Professor Altmann: My answer would be that for all viruses of this type there will be a certain amount of sequence variation and evolution, and there is enormous work going on at the moment in this country and elsewhere to sequence all the virus isolates.
My prediction is that this is not going to be one of the stories where we are grappling with a rapidly divergent and diversifying virus. If we tackle it, we tackle it, and any immunity or vaccines will probably work across the board, so I do not think it is diversifying very fast.
Q350 Graham Stringer: I finish by asking you the impossible question. When do you think we will know enough to be confident in any strategies that we have to deal with this dreadful disease?
Professor Altmann: You will have gathered from everything I said that I do not feel confident that I know enough at the moment. With my professor’s hat on, if I was on a peer review panel and somebody said, “I’ve got a proposal to change our measures based on a yes/no antibody test. Would you fund this science?”, I would blast holes in it because we have no empirical evidence to support that at all at the moment.
I see so much good stuff going on and so many good research proposals getting started on this that I imagine with six to 12 months’ hard work there would be quite a big evidence base to say the necessary things and put things in place, but it is impossible to imagine less than six months, not least because, if you want to understand durability of the response and how it wanes with time, you need some time to assess that.
Q351 Chair: In terms of the paucity of information that we still have at this moment, is it principally a matter of data collection, or is it studies that have been done, tested and peer reviewed based on that data? Will getting more data advance us more quickly down the road?
Professor Altmann: The simple answer is yes. More and more studies are kicking off every day. There are terribly bright people out there who have a terrific toolkit for doing all the necessary stuff. I find incredibly impressive how fast all that has happened in real time. We all read the literature probably two or three times a day; it is coming at us thick and fast, with lots of exciting data. It is all doable, but we need to collect it in real time as it happens. We are quite a short time into the outbreak in the UK to do all the studies, collect all the blood samples, do all the analyses and crunch all the data. It is all coming at us now.
Q352 Chair: The question of testing has had quite a lot of prominence in recent weeks. It has been principally about identifying individuals to check whether they have Covid-19, but perhaps one of the less discussed aspects of data collection is to inform mass studies such as you are talking about, to develop the science on it. Would that be a fair reflection?
Professor Altmann: It would be a very fair reflection. I return to the point I made at the beginning. You start out looking at the very overt severe cases in hospital, but for the kinds of questions you are asking and are interested in those are not the only people we are interested in. We are interested in everybody in the full spectrum of immune response.
Q353 Katherine Fletcher: Professor Altmann, it is important to make sure that we take the British public with us on this journey of scientific discovery. While it is technical, one virus is not another virus. Could you explain the specific difficulties that the coronaviruses present for understanding immunity and vaccine development?
Professor Altmann: You make the point correctly. All viruses are different, and immunologists study their given, much-loved, virus very specifically because the nuances will be a bit different and the devil will be in the detail. I think the devil in the detail here is that it induces immunity that is very variable and, I suspect, although we have not seen all the evidence yet, does not last very long, probably not more than a few years.
Some people who have been exposed to it and have not met much virus may have negligible antibody and future protection. Some parts of the immune response, on the other hand, might be over-exuberant and might be the things in your lungs that are causing you immense problems. There are some problems of too little immunity and some problems, as in other respiratory viral infections, of too much immunity. Those things are not unique, but in this virus they come in perhaps a slightly different flavour.
Q354 Katherine Fletcher: You mentioned SARS and MERS. We have heard evidence previously from people looking to take learnings from those viruses and apply them. Obviously, it is early days, but it is potentially exciting.
Are there any characteristics of the coronavirus that give us an advantage in another area? For example, I have heard that the lipid coating makes it much more susceptible to disinfecting by hand washing, so, while it might be difficult to generate a vaccine because of that, we can kill it more easily by measures to keep ourselves safe as we are out and about. Is there anything you want to draw to the Committee’s eye there?
Professor Altmann: Just the obvious really. This is not my idea; it was everybody’s idea that, although there are many nuances and horrific aspects to this virus, some aspects of it are almost “simple” compared with something like an HIV vaccine. It is very reliant on the spike antigen to get entry to a human cell. The hunch is that, if you can have a vaccine, a therapeutic or an antibody that blocks entry through the spike antigen, that is a single point of weakness you can attack and it is job done. It is not just me saying that—everybody says it, and it is a fair point.
Q355 Chair: You talked about greater exposure to the virus being more likely to result in greater development of antibodies than light exposure. That has obvious implications for what we will come on to talk about, which is contact tracing. If someone had had a brush-by with someone else and been exposed very lightly, you would expect to see a different immune response than in someone who perhaps had been in close proximity for a sustained period of time. Have I understood that correctly?
Professor Altmann: Those are all good and fair points. There are various bits and pieces of data emerging at the moment in various publications trying to quantify those kinds of things. They are all the things you would expect from what you have just said.
It is stating the obvious that one of the reasons why healthcare workers have been so badly affected is that they do not have one brush past; they have continuous ongoing exposure and a very high virus load. As the data comes through, I suspect they will have very large antibody responses as a consequence.
It is a complex picture. On the one hand, we are saying that low exposure might give you only low immunity. On the other hand, that low one-off exposure might be enough to make you very sick on a bad day. It is a complex picture, but lots of data is coming out on that. The answer is that big exposure means a big immune response, but there are big differences between people.
Chair: That is very important for the development of any of the apps that we are going to talk about.
Q356 Carol Monaghan: Professor Altmann, this morning you have been quite guarded in your use of the word “immunity”. Could better knowledge or understanding of immunity in the population help with the easing of restrictions as we move forward?
Professor Altmann: Enormously. The cliché often repeated—it is a cliché because it is true—is that, without good antibody testing and seroprevalence data in the population, we are flying blind; we do not have a clue who has had it, how many have had it, where they have had it or where we stand for the future with second waves. I cannot emphasise sufficiently how desperately and widely we need that data.
Q357 Carol Monaghan: Professor Michie, how useful is it for individuals to know whether they have developed immunity, and could that knowledge, both for individuals and for communities, affect the psychological wellbeing of the population?
Professor Michie: The usefulness is going to depend on the accuracy, and, as we have heard, there is not a one-to-one relationship between symptoms and antibodies and antibodies and immunity. Even if one has a very reliable or accurate test, it is never going to be 100%. There will always be individuals who think they are immune and are not, and, on the other hand, those who think they are not immune but actually are.
To the extent that it is accurate, it can be helpful in that it can protect people from harm and protect other people from being infected. It also could be helpful in people avoiding unnecessary isolation. The usefulness depends on the level of accuracy and the number of people who are getting false positives and false negatives. It also depends on how it is communicated. It is much better to talk about antibody testing because that is all that is being tested; we are not testing immunity at all. That is a very important point, so that the uncertainty is communicated very well to everybody.
As to wellbeing, to the extent that it accurately predicts people’s immunity it can provide huge opportunities in terms of people being able to feel confident about returning to certain kinds of work, travel and so on. That in turn has knock-on effects for society and the population as a whole.
However, there are potential downsides. We will be generating one group of people who are considered immune and another group who are not. That could create divisions, and possible stigmatisation of people who are judged not to be. There could be problems of access, with some people being resentful about others having been given the test and the status.
There is a potential for anxiety—for example, people tested and found positive for antibodies could be asked to go back into risky situations. Nobody will ever have a 100% guarantee that they are immune. It may mean that they go into situations where there is not enough social distancing or personal protective behaviour, such as access to soap and hand sanitiser. People who thought that they did not have antibodies may be isolating themselves unnecessarily, and that has all sorts of psychological issues over time.
Because we will never have 100% accuracy, we will always have false positives and false negatives—it is just a question of how many and what proportion—and that can sow distrust in the whole system. If those cases are publicised, it may make people feel distrustful and less confident, and that may generalise. There may be more general problems of trust in introducing a technology that is not failsafe.
Q358 Carol Monaghan: Professor Altmann, can I go back to something you said earlier that relates to what Professor Michie has just said? You talked about measuring the level of antibodies in a person who had been exposed to Covid-19. I understand that we are at an early stage, but have there been any studies that look at how the level of antibodies might be related to those who go on to form a second infection?
Professor Altmann: That is a terrific research proposal you’ve got there. The answer is that we do not know anything yet about the meaning of those “reinfections”, even what they were or what they mean. Were they bona fide reinfections, or were they persons who went negative for a little while and it was not detectable, but was never really cleared and then they became positive again? The jury is out on what those cases actually mean at all, let alone studying their immunology, but, for sure, you can make the prediction that maybe people who are right on the bottom of the graph, with tiny amounts of antibody, might be the ones who could become candidates for reinfection.
Q359 Carol Monaghan: Is there a difference between the dependability of a lab-based antibody test and commercial blood tests?
Professor Altmann: I have not been directly involved in any of those comparisons; they mainly went on at Public Health England. It is a given, and has been widely reported in the scientific literature, how many problems they had with the commercial tests, which is not very surprising, compared with the lab-based tests.
Those kinds of lab-based tests, all of which are based loosely on an approach called ELISA, where you stick your antigen on to a plastic plate and measure the dilution of antibody that binds to it, are tried, tested and doable in practically any hospital lab in the country, whereas rolling out little commercial kits would normally take years of research and development to optimise so that they really measure what you think you are measuring. There are enormous differences in the quality of data they can deliver. I think that is a given.
Q360 Chair: To pursue Carol’s research proposal, as you described it, presumably for it to succeed the precondition is a large database to be able to detect second infections, so that is another reason for maximising the amount of testing we are doing. Would that be a fair surmise?
Professor Altmann: Yes, enormously; it is self-evident.
Q361 Aaron Bell: Professor Michie, you mentioned some of the ethical considerations already, starting, I think, with access. Should an immunity‑testing programme be something we aim to roll out for the whole population, or is it something you would suggest we do in groups? In the end, would you want to do the whole population with an immunity test?
Professor Michie: If it was possible to do the whole population, it would obviously be advantageous for research in improving our knowledge, which is absolutely key, and preventing any divisions and potential resentments. One of the real strengths of the population’s response to the measures being taken to address the pandemic has been the sense of collective solidarity. By and large, we are all being asked to do the same things, to date.
Once one begins selecting particular groups of the population to be given priority testing over others, there has to be a very good explanation as to why that is the case so that people understand that it is for the good of the whole of society. Groups of workers where there may be a case for that are those looking after vulnerable people, such as the elderly or those with underlying conditions, or who are themselves vulnerable, for example, if they are pregnant.
I reinforce what I said before. There is a downside to that in people either feeling themselves, and/or being perceived, to be more protected than they actually are, which could lead to them being less protected in other ways, with all the disadvantages of transmission and increased illness as a result.
As much as possible, we want to do things universally and avoid any kind of two-tier systems where we can. If there is a good case to be made for certain groups, there should be a very good communication explanation, starting well in advance of when it happens. That is another thing I would like to stress. One cannot start too early in increasing public awareness and understanding, and engaging the public in open discussion about complicated issues. The other very important thing in that kind of situation is good legislative and regulatory oversight, and trust frameworks, so that people understand the extent to which groups are and are not being prioritised, and why.
Q362 Aaron Bell: You are right about communications. I think you made the point that antibody tests are not the same as immunity, and I fear that that is already an idea that has caught on among the population at large. Perhaps we need to do some work on communication around that.
Professor Michie: Definitely.
Q363 Aaron Bell: One option would be to do the analogous thing we have done with tests and make them available for key workers first, but, if we assume that the whole population could be tested, what are the risks for societal cohesion of identifying some people as “immune” or not, and how could those risks be mitigated?
Professor Michie: I could say this in every single answer. There is always a problem about the false positives and false negatives that apply to everything. That is always a risk, so we can say that is a given.
In addition, there may be an idea about those who are immunologically fit and those who are immunologically unfit, so there could be stigmatisation around that. There could be unfair discrimination; people could be unfairly restricted from access to certain kinds of employment and travel, even to leisure facilities. Once things are perceived to be unfair, we know from the literature that that is a real problem in terms of acceptance, engagement and adherence to advice. That is another problem.
If it is not done universally, there is a potential problem of mission creep. Will it go from employment into insurance? There are ways in which people could see it as being unfair, and people who are already disadvantaged could become further disadvantaged. That is against the backdrop of its happening already. The measures that have had to be taken have differentially disadvantaged those who are already disadvantaged. We started from an unequal society anyway, and we have to pay attention to the issue of equity and inequalities in any measures that we take in this respect.
Q364 Aaron Bell: Do you have any further thoughts on mitigation? I agree with everything you have just said. Are there any lessons from previous experiences about how we can mitigate the unfairnesses and potential stigmatisation?
Professor Michie: We have already mentioned the absolutely key issue of communication and engagement. It is not just educating the public but listening to the public, starting from where the public are and engaging with them. Obviously, we should offer tests free at the point of testing and make sure that everybody has equal access wherever they live so that distance to testing points does not become a problem.
Independent oversight of both the development and the implementation of the system would help. There are likely to be real concerns about privacy and security, so we have to ensure that the systems are properly encrypted and there is proper oversight. There should be very clear legislation about exactly when, why and under what conditions the testing would be done, and very explicit end-user consent in the process.
Q365 Chair: Professor Michie, you are an expert in how behaviours in health are determined. You mentioned trust. In communicating what is already evident from this morning’s hearing—that the scientific perspectives are developing and there is no settled answer to some of these questions yet—is it your view that debate should be conducted in public and a means found to help the public engage with that, or will the crucial point be when policies are enacted on the basis of a conclusion? Could you reflect on that for a few seconds?
Professor Michie: The more one engages with the public in honest open debate, the better, partly because listening to the public and understanding what they are thinking and feeling and how they are behaving at any point in time can help to enrich policy to begin with.
If the public have been engaged with the development of policy, they will feel much more ownership of it and will be much more likely to accept it and adhere to it. It will also make for much better relationships between the population and authority, whether the authority be the Government or enforcement agencies. I cannot stress enough that it would be good to do more of that. In retrospect, on other issues I think it would have been a good idea to have honest open debates with the public.
Q366 Zarah Sultana: We have already heard in this evidence session that it is hard to determine whether someone is immune, because of false positives and false negatives. Professor Michie, how could an immunisation or immunity certification policy be enforced?
Professor Michie: Enforcement would suggest it was mandatory. One would have to take careful consideration as to why such a system should be mandatory. Many different disciplines should be brought into the discussions on forming any such policy, including ethicists, social and behavioural scientists and many others.
If there was such a situation, and enforcement was on the cards or on the table, we know that enforcement strategies that are respectful, engage the population and where there is a two-way listening process, rather than a more authoritarian style, are more effective, more acceptable and have fewer negative unintended consequences.
Q367 Zarah Sultana: You have gone public in criticising the Government’s mixed messages in their communications on lockdown measures, such as opening up DIY stores and telling people to stay at home while still requiring some people to go to work. What factors should be considered when devising a communication strategy for identifying individuals as immune?
Professor Michie: There have been many phases of communication and types of communication. Some of them have been excellent and very good, and some have been received, as you say, as mixed messages.
That can occur for a number of reasons. Sometimes it can occur, as I think happened earlier on, when different people in authority, maybe different Ministers, say slightly different things. It may not mean different things, but different words are used and it is confusing. Once people get confused by messages, they get anxious and distrustful, and it can become a vicious circle. It is important that people use the same words and use words that everybody understands.
The other way mixed messages come across, which I think is what you were referring to in one of the things I said, is the difference between what is said and what is done. That is often how it is perceived. For example, on the one hand, people are being told to stay at home because we must have no transmission—“You cannot even see your children or your grandchildren”—alongside thousands of people coming in through airports every day without screening, and alongside what is seen as non-essential work, the building of luxury hotels having been cited, and the sale of a whole variety of products that are not deemed essential. There is a twofold problem. One is that people begin to think that it does not add up. If it does not add up, that can bring in problems of distrust.
The other issue is people thinking to themselves, “If those people can do that, why can’t I?”, and the perceived unfairness. We know that unfairness undermines adherence. If we can, we should have an absolute matching of messages both in the language being used and in who is doing what and whether it is consistent with the messages. If it is not, there will always be situations where there is a perceived mismatch, but that should be addressed head on, and it should be explained to people why it seems that there is inconsistency.
Over the last weekend, it has been said that more people were on transport and more people were out and about. That may be legitimate. It may be that legitimate employers are giving safe working conditions for people to go into work, or it may not. The trouble is that we do not know. That has a negative effect on the population, so the more data and information that can be given to people and the more that seeming inconsistencies can be explained, the better.
Q368 Chair: On the very interesting reflections you made, it is notable that the Committee has taken evidence from many experts who were surprised at the level of adherence to the social distancing measures. Modellers found that adherence has been greater than expected. Do you have any take on that?
Professor Michie: I agree; it has been phenomenal, and more than most people expected. It is a tribute to the British public. Once people see the seriousness of the situation and when there is appeal to collective solidarity, which I think has been done very effectively, people rise to the occasion. The messages that have been especially about protecting other people and the NHS have had a big impact, rather than just ones about protecting yourself. We have seen great degrees of altruism and helping other people that have been really heart-warming.
Chair: That is a very interesting point.
Q369 Darren Jones: The World Health Organisation has warned against the use of immunity passports or certification, and there has been a debate about the use of physical or digital—in my view—identity cards. Could Professor Altmann talk to that from an immunological perspective, and Professor Michie from an ethical perspective?
Professor Michie: The words “passport” and “certificate” are ill advised because they suggest a degree of certainty that we will never have, however accurate the antibody tests are.
As to whether the record of the antibody level, which is what we will have, should be digital or paper, the common view, as a result of the Ada Lovelace Institute’s recent report, suggests that digital is likely to confer greater security and privacy, and will be less open to fraud and misuse, such as profiteering. The problem about it is access. Not everybody has access to digital. I think it has to be complemented with paper versions, but a lot of thinking would need to be put into how to stop the system being abused in some way.
Professor Altmann: All I can add is that we have discussed around this table many caveats—not understanding correlates protection yet; the variability and levels of immunity for things that we can measure; and the enormous unknown about the durability of immunity. If you had a positive result on your ID card this month, what would it mean for your status in three months, six months or 12 months? We do not have the foggiest notion, so you will have gathered that my message is that protective immunity is something we cannot guess; we have to measure the measurables and work on that basis. At the moment, I would be very worried.
Q370 Darren Jones: Presumably, immunity would need to be linked to data on name, address and maybe national insurance number. Those are ID cards, aren’t they?
Professor Altmann: From the sound of it, that is a question for Susan Michie.
Professor Michie: First of all, one should not be talking about immunity, for all the reasons we have been discussing. We can talk about antibody level and the risk of getting reinfected or the degree of protection. That is all one can talk about. It is most helpful to think about a record. It could be some record that could be held centrally as part of one’s health records, or there could be local systems doing it, but I do not think one would go any further than saying that it was a record of the results of an antibody test.
Q371 Graham Stringer: Professor Michie, you talked about a communication strategy. If I could summarise it, I think you were saying that basically the Government should stay on message and not send out slightly contradictory messages. Can you give some advice on how we follow that in a democracy? It is part of the nature of this society that people will disagree and argue both within and without Government and Parliament. Isn’t that bound to lead to the public listening to different points of view? Democratically, that is a good thing, but in getting people to follow the rules it may not be.
Professor Michie: I absolutely agree with what you are saying. We are talking about a very complex situation with many uncertainties. It is also a rapidly changing situation. It is a huge challenge for communication. I absolutely agree that the nuances and subtleties of the debate should be open to everybody to take part in and be aware of.
As a result of those debates, what are we asking people to do? That is where the mixed messages can cause a potential problem. People want to know exactly who can do what, where, when and how, and, crucially, why. It is about preventing the sort of fuzziness and grey areas in the actual advice about what people should and should not be doing, but all of what takes you to that conclusion should be absolutely open for discussion, debate and review.
Yesterday, I heard many people, through several different routes, questioning the 70-year-old cut-off for staying at home for many weeks. The point has been made that many 70-year-olds are much fitter and more active, keeping volunteer services going in the community and so on, than many people who are younger. That is an example of a grey area where we try to give advice, but maybe sometimes it is better to talk about principles that people then apply within ranges rather than the absolutes that then bring resentment, confusion or disagreement.
Chair: Thank you, Professor Michie and Professor Altmann. It has been a fascinating session. We have come to the end of our time.
There was talk in the recent past about immunity certificates and passports, but it has been evident from your evidence today that we are some way from that, and there is a degree of uncertainty about immunity that comes from having been exposed to Covid-19. There will be a lot more research, dependent on a lot more data, to make advances there, so it is very helpful to hear directly from you on these matters.
It was very interesting to hear your reflections on communication and trust. Just as we have observed within the scientific firmament, knowledge advances through disagreement and through testing hypotheses. Sometimes that is the case in policy making as well, and in order to get to advice we need to put forward different alternatives as to what it might be before settling on it. We have had a good airing of that this morning. Thank you very much indeed for your work and for joining us this morning.
Examination of witnesses
Witnesses: Matthew Gould, Professor Edwards and Professor Fraser.
Q372 Chair: The Committee has heard repeatedly in recent weeks about how important contact tracing is to successful containment of the spread of Covid-19 around the world and the easing of lockdown measures. I am delighted to welcome three people who are engaged in the development of, or are advising on, the use of apps in contact tracing.
To introduce them briefly, we have Matthew Gould, the chief executive of NHSX, the body responsible for digital transformation within the NHS and social care. He is a former UK director of cyber-security and a former UK ambassador to Israel. Professor Lilian Edwards, professor of law at Newcastle University, is lead author of a recent draft Bill on safeguards for Covid‑19-related technologies. Professor Christophe Fraser is professor in the Nuffield Department of Medicine at the University of Oxford, and senior group leader in pathogen dynamics at the Oxford University Big Data Institute. I think he has been advising on the development of the NHS contact-tracing app. Thank you for joining us today. We are very grateful for your appearance.
Professor Fraser, for the benefit of the Committee and people watching, could you describe how a contact-tracing app works in principle?
Professor Fraser: The way a contact-tracing app works is that, when the app is installed on multiple users’ mobile phones, it records when the people with the phones come into proximity with one another and records a memory of anonymous IDs of the phones they have come into contact with, such that if a person at a later date becomes symptomatic with Covid, or diagnosed with it, a notification can be sent anonymously to people who have been identified as at highest risk of having potentially acquired the infection. That enables public health messages to be passed to those individuals so that they can reduce their contact rates and avoid transmitting the virus to other people, particularly vulnerable people, and, if they are in contact with a confirmed case, there is the possibility of asking for quarantine, just as is done with manual contact tracing.
Q373 Chair: Looking around the world, there are different ways of contact tracing. In your assessment, how important is the app? How important is that piece of technology to successful regimes of contact tracing?
Professor Fraser: We arrived at the notion that it was very important. It was not a technological reason; it was because it solved an epidemiological problem. My first experience of contact tracing was working on the SARS epidemic in Hong Kong with the Hong Kong Government, and understanding after SARS that contact tracing was a very important intervention in controlling the SARS epidemic.
I have also worked, together with the World Health Organisation, as part of the Imperial College group on contact tracing in Ebola, where it was understood both that it was an important intervention and that it helped in the assessment of how the control efforts for Ebola were doing.
In that context, we were modelling to try to understand, and to help to provide information to support the containment of Covid. We found very early on, looking at the data being published from China and Singapore, that what differentiates Covid is that it is transmitted before people become symptomatic. We were modelling manual contact tracing and were in the process of writing a paper where we concluded that manual contact tracing would be unlikely to be quick enough to get the message to people who were infected before they became infectious. There was a limit, and you could not get ahead of the epidemic. The app solves the problem of how you get the message to the person who might be infected before they become infectious and symptomatic.
Q374 Chair: That is very clear. Speed is of the essence. You referred to some of your recent experience in other countries. Which countries do contact tracing by apps best at the moment?
Professor Fraser: Singapore was the first country to introduce the TraceTogether app, but that app is very closely tied to manual contact tracing, in the sense that the message is a matter of passing the phone to the manual contact tracing teams. It has had relatively low uptake.
About 10 days ago, a contact-tracing app was released in Norway. It is still in the phase where it is being evaluated at regional level, but uptake has been very high—in fact, it is higher than the total population of the areas where it has been used. Iceland has adapted the Singapore TraceTogether app. In the countries that now have very high uptake of the app, Norway and Iceland, I think it is too early to tell how effective the intervention has been.
On other countries that have used apps, there have been multiple apps in different regions of China; there have been apps in Singapore, and they are now appearing in other countries. They are not strictly contact-tracing apps because they are not about measuring proximity. They collect much more information than the contact-tracing apps that have been developed by multiple European countries, by NHSX and by independent research groups in the United States.
Q375 Aaron Bell: I guess my questions are for Professor Fraser or Mr Gould, depending on whether we are talking specifically about the UK or in general. To get into some of the technical guts of how an app would work, is a contact a yes/no flag, that a contact has or has not happened, or is it something we measure as the probability of a contact? Perhaps Professor Fraser could begin. If Mr Gould has specifics about what we are doing for the NHS, that would be helpful.
Professor Fraser: The contact is a continuous measure, which is dependent on many variables, such as the actual proximity and duration of the contact. In manual contact tracing, the rule is that you ask somebody whether they spent 15 minutes or more with a contact at less than 2 metres or whether they had a face-to-face conversation. Of course, somebody would approximate it in evaluating that.
With a low-energy Bluetooth signal, you have a continuous measure of attenuation between the two phones, of duration and maybe repeated contacts. Essentially, the challenge is that you have to turn that into a binary decision. Was it a meaningful contact where transmission could have happened, or was it a contact where it was unlikely for transmission to have happened? The challenge is to send notifications of risk contact to those who are above the threshold and not send them to contacts who are below the threshold.
Matthew Gould: At one level, there will always necessarily be a binary quality: are you being advised to isolate, or are you not being advised to isolate? Behind that can sit a more subtle algorithm. If you are providing advice to the public or doing manual contact tracing, you need to keep the decision making relatively simple and straightforward, but, if people are wandering around with what is effectively a powerful computer in their pocket, it can work on a more subtle contact risk model.
For example, the model can take into account that you may have had one significant contact over a prolonged period of time with somebody who subsequently became symptomatic, or you may have had a series of shorter contacts with a number of people who became symptomatic, both of which could contribute to the level of risk.
The approach we are likely to take is to start with a relatively straightforward risk model but, over time, see if we can work up something smarter that can develop into a system that can take advantage of the ability to work out more accurately, based on experience to date, what constitutes a sufficient threshold, developing the risk model as we go. We have made a commitment that we will publish that risk model as well, so how we are doing it is transparent.
Q376 Aaron Bell: Thank you, Mr Gould; you anticipated some of what I wanted to ask. It seems that we have potential for a much richer approach than a yes/no approach, but, at some point, we are turning it into a yes/no. Will we keep the old data so that, if we improve the model, we can then amend the criteria that we use to set that threshold, and retrospectively go back and say that we now think it is a contact, whether that is based on medical evidence or based on the total workload generated by the app?
Matthew Gould: The way it will work is that people’s phones will keep a record of the anonymised tokens of those they have been in touch with. That data will stay on people’s phones until such point as they become symptomatic, when they will have the option to give us the list of randomised IDs of those they have been in touch with. That will allow us to do the cascades of warning that Christophe talked about. It will also allow us to see the wider contact graph of how the risk is propagating more widely, and what the contacts are between people, on an anonymous basis. Over time, that will allow us to hone the algorithm in precisely the way you talked about.
To be clear, what we have are identifiers rather than identities. The data sits on people’s phones until they choose to share it with us, so there are a series of protections that allow people to be confident in using it that their privacy is being protected, even as it allows us, at the same time, to hone the algorithm and develop a more sophisticated risk model.
Q377 Aaron Bell: Going to the macro level, is it feasible to expect 80% of all smartphone users—around 55% or 56% of the UK population—to use such an application? You have just talked about some of the privacy and surveillance fears, and the increasing anxiety, if you have an app like that. How do you propose to encourage and incentivise uptake of the app?
Matthew Gould: It needs to become part of the core message that, as the country looks to reduce the restrictions it is under at the moment and the Government face difficult choices, the way we can manage that safely is by being confident that we can rapidly detect and isolate people who have recently come into contact with new Covid cases.
The message needs to be that, if you want to keep your family and yourself safe, and you want to protect the NHS and stop it being overwhelmed, and at the same time you want to get the country back and the economy moving, the app is going to be an essential part of the strategy for doing that.
To be blunt, the levels of download that you mentioned, which would be optimal for making the thing work, will be tough; it will require us to get the message over that this is a core part of how we move forward. It will require us to earn and keep people’s trust that we are doing it in the right way so that they understand what we are doing and can trust us with the way we are doing it. It will require us to have messages from everyone people trust, from both the Government and politics, and more widely. It will require us to find messages and messengers that resonate in all the communities of the country that we need to be part of this. It will require an enormous comms effort, but if we can do it and get that level of trust and participation, as Christophe said, the impact on our ability to manage the situation will be important.
Q378 Aaron Bell: Some of my colleagues have questions about privacy and the legal aspects. More generally, you mentioned that it will be anonymised codes identifying devices rather than people but that it is a potential opportunity for us to learn a lot more about the disease as well. Could there be different levels of data-sharing consent built into the app?
Matthew Gould: Yes. One of the things that it is important to say is that the app will iterate. We have been developing it at speed since the very start of the situation, but the first version that we put out will not have everything in it that we would like.
We are quite keen that subsequent versions should give people the opportunity to offer more data if they wish to do so. For example, it would be very useful epidemiologically if people were willing to offer us not just the anonymous proximity contacts but the location of where those contacts took place. That would allow us to know that certain places or sectors were a particular source of proximity contacts that subsequently became problematic. If people were willing to do that, and I suspect a significant proportion would be willing, it would be very important data, because it would allow us to have an important insight into how the virus was propagated.
Q379 Chair: Professor Fraser was indicating that he would like to come in, partially in response to that question.
Professor Fraser: To link together the last two questions, we have been advising closely NHSX and Matthew’s team, but we have also been advising other countries that have made different choices. In particular, the question of whether you can turn a continuous signal into a binary decision—yes, we think this is a risk contact; no, this isn’t a risk contact—requires continuous validation of the outcome.
You need to be able to estimate, of the proportion of people who received the notification, whether they were above the threshold and what proportion went on to develop the infection. You would work that out, and they would then upload or declare themselves as cases through the consent-based process. Similarly, for those who fell below the threshold, it would ask what proportion became cases.
It is about evaluating and improving the process, and being transparent about the strength of evidence, and what proportion of people who receive notifications actually develop infection. For manual contact tracing, typically, a relatively small number of contacts are identified, and about 15%, somewhere between 10% and 20%, of contacts notified through manual contact tracing for Covid are typically infected.
In terms of advising other countries, we have worked very closely with countries such as Switzerland, which have chosen a decentralised approach based on privacy considerations. We have not yet found a system to do that evaluation. You can model the different relationships between how the contacts are measured and whether notifications are sent, but the trade-offs in epidemiological efficiency, and being able to validate and have the transparency that the messages are based on the best current available evidence, depend on those choices being made.
Q380 Chair: Is the learning and feedback loop that you described going to take place through machine learning, or does it export the data to be analysed by researchers who then tweak the algorithm? Is that adjustment internal or external?
Professor Fraser: The proposal so far is that we would help to draft, together with other scientists, a series of analyses and evaluations, but that would be done by NHSX.
Chair: It would not be done automatically through machine learning.
Q381 Aaron Bell: Professor Fraser, from your estimations, could you give a figure for how much the use of such an app is likely to reduce transmission of Covid? Secondly, how many physical contact tracing staff would be required to maximise the effectiveness of the app and get that reduced transmission?
Professor Fraser: We have been doing extensive simulations for the last month to validate that our simulations represent the known contact structure of people in households, in workplaces and randomly, tailoring random mixing and those simulations to what is known about the transmission of Covid, and testing different ways in which the contact tracing app could work.
For example, you could send a notification immediately based on self-diagnosis, which would result in somebody being notified that they were maybe an amber warning, that they were a contact of a suspect case. Then, at a later date, when the person was tested, if they tested positive, you could send a further notification saying that they were a contact with a confirmed case, or you could wait until you had the test.
We have simulated different times you would wait for the test result to come back, and then you would send a notification only after the receipt of a positive test. There is a difficult choice, because we found that the predicted epidemic curves are quite different under those two scenarios. The difficulty with Covid is that it is transmitted quickly, before people acquire symptoms, so the second route of waiting for the test would result in less control of the epidemic and a greater possibility that it would be resurgent.
Because we do not know what the uptake of the app will be, we have modelled a whole range of different uptakes and adherents of the app. In scenarios that are relatively pessimistic with respect to other control measures in place at the same time, we have found that, if roughly 60% of the population used the app, it would be enough to bring the reproduction number below 1 and control the epidemic. That would be not just downloading the app but adhering to instructions.
There would be a public health intervention, asking people to self-isolate and then, potentially, to quarantine for an amount of time. We think that would be greatly enhanced by a good relationship between that system and manual contact tracing, such that people understand and reinforce the messages of adherence. But those numbers will depend on what other interventions are there.
If you are trying to bring down a reproduction number that starts at 3 after the lockdown to somewhere below 1, if you have other interventions in place, or if social distancing continues after the lockdown and you have to go from 2 down to 1, perhaps a slightly lower uptake of the app would achieve the same effect. The difficulty is that you need to make assumptions not just about how many people download the app and what adherence there is to instructions; you need to place it in the context of what other interventions there are in a broader exit from lockdown strategy.
Q382 Chair: Thank you. If we could try to keep our answers succinct, we can get in lots of questions. We have plenty on the law for Professor Edwards, which we will get to once we have understood the technology.
Matthew Gould: I agree with what Christophe said. A lot will depend on context. The precise numbers of contact traces[1] needed will be an issue for Public Health England, which is leading that part of the strategy. The underlying point is the important one that the app makes sense as part of a strategy where there is contact tracing on one side and testing as well.
We need to make sure that the hinge between those three parts works, so that, for example, if somebody becomes symptomatic or subsequently tests positive, as well as being able very quickly to find out who they have been in touch with who had the app, we will also have a more manual process to work through who they might have been in touch with who clearly would not have had the app. It has to be part of an integrated strategy.
Q383 Chair: When will the app be ready for deployment?
Matthew Gould: We are working at it full pelt. We hope in the next couple of weeks that we will be in a position to roll it out in a small area. Given that it is essentially new technology, and part of a wider strategy with several moving parts, it makes sense to see how it might work locally before going national. I hope that we will be ready in the next couple of weeks to look at it in a controlled and relatively smaller environment before scaling up.
Q384 Chair: When do you expect it to be available for mass deployment?
Matthew Gould: For mass deployment, it depends on the wider strategy. It is not a stand-alone; it is embedded in the wider approach of what we are doing with the restrictions, the testing and the tracing.
Q385 Chair: But it cannot be part of the wider strategy if it is not available, can it? For that, you need to make it available. When do you expect it to be available for deployment as part of the wider strategy?
Matthew Gould: I would expect us to have it technically ready, subject to its performing in trials in the smaller area in the way we expect, for wider deployment in two to three weeks. Whether it is then deployed depends on the wider strategy. That was my point.
Q386 Chair: I see. When did work start on development of the app?
Matthew Gould: Professor Fraser will remember when we had our first conversations. From memory, it was about two weeks before the lockdown started, so it was relatively early in the process.
Professor Fraser: Our first meeting was on 7 March.
Q387 Chair: Was it not possible, once we knew that Covid-19 was going to be extensive, to start the preparations so that it might be available for mass deployment at the point at which the lifting of social distancing measures was being contemplated? Could it have started before March?
Matthew Gould: Yes, it could, and with the benefit of hindsight I wish that we had done it. But we very quickly moved when Professor Fraser gave us the epidemiological basis for why it would be a powerful intervention. It may not be much comfort, but if you look at when we started to work on this compared with many internationally, we were fairly swiftly out of the gates. I hope that we will be ready when it is most needed, which is at the point when the country is looking for tools to get out of lockdown safely.
Q388 Chair: Why are we doing it ourselves rather than using what other countries have already deployed? Why are we having a UK bespoke version, rather than making use of others?
Matthew Gould: We are co‑operating very closely with a range of other countries. We are sharing code and technical solutions, and there is a lot of co-operation. A key part of how this works is not just about the core Bluetooth technology, although that is an important part of it, but about the back end, and how it ties in with testing, tracing and everything else. A certain amount of it necessarily has to be embedded in the national approach.
We are sensibly trying to learn international best practice and share it, and we have shared quite a lot of the technological progress we have made in certain areas, but it has to embed in the wider UK strategy, so there is an irreducible amount that has to be done nationally.
Q389 Chair: This Committee has taken evidence on testing in recent weeks. There seems to be a settled consensus that we did not have testing available at the scale that would have been optimal at the time when we needed it, at the peak of the pandemic, although it continues to be needed.
Looking at the development of that testing capacity, there is a reflection that it was rather slow to start, or at least that it started but then changed course and only in recent weeks has been substantially expanded. Is there a concern that, in the development of this app, it will come to full fruition a few weeks after it would be really desirable, at the point at which decisions are made about the strategy for social distancing measures?
Matthew Gould: I hope not. We are, I hope, on course to have the app ready for when it will be needed, at the moment when the country looks to the tools to come out of lockdown safely. We are going as fast as we can; we have teams of people working at it literally 24/7, because we are using development teams around the world. We are going as fast as we can precisely to avoid the situation that you described.
Q390 Chair: No one doubts the effort being put into it and the commitment of everyone responsible. I guess there is a question as to whether we are learning lessons from aspects of the handling of the pandemic that have an application elsewhere.
In the case of testing, following international models, there was a particular reflection on having a decentralised approach and having a large number of testing stations and labs available, and that seems to have been beneficial to other countries. Have you studied the progress of testing and mined it, as it were, for its application to contact tracing apps?
Matthew Gould: Yes. Hinged testing will be one of the key elements of the way the process will work. As Professor Fraser said, we will give people the chance in the process to tell the app what symptoms they have and start a precautionary cascade that way, and then subsequently get a test so that they can confirm that it was a case of Covid—in which case, the people they have been in touch with will be confirmed in the advice you have given them—or it was not, in which case you can release them. We have been working very closely with the testing strand.
To answer your question directly, yes, we have been trying to learn all the lessons we can. As Professor Fraser said, we first discussed this in early March, and we have been cracking on in a fairly single-minded way ever since, to try to get it ready for the time it needs to be deployed.
Q391 Andrew Griffith: Thank you, Mr Gould, for everything that NHSX has done and continues to do. We all recognise the Herculean effort, for an organisation that itself was in flux when the crisis broke, in putting its full resources behind this.
To follow up the Chair’s questions, where are we at the moment in the process of cutting code, getting acceptance in app stores and testing that code?
Matthew Gould: I would say that we are advanced. We have a working model that we are looking to deploy in a small area in the next week to two weeks. We are in close contact with the app stores, we are load-testing, and we are going through a rigorous assurance process to make sure that it can do what we want it to do, that it can scale, will be stable and performs as we expect it to perform.
Q392 Andrew Griffith: In addition to your own excellent teams, what prime contractors are you working with?
Matthew Gould: The prime contractors are VMware Pivotal Labs. They are the people doing most of the building. We appointed them very early on because of their technical capability and our experience of dealing with them as a development shop, and they have done very well. We have worked with a number of others, including Zulka. We have had user researchers and interaction designers from the NHS Business Services Authority, and we have had the benefit of NHS Digital’s assurance process advising us on the things we need to do to make sure that the thing behaves as we need it to behave.
We have worked with a range of others. Obviously, inside the system, we have worked very closely with Public Health England, and the office of the Government chief scientific adviser. More widely, a lot of people have helped us, including the BBC, with testing. We have had the benefit of a range of partners.
Q393 Andrew Griffith: I have one final question before my colleagues move on to privacy and people’s legitimate concerns. Slightly from the other direction, on speed to market and getting as quickly as possible a minimum viable product to aid in lifting the lockdown that is hurting our economy, to what extent are people’s legitimate concerns about privacy nevertheless contorting what we would otherwise do?
Matthew Gould: I do not think they are. It is a very fair question, but the system we have developed, of people using randomised identifiers, storing them on their phones and uploading them when they become symptomatic so that we can do the cascades of warning that the system delivers, to a considerable degree squares the circle. It is effective, fast moving and does what we want it to do, but at the same time it preserves people’s privacy. I do not think that we have delayed the process or made it less effective while preserving people’s privacy.
Andrew Griffith: I know that we are working with Apple and Google, but this is not the decentralised approach that is most compatible with their solution. To the same point, are you comfortable that—
Chair: Order. We are going to have a minute’s silence in honour of those who lost their lives in the care sector during the crisis.
A one-minute silence was observed.
Chair: Thank you colleagues and witnesses. Andrew, would you like to rehearse your question?
Q394 Andrew Griffith: My final question was on a point about speed and expediency. Would it not have been better to go with the more compatible, decentralised Apple and Google approach?
Matthew Gould: First off, we are working very closely with Apple and Google. We talk to them frequently and in detail about what we are doing, what APIs we are using and how it is working.
Secondly, the Apple and Google approach is itself evolving, and it is not there yet. They have said that they will do a two-stage process, first to try to make an API available, allowing those developing contact tracing apps to do so more effectively. The second stage is to develop their own contact tracing product, but we are some way from that second stage, so waiting for them would slow us down considerably.
There is a wider question about centralised versus decentralised, and whether we should go for a decentralised approach along the lines that are talked about. There is something of a false dichotomy, between centralised equals non-privacy secure: decentralised is privacy friendly.
We firmly believe that our approach, although it has a measure of centralisation, inasmuch as you upload anonymised identifiers to run the cascades, none the less preserves people’s privacy in doing so. We do not believe that it is a privacy-endangering step. Doing that allows you to see the contact graph of how this is propagating and how the contacts are working across a number of individuals, without knowing who they are, which allows you to do certain important things that you could not do if it was just phone-to-phone propagation.
For example, one of the concerns around contact tracing is the ability to detect malicious use. One way to do that is to look for anomalous patterns; even if you do not know who the individuals are, you can see anomalous propagation, which the approach we have taken allows, but we are not clear that a decentralised approach would allow. Ditto, you might have a situation, as we might end up in, where people declare themselves symptomatic and you run a cascade on the basis of that. If they then get a test, as we hope they would, and find out that they do not have Covid, we want to be able to release all the people who were previously given an instruction to isolate on the basis of their being symptomatic.
If it was done in an entirely decentralised way, that would become very difficult, because it would have all been done phone to phone, and you could not go back to those individuals to say that they did not have to be locked down because their index case turned out to be negative. We believe that there are big advantages in the way we are doing it, and we do not believe that it is privacy endangering.
Q395 Chair: I understand that at the weekend Germany changed its approach from centralised to decentralised. Is that correct? Why did it take that decision?
Matthew Gould: I have heard the same. I do not know the basis for that decision. We are talking to them, but I am not sure that we have had a conversation since that decision. All I would say is that we believe that there are profound benefits from being able to see the contact graph, not just the cascade running from phone to phone and user to user but how it propagates more widely, so that you can detect patterns.
Chair: You may have heard in our earlier session at this hearing that the importance of gathering data to inform research and practice was very strongly emphasised.
Q396 Zarah Sultana: Mr Gould, we understand from Google and Apple that they would be able to disable the programming interface that would support a contact tracing app when it was no longer needed. Would that mean that the app developed by NHSX could be turned off by Apple and Google at any point?
Matthew Gould: It is a fair question. Rather than make up an answer, can I write to the Committee to give a definitive answer? Certainly, it was always our expectation that, after the Covid situation was over, we would shut the app and people would no longer have it on their phones. Let me write to you to give you a definitive answer, if that is okay.
Q397 Chair: We would be grateful if you could do it quickly so that when we reflect on this session we can include it.
Matthew Gould: Of course.
Q398 Zarah Sultana: What are the implications for privacy? Will the decision to stop collecting data be for NHSX alone, or will it be Google and Apple entwined?
Matthew Gould: I hope the decision will be a collective decision of the UK authorities. Emphatically, it will not be mine; it will be for the chief medical officer, the Government chief scientific adviser and, ultimately, the Secretary of State and the Prime Minister. Does that answer your question?
In terms of Google and Apple, we are working very closely with them. We are trying to achieve the same thing and working out technical answers to how we do it. We would not expect them to take decisions about how we were running the service and the process that we had set up.
Q399 Zarah Sultana: What are the risks of non-official applications circulating, and what will be done to protect the public against that risk?
Matthew Gould: There are a number of non-official symptom-checking apps around, and some of them actually provide very helpful data and advice to the system. We have set up mechanisms whereby we can take in the data that they have provided, which has been highly useful, the ZOE app being one such example.
On contact tracing, it is important that there should be one contact tracing app, which will be the NHS Covid-19 app. If we start to get a proliferation of different contact tracing apps, it immediately fractures the population of people who have apps and stops being effective. We need one NHS app, which we need people to get behind, download and use, and we need to get the largest number of people to do that, which means being clear. Google, Apple and the app stores have been clear that for contact tracing, the offer to the public should be the app developed by the public health authority in the jurisdiction concerned.
Q400 Darren Jones: We have heard today that there are plans for different iterations of the tracing app as the technology develops. The answers that we have been given just now on how, when and who will mothball the app have not been particularly confident.
When we are trying to understand the privacy implications, and thinking about privacy by design through the lifetime in the use of these apps, it is important that we understand the scope and who has authority to do what. We also heard today that Switzerland decided to take the decentralised approach by focusing on mobile providers as opposed to one central server because of their concerns around privacy.
My first question is to Professor Edwards and then to Professor Fraser. Could you help the Committee to understand what the privacy implications are between taking a handset-based decentralised approach compared with a centralised server approach?
Professor Edwards: I am obviously not a security expert or a cryptographer—I am a lawyer—but there is an intrinsic risk in building any kind of centralised index of the movements, or social graph, as it is called, of the entire population, which might be retained in some form beyond the pandemic. Without absolute details of the technology, which I was exposed to in an earlier form only at the weekend, it is hard for me to say more.
This is, essentially, a bad precedent. We have the precedent of previous pandemics leading to a mass land grab in extensive state surveillance. That is my worry. Much will depend on the details; the devil is in the details, which is why colleagues of mine were pressing for more publicity on this earlier. Much depends on the nature of the ephemeral IDs and the persistent IDs, and how pseudonymous it is.
Q401 Darren Jones: Professor Fraser?
Professor Fraser: I am not an expert on security or cryptography. I have analysed databases for manual contact tracing in the past, which are centralised databases. In this particular case, the assessment of the privacy and security of the two different proposals is for others to comment on.
I reiterate that the planned analysis that we would recommend be done, as part of the auditing and improving of the centralised model, would be based on anonymous IDs of the index case contacted and the contact case. You would be looking at the link between those anonymous IDs and whether the contact developed symptoms at a later date or did not so that you could test and audit the model you are using to decide who receives the notification that they are at risk and who is not.
Q402 Darren Jones: Mr Gould, it was reported yesterday that GCHQ had been involved in advising NHSX on the development of the app. Have the intelligence services proposed to you whether you ought to take a centralised or decentralised approach?
Matthew Gould: The National Cyber Security Centre, along with a number of others—the Information Commissioner’s Office and the National Data Guardian for the NHS—has been advising us. As it is the technical authority for cyber-security, I am very glad to have had the advice of the National Cyber Security Centre.
To answer the underlying point if I might, we have said that we will open‑source the software and publish the privacy and security model underpinning what we are going to do. The whole model rests on people having randomised IDs, so the only point in the process at which they need to say to us who they are is when they need to order a test, having become symptomatic, because it is impossible to do that otherwise.
They will have the choice both to download the app and turn it on and to upload the list of randomised IDs of people they have been in touch with. They will also have the choice, at any point, to delete the app and all the data that they have not shared with us up to that point. What we have done has respect for people’s privacy, but at the same time it is effective in being able to keep people safe, with a series of steps at which people have to choose to be part of it—repeated points of consent and repeated safeguards.
Q403 Darren Jones: Thank you. I am conscious that you chose to answer the theme as opposed to the specifics of my question. I have a few specific questions, so could you just answer them directly, because I am conscious of time? My question just now was whether you had been advised by the National Cyber Security Centre, a function of GCHQ, to take a centralised or decentralised approach?
Matthew Gould: The National Cyber Security Centre was part of the discussions in which we decided to take the approach that we have taken.
Q404 Darren Jones: Thank you for that answer. I think I might move on. A question has been raised about what happens to the data after the app has been retired. What will happen to the datasets that will be uploaded to your centralised server?
Matthew Gould: If people have chosen to share them, particularly in relation to some of the later versions of the app, which we hope will give people the opportunity voluntarily to offer more data, there is the possibility of being able to use the data subsequently for research purposes.
We have said all along that the data from the app will be used only for controlling the epidemic, helping the NHS and public health and for research purposes. If we are going to ask people whether we can keep their data for research purposes, we will make that abundantly clear, and they will have the choice of whether to do so.
Q405 Darren Jones: It might be useful, if you are amenable, Mr Gould, for our Committee to look at the privacy policy before the app is released, because I am not entirely clear from your answer about what happens with the data afterwards, so we will want to explore that further.
Moving to my next question, you might have heard in the previous session the debate about immunity ID cards, or passports. Has NHSX done any work on developing those digital immunity ID cards?
Matthew Gould: As in line with the earlier discussion, the science is a considerable way from being able to underpin something like that, so we are not at a point where we are building something like that. We have been approached by any number of people offering us solutions in that space, and we have started the very early stage of looking through the solutions and looking at what is available.
I would not want the tech cart to come before the horse; we need to work out what we are trying to achieve and what the science will allow us to do, as well as what the policy is. Then we will be able to work out what tech underpinning it needs. Whether it will be NHSX or another part of the machine doing it, is not yet clear.
Q406 Darren Jones: Evidence submitted to our Committee from Onfido, a company providing immunity passport solutions in the United States, referred to needing to use facial recognition technology. Can you confirm that there are no plans in the UK to follow that particular path?
Matthew Gould: We are far from being able to get into that level of detail. We are not planning that, but we are not at a stage where we are even getting into that level of detail. As I say, the science and the policy need to come before the technology; we need to work out what we are trying to achieve before we can work out how we build it.
Q407 Chair: Is not a fundamental question of design whether it is going to use facial recognition or not?
Matthew Gould: I would put that into the category of means. At this point, we are not at that stage. We are not planning, nor have I seen any plan, to use facial recognition. We are some way in advance of the level of detail in what we are trying to achieve to be able to work out what technologies you would use to achieve it.
Q408 Chair: To follow up on the questions about security and privacy settings, do you intend to publish the app’s source code as well as its security and privacy settings before the app is rolled out?
Matthew Gould: We definitely intend to publish the source code. On the precise point at which we publish it, can I get back to you? At the moment, we are still building and still getting ready to test the thing.
Q409 Chair: Would it not be strange to ask people voluntarily to sign up to an app if you were unable to give confidence as to what the security and privacy settings were?
Matthew Gould: The privacy model and the security settings we will publish for sure.
Q410 Chair: Before the app is released.
Matthew Gould: Before it goes nationally. I would not want to commit to publishing them before we do local area testing, because we want to see how it works and whether we need to make changes.
Q411 Chair: For those tests, you would presumably disclose that the privacy and security settings were not yet publishable.
Matthew Gould: Yes, and we will be open about what we were doing and why we were doing it.
Q412 Chris Clarkson: Do NHSX and the Government intend to carry out any kind of data assessment impact on privacy?
Matthew Gould: Yes, we will for each iteration, and we will publish it.
Q413 Chris Clarkson: However you cut it, you will be using an amount of personal data that is transferred to you. Do you envisage any additional legislation being required, or regulatory guidance?
Matthew Gould: Not at this stage. We are working very closely with the Information Commissioner’s Office and the National Data Guardian to make sure that what we do is compliant with GDPR and the Data Protection Act 2018. We think there is sufficient legislation and there are sufficient safeguards in place for what we are trying to do.
Q414 Chris Clarkson: I appreciate that the ICO said that it was comfortable with the use of generalised location data. You talked about later iterations of the app and people sending more data through. Do you envisage needing to revisit that at some stage?
Matthew Gould: At every stage, we will do a data protection impact assessment, and at every stage we will make sure that the Information Commissioner knows what we are doing and is comfortable with it. We will proceed carefully and make sure that what we do is compliant.
Q415 Chris Clarkson: Professor Edwards, the Justice Secretary told the Joint Committee on Human Rights that he was satisfied with the prioritisation of data privacy in the security app’s development. What are your thoughts? I am thinking in particular of your GDPR paper. I would like to get your buy‑in on this.
Professor Edwards: I am very gratified to hear that a data protection impact assessment is being prepared and will be published. It will be very important to have a schedule on that, at least at some draft level as, obviously, the technical details of the app are changing from day to day. I think as of Friday, when the Ada Lovelace Institute had a seminar, Simon McDougall of the ICO reported that he had not seen details of the plans.
There has been a slight information gap. This is a situation with an app that has high-risk stakes, involving very sensitive personal data, where there is clearly a GDPR obligation to prepare a data protection impact assessment, and one might have thought that prior consultation and a formal sign-off by the ICO would be desirable. However, it is very good to hear that news, which, for some time, I have been personally pressing for.
Another point is that this is not just about the GDPR. We have already heard from Susan Michie, very cogently, that there are huge issues about the societal discrimination that may be created, about social stigma and, perhaps, about autonomy—being allowed to leave your home, take up your employment and go to public places, perhaps to go to football stadiums. Will there be any kind of compulsion—incentivisation might be a better word—to download the app, use it and share the data? That becomes exponentially worse, obviously, if we move to a scenario where we have immunity certificates or passports.
The reason why I and my team prepared the draft Bill, which has had a certain amount of traction, was to deal with the social issues that go beyond the technical details of the privacy and personal data gathering, the pseudonymisation and the choice of centralisation or decentralisation. My feeling was that the debate had bogged down a bit in that technical architecture, and we were not considering enough the surrounding penumbra of digital exclusion, discrimination, compulsion or effects on autonomy.
Very simplistically, our Bill tried to draft safeguards relating to that—for example, that no one should be compelled to install the app. I am sure people will instantly say that the Government have repeatedly made commitments that it would be voluntary, that no one would be required to install it and there would be no compulsion; but none of that is in hard law. You might extrapolate some of it from basic human rights, employment law and non-discrimination law, but it is not clearly laid down in the same way as the GDPR. That is the first point where I think we need legislation.
What we have seen already, obviously in an emergency situation, is that guidance can be confusing, and can confuse public messaging, commitments can be rolled back and the police may misinterpret or differently interpret it. There is a clear need for hard law, whether it is in primary statute or whether it is possible in some way to make it as delegated legislation, as SIs, perhaps under existing coronavirus or public health legislation.
My second point is—
Chair: We are about to run out of time, Professor Edwards, so if you can be succinct I will go back to Chris.
Professor Edwards: My second point is that the GDPR covers only personal data; it does not cover anonymised data. We are talking about data that may be very personal and sensitive being retained, with the consent of the users.
There is much talk about this data being anonymised and being reused in various ways, and perhaps even shared with the private sector, but there is already a vast and cogent literature that shows that the level of anonymisation routinely practised, even I think in the NHS, may not be sufficient for this extraordinary data. That is the other area that really needs looking at. The Bill recommends that a new code of practice be evolved relating to anonymisation standards.
Chair: Chris, do you have any further questions?
Chris Clarkson: Mindful of the time, I will cut it off there. Thank you very much, Professor Edwards; you answered one of my follow-ups anyway.
Q416 Chair: Matthew Gould wanted to provide some additional information.
Matthew Gould: I wanted to knock on the head very quickly the concept that any data could be shared with the private sector. This is data that will be probably under the joint data controllership of DHSC, NHS England and NHS Improvement. I see no context in which it would be shared with the private sector. The Digital Economy Act makes it clear that reidentifying deidentified data, or in this case anonymised data, is illegal. There is a series of protections in place, and I would be very sorry if people started talking about sharing this data with the private sector as if it was a possibility. I do not see it as a possibility.
Chair: That is a helpful clarification.
Q417 Katherine Fletcher: Professor Edwards, I am not a lawyer—I am a biologist—but it strikes me, as you have already referenced, that this is an extraordinary pandemic. It is unprecedented, as you have said. Is there any research to understand the tolerance of the British people to the trade‑offs that we are going to need between the science on protecting us and the law? Ultimately, the law is made by representatives on behalf of the people, and it strikes me that that would be very valuable.
Professor Edwards: I do not know of research of exactly that kind. There is long-standing research about the proportion of the population that really worry about privacy, which is usually about 20%, whom you might call, disparagingly, “privacy fundamentalists”. If you are talking about getting 80% of smartphone users to use the app in a full and consented way, you cannot dismiss those people as unreasonable. You need to have them on board.
Q418 Katherine Fletcher: You were talking about the need to encode protections in hard law. Are you aware of any of the current processes breaking existing law?
Professor Edwards: No, I am not aware, because we do not have the detail. As I keep saying, the devil is in the detail.
One slight worry I have, which has not really been explored at all, and which I need to research, is whether any directions or guidance given by the app—we have been told repeatedly that it will only be guidance—might form directions to potentially infected persons under the coronavirus regulations, in which case criminal sanctions might follow from disobeying them. That is an area where, again, a briefing note would be very useful from, perhaps, the Lord Chancellor. I do not think it is an ICO job.
Q419 Carol Monaghan: Matthew Gould, we have heard this morning that the app is two to three weeks from being ready to be rolled out, yet you said in response to my colleague, Darren Jones, that at this stage you did not know whether facial recognition would form part of the app. I find those two statements contradictory. Could you explain that contradiction, please?
Matthew Gould: I am sorry; the misunderstanding might be mine. There is no facial recognition in the app. I took the facial recognition question in the context of a separate conversation around possible tech support for any sort of certification on immunity or risk. It was that discussion. The app itself will have no facial recognition.
Q420 Zarah Sultana: Migrants’ organisations and Doctors of the World have historically campaigned against data sharing between the NHS and the Home Office. Will the NHSX app share data with the Home Office?
Matthew Gould: We have been clear that the data will only ever be used for NHS care, management, evaluation and research. That was an up-front promise right from the start, and I think it should be very clear.
Q421 Chair: I have a couple of brief final questions. On the take-up rate, if it is going to be voluntary, if someone discovers through their app that they have been proximate to someone with the coronavirus, would they then be obliged to isolate themselves for a period of time?
Matthew Gould: The process is entirely voluntary. Having the app is voluntary, uploading symptoms is voluntary, and the advice that comes out is advisory. The entire process rests on the consent, engagement and willingness of the public to be part of it. That is the basis on which we have built it, and I think it is the only basis on which it can work.
Q422 Chair: If your phone tells you, whether through a centralised approach or in a decentralised model, that you have had exposure to someone suffering from Covid-19, you have that information and it is entirely up to you what you do with it—whether you choose to stay at home or choose to continue your daily life, perhaps even working in a care setting.
Matthew Gould: The professor made an important point earlier around the question of direction under Covid regulations, which I shall need to double-check, but my understanding is that the basis on which we are building this is that it is an advisory to users of the app.
Chair: I see. You can see that it is obvious that there are difficult implications. If it is advisory and someone has had sustained contact with someone who has proved to be infectious with Covid-19, if they were working in a care setting that might give cause for concern. Equally, if there were compulsion, and if you happened to be doing your shopping in the supermarket and someone in the aisle had Covid-19 and it was reported and that meant you had to isolate for two weeks, you might not take your phone with you when you went shopping in the supermarket, to remove a risk that some people might think worth avoiding. There are some fundamental questions.
It has been a fascinating session, and I am grateful to all three witnesses. We are entering a phase in which some very important decisions will need to be made about how we can amend social distancing requirements. We know from our evidence from other countries, and from experts in this country, that contact tracing and the isolation of people who are found to have been in contact with infectious people is very important.
We also heard in our earlier session how important it is to gather data on this, so the question as to whether the contact tracing is manual or electronic is very important. It seems from the discussion today that a lot of fundamental questions remain to be resolved in this area, and it would perhaps be useful, before we make any final conclusions or reflections, to follow up with correspondence on areas where greater clarity might be needed.
We are very grateful for the work of all three witnesses in their different areas. We know that there is intense pressure and that a lot of hard work is being done, as with scientists generally, at a great pace and with great intensity. We are very grateful to you for your attendance here today and for your wider work in the community.