NHS COVID-19 app update blocked by Apple, Google over location privacy fears

An update for the NHS's COVID-19 test-and-trace app for England has been blocked by both Apple and Google because it added the ability for users to store and share location data. The arm of the National Health Service that developed the app signed an agreement with both tech giants that it would not gather location data …

[Version 1.0]

They never store and share location data?

I'm pretty confident that Google stores and shares my phones location data all the time. I suspect that the NHS would be able to do this if they told Apple and Google that they were just using it to send users a few COVID-19 advertisements every time they browsed the Internet or used other apps.

[Roland6]

Re: They never store and share location data?

This is the confusing bit. From what is said, the CoViD app doesn't use the phone's location data - something everyone understands as "location data", it uses data the user has okayed the app to receive, namely the venue QR codes and that this update allows the user (to opt in?) to these being uploaded.

So on this basis any app for which Apple and Google doesn't have an appropriate agreement with, that uploads a person's: address, school, university, employer etc. (ie. anything that provides some form of location information) needs to be removed from their stores.

[Graham Cobb]

Re: They never store and share location data?

Only if they use the privacy-busting Covid-specific "who have you been nearby" API.

The Covid apps use an API Google/Apple created which allows the app to get data on other phones nearby. That data is clearly very sensitive and, in order to get maximum acceptance from users all over the world for this crisis, Google/Apple put very severe restrictions on any app which uses it.

Those restrictions mean that any app which wants access to this special "who has been nearby" API they are not allowed to use many other perfectly normal location APIs.

You can argue about whether those restrictions were necessary but I, for example, would not have downloaded the NHS app without those restrictions being in place. And the restrictions are very clear. There is nothing to stop governments having a second app which does not use that API but records other location data - which is what Scotland has done. I would not install that second app on my phone, however, just like I do not install many other apps which want location information.

[Winkypop]

“ how it managed to develop an entire update without realizing it would be blocked”

Sheer, bloody minded, incompetence for the win.

Every time!

[Prst. V.Jeltz]

Re: “ how it managed to develop an entire update without realizing it would be blocked”

its just embarrassing . I feel embarrassed to be British .

Theres foreigners reading this!

[Muscleguy]

Re: “ how it managed to develop an entire update without realizing it would be blocked”

That should be English, as the article says up here in Scotland we avoided that trap with a completely separate app which I have just installed, thanks El Reg!

The NHS Protect app is separate as well. We plugged into the API’s from the start. So all the expensive false starts in Englandshire did not happen up here.

[gobaskof]

Re: “ how it managed to develop an entire update without realizing it would be blocked”

It is really sad that at a time when even Google and Apple can pull together on an API, every country has invested in building their own apps, rather than make one that works across boarders. Not that I blame Scotland for steering well clear of this (very much not the NHS) NHS app.

[Brewster's Angle Grinder]

Re: “ how it managed to develop an entire update without realizing it would be blocked”

There's probably trace elements of a PM who thinks he can blag his way through everything and has hired in his image.

[Arthur the cat]

Re: “ how it managed to develop an entire update without realizing it would be blocked”

Senior civil servants(*) understand technology in much the same way as Labrador dogs understand the Large Hadron Collider.

(*) The ones who make the decisions that the poor minions(**) have to try to implement.

(**) Who are younger and tend to have a better grasp. (But still not good.)

[gobaskof]

Re: “ how it managed to develop an entire update without realizing it would be blocked”

You mention senior civil servants, but Test and Trace displaces the top civil servants to put Dido Queen of Carnage in charge and she surrounded herself with consultants. Capitalism and greed...

[xyz]

Obviously...

Someone up top thought no one would check. By tomorrow it'll be the EU's fault.

[John Robson]

Re: Obviously...

Yes because the EU are one of the few organisations powerful enough to take on big tech, who came up with the whole "Governments shouldn't be using this to spy on their population" rule.

Of course the bigger problem is that the EU agree with that sentiment.

</sarcasm>

[nematoad]

Re: Obviously...

"By tomorrow it'll be the EU's fault."

Unfortunately for Johnson and co. Brexit has shot that fox and now the government and its supporters are having to confect disagreements and rows with the EU so they can continue blaming someone else for their mistakes.

Like all authoritarian governments they have to have an external enemy or their grasp on the levers of power will be lost.

See also: Leopoldo Galtieri and the Falklands War to see how well that worked out.

[Graham Cobb]

Re: Obviously...

Yeah, that was my first thought when the referendum was announced: the only reason people wanted to leave the EU was because the government had been using the EU as scapegoat for all its unpopular policies. What would the government do when that scapegoat had been killed?

Of course, the government didn't want the referendum result they got - they had shot themselves in the foot.

[Rich 11]

Re: Obviously...

Of course, the government didn't want the referendum result they got - they had shot themselves in the foot.

But the simple way for the government to fix that was for the party controlling government to shuffle some bodies around and get the new set of lacklustre minds to announce that the government was now fully in agreement with the electorate and to make it clear that the footbullet incident was the ideal opportunity to replace the weak, fleshy, backward-looking foot with a brand spanking new bionic foot capable of leading the country into a bright and glorious future. Unicorns arise!

[Chris G]

Not the first and won't be the last

Attempt at trying to keep tabs on everyone all of the time.

Even after this pandemic I am sure the government would try to find reasons for keeping track and trace. "Just in case"

[Doctor Syntax]

Re: Not the first and won't be the last

Just in case somebody competent takes charge?

[Danny Boyd]

Vaccination, vaccination, and, once more, vaccination!

This is what will help. These tracking gimmicks are just another kind of surveillance pushed under the pretense of "fighting the pandemics". Tracking won't protect you from COVID-19 (or anything else, as a matter of fact). Yes, you may learn postfactum you might have gotten infected when you visited that brothel (or an opera). Does this help much?

[Anonymous Coward]

Re: Vaccination, vaccination, and, once more, vaccination!

Big brother aside, yes the apps can help. After my trip to the brothel, were I to get a notification I might decide to stay home and not go to the Opera, maybe not pop round to see Granny his weekend, or at least take a lateral flow test or two before going back in to work. So I break the chain of infection.

I'm not saying that the half hearted current English implementation of track and trace is going to do that. I am sure at least 50% of the people who originally downloaded the Covid app have since upgraded their phones and no longer have it loaded, but I'm sure the clear messaging, relentless TV adverts and the big billboards on the side of buildings and buses will remind them to reload it before drunkenly embracing their mates at the Dog and Duck.

Enjoy the end of this lockdown, see you all on zoom when we lock down again in June!

[John Robson]

Re: Vaccination, vaccination, and, once more, vaccination!

We might be OK in June, mostly due to the weather, but September.... Who am I kidding, the response will be needed in September, it won't happen until November at the earliest.

[Rich 11]

Re: Vaccination, vaccination, and, once more, vaccination!

Tracking won't protect you from COVID-19

FFS! We've had a year of this yet still there are idiots who can't comprehend that not everything is about them alone, first and foremost. Selfish fuckwits!

[Anonymous Coward]

NHS COVID-19 app update blocked by Apple, Google over location privacy fears

yeah, I saw this yesterday, life imitating life, pot meet kettle, etc. Funny haha, never mind the context, i.e. how many billions of quid? 30, to mushroom towards 60?

[Prst. V.Jeltz]

Re: NHS COVID-19 app update blocked by Apple, Google over location privacy fears

Governent funding for software seems to be on a "per unit produced " basis , like it was a tangible thing that needs a production line and raw materials for each instance.

Its like the beancounters havent grasped the difference between buying software and writing it.

[codejunky]

Shock

I wonder how much tax payer money got spaffed on this clever update? Nice to see Google and Apple not allowing such abuse even from a monopoly giant as a government.

May the lockdown be ending, freedom returning and the gov sod off with its tracking desires.

[Prst. V.Jeltz]

Re: Shock

maybe they watching this software like a hawk and holding it up at every turn , hoping they give up and buy google soulution instead

[teebie]

"the agreement the NHS signed with them"

I thought the NHS had nothing to do with 'NHS track and trace', and that the name was just a branding exercise to get people to trust the app?

So why is there a contact signed by the NHS?

[anothercynic]

Re: "the agreement the NHS signed with them"

There isn't. It probably was signed On Their Behalf by some faceless functionary.

People have pointed out that there were problems with the whole plan to begin with... Most people ignore the instructions to scan themselves into a venue, and given that the NHS app didn't allow for checkouts (i.e. 'I've been here only for 30 minutes', so I'll scan myself out), a lot of people just didn't bother because they were concerned they'd be caught out by positives being traced to a location they'd been in hours before the infected person.

I like NHS Scotland's idea of a separate app, but even then, I have problems with the trackability of individuals (albeit anonymised).

[TheProf]

Re: "the agreement the NHS signed with them"

" NHS app didn't allow for checkouts "

I was in two minds whether or not to create a venue poster using my home as a venue. Then when I got home I could scan myself in.

In the end the whole country just stopped going places so I didn't bother.

[John 110]

Re: "the agreement the NHS signed with them"

@anothercynic

"...I have problems with the trackability of individuals (albeit anonymised)...."

I don't think that anyone with your handle (do we still call them "handles") actually believes that we're not being tracked everywhere by these devices anyway. It's best to treat it as the price you have to pay for the features and convenience of having a pocket computer.

[DS999]

Is any country successfully using contact tracing apps?

Hopefully it will all get figured out after the pandemic is over, and be kept in place in future smartphones (and whatever devices may replace them) so we're ready when the next pandemic arrives.

[redpola]

Is it still iOS 13 and above only?

Apple backported their “exposure” API into older versions of iOS. Yet UK government continues to build the app only for the latest iOS.

My attempts to “report a technical issue” reliably result in a link to the “what phones our app supports” web page.

Another page in the book of UK Gov’s total incompetence with tech.

[TheMeerkat]

Does it matter?

The number of people using this app is do low, that it does not matter if it works at all.

The very idea of this App was flawed in the first place. It is useless in the U.K. and it is useless in any other countries.

It can only work in those countries that can get away with apps that specifically designed to send the government your gps location linked to your identity and the police checks if you have the phone with you all the time.