RogerBW's Blog: NHS App?

There is at long last an "official NHS contact-tracing app". Should one use it?

Not, presumably, "NHS App" but rather "NHS COVID-19". (Not of course written by the NHS; Serco and Deloitte are the responsible parties, but those names are associated with (absolutely not criminal in any way) fraud and incompetence so they're pretending not to be involved.) For me there are some strong reasons not to.

The merely technical. I'm running LineageOS and I'm reasonably sure that this thing will want enough of Google Play Services (aka the privacy invasion layer on top of base Android, whatever it's being called this month) that it simply won't work.

The higher-order technical. While the app itself is now open-source, we don't know anything about the internals of the data processing except that Hays Travel is involved and they aren't allowed to talk about it. But we can speculate: we know the original system didn't use the facilities that Google and Apple offered for low-impact tracking, and that there are two significant differences between those and what it did do: they would have lower impact on battery life, and the data would be kept decentralised. (So you could send a command from central to "alert every phone that was near this other phone at this time", but not "tell me who was there".) But this system wouldn't do that; in other words it was an even finer-grained location tracker than IMEI pings, since even if this thing weren't doing it chances are that one of the phones you're "near" would be leaking GPS data. Now it's claimed that this has all been fixed; but nobody involved in the process has any incentive to preserve the privacy of the users, only to make them think that that's the case, and lying is not only much cheaper but something that this government and its contractors have repeatedly proved themselves willing to do.

There's a perfectly good privacy-preserving protocol in use in Germany, Belgium, Italy, Poland, the Netherlands, Spain… but no. They want to know where you are and whom you're associating with.

(In terms of visible levels of competence as opposed to proud boasts, they know less about QR codes than I do, or the chap who runs my ISP. They also admit, in between the boasts, that they haven't yet used secure key storage or proper validation because they had to get it out NOW NOW NOW. And similarly gosh-aren't-we-wonderful things were said about the previous version).

The ethical. Given the number of free systems that were already available, the government refused to implement one until it could find an excuse to hand over lots of money to one of its friends. I don't want to support that.

The practical. If you are to get an alert when you've been near a person who turns out to have been infected (which is a fairly small number of people), before you get symptoms yourself, they need to have been running this thing and so do you. The uptake numbers needed to make this at all reliable are probably over 50% of the population. This is not going to happen, so the chance of a false negative (you don't get an alert when you should) is very high – and therefore you should still take all the other precautions you'd be taking anyway. (Given that you'll get an alert if you've been "near" an infected person if they were also running the thing, the chance of a false positive also seems quite high. For example, if a car or bus with an infected person goes past while you're standing on the pavement…)

The social. The socialising I'm doing at the moment involves going to the pub (who are, as required, keeping a record of my presence), sometimes having friends over (who would tell me if they came down with it), and very occasionally going to a restaurant (see pub). This system is aimed much more at people who go from group to group that they don't particularly know. Whether that applies to you will depend on your work/school/etc. pattern.

I think this is the key point: having my associations tracked would generally not be of benefit either to me or to the people I meet. The only exception to this pattern is my fortnightly shopping trips, and that's where there's room for argument. But adding on the other stuff I still think the balance of privacy risk (when the data are inevitably abused or leaked because all personal data are eventually abused or leaked) outweighs the rather small potential benefit to myself and to others.

Comments on this post are now closed. If you have particular grounds for adding a late comment, comment on a more recent post quoting the URL of this one.