UK finds itself almost alone with centralized virus contact-tracing app that probably won't work well, asks for your location, may be illegal

Britain is sleepwalking into another coronavirus blunder by failing to listen to global consensus and expert analysis with the release of the NHS COVID-19 contact-tracking app. On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in …

[[e-mail]]

Herd immunity has the least deaths.

Odd how people admit the lock down only slows the curve and does not reduce the death toll, but then still do not realize that the quicker we achieve herd immunity, the least deaths result. The only exception would be if we were on the brink of herd immunity through vaccination, which clearly is 2 years away.

[hayzoos]

"...a big green button..."

I find it hard to believe a modern smartphone app will have "...a big green button..." in this world of flatso with no fricking way to tell where one is to tap/click. It makes one think this is some sort of fantasy app. Do modern developers even know how to make "...a big green button..."?

[Anonymous Coward]

Hard decisions

I don't actually want more people to die because of decisions I make. But then I look at the kind of wholesale incompetence and stupidity displayed by these people and I think, well, if humans were just wiped away, would this be altogether a bad thing?

I mean, come on, you made a mistake picking the model you did, so unwind that mistake and do something sensible: it is not too late. If Google, a company whose entire business model is based on surveillance, are not supporting the model you want to use, then you kind of know you're making a bad decision.

There's a quote by Garry Kasparov (yes, that Garry Kasparov) about can be repurposed here:

One comforting thing about the UK government [originally: the Trump White House] is that you aren't forced to choose between malice and incompetence. It's always both.

Fuck these people.

[Gonzo wizard]

Why am I not surprised...

Here we go again on our own. Going down the only road DC's ever known. That's about as much levity as I can produce. May have given myself concussion from too much slapping forehead with hand when I read the article.

There are just so many red flags raised by what's being done that I despair of where to start. Bluntly, it is apparent to me that this go-it-alone effort is deeply flawed, doomed to cause further unnecessary deaths. If I'd been working on this code and was aware of all these flaws with the basic premise I'd be walking away. There are too many things that have to be just right for this to work reliably for a single interaction between two devices. Factor in the issue that each new interaction is no more likely to work than any previous one. Now add in the variations in behaviour of every flavour of Android. It screams design fail at me - very, very loud. But at least DC's mate's brother is getting a £250 million contract out of it with, no doubt, a hefty cancellation clause.

You also have to persuade people to install and use it. While some of the people pushing for this solution may believe that this is the right thing to do, I suspect that others are more interested in the data collected.

Dr Ian Levy should be ashamed of himself for managing to publicly state that the app both protects privacy whilst not protecting privacy. There's no sensible data retention policy. No way to have your data deleted. No way to know what it might be used for in future. "Trust us" say the people who so far have failed to provide a single convincing reason to do so, and a number of reasons to absolutely not trust.

Fundamentally I can deal with the lockdown, I can deal with staying at home, not seeing my partner for two months. So far. What I am finding harder with each passing week to deal with is the ineptitude (at best - I'm being kind) of the government. Watching them react slowly to things most other countries reacted to quickly. Watching them turn important testing milestones into cheap and meaningless political stunts. And now watching them botch the track and trace approach.

The only conclusion I can come to is that the people leading the country are inept, lazy, self interested and bluntly uncaring about anything or anyone beyond themselves. People are dying at rates not seen anywhere else except maybe the US. People will continue to die. And our "leaders" will continue to insist that they're doing everything right, that now is not the time for comparisons, that the data sets are different...

I find their actions criminally negligent. Something needs to be done. I am so, so angry - that they are doing this, that our 'press' is by and large allowing them to do it unchallenged, and that there is nothing anyone appears to be able to do about it.

[Anonymous Coward]

Re: Why am I not surprised...

People are dying at rates not seen anywhere else except maybe the US

Using the JHS CSSE data from yesterday, the US has had 68,922 deaths, and the UK 28,734. The UK's population is (according to Mathematica) about 66 million, the US is about 320 million. The death rate per person, which is the important number is about 434 per million in the UK, and about 212 per million in the US.

Since the start of the pandemic, people in the UK have died at twice the rate in the UK that they have in the US.

Disclaimer: averages over processes which involve exponentials are at best questionable, and the UK is more densely populated so the spread should be faster I think: the important number will be deaths/head once the whole pandemic is over. But so far, the UK is not doing better than the US: it's doing far worse.

[Anonymous Coward]

Re: Why am I not surprised...

In fairness to Dr Levy, his report does state the considered privacy criteria, although it's done in a way that is open to misreading (page 4 of the report):

3) It should not be possible to track users of the app over time [so far, so good], through the Bluetooth transmissions. [oh]

[Simon Harris]

False sense of security?

Ignoring aspects of personal data security for now...

German science is suggesting that coronavirus infections may be 10 times higher than official figures (presumably based on those tested)

https://www.theguardian.com/world/2020/may/04/german-covid-19-cases-may-be-10-times-higher-than-official-figures

If this is true and is also reflected in the UK population (may well be a higher ratio as Germany has a higher number of tests) then while the app may tell you if you've been near someone who's tested positive, it may well miss many more contacts with people who are positive, but haven't been tested (and if they are non- or mildly-symptomatic may never be tested) - surely this will give a false sense of security to the population as the false negatives in contact detection may overwhelm the true positives.

Or maybe I'm missing the point and the app and a false sense of security are really designed to extend the hypothetical 'herd immunity' rather than to isolate those infected.

[[e-mail]]

Re: False sense of security?

Since the number infected is 10 times higher than we realize, and we only need 55% for herd immunity, then that means it is almost over, all by itself.

[Simon Harris]

Re: False sense of security?

UK government figures for infections are just shy of 200,000. Multiply that by 10 and 2 million is only about 3% of the population. Just a little bit short of 55%

[Anonymous Coward]

Re: False sense of security?

>Since the number infected is 10 times higher than we realize, and we only need 55% for herd immunity, then that means it is almost over, all by itself.

According to the CDC, R0 of COVID-19 is 5.7, implying that you would need ~83% for herd immunity.

https://wwwnc.cdc.gov/eid/article/26/7/20-0282_article

[tallenglish]

I forsee three types of issues.

People.like me, that refuse to put battery draining spyware on my phone. I dont live in fear of every flu that comes along, no matter how hyped up it is. Fear is the mind killer, fear is the path to being controlled.

People that will install it on many phones (including old spares), just to keep pressing the big infected button to troll/scare the shit out of everyone around them.

People rarely using the app, so it is asleep most of the time.

Either way, the data they collect is going to be useless.

[Long John Silver]

Automated contact tracing for Covid-19 is a fools' errand

Automated contact tracing regarding infection with Covid-19 is yet another fantasy arising from PM Johnson's ill-chosen gaggle of 'scientific advisers'.

Tracing is predicated on the assumption that asymptomatic carriers of Covid-19, some of whom go onto display symptoms, can pass the virus onto others. Apparently there is 'science' making the possibility plausible e.g. suggestion of the virus being present in bodily fluids such as saliva and sweat.

Symptomatic carriers who may cough, sneeze, and wheeze, are unlikely to be out and about. In principle they are recognisable and outdoors pretty much avoidable by sensible distancing (not the ridiculous 2 metres that panders to neurotic and obsessive persons). Theoretically, asymptomatic individuals may deposit infected fluids on surfaces others come into contact with; there is already good guidance issued regarding personal hygiene, particularly hand washing, as excellent protection.

In context of outdoors, fleeting proximity to infected persons has negligible prospect of viral transmission.

Indoors, e.g. shops and public transport, chance of airborne transmission by people already displaying symptoms could be considerable especially when there is poor ventilation or, indeed, recycled air as on aircraft. Yet no practical good arises from notifying people about having been in 'contact' with infected people regardless of whether they displayed symptoms at the time. Such as actually contract infection will remain harmless to others, assuming simple hygiene is maintained, until symptoms emerge; at that point self-isolation, or enforced isolation, becomes desirable.

Automated registration of proximity 'contact' will induce further anxiety among a populace already scared by the false doom scenarios of mainstream media and the even more ignorant tittle tattle on social media; dissemination of inaccurate statistics and silly 'scientific' prognostications by government are icing on the cake of panic.

It seems likely that automated contact screening will result in an overwhelming number of false positives; false in the sense that knowledge of genuine proximity 'contact' can make negligible impact on progress of the epidemic. It may give a false sense of security too by possibly distracting people from truly sensible measures such as hand washing when exposed to objects others will have touched.

People notified of having had 'contact' will be rushing for antibody tests. This testing too is a waste of resources except for giving peace of mind to people (families too) occupationally exposed to infected persons.

The UK manifestation of the pandemic has led to headless chickens running about in Whitehall. Neither the politicians nor many from whom they seek advice appear capable of weighing and prioritising risks, of balancing benefits of measures against adverse short, medium, and long term sequelae from the measures, and of convincing any but the ill-educated mass that they have a clue about what they are doing.

[druck]

Re: Automated contact tracing for Covid-19 is a fools' errand

You can't lay contract tracing at Johnson's door, almost every other county is doing it, and most of them they started before us.

You are right about all the false positives, and that's why the decentralised model won't work. The false positive alerts will automatically propage from phone to phone, and countries using it will be paralysed by a large amount, possibly the majority, of their population being told to self isolate, again and again and again. They'll never escape lock down.

The centralised model won't have any less false positives, but has the advantage but there is then control over how fast and how far the positive alerts can spread, so the country won't be crippled. Yes this will also limit the propagation of true positives too, but then the entire point of this isn't to find every case of the virus, its enable lock down to be ended and make people feel safe enough to go back to work.

[jake]

Re: Automated contact tracing for Covid-19 is a fools' errand

"won't have any less false positives"

Fewer.

[JDX]

How does a decentralised solution avoid the backround-running restrictions?

I didn't understand how/why everyone else's apps' lack of a central server means the restrictions on backround-running ID sending isn't the same problem.

Can anyone who knows about this stuff give more information?

[Phil Endecott]

Re: How does a decentralised solution avoid the backround-running restrictions?

Because Apple and Google have specifically allowed this.

[Doctor Syntax]

Neither of the NCSC's explanations are readable without disabling NoScript. That's not a good start to seeking trust.

[Phil Endecott]

I might have almost given them the benefit of the doubt until I heard that Palantir was involved.

[Anonymous Coward]

Yes, that's basically like going to meet some vendor when you realise that the vendor's senior sales person has eyes which glow a dull red. The solution is do not deal with the devil however much you want what he has to offer: just walk away.

Unfortunately they didn't do that.

[Doctor Syntax]

Levy also noted that "currently" only “the first part of your postcode” is taken and stored “for NHS resource planning, mainly.”

Spot the weasel words. Both of them.

Of course a lot of us could have the postcode SW1 2AA.

[BallistiX09]

Might want to check your facts...

The whole part about the app not being able to work in the background is completely wrong. Normally, background Bluetooth scanning isn't allowed, which is likely why it wasn't working on the video mentioned, but that's not the case for the NHS app. Apple at least (and I'm assuming Google will follow suit) are allowing this one app to run scans in the background without the need for the app to be open on the user's screen.

Also, saying that it's able to track your location is objectively wrong. It asks for the first part of your postcode, which is a pretty massive area, and nothing else. It doesn't request location access, and judging it based on the fact that they could request that in the future means absolutely nothing right now.

[James R Grinter]

Re: Might want to check your facts...

My understanding, reading between the lines and knowing the APIs available, is that they’re both transmitting BLE messages and also registering to listen for them. You might know this as iBeacons.

You can listen for Beacons from your family in the background, the OS APIs make it easy and battery friendly.

You can’t transmit beacons in the background so easily, transmitting also requires more power.

[Anonymous Coward]

Have you even read the NCSC technical report all the way through?

"Bear in mind, the Apple-Google decentralised approach produces new ID numbers for each user each day, thwarting identification, especially with the ban on location tracking." The NCSC report describes how a similar approach is taken by the NHS app - does this mean the NHS app does not "thwart identification"?

Politcial angles (e.g. government mistrust, the conservatives are bastards etc.. etc) are all entirely valid concerns to make but it would be good if this could be separated from the technical aspects. Which specific parts of the technical implementation as described in the NCSC will not work?

No one has a duty to compliantly follow the government line but we all have a duty (particularly in the nerd fraternity) to make an effort to understand the technical details before yelling from the roof tops that the app is a privacy disaster.

Get a cup of tea and read the report.

[Anonymous Coward]

Re: Have you even read the NCSC technical report all the way through?

Different AC replying:

AC: The NCSC report describes how a similar approach is taken by the NHS app - does this mean the NHS app does not "thwart identification"?

It thwarts identification by eavesdroppers. This is one of the security aims, as set out in the report.

It does not thwart identification by the Government (including security services, Home Office, Cummings and his pals, ...)

And even if you trust the current Government (stay with me), the next Government could decide to do what it liked with all that data, just sitting there.

[Barrie Shepherd]

Mandarin Power Strikes again

Once again the centralised Mandarins show their colours.

Not content with wanting a centralised APP, immediately alienating people with a central data slurp, they then announce that rather than use Public Health staff, located in local communities to exercise the track and tracing tracing activity - people who are already trained in these tasks - they have apparently awarded a contract to Sirco to carry out this work. What price the data privacy/security when the data gets into Sirco? (Remind me how well was the prisoner tracking implemented?)

At least Australia implemented simple legislation to allay public fear about scope creep and unintended use of the APP.

Worth a read to see what the Aus government thought could go wrong! (it's only a couple of pages)

https://www.legislation.gov.au/Details/F2020L00480

[Anonymous Coward]

NCSC & javascript

Why does the NCSC site just say "You need to enable JavaScript to run this app."

Supposedly it's just going to display a document to me.

Why does it 'need' Javascript to do that?

[cantankerous swineherd]

my mobile phone stays at home

[Simon Harris]

Mine's so old and knackered, the only contacts the app would find would be those within reach of a charger.

[cantankerous swineherd]

ofc internet postcodes are a bit like internet birthdays: I'm usually at SW1 1AA.

[Mike 137]

Read the Act!

'Levy [... goes on: "Nothing identifying and no personal data are taken from the device or the user."'

Clearly Levy has either not read, not understood, or refuses to honour the GDPR definition of personal data. Any data at all from which a living person can be identified is personal data under the GDPR.

The irony is that, given the circumstances (epidemic control) the regulation gives him a free hand - he doesn't have to justify the collection of personal data for this purpose.

These constant "assurances" from government about privacy suggest that they know they're on shaky ground. It's worth remembering that the GDPR is human rights law, and that the European Declaration of Human Rights was created to protect the public from governments, not from social media behemoths. Unfortunately, almost from day one, it's failed to do so, because governments can award themselves exceptions to the controls.

Quite apart from which, this looks like just another failed government IT project in the making. It would be great if once in a while a little technical competence and forethought were injected into the picture.

[jake]

Re: Read the Act!

Do you honestly think that your government will think that the GDPR will apply to them after brexit is complete at the end of this year?

[Phil O'Sophical]

Re: Read the Act!

Do you honestly think that your government will think that the GDPR will apply to them after brexit is complete at the end of this year?

It's already enshrined in British law by the withdrawal legislation, and abiding by it will be a prerequisite for trade with EU countries. In any case, British data and consumer protection law has always been ahead of, and stronger than, EU minimums.

[Rol]

It's the little things that matter. Like, a reading age in double figures for a start.

I read that America isn't even going to bother developing an app.

Seems Donald is of the mind that humanity has, and always will be suffering from plague, and only in rare circumstances will that result in death.

He pointed to a dentistry journal on his desk, when queried about his source for such a controversial stance.

The news reporter was banned as fake news shortly after pointing out the differences between plague and plaque.

[Boris the Cockroach]

You there

Cockroach 4563532 Boris... show us your phone and allow us to check your corona app........ whats this? you dont have it installed? well let take you in so we can run some background checks on you and convert you into a loyal citizen willing to do whatever our great leader says

Yours, the ministry of love

If you want to imagine a future, imagine a boot stamping on a human face forever.

The world is changing due to this pandemic, what its changing into is anyone's guess

[Anonymous Coward]

"will only work in the way the UK government claims it will if everyone does what it says"

"a classic failing of the Whitehall mindset that stretches back to the World War One trenches"

Not a huge follower of UK history, are we? The UK government definitely suffered from this same shortsightedness in the Boer War, the Crimean War and the American Revolutionary War. On the whole, they did run things well against Napoleon from 1805 onward. And the UK got things right in the Seven Years War, after some initial missteps.

[Mark #255]

Re: "will only work in the way the UK government claims it will if everyone does what it says"

And England totally won the English Civil War.

[Anonymous Coward]

Bluetooth --Schmuetooth----

-----what we really need is an app which DETECTS THE VIRUS when you are on the phone.

*

The phone can then send THE NEWS, your phone number, phone model, recent selfies, an analysis of your social network, your current location and a photograph of everyone you've been near for the last three months ----- directly to Palantir.

*

Apple are working on the technology as we speak. This new iPhone will cost £1500 a pop, and there will be queues round the block (2 metres apart of course) with most people buying at least two.

*

And like the virus, the phone will be built in China.

*

Welcome to the future!

[[e-mail]]

Tracing can't work

The reason tracking can never work with COVID-19 is that it is not one cholera pump or typhoid person.

If a COVID infected person picks up a loaf of bread in a grocery store, then decides not to buy, but 5 minutes later someone else does, then there is not going to be any way of tracing it.

You can't trace infection with GPS location because infection can't happen just because 2 people crossed paths on the sidewalk.

GPS does not tell you anything.

You need far more information than that, because there has to be actual contact, and you may not even know there is an infection and worth tracing until a week later. That would mean you would need to store all the movements of all the people for weeks, waiting until there was an infection. That not only is impossibly huge, but would be far more dangerous and intrusive than any virus.

Dumbest idea I ever heard of.

[[e-mail]]

Easily defeated

All people have to do is either leave their phone at home, or put it into a metal or mesh faraday cage. Which any intelligent person was already doing.

Anyone who thinks you can do anything honest of useful with tracking people, is an idiot. There is no way to trace infections by GPS.

[Anonymous Coward]

All because we cannot get testing right

The linked technical document in this article explains that NHSX have only gone down this route because testing is inadequate in the UK. It states that either system is viable and also that the authors do not recommend centralised as the only option. When explaining decentralised concerns, it falls on the lack of clinical testing:

Move the health response from ‘react to symptoms’ to ‘react to clinical test results’: We

cannot currently find a way to manage malicious notifications, or possible amplification

attacks, in a decentralised model without authentication. Consequently, notification must be

uniquely tied to an authentic clinical test. This generates a dependency on the digital

authentication of clinical testing.

[Andy3]

More paranoid speculation. The headline consists almost entirely of 'could be's' & 'probablies' and sounds like it was written by a college student who thinks it's cool to pick holes in everything a Tory gov't tries to do.

[Citizen99]

Even if it worked, it would be an epidemiologists' toy, from which the emerging information would probably be ignored as far as implementation is concerned. (Experience suggests).

[Colin Miller]

Bluetooth disabled?

Does the app function correctly (I hope not!) if the user has turned off Bluetooth on their device? Until I got a smartwatch, I only turned on Bluetooth when I was using it, in an attempt to extend my phone's battery life.

However, I'm not sure how many other folks do this

[Nickckk]

No one knows the science

You are making scientific conclusions when you say,

"Unfortunately for folks in UK, while the explanation is coherent, calm, well-reasoned and plausible, it is likely to be a repeat of the disastrous "herd immunity" approach the government initially backed as a way to explain why it didn't need to go into a national lockdown. That policy was also well-reasoned and well-explained by a small number of very competent doctors and scientists who just happened to be wrong."

The truth is that no one knows enough to make such judgements. Have a look at what Professor Michael Levitt has to say about an alternative to national lockdown and using distancing measures along the lines of Sweden. Levitt has more experience than most in this epidemic. The 30+ mins makes good listening, particularly when you're at home with time on your hands

https://unherd.com/thepost/nobel-prize-winning-scientist-the-covid-19-epidemic-was-never-exponential/

[ducatis'r us]

Reports on BBC state that app is developed by VMWare Pivotal. VMWare pivotal have exactly how much background in mobile app development???? Don't see the connection to Cummings et al either?

[oldsteel]

Government, privacy and the NHS app

The nefarious statements about the ability to join databases and identify individuals by 'the government' to do nasty things are all just noise. If 'the government' wanted to do this they have much to go at, HMRC, passport agency, DVLA, ANPR cameras and all the other databases used to track our activity much more effectively should they wish to do so. And Facebook gathers more data about you than this ever will. The main point in the article for me is the technical failings of the app and the way bluetooth will be used, differently, in Android and IOS phones, and how this might impact the effectiveness of the app. It has been stated over 50% of the population must use the app for it to work. Personally I have many times turned off bluetooth to save battery, that added to the foreground/background limitations described make it look distinctly flaky. And we have all seen at first hand how 'data', 'science' (and data science!) can be interpreted incorrectly due to assumptions made, partial reporting, ways of reporting etc etc, and this app will simply add to the mass of partial data out there. I have sympathy with those tasked to make decisions, but fear this app will end up as yet another piece of 'corona-junk'.

[LittleTyke]

Re: Government, privacy and the NHS app

"corona junk" like the Nightingale Hospitals, for instance. They were built at massive cost and are now practically redundant already, having received very few patients. Oh, well. The taxpayer is going to need really deep pockets to pay for all this.

[Anonymous Coward]

Re: Government, privacy and the NHS app

They have been built for use in November - December.

But no-one is allowed to say that.

[SAdams]

Herd Immunity

There is a repeat of a fundamental misunderstanding of many journalists on Covid 19 here;

“... it is likely to be a repeat of the disastrous "herd immunity" approach the government initially backed as a way to explain why it didn't need to go into a national lockdown. That policy was also well-reasoned and well-explained by a small number of very competent doctors and scientists who just happened to be wrong.“

Immunity is not “wrong”. All coronaviruses impart a level of immunity, via antibodies or T cells. In some cases its not full immunity and usually only lasts 1-2 years. Its unlikely SARS Cov 2 is very different.

With the Covid 19 disease, it has an R0>3 (probably >5) and pre symptom viral shedding. So you don’t just stop it by isolation etc. A vaccine is a wild shot, unlikely to be ready in less than a year if at all. Likewise an effective treatment is a lottery. The most likely outcome is that restrictions of some form stay in place until there is a level of immunity in the population such that outbreaks are few and far between. In other words - “herd immunity”.