NHS Coronavirus tracking app

[PTR 444]

With an app aimed to mitigate the spread of Coronavirus due to be rolled out within the next 2-3 weeks, i thought it would be good to have a thread on it.

In case anyone isn’t aware, the app when downloaded uses Bluetooth to detect other phone users who have the app when nearby. If you tell the app you have symptoms, it automatically sends a message to anyone with the app you’ve been in contact with to self isolate.

In order for it to work, it needs 80% of smartphone users to download the app. There is still a significant proportion of the population who don’t have a smartphone however, and I wonder whether these people will be able to buy/rent devices for a heavily discounted price so they can download the app and help stop the spread of the virus.

 

[6862]

It would be interesting to have a poll to see how many members would download it.

 

[johnnychips]

And how many would ignore it if it told them to self-isolate. Not being cynical, just curious. Would it tell you where the contact was?

 

[scotrail158713]

It would be interesting to have a poll to see how many members would download it.

I’d be happy to. Seems a fairly straightforward thing for me to do in the fight against Covid19.

 

[yorkie]

As I mentioned in another thread, there are some flaws detailed here:

Contact Tracing in the Real World | Light Blue Touchpaper

..Anyone who’s worked on abuse will instantly realise that a voluntary app operated by anonymous actors is wide open to trolling. The performance art people will tie a phone to a dog and let it run around the park; the Russians will use the app to run service-denial attacks and spread panic; and little Johnny will self-report symptoms to get the whole school sent home...

And how many would ignore it if it told them to self-isolate.....

Quite! But I imagine they may say to get a test rather than self-isolate.

 

[Islineclear3_1]

I fear it will be open to abuse, violate privacy and usher in mass surveillance.

It's a tracking app that can detect when 2 or more people are within a certain distance of each other for longer than a specified amount of time. Will it automatically alert the authorities if you are out for longer than say, an hour?

I don't think I will be downloading it...

 

[PTR 444]

I will be downloading it as soon as it is available. Personal data tracking is the least of my worries when we need to fight the virus and get our country up and running again.

Maybe the government will introduce incentives for people to download the app, such as unlimited mobile data for a year or a free iPhone.

 

[londiscape]

I will definitely not be downloading it in it's proposed current form. Sorry about the long post but this is something I've been reading a lot about in the last couple of days.

NHSX has decided not to use the Apple/Google "Privacy Preserving Contact Tracing" open APIs, for which there is growing international and expert consensus as providing a suitable level of privacy by decentralising, limiting data to proximity, using anonymous IDs and allowing the user to control when data is released from their phone. Germany, France, Austria, Switzerland and Estonia (at least) are adopting this model, the first two having decided to do so recently.

So how do the coronavirus smartphone tracking apps actually work and should you download one to help?

Bluetooth, GPS, cell towers, code scanning: what’s the best way?

www.theregister.co.uk

Unlike the other systems that have been run centrally and with very limited information about how they function, Apple and Google have published the APIs that they propose using and focused on how to put the user in charge of their data.

In this case, the system uses your phone’s Bluetooth function. Bluetooth uses short-wavelength UHF radio waves to transmit data over short distances. Your phone constantly broadcasts a Bluetooth identifier that allows others nearby to see it and connect to it.

Apple and Google’s system would use this function to keep a record - on your phone - of every other Bluetooth device that you come close to - an effective method of knowing that your device was physically close to another device. If someone is then diagnosed as having COVID-19 they can self-declare that fact and their phone will release the identifiers of all the other devices that they were close to over the past 14 days.

Other people’s devices will then grab this list of identifiers and if their phone is on the list, they will be informed that they were close to someone with COVID-19 and may need to quarantine themselves.

This approach has several advantages: it doesn’t require precise location data, only relative location - you were close to this other person but it doesn’t matter where exactly you were when you were close to them. It also avoids the issue of a centralized database and control, with all the relevant data stored on individuals’ phones; data that is effectively worthless from a financial perspective. And it puts the reporting of a positive result into the hands of the individual.

Instead the NHS has decided to go its own way, building a centralised database of everyone's whereabouts and any other information they want. This has already attracted widespread academic criticism. One must wonder why the UK has decided to go down this path and "re-invent" its own platform when there is a perfectly good framework already developed and in progress in other countries? Surely the way to convince people that the government "promises to protect privacy" is to use the existing framework? One can therefore conclude there is no intention to protect privacy at all.

UK snubs Apple-Google coronavirus app API, insists on British control of data, promises to protect privacy

Why do it at all? Easier to audit and adapt, apparently

www.theregister.co.uk

Academics demand answers from NHS over potential data timebomb ticking inside new UK contact-tracing app

Slurp everyone's details and you create a hugely valuable hacker target

www.theregister.co.uk

Also myriad unanswered questions regarding the involvement of the two shady data analytics companies Faculty AI and Palantir - the former owned by Dominic Cummings' mate's brother and heavily involved in both Brexit and 2019 Conservative election campaigns (that is not to comment on those particular political positions themselves, merely that use of covert data gathering and analytics to sneakily manipulate opinion is itself distasteful, whoever does it), the latter owned by Peter Thiel and allegedly backed by the CIA and linked to the Trump administration. Given they're reportedly doing work on the "NHS coronavirus data project" for the round sum of £1, it's not too much of a stretch to suspect they want all that nice juicy data as the "valuable" bit.

Revealed: Palantir commits 45 engineers to NHS coronavirus data project, earns £1

<p>Palantir has committed 45 engineers to a government data project designed to predict surges in NHS demand during the coronavirus crisis, NS Tech can reveal. The pledge is likely to cost the controv

tech.newstatesman.com

 

[Bletchleyite]

It's a tracking app that can detect when 2 or more people are within a certain distance of each other for longer than a specified amount of time. Will it automatically alert the authorities if you are out for longer than say, an hour?

What would be the point in that when (a) that isn't the rule, (b) that isn't even the guidance, and (c) the whole basis of the app is to lift lockdown, not tighten it?

 

[Mojo]

I’m surprised/disappointed if it uses Bluetooth (could someone clarify - I’ve not seen any publicity on the App). I always have mine turned off in the phone settings. I understand people who have higher spec cars or accessories such as keyboards leave it on all the time, but I’m not one of such people!

 

[[.n]]

I’m surprised/disappointed if it uses Bluetooth (could someone clarify - I’ve not seen any publicity on the App). I always have mine turned off in the phone settings. I understand people who have higher spec cars or accessories such as keyboards leave it on all the time, but I’m not one of such people!

If you read the various bits of stuff around the various apps, there are quite good reason for using Bluetooth over other methodologies. I do agree though I generally have mine turned off unless I'm actually using it (same for NFC)

 

[Bletchleyite]

I’m surprised/disappointed if it uses Bluetooth (could someone clarify - I’ve not seen any publicity on the App). I always have mine turned off in the phone settings. I understand people who have higher spec cars or accessories such as keyboards leave it on all the time, but I’m not one of such people!

It does, and it has to. If you used GPS you'd have all sorts of people being wrongly in contact, e.g. in the small row of terraces I live in you'd have all 5 households shown as interacting, but in practice we don't. If you're going to use it you'll have to switch it on. Phone GPS is accurate only to about 10m, when what you want to find out is if people have been much closer together than that.

 

[Peter Mugridge]

I haven't a clue how to use Bluetooth... does it need wifi to work, or will it work through the 4G network? I never have my phone on wifi - especially not in public... for a start it's less secure and for another thing the 4G network gives a much better and more constant signal...

 

[6862]

Personally, I have no concerns about downloading and using it, if it lets us get back to work sooner! My only concern is the risk of false positives (through a wall etc). I don't care if the government are spying on me - I have nothing to hide!

 

[6862]

I haven't a clue how to use Bluetooth... does it need wifi to work, or will it work through the 4G network? I never have my phone on wifi - especially not in public... for a start it's less secure and for another thing the 4G network gives a much better and more constant signal...

Completely independent of Wifi and 4G. It operates on a different radio frequency, which I believe is optimised for short range, high quality signals.

 

[Domh245]

Also myriad unanswered questions regarding the involvement of the two shady data analytics companies Faculty AI and Palantir - the former owned by Dominic Cummings' mate's brother and heavily involved in both Brexit and 2019 Conservative election campaigns (that is not to comment on those particular political positions themselves, merely that use of covert data gathering and analytics to sneakily manipulate opinion is itself distasteful, whoever does it), the latter owned by Peter Thiel and allegedly backed by the CIA and linked to the Trump administration. Given they're reportedly doing work on the "NHS coronavirus data project" for the round sum of £1, it's not too much of a stretch to suspect they want all that nice juicy data as the "valuable" bit.

Not to mention GCHQ's involvement. Completely innocent I'm sure

 

[Mojo]

I haven't a clue how to use Bluetooth... does it need wifi to work, or will it work through the 4G network? I never have my phone on wifi - especially not in public... for a start it's less secure and for another thing the 4G network gives a much better and more constant signal...

There's also been issues, particularly on public transport, with people sending others explicit images.

 

[Bletchleyite]

There's also been issues, particularly on public transport, with people sending others explicit images.

I have mine on all the time and this has never happened. Also if a file is sent to you you're asked to confirm first, just click "no".

 

[Peter Mugridge]

Completely independent of Wifi and 4G. It operates on a different radio frequency, which I believe is optimised for short range, high quality signals.

Right... so if I had this app, I could still use the phone in the way I do now? It's just a matter of switching the app on and it does everything else that it needs to, including using the Bluetooth?

 

[Mojo]

I have mine on all the time and this has never happened. Also if a file is sent to you you're asked to confirm first, just click "no".

That isn't the point. I dread to think how horrible this must be especially for a solo traveller. On many phones, when a single image is being sent you get a thumbnail of the image, so clicking "no" is a bit too late.

Also I think you may be missing the obvious from this; from an Evening Standard article (https://www.standard.co.uk/news/crime/cyberflashing-trains-british-transport-police-a4365886.html) on the subject:

the majority of those targeted (88 per cent) were women

 

[Bletchleyite]

How on earth would you target it at a specific individual when you have no idea which person each phone is?

 

[Mojo]

How on earth would you target it at a specific individual when you have no idea which person each phone is?

Well for a start most people name their phone by their real name.

 

[Bletchleyite]

Well for a start most people name their phone by their real name.

Perhaps it's that we need to campaign against then!

 

[Qwerty133]

How on earth would you target it at a specific individual when you have no idea which person each phone is?

While it's not going to be an exact science I'd imagine it'd be quite easy to use various factors to have a good guess. Most default Bluetooth names contain information as to the make and model of the device and some include a first name, so it'd be pretty obvious that 'Bob's iPhone' is unlikely to belong to a woman using an android device.

 

[CaptainHaddock]

I haven't a clue how to use Bluetooth... does it need wifi to work, or will it work through the 4G network? I never have my phone on wifi - especially not in public... for a start it's less secure and for another thing the 4G network gives a much better and more constant signal...

I'm with you on this one. I have no idea what Bluetooth is and have no desire to find out if it means it will track my every move. More fool anyone who tries it.

 

[Qwerty133]

Bluetooth, in itself does not track location and is usually used as a way for devices to connect to each other in order to transmit data between them. The only way that Bluetooth could possibly be used to track location information would be by the installation of fixed Bluetooth points at locations that are of particular interest. That being said it appears that Bluetooth is only one of the technologies being used by the proposed NHS app and it may well also be tracking peoples movements using other technologies.

 

[6862]

Right... so if I had this app, I could still use the phone in the way I do now? It's just a matter of switching the app on and it does everything else that it needs to, including using the Bluetooth?

Yes I believe so, if you give it permission to access your phone's Bluetooth (which I am sure you will be prompted to when you download it).

 

[Bletchleyite]

Bluetooth, in itself does not track location and is usually used as a way for devices to connect to each other in order to transmit data between them. The only way that Bluetooth could possibly be used to track location information would be by the installation of fixed Bluetooth points at locations that are of particular interest. That being said it appears that Bluetooth is only one of the technologies being used by the proposed NHS app and it may well also be tracking peoples movements using other technologies.

Location isn't actually interesting, or at least isn't key. What's interesting is someone with COVID being next to someone else within transmission range. Bluetooth is absolutely ideal for that.

 

[Bantamzen]

I will be downloading the app, if for no other reason than sheer curiosity. I can see pros & cons in both the NHSX centralised database approach, and the Google-Apple API (Application Programming Interface) on which other decentralised apps will be built on (I can eventually see the NHSX being built around this too).

A centralised database gives the NHS (or at least the algorithms built into it) the ability to decide who & when should be contacted, and tailor the advice the app would give to them. So for example if the algorithms identify a number of people how have been in prolonged exposure to someone who has subsequently reported been tested positive for covid & notified by the app, it could advise them to seek a test, it could even create a secure key to be used with the online booking system to get priority testing. Plus it could give the NHS the option to ask for some further, voluntary data to help build up a bigger picture of the spread of the infection. So it could be very beneficial. Of course on the flip side, if the data is not properly anonymised, or properly encrypted then it could easily be used as a people tracking system, sold off to private companies or even targeted by hackers. Its a delicate balance & depends on what data is sent back & how it is stored, that will only become clearer when it get launched & investigated by the tech community.

Meanwhile a decentralised app built on the Goole-Apple API has the benefit of not transmitting data back to a central database (unless of course the developers build that in anyway), instead storing the encrypted data on the device. This means that when a user activates an alert, i.e. they notify it that they have possible symptoms or have tested positive, their devices then transmits via the Goole-Apple systems that alert to all the other devices that the app identifies as a risk. So it probably affords much more privacy in this respect. However on the flip side such a system basically turns your device into a mobile database, with potential for transmitting data to other devices, something hackers would absolutely love. They could just spend a few weeks moving around in busy areas, then break into the code and encrypted data & monitor how the device then transmits the information to the other devices. Don't get me wrong, this wouldn't be easy & would be only something a very small number of the most experienced hackers could ever hope to achieve, but nonetheless it remains a real risk.

Either way such an app will have to be voluntary, I think enough people will take it up to at least make it reasonably effective, but we most certainly should not be forcing it onto people. I guess time will tell if this is how it pans out.

 

[underbank]

And how many would ignore it if it told them to self-isolate. Not being cynical, just curious. Would it tell you where the contact was?

Exactly. People didn't self isolate in those few weeks before the lockdown despite having symptoms. There've been people admitting they went to Cheltenham Races and that Liverpool football match with symptoms. Everyone thinks they know best when it suits them.